- Documentation
- OpenShift Container Platform
- Security and compliance
- Compliance Operator
- Compliance Operator scan management
- Supported compliance profiles history bug_report picture_as_pdf
OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
- About
- Release notes
- Getting started
- Architecture
- Installing
- Installation overview
- Disconnected installation mirroring
- Installing on Alibaba
- Preparing to install on Alibaba Cloud
- Creating the required Alibaba Cloud resources
- Installing a cluster quickly on Alibaba Cloud
- Installing a cluster on Alibaba Cloud with customizations
- Installing a cluster on Alibaba Cloud with network customizations
- Installing a cluster on Alibaba Cloud into an existing VPC
- Uninstalling a cluster on Alibaba Cloud
- Installing on AWS
- Preparing to install on AWS
- Configuring an AWS account
- Manually creating IAM
- Installing a cluster quickly on AWS
- Installing a cluster on AWS with customizations
- Installing a cluster on AWS with network customizations
- Installing a cluster on AWS in a restricted network
- Installing a cluster on AWS into an existing VPC
- Installing a private cluster on AWS
- Installing a cluster on AWS into a government region
- Installing a cluster on AWS into a Secret or Top Secret Region
- Installing a cluster on AWS into a China region
- Installing a cluster on AWS using CloudFormation templates
- Installing a cluster using AWS Local Zones
- Installing a cluster on AWS in a restricted network with user-provisioned infrastructure
- Installing a cluster on AWS with remote workers on AWS Outposts
- Uninstalling a cluster on AWS
- Installing on Azure
- Preparing to install on Azure
- Configuring an Azure account
- Manually creating IAM
- Enabling user-managed encryption on Azure
- Installing a cluster quickly on Azure
- Installing a cluster on Azure with customizations
- Installing a cluster on Azure with network customizations
- Installing a cluster on Azure into an existing VNet
- Installing a private cluster on Azure
- Installing a cluster on Azure into a government region
- Installing a cluster on Azure using ARM templates
- Uninstalling a cluster on Azure
- Installing on Azure Stack Hub
- Preparing to install on Azure Stack Hub
- Configuring an Azure Stack Hub account
- Installing a cluster on Azure Stack Hub with an installer-provisioned infrastructure
- Installing a cluster on Azure Stack Hub with network customizations
- Installing a cluster on Azure Stack Hub using ARM templates
- Uninstalling a cluster on Azure Stack Hub
- Installing on GCP
- Preparing to install on GCP
- Configuring a GCP project
- Manually creating IAM
- Installing a cluster quickly on GCP
- Installing a cluster on GCP with customizations
- Installing a cluster on GCP with network customizations
- Installing a cluster on GCP in a restricted network
- Installing a cluster on GCP into an existing VPC
- Installing a cluster on GCP into a shared VPC
- Installing a private cluster on GCP
- Installing a cluster on GCP using Deployment Manager templates
- Installing a cluster into a shared VPC on GCP using Deployment Manager templates
- Installing a cluster on GCP in a restricted network with user-provisioned infrastructure
- Uninstalling a cluster on GCP
- Installing on IBM Cloud VPC
- Preparing to install on IBM Cloud VPC
- Configuring an IBM Cloud account
- Configuring IAM for IBM Cloud VPC
- Installing a cluster on IBM Cloud VPC with customizations
- Installing a cluster on IBM Cloud VPC with network customizations
- Installing a cluster on IBM Cloud VPC into an existing VPC
- Installing a private cluster on IBM Cloud VPC
- Uninstalling a cluster on IBM Cloud VPC
- Installing on Nutanix
- Installing on bare metal
- Installing on-premise with Assisted Installer
- Installing an on-premise cluster with the Agent-based Installer
- Installing on a single node
- Deploying installer-provisioned clusters on bare metal
- Installing on IBM Cloud Bare Metal (Classic)
- Installing on IBM Z and IBM LinuxONE
- Preparing to install on IBM Z and IBM LinuxONE
- Installing a cluster with z/VM on IBM Z and IBM LinuxONE
- Restricted network IBM Z installation with z/VM
- Installing a cluster with RHEL KVM on IBM Z and IBM LinuxONE
- Restricted network IBM Z installation with RHEL KVM
- Installation configuration parameters for IBM Z and IBM LinuxONE
- Installing on IBM Power
- Installing on OpenStack
- Preparing to install on OpenStack
- Preparing to install a cluster that uses SR-IOV or OVS-DPDK on OpenStack
- Installing a cluster on OpenStack with customizations
- Installing a cluster on OpenStack with Kuryr
- Installing a cluster on OpenStack on your own infrastructure
- Installing a cluster on OpenStack with Kuryr on your own infrastructure
- Installing a cluster on OpenStack in a restricted network
- Configuring network settings after installing OpenStack
- OpenStack Cloud Controller Manager reference guide
- Uninstalling a cluster on OpenStack
- Uninstalling a cluster on OpenStack from your own infrastructure
- Installing on RHV
- Installing on vSphere
- Preparing to install on vSphere
- Installing a cluster on vSphere
- Installing a cluster on vSphere with customizations
- Installing a cluster on vSphere with network customizations
- Installing a cluster on vSphere with user-provisioned infrastructure
- Installing a cluster on vSphere with user-provisioned infrastructure and network customizations
- Installing a cluster on vSphere in a restricted network
- Installing a cluster on vSphere in a restricted network with user-provisioned infrastructure
- Configuring the vSphere connection settings after an installation
- Uninstalling a cluster on vSphere that uses installer-provisioned infrastructure
- Using the vSphere Problem Detector Operator
- Installing on VMC
- Preparing to install on VMC
- Installing a cluster on VMC
- Installing a cluster on VMC with customizations
- Installing a cluster on VMC with network customizations
- Installing a cluster on VMC in a restricted network
- Installing a cluster on VMC with user-provisioned infrastructure
- Installing a cluster on VMC with user-provisioned infrastructure and network customizations
- Installing a cluster on VMC in a restricted network with user-provisioned infrastructure
- Uninstalling a cluster on VMC
- Installing on any platform
- Installation configuration
- Validation and troubleshooting
- Post-installation configuration
- Post-installation configuration overview
- Configuring a private cluster
- Bare metal configuration
- Configuring multi-architecture compute machines on an OpenShift cluster
- Machine configuration tasks
- Cluster tasks
- Node tasks
- Postinstallation network configuration
- Configuring image streams and image registries
- Storage configuration
- Preparing for users
- Configuring alert notifications
- Converting a connected cluster to a disconnected cluster
- Enabling cluster capabilities
- Configuring additional devices in an IBM Z or IBM LinuxONE environment
- Red Hat Enterprise Linux CoreOS image layering
- Updating clusters
- Updating clusters overview
- Understanding OpenShift updates
- Understanding update channels and releases
- Understanding OpenShift update duration
- Preparing to update to OpenShift Container Platform 4.12
- Preparing to perform an EUS-to-EUS update
- Preparing to update a cluster with manually maintained credentials
- Updating a cluster using the web console
- Updating a cluster using the CLI
- Performing update using canary rollout strategy
- Updating the boot loader on Red Hat Enterprise Linux CoreOS nodes using bootupd
- Updating a cluster that includes RHEL compute machines
- Updating a cluster in a disconnected environment
- Updating hardware on nodes running on vSphere
- Preflight validation for Kernel Module Management (KMM) Modules
- Support
- Support overview
- Managing your cluster resources
- Getting support
- Remote health monitoring with connected clusters
- About remote health monitoring
- Showing data collected by remote health monitoring
- Opting out of remote health reporting
- Enabling remote health reporting
- Using Insights to identify issues with your cluster
- Using the Insights Operator
- Using remote health reporting in a restricted network
- Importing simple content access entitlements with Insights Operator
- Gathering data about your cluster
- Summarizing cluster specifications
- Troubleshooting
- Troubleshooting installations
- Verifying node health
- Troubleshooting CRI-O container runtime issues
- Troubleshooting operating system issues
- Troubleshooting network issues
- Troubleshooting Operator issues
- Investigating pod issues
- Troubleshooting the Source-to-Image process
- Troubleshooting storage issues
- Troubleshooting Windows container workload issues
- Investigating monitoring issues
- Diagnosing OpenShift CLI (oc) issues
- Web console
- CLI tools
- Security and compliance
- Security and compliance overview
- Container security
- Understanding container security
- Understanding host and VM security
- Hardening Red Hat Enterprise Linux CoreOS
- Container image signatures
- Understanding compliance
- Securing container content
- Using container registries securely
- Securing the build process
- Deploying containers
- Securing the container platform
- Securing networks
- Securing attached storage
- Monitoring cluster events and logs
- Configuring certificates
- Certificate types and descriptions
- User-provided certificates for the API server
- Proxy certificates
- Service CA certificates
- Node certificates
- Bootstrap certificates
- etcd certificates
- OLM certificates
- Aggregated API client certificates
- Machine Config Operator certificates
- User-provided certificates for default ingress
- Ingress certificates
- Monitoring and cluster logging Operator component certificates
- Control plane certificates
- Compliance Operator
- File Integrity Operator
- File Integrity Operator Overview
- File Integrity Operator release notes
- File Integrity Operator support
- Installing the File Integrity Operator
- Updating the File Integrity Operator
- Understanding the File Integrity Operator
- Configuring the File Integrity Operator
- Performing advanced File Integrity Operator tasks
- Troubleshooting the File Integrity Operator
- Security Profiles Operator
- Security Profiles Operator overview
- Security Profiles Operator release notes
- Security Profiles Operator support
- Understanding the Security Profiles Operator
- Enabling the Security Profiles Operator
- Managing seccomp profiles
- Managing SELinux profiles
- Advanced Security Profiles Operator tasks
- Troubleshooting the Security Profiles Operator
- Uninstalling the Security Profiles Operator
- cert-manager Operator for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift overview
- cert-manager Operator for Red Hat OpenShift release notes
- Installing the cert-manager Operator for Red Hat OpenShift
- Configuring an ACME issuer
- Configuring certificates with an issuer
- Enabling monitoring for the cert-manager Operator for Red Hat OpenShift
- Configuring the egress proxy for the cert-manager Operator for Red Hat OpenShift
- Customizing cert-manager by using the cert-manager Operator API fields
- Authenticating the cert-manager Operator with AWS Security Token Service
- Configuring log levels for cert-manager and the cert-manager Operator for Red Hat OpenShift
- Authenticating the cert-manager Operator for Red Hat OpenShift on AWS
- Authenticating the cert-manager Operator for Red Hat OpenShift with GCP Workload Identity
- Authenticating the cert-manager Operator for Red Hat OpenShift on GCP
- Uninstalling the cert-manager Operator for Red Hat OpenShift
- Viewing audit logs
- Configuring the audit log policy
- Configuring TLS security profiles
- Configuring seccomp profiles
- Allowing JavaScript-based access to the API server from additional hosts
- Encrypting etcd data
- Scanning pods for vulnerabilities
- Network-Bound Disk Encryption (NBDE)
- Authentication and authorization
- Authentication and authorization overview
- Understanding authentication
- Configuring the internal OAuth server
- Configuring OAuth clients
- Managing user-owned OAuth access tokens
- Understanding identity provider configuration
- Configuring identity providers
- Configuring an htpasswd identity provider
- Configuring a Keystone identity provider
- Configuring an LDAP identity provider
- Configuring a basic authentication identity provider
- Configuring a request header identity provider
- Configuring a GitHub or GitHub Enterprise identity provider
- Configuring a GitLab identity provider
- Configuring a Google identity provider
- Configuring an OpenID Connect identity provider
- Using RBAC to define and apply permissions
- Removing the kubeadmin user
- Understanding and creating service accounts
- Using service accounts in applications
- Using a service account as an OAuth client
- Scoping tokens
- Using bound service account tokens
- Managing security context constraints
- Understanding and managing pod security admission
- Impersonating the system:admin user
- Syncing LDAP groups
- Managing cloud provider credentials
- Networking
- About networking
- Understanding networking
- Accessing hosts
- Networking Operators overview
- Understanding the Cluster Network Operator
- Understanding the DNS Operator
- Understanding the Ingress Operator
- Understanding the Ingress Node Firewall Operator
- Configuring the Ingress Controller for manual DNS management
- Verifying connectivity to an endpoint
- Changing the cluster network MTU
- Configuring the node port service range
- Configuring IP failover
- Configuring interface-level network sysctls
- Using SCTP
- Using PTP hardware
- External DNS Operator
- Understanding the External DNS Operator
- Installing the External DNS Operator
- External DNS Operator configuration parameters
- Creating DNS records on a public hosted zone for AWS
- Creating DNS records on a public zone for Azure
- Creating DNS records on a public managed zone for GCP
- Creating DNS records on a public DNS zone for Infoblox
- Configuring the cluster-wide proxy on the External DNS Operator
- Network policy
- CIDR range definitions
- AWS Load Balancer Operator
- AWS Load Balancer Operator release notes
- Understanding the AWS Load Balancer Operator
- Installing the AWS Load Balancer Operator
- Preparing for the AWS Load Balancer Operator on a cluster using the AWS Security Token Service (STS)
- Creating an instance of the AWS Load Balancer Controller
- Serving multiple ingress resources through a single AWS Load Balancer
- Adding TLS termination on the AWS Load Balancer
- Configuring cluster-wide proxy on the AWS Load Balancer Operator
- Multiple networks
- Understanding multiple networks
- Configuring an additional network
- About virtual routing and forwarding
- Configuring multi-network policy
- Attaching a pod to an additional network
- Removing a pod from an additional network
- Editing an additional network
- Removing an additional network
- Assigning a secondary network to a VRF
- Hardware networks
- About Single Root I/O Virtualization (SR-IOV) hardware networks
- Installing the SR-IOV Operator
- Configuring the SR-IOV Operator
- Configuring an SR-IOV network device
- Configuring an SR-IOV Ethernet network attachment
- Configuring an SR-IOV InfiniBand network attachment
- Adding a pod to an SR-IOV network
- Tuning sysctl settings on an SR-IOV network
- Using high performance multicast
- Using DPDK and RDMA
- Using pod-level bonding for secondary networks
- Configuring hardware offloading
- Switching Bluefield-2 from NIC to DPU mode
- Uninstalling the SR-IOV Operator
- OVN-Kubernetes network plugin
- About the OVN-Kubernetes network plugin
- OVN-Kubernetes architecture
- OVN-Kubernetes troubleshooting
- OVN-Kubernetes traffic tracing
- Migrating from the OpenShift SDN network plugin
- Rolling back to the OpenShift SDN network plugin
- Converting to IPv4/IPv6 dual stack networking
- Logging for egress firewall and network policy rules
- Configuring IPsec encryption
- Configuring an egress firewall for a project
- Viewing an egress firewall for a project
- Editing an egress firewall for a project
- Removing an egress firewall from a project
- Configuring an egress IP address
- Assigning an egress IP address
- Considerations for the use of an egress router pod
- Deploying an egress router pod in redirect mode
- Enabling multicast for a project
- Disabling multicast for a project
- Tracking network flows
- Configuring hybrid networking
- OpenShift SDN network plugin
- About the OpenShift SDN network plugin
- Migrating to the OpenShift SDN network plugin
- Rolling back to the OpenShift SDN network plugin
- Configuring egress IPs for a project
- Configuring an egress firewall for a project
- Viewing an egress firewall for a project
- Editing an egress firewall for a project
- Removing an egress firewall from a project
- Considerations for the use of an egress router pod
- Deploying an egress router pod in redirect mode
- Deploying an egress router pod in HTTP proxy mode
- Deploying an egress router pod in DNS proxy mode
- Configuring an egress router pod destination list from a config map
- Enabling multicast for a project
- Disabling multicast for a project
- Configuring multitenant isolation
- Configuring kube-proxy
- Configuring Routes
- Configuring ingress cluster traffic
- Overview
- Configuring ExternalIPs for services
- Configuring ingress cluster traffic using an Ingress Controller
- Configuring the Ingress Controller endpoint publishing strategy
- Configuring ingress cluster traffic using a load balancer
- Configuring ingress cluster traffic on AWS
- Configuring ingress cluster traffic using a service external IP
- Configuring ingress cluster traffic using a NodePort
- Configuring ingress cluster traffic using load balancer allowed source ranges
- Kubernetes NMState
- Configuring the cluster-wide proxy
- Configuring a custom PKI
- Load balancing on OpenStack
- Load balancing with MetalLB
- About MetalLB and the MetalLB Operator
- Installing the MetalLB Operator
- Upgrading the MetalLB Operator
- Configuring MetalLB address pools
- Advertising the IP address pools
- Configuring MetalLB BGP peers
- Advertising an IP address pool using the community alias
- Configuring MetalLB BFD profiles
- Configuring services to use MetalLB
- MetalLB logging, troubleshooting, and support
- Associating secondary interfaces metrics to network attachments
- Storage
- Storage overview
- Understanding ephemeral storage
- Understanding persistent storage
- Configuring persistent storage
- Persistent storage using AWS Elastic Block Store
- Persistent storage using Azure Disk
- Persistent storage using Azure File
- Persistent storage using Cinder
- Persistent storage using Fibre Channel
- Persistent storage using FlexVolume
- Persistent storage using GCE Persistent Disk
- Persistent Storage using iSCSI
- Persistent storage using NFS
- Persistent storage using Red Hat OpenShift Data Foundation
- Persistent storage using VMware vSphere
- Persistent storage using local storage
- Using Container Storage Interface (CSI)
- Configuring CSI volumes
- CSI inline ephemeral volumes
- Shared Resource CSI Driver Operator
- CSI volume snapshots
- CSI volume cloning
- CSI automatic migration
- AliCloud Disk CSI Driver Operator
- AWS Elastic Block Store CSI Driver Operator
- AWS Elastic File Service CSI Driver Operator
- Azure Disk CSI Driver Operator
- Azure File CSI Driver Operator
- Azure Stack Hub CSI Driver Operator
- GCP PD CSI Driver Operator
- GCP Filestore CSI Driver Operator
- IBM VPC Block CSI Driver Operator
- OpenStack Cinder CSI Driver Operator
- OpenStack Manila CSI Driver Operator
- Red Hat Virtualization CSI Driver Operator
- VMware vSphere CSI Driver Operator
- Generic ephemeral volumes
- Expanding persistent volumes
- Dynamic provisioning
- Registry
- Registry overview
- Image Registry Operator in OpenShift Container Platform
- Setting up and configuring the registry
- Configuring the registry for AWS user-provisioned infrastructure
- Configuring the registry for GCP user-provisioned infrastructure
- Configuring the registry for OpenStack user-provisioned infrastructure
- Configuring the registry for Azure user-provisioned infrastructure
- Configuring the registry for OpenStack
- Configuring the registry for bare metal
- Configuring the registry for vSphere
- Configuring the registry for OpenShift Data Foundation
- Configuring the registry for Nutanix
- Accessing the registry
- Exposing the registry
- Operators
- Operators overview
- Understanding Operators
- User tasks
- Administrator tasks
- Adding Operators to a cluster
- Updating installed Operators
- Deleting Operators from a cluster
- Configuring OLM features
- Configuring proxy support
- Viewing Operator status
- Managing Operator conditions
- Allowing non-cluster administrators to install Operators
- Managing custom catalogs
- Using OLM on restricted networks
- Catalog source pod scheduling
- Managing platform Operators
- Developing Operators
- About the Operator SDK
- Installing the Operator SDK CLI
- Go-based Operators
- Ansible-based Operators
- Helm-based Operators
- Java-based Operators
- Defining cluster service versions (CSVs)
- Working with bundle images
- Complying with pod security admission
- Validating Operators using the scorecard
- Validating Operator bundles
- High-availability or single-node cluster detection and support
- Configuring built-in monitoring with Prometheus
- Configuring leader election
- Object pruning utility
- Migrating package manifest projects to bundle format
- Operator SDK CLI reference
- Cluster Operators reference
- CI/CD
- About CI/CD
- Builds
- Understanding image builds
- Understanding build configurations
- Creating build inputs
- Managing build output
- Using build strategies
- Custom image builds with Buildah
- Performing and configuring basic builds
- Triggering and modifying builds
- Performing advanced builds
- Using Red Hat subscriptions in builds
- Securing builds by strategy
- Build configuration resources
- Troubleshooting builds
- Setting up additional trusted certificate authorities for builds
- Pipelines
- GitOps
- Jenkins
- Images
- Overview of images
- Configuring the Cluster Samples Operator
- Using the Cluster Samples Operator with an alternate registry
- Creating images
- Managing images
- Managing image streams
- Using image streams with Kubernetes resources
- Triggering updates on image stream changes
- Image configuration resources
- Using templates
- Using Ruby on Rails
- Using images
- Building applications
- Building applications overview
- Projects
- Creating applications
- Viewing application composition by using the Topology view
- Exporting applications
- Connecting applications to services
- Service Binding Operator release notes
- Understanding Service Binding Operator
- Installing Service Binding Operator
- Getting started with service binding
- Getting started with service binding on IBM Power, IBM Z, and IBM LinuxONE
- Exposing binding data from a service
- Projecting binding data
- Binding workloads using Service Binding Operator
- Connecting an application to a service using the Developer perspective
- Working with Helm charts
- Deployments
- Quotas
- Using config maps with applications
- Monitoring project and application metrics using the Developer perspective
- Monitoring application health
- Editing applications
- Pruning objects to reclaim resources
- Idling applications
- Deleting applications
- Using the Red Hat Marketplace
- Serverless
- Machine management
- Overview of machine management
- Managing compute machines with the Machine API
- Creating a compute machine set on Alibaba Cloud
- Creating a compute machine set on AWS
- Creating a compute machine set on Azure
- Creating a compute machine set on Azure Stack Hub
- Creating a compute machine set on GCP
- Creating a compute machine set on IBM Cloud
- Creating a compute machine set on Nutanix
- Creating a compute machine set on OpenStack
- Creating a compute machine set on RHV
- Creating a compute machine set on vSphere
- Creating a compute machine set on bare metal
- Manually scaling a compute machine set
- Modifying a compute machine set
- Machine phases and lifecycle
- Deleting a machine
- Applying autoscaling to a cluster
- Creating infrastructure machine sets
- Adding a RHEL compute machine
- Adding more RHEL compute machines
- Managing user-provisioned infrastructure manually
- Managing control plane machines
- Managing machines with the Cluster API
- Deploying machine health checks
- Nodes
- Overview of nodes
- Working with pods
- About pods
- Viewing pods
- Configuring a cluster for pods
- Automatically scaling pods with the horizontal pod autoscaler
- Automatically adjust pod resource levels with the vertical pod autoscaler
- Providing sensitive data to pods
- Creating and using config maps
- Using Device Manager to make devices available to nodes
- Including pod priority in pod scheduling decisions
- Placing pods on specific nodes using node selectors
- Automatically scaling pods with the Custom Metrics Autoscaler Operator
- Release notes
- Custom Metrics Autoscaler Operator overview
- Installing the custom metrics autoscaler
- Understanding the custom metrics autoscaler triggers
- Understanding custom metrics autoscaler trigger authentications
- Pausing the custom metrics autoscaler
- Gathering audit logs
- Gathering debugging data
- Viewing Operator metrics
- Understanding how to add custom metrics autoscalers
- Removing the Custom Metrics Autoscaler Operator
- Controlling pod placement onto nodes (scheduling)
- About pod placement using the scheduler
- Scheduling pods using a scheduler profile
- Placing pods relative to other pods using pod affinity and anti-affinity rules
- Controlling pod placement on nodes using node affinity rules
- Placing pods onto overcommited nodes
- Controlling pod placement using node taints
- Placing pods on specific nodes using node selectors
- Controlling pod placement using pod topology spread constraints
- Evicting pods using the descheduler
- Secondary scheduler
- Using Jobs and DaemonSets
- Working with nodes
- Viewing and listing the nodes in your cluster
- Working with nodes
- Managing nodes
- Managing the maximum number of pods per node
- Using the Node Tuning Operator
- Remediating, fencing, and maintaining nodes
- Understanding node rebooting
- Freeing node resources using garbage collection
- Allocating resources for nodes
- Allocating specific CPUs for nodes in a cluster
- Enabling TLS security profiles for the kubelet
- Machine Config Daemon metrics
- Creating infrastructure nodes
- Working with containers
- Understanding containers
- Using Init Containers to perform tasks before a pod is deployed
- Using volumes to persist container data
- Mapping volumes using projected volumes
- Allowing containers to consume API objects
- Copying files to or from a container
- Executing remote commands in a container
- Using port forwarding to access applications in a container
- Using sysctls in containers
- Working with clusters
- Viewing system event information in a cluster
- Analyzing cluster resource levels
- Setting limit ranges
- Configuring cluster memory to meet container memory and risk requirements
- Configuring your cluster to place pods on overcommited nodes
- Configuring the Linux cgroup version on your nodes
- Enabling features using FeatureGates
- Improving cluster stability in high latency environments using worker latency profiles
- Remote worker nodes on the network edge
- Worker nodes for single-node OpenShift clusters
- Windows Container Support for OpenShift
- Red Hat OpenShift support for Windows Containers overview
- Release notes
- Getting support
- Understanding Windows container workloads
- Enabling Windows container workloads
- Creating Windows machine sets
- Scheduling Windows container workloads
- Windows node upgrades
- Using Bring-Your-Own-Host Windows instances as nodes
- Removing Windows nodes
- Disabling Windows container workloads
- Sandboxed Containers Support for OpenShift
- Observability
- Observability overview
- Monitoring
- Monitoring overview
- Configuring the monitoring stack
- Enabling monitoring for user-defined projects
- Enabling alert routing for user-defined projects
- Managing metrics
- Querying metrics
- Managing metrics targets
- Managing alerts
- Reviewing monitoring dashboards
- The NVIDIA GPU administration dashboard
- Accessing monitoring APIs by using the CLI
- Troubleshooting monitoring issues
- Config map reference for the Cluster Monitoring Operator
- Logging
- Release notes
- Support
- Troubleshooting logging
- About Logging
- Installing Logging
- Updating Logging
- Visualizing logs
- Configuring your Logging deployment
- Log collection and forwarding
- Log storage
- Logging alerts
- Performance and reliability tuning
- Scheduling resources
- Uninstalling Logging
- Exported fields
- API reference
- Glossary
- Distributed tracing
- Red Hat build of OpenTelemetry
- Release notes
- Installing
- Configuring the Collector
- Configuring the instrumentation
- Sending traces and metrics to the Collector
- Configuring metrics for the monitoring stack
- Forwarding telemetry data
- Configuring the Collector metrics
- Gathering the observability data from multiple clusters
- Troubleshooting
- Migrating
- Upgrading
- Removing
- Network Observability
- Network Observability release notes
- Network Observability overview
- Installing the Network Observability Operator
- Understanding Network Observability Operator
- Configuring the Network Observability Operator
- Network Policy
- Observing the network traffic
- Using metrics with dashboards and alerts
- Monitoring the Network Observability Operator
- Scheduling resources
- Secondary networks
- Network Observability CLI
- FlowCollector API reference
- FlowMetric API reference
- Flows format reference
- Troubleshooting Network Observability
- Cluster Observability Operator
- Scalability and performance
- Scalability and performance overview
- Recommended performance and scalability practices
- Planning your environment according to object maximums
- Compute Resource Quotas
- Recommended host practices for IBM Z & IBM LinuxONE environments
- Using the Node Tuning Operator
- Using CPU Manager and Topology Manager
- Scheduling NUMA-aware workloads
- Scalability and performance optimization
- Managing bare metal hosts
- Monitoring bare-metal events
- What huge pages do and how they are consumed by apps
- Low latency tuning
- Performing latency tests for platform verification
- Improving cluster stability in high latency environments using worker latency profiles
- Creating a performance profile
- Workload partitioning in single-node OpenShift
- Requesting CRI-O and Kubelet profiling data by using the Node Observability Operator
- Clusters at the network far edge
- Challenges of the network far edge
- Preparing the hub cluster for ZTP
- Installing managed clusters with RHACM and SiteConfig resources
- Configuring managed clusters with policies and PolicyGenTemplate resources
- Manually installing a single-node OpenShift cluster with ZTP
- Recommended single-node OpenShift cluster configuration for vDU application workloads
- Validating cluster tuning for vDU application workloads
- Advanced managed cluster configuration with SiteConfig resources
- Advanced managed cluster configuration with PolicyGenTemplate resources
- Updating managed clusters with the Topology Aware Lifecycle Manager
- Updating managed clusters in a disconnected environment with the Topology Aware Lifecycle Manager
- Updating GitOps ZTP
- Expanding single-node OpenShift clusters with GitOps ZTP
- Pre-caching images for single-node OpenShift deployments
- Specialized hardware and driver enablement
- Backup and restore
- Overview of backup and restore operations
- Shutting down a cluster gracefully
- Restarting a cluster gracefully
- OADP Application backup and restore
- Control plane backup and restore
- Migrating from version 3 to 4
- Migrating from version 3 to 4 overview
- About migrating from OpenShift Container Platform 3 to 4
- Differences between OpenShift Container Platform 3 and 4
- Network considerations
- About MTC
- Installing MTC
- Installing MTC in a restricted network environment
- Upgrading MTC
- Premigration checklists
- Migrating your applications
- Advanced migration options
- Troubleshooting
- Migration Toolkit for Containers
- API reference
- API overview
- Common object reference
- Authorization APIs
- About Authorization APIs
- LocalResourceAccessReview [authorization.openshift.io/v1]
- LocalSubjectAccessReview [authorization.openshift.io/v1]
- ResourceAccessReview [authorization.openshift.io/v1]
- SelfSubjectRulesReview [authorization.openshift.io/v1]
- SubjectAccessReview [authorization.openshift.io/v1]
- SubjectRulesReview [authorization.openshift.io/v1]
- TokenRequest [authentication.k8s.io/v1]
- TokenReview [authentication.k8s.io/v1]
- LocalSubjectAccessReview [authorization.k8s.io/v1]
- SelfSubjectAccessReview [authorization.k8s.io/v1]
- SelfSubjectRulesReview [authorization.k8s.io/v1]
- SubjectAccessReview [authorization.k8s.io/v1]
- Autoscale APIs
- Config APIs
- About Config APIs
- APIServer [config.openshift.io/v1]
- Authentication [config.openshift.io/v1]
- Build [config.openshift.io/v1]
- ClusterOperator [config.openshift.io/v1]
- ClusterVersion [config.openshift.io/v1]
- Console [config.openshift.io/v1]
- DNS [config.openshift.io/v1]
- FeatureGate [config.openshift.io/v1]
- HelmChartRepository [helm.openshift.io/v1beta1]
- Image [config.openshift.io/v1]
- ImageContentPolicy [config.openshift.io/v1]
- Infrastructure [config.openshift.io/v1]
- Ingress [config.openshift.io/v1]
- Network [config.openshift.io/v1]
- Node [config.openshift.io/v1]
- OAuth [config.openshift.io/v1]
- OperatorHub [config.openshift.io/v1]
- Project [config.openshift.io/v1]
- ProjectHelmChartRepository [helm.openshift.io/v1beta1]
- Proxy [config.openshift.io/v1]
- Scheduler [config.openshift.io/v1]
- Console APIs
- About Console APIs
- ConsoleCLIDownload [console.openshift.io/v1]
- ConsoleExternalLogLink [console.openshift.io/v1]
- ConsoleLink [console.openshift.io/v1]
- ConsoleNotification [console.openshift.io/v1]
- ConsolePlugin [console.openshift.io/v1]
- ConsoleQuickStart [console.openshift.io/v1]
- ConsoleYAMLSample [console.openshift.io/v1]
- Extension APIs
- Image APIs
- About Image APIs
- Image [image.openshift.io/v1]
- ImageSignature [image.openshift.io/v1]
- ImageStreamImage [image.openshift.io/v1]
- ImageStreamImport [image.openshift.io/v1]
- ImageStreamLayers [image.openshift.io/v1]
- ImageStreamMapping [image.openshift.io/v1]
- ImageStream [image.openshift.io/v1]
- ImageStreamTag [image.openshift.io/v1]
- ImageTag [image.openshift.io/v1]
- SecretList [image.openshift.io/v1]
- Machine APIs
- About Machine APIs
- ContainerRuntimeConfig [machineconfiguration.openshift.io/v1]
- ControllerConfig [machineconfiguration.openshift.io/v1]
- ControlPlaneMachineSet [machine.openshift.io/v1]
- KubeletConfig [machineconfiguration.openshift.io/v1]
- MachineConfigPool [machineconfiguration.openshift.io/v1]
- MachineConfig [machineconfiguration.openshift.io/v1]
- MachineHealthCheck [machine.openshift.io/v1beta1]
- Machine [machine.openshift.io/v1beta1]
- MachineSet [machine.openshift.io/v1beta1]
- Metadata APIs
- Monitoring APIs
- About Monitoring APIs
- Alertmanager [monitoring.coreos.com/v1]
- AlertmanagerConfig [monitoring.coreos.com/v1beta1]
- PodMonitor [monitoring.coreos.com/v1]
- Probe [monitoring.coreos.com/v1]
- Prometheus [monitoring.coreos.com/v1]
- PrometheusRule [monitoring.coreos.com/v1]
- ServiceMonitor [monitoring.coreos.com/v1]
- ThanosRuler [monitoring.coreos.com/v1]
- Network APIs
- About Network APIs
- CloudPrivateIPConfig [cloud.network.openshift.io/v1]
- EgressFirewall [k8s.ovn.org/v1]
- EgressIP [k8s.ovn.org/v1]
- EgressQoS [k8s.ovn.org/v1]
- Endpoints [undefined/v1]
- EndpointSlice [discovery.k8s.io/v1]
- EgressRouter [network.operator.openshift.io/v1]
- Ingress [networking.k8s.io/v1]
- IngressClass [networking.k8s.io/v1]
- IPPool [whereabouts.cni.cncf.io/v1alpha1]
- NetworkAttachmentDefinition [k8s.cni.cncf.io/v1]
- NetworkPolicy [networking.k8s.io/v1]
- OverlappingRangeIPReservation [whereabouts.cni.cncf.io/v1alpha1]
- PodNetworkConnectivityCheck [controlplane.operator.openshift.io/v1alpha1]
- Route [route.openshift.io/v1]
- Service [undefined/v1]
- Node APIs
- OAuth APIs
- Operator APIs
- About Operator APIs
- Authentication [operator.openshift.io/v1]
- CloudCredential [operator.openshift.io/v1]
- ClusterCSIDriver [operator.openshift.io/v1]
- Console [operator.openshift.io/v1]
- Config [operator.openshift.io/v1]
- Config [imageregistry.operator.openshift.io/v1]
- Config [samples.operator.openshift.io/v1]
- CSISnapshotController [operator.openshift.io/v1]
- DNS [operator.openshift.io/v1]
- DNSRecord [ingress.operator.openshift.io/v1]
- Etcd [operator.openshift.io/v1]
- ImageContentSourcePolicy [operator.openshift.io/v1alpha1]
- ImagePruner [imageregistry.operator.openshift.io/v1]
- IngressController [operator.openshift.io/v1]
- InsightsOperator [operator.openshift.io/v1]
- KubeAPIServer [operator.openshift.io/v1]
- KubeControllerManager [operator.openshift.io/v1]
- KubeScheduler [operator.openshift.io/v1]
- KubeStorageVersionMigrator [operator.openshift.io/v1]
- Network [operator.openshift.io/v1]
- OpenShiftAPIServer [operator.openshift.io/v1]
- OpenShiftControllerManager [operator.openshift.io/v1]
- OperatorPKI [network.operator.openshift.io/v1]
- ServiceCA [operator.openshift.io/v1]
- Storage [operator.openshift.io/v1]
- OperatorHub APIs
- About OperatorHub APIs
- CatalogSource [operators.coreos.com/v1alpha1]
- ClusterServiceVersion [operators.coreos.com/v1alpha1]
- InstallPlan [operators.coreos.com/v1alpha1]
- OLMConfig [operators.coreos.com/v1]
- Operator [operators.coreos.com/v1]
- OperatorCondition [operators.coreos.com/v2]
- OperatorGroup [operators.coreos.com/v1]
- PackageManifest [packages.operators.coreos.com/v1]
- Subscription [operators.coreos.com/v1alpha1]
- Policy APIs
- Project APIs
- Provisioning APIs
- RBAC APIs
- Role APIs
- Schedule and quota APIs
- About Schedule and quota APIs
- AppliedClusterResourceQuota [quota.openshift.io/v1]
- ClusterResourceQuota [quota.openshift.io/v1]
- FlowSchema [flowcontrol.apiserver.k8s.io/v1beta1]
- LimitRange [undefined/v1]
- PriorityClass [scheduling.k8s.io/v1]
- PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1beta1]
- ResourceQuota [undefined/v1]
- Security APIs
- About Security APIs
- CertificateSigningRequest [certificates.k8s.io/v1]
- CredentialsRequest [cloudcredential.openshift.io/v1]
- PodSecurityPolicyReview [security.openshift.io/v1]
- PodSecurityPolicySelfSubjectReview [security.openshift.io/v1]
- PodSecurityPolicySubjectReview [security.openshift.io/v1]
- RangeAllocation [security.openshift.io/v1]
- Secret [undefined/v1]
- SecurityContextConstraints [security.openshift.io/v1]
- ServiceAccount [undefined/v1]
- Storage APIs
- About Storage APIs
- CSIDriver [storage.k8s.io/v1]
- CSINode [storage.k8s.io/v1]
- CSIStorageCapacity [storage.k8s.io/v1]
- PersistentVolumeClaim [undefined/v1]
- StorageClass [storage.k8s.io/v1]
- StorageState [migration.k8s.io/v1alpha1]
- StorageVersionMigration [migration.k8s.io/v1alpha1]
- VolumeAttachment [storage.k8s.io/v1]
- VolumeSnapshot [snapshot.storage.k8s.io/v1]
- VolumeSnapshotClass [snapshot.storage.k8s.io/v1]
- VolumeSnapshotContent [snapshot.storage.k8s.io/v1]
- Template APIs
- User and group APIs
- Workloads APIs
- About Workloads APIs
- BuildConfig [build.openshift.io/v1]
- Build [build.openshift.io/v1]
- BuildLog [build.openshift.io/v1]
- BuildRequest [build.openshift.io/v1]
- CronJob [batch/v1]
- DaemonSet [apps/v1]
- Deployment [apps/v1]
- DeploymentConfig [apps.openshift.io/v1]
- DeploymentConfigRollback [apps.openshift.io/v1]
- DeploymentLog [apps.openshift.io/v1]
- DeploymentRequest [apps.openshift.io/v1]
- Job [batch/v1]
- Pod [undefined/v1]
- ReplicationController [undefined/v1]
- PersistentVolume [undefined/v1]
- ReplicaSet [apps/v1]
- StatefulSet [apps/v1]
- Service Mesh
- Service Mesh 2.x
- About OpenShift Service Mesh
- Service Mesh 2.x release notes
- Upgrading Service Mesh
- Understanding Service Mesh
- Service Mesh deployment models
- Service Mesh and Istio differences
- Preparing to install Service Mesh
- Installing the Operators
- Creating the ServiceMeshControlPlane
- Adding services to a service mesh
- Enabling sidecar injection
- Managing users and profiles
- Security
- Traffic management
- Gateway migration
- Route migration
- Metrics, logs, and traces
- Performance and scalability
- Deploying to production
- Federation
- Extensions
- OpenShift Service Mesh Console plugin
- 3scale WebAssembly for 2.1
- 3scale Istio adapter for 2.0
- Troubleshooting Service Mesh
- Control plane configuration reference
- Kiali configuration reference
- Jaeger configuration reference
- Uninstalling Service Mesh
- Service Mesh 1.x
- Service Mesh 1.x release notes
- Service Mesh architecture
- Service Mesh and Istio differences
- Preparing to install Service Mesh
- Installing Service Mesh
- Security
- Traffic management
- Deploying applications on Service Mesh
- Data visualization and observability
- Custom resources
- 3scale Istio adapter for 1.x
- Removing Service Mesh
- Service Mesh 2.x
- Virtualization
- About OpenShift Virtualization
- OpenShift Virtualization architecture
- Getting started with OpenShift Virtualization
- Web console overview
- OpenShift Virtualization release notes
- Installing
- Updating OpenShift Virtualization
- Security policies
- Using the CLI tools
- Virtual machines
- Creating virtual machines
- Editing virtual machines
- Editing boot order
- Deleting virtual machines
- Exporting virtual machines
- Managing virtual machine instances
- Controlling virtual machine states
- Accessing virtual machine consoles
- Automating Windows installation with sysprep
- Triggering virtual machine failover by resolving a failed node
- Installing the QEMU guest agent on virtual machines
- Viewing the QEMU guest agent information for virtual machines
- Managing config maps, secrets, and service accounts in virtual machines
- Installing VirtIO driver on an existing Windows virtual machine
- Installing VirtIO driver on a new Windows virtual machine
- Using virtual Trusted Platform Module devices
- Managing virtual machines with OpenShift Pipelines
- Advanced virtual machine management
- Working with resource quotas for virtual machines
- Specifying nodes for virtual machines
- Configuring certificate rotation
- UEFI mode for virtual machines
- Configuring PXE booting for virtual machines
- Using huge pages with virtual machines
- Enabling dedicated resources for a virtual machine
- Scheduling virtual machines
- Configuring PCI passthrough
- Configuring vGPU passthrough
- Configuring mediated devices
- Configuring a watchdog device
- Automatic importing and updating of pre-defined boot sources
- Enabling descheduler evictions on virtual machines
- Importing virtual machines
- Cloning virtual machines
- Virtual machine networking
- Configuring a virtual machine for the default pod network
- Creating a service to expose a virtual machine
- Connecting a virtual machine to a Linux bridge network
- Connecting a virtual machine to an SR-IOV network
- Connecting a virtual machine to a service mesh
- Configuring IP addresses for virtual machines
- Viewing the IP address of NICs on a virtual machine
- Using a MAC address pool for virtual machines
- Virtual machine disks
- Features for storage
- Configuring local storage for virtual machines
- Creating data volumes
- Reserving PVC space for file system overhead
- Configuring CDI to work with namespaces that have a compute resource quota
- Managing data volume annotations
- Using preallocation for data volumes
- Uploading local disk images by using the web console
- Uploading local disk images by using the virtctl tool
- Uploading a local disk image to a block storage data volume
- Managing virtual machine snapshots
- Moving a local virtual machine disk to a different node
- Expanding virtual storage by adding blank disk images
- Cloning a data volume using smart-cloning
- Creating and using boot sources
- Hot plugging virtual disks
- Using container disks with virtual machines
- Preparing CDI scratch space
- Re-using statically provisioned persistent volumes
- Expanding a virtual machine disk
- Virtual machine templates
- Live migration
- Virtual machine live migration
- Live migration limits and timeouts
- Migrating a virtual machine instance to another node
- Migrating a virtual machine over a dedicated additional network
- Cancelling the live migration of a virtual machine instance
- Configuring virtual machine eviction strategy
- Configuring live migration policies
- Node maintenance
- Logging, events, and monitoring
- Virtualization Overview page
- Viewing OpenShift Virtualization logs
- Viewing events
- Monitoring live migration
- Diagnosing data volumes using events and conditions
- Viewing information about virtual machine workloads
- Monitoring virtual machine health
- Viewing cluster information
- Reviewing resource usage by virtual machines
- OpenShift cluster monitoring, logging, and Telemetry
- Running OpenShift cluster checkups
- Prometheus queries for virtual resources
- Exposing custom metrics for virtual machines
- OpenShift Virtualization runbooks
- Collecting data for Red Hat Support
- Backup and restore
×
Supported compliance profiles
There are several profiles available as part of the Compliance Operator (CO) installation. While you can use the following profiles to assess gaps in a cluster, usage alone does not infer or guarantee compliance with a particular profile and is not an auditor.
In order to be compliant or certified under these various standards, you need to engage an authorized auditor such as a Qualified Security Assessor (QSA), Joint Authorization Board (JAB), or other industry recognized regulatory authority to assess your environment. You are required to work with an authorized auditor to achieve compliance with a standard.
For more information on compliance support for all Red Hat products, see Product Compliance.
|
The Compliance Operator might report incorrect results on some managed platforms, such as OpenShift Dedicated and Azure Red Hat OpenShift. For more information, see the Red Hat Knowledgebase Solution #6983418. |
Compliance profiles
The Compliance Operator provides profiles to meet industry standard benchmarks.
|
The following tables reflect the latest available profiles in the Compliance Operator. |
CIS compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-cis [1] |
CIS Red Hat OpenShift Container Platform Benchmark v1.5.0 |
Platform |
CIS Benchmarks ™ [1] |
|
|
ocp4-cis-1-4 [3] |
CIS Red Hat OpenShift Container Platform Benchmark v1.4.0 |
Platform |
CIS Benchmarks ™ [4] |
|
|
ocp4-cis-1-5 |
CIS Red Hat OpenShift Container Platform Benchmark v1.5.0 |
Platform |
CIS Benchmarks ™ [4] |
|
|
ocp4-cis-node [1] |
CIS Red Hat OpenShift Container Platform Benchmark v1.5.0 |
Node [2] |
CIS Benchmarks ™ [4] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
ocp4-cis-node-1-4 [3] |
CIS Red Hat OpenShift Container Platform Benchmark v1.4.0 |
Node [2] |
CIS Benchmarks ™ [4] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
ocp4-cis-node-1-5 |
CIS Red Hat OpenShift Container Platform Benchmark v1.5.0 |
Node [2] |
CIS Benchmarks ™ [4] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
-
The
ocp4-cisandocp4-cis-nodeprofiles maintain the most up-to-date version of the CIS benchmark as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as CIS v1.4.0, use theocp4-cis-1-4andocp4-cis-node-1-4profiles. -
Node profiles must be used with the relevant Platform profile. For more information, see Compliance Operator profile types.
-
CIS v1.4.0 is superceded by CIS v1.5.0. It is recommended to apply the latest profile to your environment.
-
To locate the CIS OpenShift Container Platform v4 Benchmark, go to CIS Benchmarks and click Download Latest CIS Benchmark, where you can then register to download the benchmark.
Essential Eight compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-e8 |
Australian Cyber Security Centre (ACSC) Essential Eight |
Platform |
|
||
rhcos4-e8 |
Australian Cyber Security Centre (ACSC) Essential Eight |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
FedRAMP High compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-high [1] |
NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level |
Platform |
|
||
ocp4-high-node [1] |
NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Node level |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-high-node-rev-4 |
NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Node level |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-high-rev-4 |
NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level |
Platform |
|
||
rhcos4-high [1] |
NIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
rhcos4-high-rev-4 |
NIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
-
The
ocp4-high,ocp4-high-nodeandrhcos4-highprofiles maintain the most up-to-date version of the FedRAMP High standard as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as FedRAMP high R4, use theocp4-high-rev-4andocp4-high-node-rev-4profiles. -
Node profiles must be used with the relevant Platform profile. For more information, see Compliance Operator profile types.
FedRAMP Moderate compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-moderate [1] |
NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level |
Platform |
|
||
ocp4-moderate-node [1] |
NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-moderate-node-rev-4 |
NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-moderate-rev-4 |
NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level |
Platform |
|
||
rhcos4-moderate [1] |
NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
rhcos4-moderate-rev-4 |
NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
-
The
ocp4-moderate,ocp4-moderate-nodeandrhcos4-moderateprofiles maintain the most up-to-date version of the FedRAMP Moderate standard as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as FedRAMP Moderate R4, use theocp4-moderate-rev-4andocp4-moderate-node-rev-4profiles. -
Node profiles must be used with the relevant Platform profile. For more information, see Compliance Operator profile types.
NERC-CIP compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-nerc-cip |
North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the OpenShift Container Platform - Platform level |
Platform |
|
||
ocp4-nerc-cip-node |
North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the OpenShift Container Platform - Node level |
Node [1] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
rhcos4-nerc-cip |
North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for Red Hat Enterprise Linux CoreOS |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
-
Node profiles must be used with the relevant Platform profile. For more information, see Compliance Operator profile types.
PCI-DSS compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-pci-dss [1] |
PCI-DSS v4 Control Baseline for OpenShift Container Platform 4 |
Platform |
|
||
ocp4-pci-dss-3-2 [3] |
PCI-DSS v3.2.1 Control Baseline for OpenShift Container Platform 4 |
Platform |
|
||
ocp4-pci-dss-4-0 |
PCI-DSS v4 Control Baseline for OpenShift Container Platform 4 |
Platform |
|
||
ocp4-pci-dss-node [1] |
PCI-DSS v4 Control Baseline for OpenShift Container Platform 4 |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-pci-dss-node-3-2 [3] |
PCI-DSS v3.2.1 Control Baseline for OpenShift Container Platform 4 |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-pci-dss-node-4-0 |
PCI-DSS v4 Control Baseline for OpenShift Container Platform 4 |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
-
The
ocp4-pci-dssandocp4-pci-dss-nodeprofiles maintain the most up-to-date version of the PCI-DSS standard as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as PCI-DSS v3.2.1, use theocp4-pci-dss-3-2andocp4-pci-dss-node-3-2profiles. -
Node profiles must be used with the relevant Platform profile. For more information, see Compliance Operator profile types.
-
PCI-DSS v3.2.1 is superceded by PCI-DSS v4. It is recommended to apply the latest profile to your environment.
STIG compliance profiles
| Profile | Profile title | Application | Industry compliance benchmark | Supported architectures | Supported platforms |
|---|---|---|---|---|---|
ocp4-stig [1] |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift |
Platform |
|
||
ocp4-stig-node [1] |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-stig-node-v1r1 [3] |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift V1R1 |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-stig-node-v2r1 |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift V2R1 |
Node [2] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
ocp4-stig-v1r1 [3] |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift V1R1 |
Platform |
|
||
ocp4-stig-v2r1 |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift V2R1 |
Platform |
|
||
rhcos4-stig |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
|
rhcos4-stig-v1r1 [3] |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift V1R1 |
Node |
DISA-STIG [3] |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
rhcos4-stig-v2r1 |
Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) for Red Hat Openshift V2R1 |
Node |
|
Red Hat OpenShift Service on AWS with hosted control planes (ROSA HCP) |
-
The
ocp4-stig,ocp4-stig-nodeandrhcos4-stigprofiles maintain the most up-to-date version of the DISA-STIG benchmark as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as DISA-STIG V2R1, use theocp4-stig-v2r1andocp4-stig-node-v2r1profiles. -
Node profiles must be used with the relevant Platform profile. For more information, see Compliance Operator profile types.
-
DISA-STIG V1R1 is superceded by DISA-STIG V2R1. It is recommended to apply the latest profile to your environment.
About extended compliance profiles
Some compliance profiles have controls that require following industry best practices, resulting in some profiles extending others. Combining the Center for Internet Security (CIS) best practices with National Institute of Standards and Technology (NIST) security frameworks establishes a path to a secure and compliant environment.
For example, the NIST High-Impact and Moderate-Impact profiles extend the CIS profile to achieve compliance. As a result, extended compliance profiles eliminate the need to run both profiles in a single cluster.
| Profile | Extends |
|---|---|
ocp4-pci-dss |
ocp4-cis |
ocp4-pci-dss-node |
ocp4-cis-node |
ocp4-high |
ocp4-cis |
ocp4-high-node |
ocp4-cis-node |
ocp4-moderate |
ocp4-cis |
ocp4-moderate-node |
ocp4-cis-node |
ocp4-nerc-cip |
ocp4-moderate |
ocp4-nerc-cip-node |
ocp4-moderate-node |