Security & Compliance Add‑Ons – Building the Layered Defense
Duration: ~10 minutes
Overview
Use platform add-ons for continuous security work: Compliance Operator for benchmark scans, Security Profiles Operator for seccomp and SELinux profiles, and RHACS for image and runtime policy. This lab focuses on Compliance Operator; the others are covered for orientation.
Orient on Compliance Operator, SPO, and RHACS roles, then list Compliance profiles and preview a sample ComplianceSuite without applying it on a shared cluster.
Why it matters
SCC and RBAC cover a lot, but they do not schedule CIS-style scans, manage seccomp profiles, or watch runtime signals alone. Compliance Operator, SPO, and RHACS fill those gaps so evidence and detection are routine instead of a scramble before each audit.
What does it solve
-
Audit evidence collected on a schedule instead of the night before
-
Consistent seccomp and SELinux profiles across workloads
-
Image and policy checks before bad images reach production
-
Runtime and network signals when something misbehaves
-
A clearer handoff between platform defaults and specialized tooling
Your Mission
Attackers move while humans scramble for last-minute audit evidence. Wire continuous controls: prove Compliance Operator is ready, inventory profiles, and schedule a CIS-style suite so posture gaps surface on a cadence—not under deadline panic.
Click each step only if you need a hint.
Confirm Compliance Operator is on the field
oc get pods -n openshift-compliance 2>/dev/null || echo 'Compliance Operator not installed'Inventory the benchmarks you can run
oc get profiles.compliance.openshift.io -n openshift-compliance 2>/dev/null || trueSchedule a sample CIS scan (adjust names if needed)
On a shared roadshow cluster, prefer previewing YAML over applying unless instructors cleared it.
oc apply -f - <<'EOF'
apiVersion: compliance.openshift.io/v1alpha1
kind: ComplianceSuite
metadata:
name: cis-scan
spec:
schedule: "0 1 * * *"
scans:
- name: cis
profile: ocp4-cis
content: rhcos4
EOFReview check results when the scan lands
oc get compliancecheckresults.compliance.openshift.io -n openshift-compliance | head| SPO manages recording & enforcing seccomp / SELinux profiles; deeper commands appear in advanced labs. |
Debrief
You inventoried Compliance Operator benchmarks and saw how add-ons (Compliance, SPO, RHACS) cover different blind spots on top of platform defaults.
What breaks without this:
-
Defaults alone → no continuous CIS-style evidence
-
One tool for everything → gaps between config compliance, runtime, and image risk
Controls that matter: layer Compliance Operator for benchmarks, SPO for runtime profiles, RHACS for image/runtime/network policy, plus SCC/PSA and GitOps drift detection.
Quick facts: you do not need every operator on day one—start with a benchmark scan, then add runtime and policy gates where risk is highest. Compliance scan ≠ RHACS vulnerability focus.
