Chapter 3. Managing compliance

Procedure

1. In the RHACS portal, click Compliance OpenShift Schedules.
2. Click Create scan schedule.

3. In the Create scan schedule page, enter the following information:

   • Name: Enter a name to identify different compliance scans.
   • Description: Specify the reason for each compliance scan.

   • Schedule: Adjust the scan schedule to fit your required schedule:

     • Frequency: From the drop-down list, select how often you want to run the scan. If you do not select a frequency, the system selects Daily automatically.

       The following values define how often you want to perform the scan:

       • Daily
       • Weekly
       • Monthly

     • On day(s): From the list, select one or more days of the week on which you want to perform the scan.

       The following values define the days of the week on which you want to perform the scan:

       • Monday
       • Tuesday
       • Wednesday
       • Thursday
       • Friday
       • Saturday
       • Sunday
       • The first of the month

       • The middle of the month

         Note

         These values are only applicable if you specify the frequency of scan as Weekly or Monthly.

     • Time: Start to type the time in hh:mm at which you want to run the scan. From the list that is displayed, select a time.
4. Click Next.
5. Select one or more healthy clusters that you want to include in the scan.
6. Click Next.
7. Select one or more profiles that you want to include in the scan. The Type column shows the profile type as Built-in or Tailored. You can include both built-in and tailored profiles in the same scan schedule.
8. Click Next.

9. Optional: To configure email delivery destinations for manually triggered reports, perform the following steps:

   Note

   You can add one or more delivery destinations.

   1. Expand Add delivery destination.

   2. In the Delivery destination page, enter the following information:

      • Email notifier: Select an email notifier from the drop-down list.

        Optional: To configure the setting for a new email notifier integration, perform the following steps:

        1. From Select a notifier drop-down list, click Create email notifier.

        2. In the Create email notifier page, enter the following information:

           • Integration name: Enter a unique name for the email notifier. This name helps you identify and manage this specific email notifier configuration.
           • Email server: Specify the address of the SMTP server that you want to use to send the emails.
           • Username: Enter the username for authentication with the SMTP server. This is often the email address for sending the emails.
           • Password: Enter the password for the SMTP username. The system uses this password for authentication with the SMTP server.
           • From: This address usually represents the sender of the emails and is visible to the recipients. This is optional.
           • Sender: Enter the name of the sender, which is displayed together with the From email address. This name helps recipients identify who sent the email.
           • Default recipient: Enter the default email address that receives the notifications if you do not specify a recipient. This ensures that there is always a recipient for the emails.
           • Annotation key for recipient: Specify the annotation key to define a recipient to inform about the policy violations related to a specific deployment or namespace. This is optional.
           • Optional: Select the Enable unauthenticated SMTP checkbox, if your SMTP server does not require authentication. This is not recommended due to security reasons.
           • Optional: Select the Disable TLS certificate validation (insecure) checkbox, if you want to disable TLS certificate validation. This is not recommended due to security reasons.

           • Optional: In the Use STARTTLS (requires TLS to be disabled) field, select the type of STARTTLS for securing the connection to the SMTP server from the drop-down list.

             Important

             To use this option, you must disable TLS certificate validation.

             The following values define the type of STARTTLS for securing the connection to the SMTP server:

             • Disabled

               Data is not encrypted.

             • Plain

               Encodes username and password in base64.

             • Login

               Sends username and password as separate base64-encoded strings for added security.

        3. Click Save integration.
      • Distribution list: Enter one or more comma-separated email addresses of the recipients to receive the report.

      • Email template: The default template is automatically applied.

        Optional: To customize the email subject and body as needed, perform the following steps:

        1. Click the pencil icon.

        2. In the Edit email template page, enter the following information:

           • Email subject: Enter the desired subject line for the email. The recipient’s inbox shows this subject and it should clearly indicate the purpose of the email.
           • Email body: Compose the text of the email. This is the main content of the email and can include text, placeholders for dynamic content and any formatting necessary to get your message across effectively.
        3. Click Apply.
10. Click Next.
11. Review your scan configuration, and then click Save.

Verification

1. In the RHACS portal, click Compliance OpenShift Schedules.
2. Select the compliance scan that you have created.
3. In the Clusters section, verify that the operator status is healthy.

4. Optional: To edit the scan schedule, perform the following steps:

   1. From the Actions drop-down list, which is in the upper right of the page, select Edit scan schedule.
   2. Make your changes.
   3. Click Save.

5. Optional: To manually send a scan report:

   Note
   • You can only send a scan report manually if you have configured an email delivery destination.
   • Compliance reporting is only available for clusters running Compliance Operator version 1.6.0 or later.

   • From the Actions drop-down list, which is in the upper right of the page, select Send report.

     You receive a confirmation that you have requested to send a report.

6. Optional: To download a scan report, perform the following steps:

   Note

   Compliance reporting is only available for clusters running Compliance Operator version 1.6.0 or later.

   1. From the Actions drop-down list, which is in the upper right of the page, select Generate download.

      You receive a confirmation that the report generation has started.

   2. Click the All report jobs tab.
   3. Optional: Set View only my jobs to on.
   4. Locate the report job that you created.
   5. Wait until the download is complete, and then click Ready for download.
   6. Optional: To delete the report job, click the overflow menu and then select Delete download.