added Compliance Operator

clusters/management-cluster/setup-compliance-operator/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: setup-compliance-operator
+description: Deploy and configure the Compliance Operator
+version: 1.0.0
+dependencies:
+  - name: compliance-operator-full-stack
+    version: ~1.0.0
+    repository: https://charts.stderr.at/
+maintainers:
+  - name: tjungbauer
+    email: [email protected]
+keywords:
+  - acs
+  - security

clusters/management-cluster/setup-compliance-operator/LICENSE

@@ -0,0 +1,13 @@
+Copyright 2022 Thomas Jungbauer
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

clusters/management-cluster/setup-compliance-operator/README.md

@@ -0,0 +1,14 @@
+
+![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
+
+# Overview
+
+This "wrapper" Helm Chart is used to deploy Advanced Cluster Security (ACS) using a GitOps approach. 
+It calls the Chart [rhacs-setup](https://artifacthub.io/packages/helm/openshift-bootstraps/rhacs-setup) which mainly takes care to
+
+- Deploy the Operator and verify if the Operator installation was successful
+- Deploy Central if required
+- Deploy Secured Cluster
+- Add a console link in the action menu of OpenShift
+
+The values.yaml provides an example of possible settings.

clusters/management-cluster/setup-compliance-operator/values.yaml

@@ -0,0 +1,65 @@
+---
+
+# Install Operator Compliance Operator
+# Deploys Operator --> Subscription and Operatorgroup
+# Syncwave: 0
+helper-operator:
+  operators:
+    compliance-operator:
+      enabled: true
+      syncwave: '0'
+      namespace:
+        name: openshift-compliance
+        create: true
+      subscription:
+        channel: stable
+        approval: Automatic
+        operatorName: compliance-operator
+        source: cs-redhat-operator-index
+        sourceNamespace: openshift-marketplace
+      operatorgroup:
+        create: true
+        notownnamespace: true
+
+helper-status-checker:
+  enabled: true
+
+  # use the value of the currentCSV (packagemanifest) but WITHOUT the version !!
+  operatorName: compliance-operator
+
+  # where operator is installed
+  namespace:
+    name: openshift-compliance
+
+  serviceAccount:
+    create: true
+    name: "sa-compliance"
+
+compliance-operator-setup:
+  compliance:
+    namespace:
+      name: openshift-compliance
+      syncwave: '0'
+      descr: 'Red Hat Compliance'
+    scansettingbinding:
+      enabled: true
+      syncwave: '3'
+
+      # Example
+      tailored:
+        enabled: false
+        modified_profiles:
+        - name: tailoredprofile-ocp4-cis
+          description: Modified ocp4-cis profile
+          title: Tailored Profile of ocp4-cis
+          extends: ocp4-cis
+          disableRule:
+          - name: ocp4-scc-limit-container-allowed-capabilities
+            rationale: Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration
+
+      profiles:
+        - name: ocp4-cis-node
+          kind: Profile  # Could be Profile or TailedProfile
+        - name: ocp4-cis
+          kind: Profile
+      scansetting: default