Updating remediations
When you update compliance content to a newer version, the Compliance Operator marks previously applied remediations as Outdated. Review these remediations and apply the updated versions to ensure your nodes use the latest configuration.
The previously applied remediation contents would then be stored in the spec.outdated attribute of a ComplianceRemediation object and the new updated contents would be stored in the spec.current attribute. After updating the content to a newer version, the administrator then needs to review the remediation. If the spec.outdated attribute exists, it would be used to render the resulting MachineConfig object. After the spec.outdated attribute is removed, the Compliance Operator re-renders the resulting MachineConfig object, which causes the Operator to push the configuration to the nodes.
|
|
The Compliance Operator does not automatically resolve dependency issues that can occur between remediations. Users should perform a rescan after remediations are applied to ensure accurate results. |
-
Search for any outdated remediations:
$ oc -n openshift-compliance get complianceremediations \ -l complianceoperator.openshift.io/outdated-remediation=Example outputNAME STATE workers-scan-no-empty-passwords OutdatedThe currently applied remediation is stored in the
Outdatedattribute and the new, unapplied remediation is stored in theCurrentattribute. If you are satisfied with the new version, remove theOutdatedfield. If you want to keep the updated content, remove theCurrentandOutdatedattributes. -
Apply the newer version of the remediation:
$ oc -n openshift-compliance patch complianceremediations workers-scan-no-empty-passwords \ --type json -p '[{"op":"remove", "path":/spec/outdated}]' -
The remediation state will switch from
OutdatedtoApplied:$ oc get -n openshift-compliance complianceremediations workers-scan-no-empty-passwordsExample outputNAME STATE workers-scan-no-empty-passwords Applied -
Verify that the nodes apply the newer remediation version and reboot.