Meaningful Compliance – Tailoring a Profile

Duration: ~25 minutes

Overview

Compliance tailoring & remediation pipeline.

Tailor a Compliance Operator profile so scans match your environment instead of treating every upstream rule as equally required.

Why it matters

Raw upstream Compliance profiles flag noise your environment cannot fix today. Tailoring keeps scans honest—required controls stay red until fixed; documented exceptions stay visible instead of ignored.

What does it solve

  • Alert fatigue from irrelevant CIS findings

  • “Waived forever” exceptions with no ownership

  • Audits that cannot explain why a rule was skipped

Your Mission

Tailor a Compliance profile so attackers and auditors alike face a scan set that matches your real platform—not a one-size-fits-nobody checklist.

Prerequisites

  • Compliance Operator installed (openshift-compliance namespace)

  • Cluster admin privileges

Click each step only if you need a hint.

Baseline Scan 
oc apply -f - <<'EOF'
apiVersion: compliance.openshift.io/v1alpha1
kind: ComplianceScan
metadata:
  name: baseline-scan
  namespace: openshift-compliance
spec:
  scanType: Platform
  profile: rhcos4-moderate
  contentImage: registry.redhat.io/compliance/openshift-compliance-content-rhel9:latest
  debug: false
EOF

Monitor:

oc get compliancescans -n openshift-compliance
Findings

When phase=DONE:

oc get complianceremediations -n openshift-compliance | head
oc logs job/baseline-scan-rhcos4-moderate-master -n openshift-compliance | head

Identify a rule to exclude (example id placeholder rhcos4-useless-example):

oc get complianceremediations -n openshift-compliance | grep -i chrony || true
Tailored Profile 
oc apply -f - <<'EOF'
apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  name: rhcos4-moderate-tailored
  namespace: openshift-compliance
spec:
  extends: rhcos4-moderate
  setValues: []
  disableRules:
    - name: rhcos4-useless-example
EOF
Tailored Scan 
oc apply -f - <<'EOF'
apiVersion: compliance.openshift.io/v1alpha1
kind: ComplianceScan
metadata:
  name: tailored-scan
  namespace: openshift-compliance
spec:
  scanType: Platform
  tailoredProfile: rhcos4-moderate-tailored
  contentImage: registry.redhat.io/compliance/openshift-compliance-content-rhel9:latest
EOF

Compare result counts:

oc get compliancescans -n openshift-compliance
Generate Remediation 
oc get complianceremediations -n openshift-compliance | grep tailored || head

Apply one remediation (example):

oc annotate complianceremediation <name> compliance.openshift.io/apply=true -n openshift-compliance
Prefer explicit annotate/apply in production. Auto-apply of remediations is for non-prod iterative hardening only—enable it with a change ticket and a rollback plan.

Debrief

Tailoring turns Compliance Operator from noise into signal: compare baseline vs tailored results, then use ComplianceRemediation as a controlled harden path.

What breaks without this:

  • Untailored profiles → alert fatigue and ignored findings

  • Manual one-off fixes → undocumentable drift from the benchmark

Controls that matter: tailored profiles, scan comparison, remediation CRs, and cautious AutoApply (prefer non-prod first).

Quick facts: document why a check is disabled; re-scan after remediation to prove the close.

giphy

Cleanup

Before moving to the next module, run the lab cleanup script to reset transient resources from this module.

cd ~/openshift-security-roadshow
bash setup/lab-cleanup.sh --module 201-08