Red Hat OpenShift Container Platform

Installing the Compliance Operator using the CLI

You can install the Compliance Operator by using the OpenShift CLI by creating the required namespace, Operator group, and subscription objects.

Prerequisites

You must have admin privileges.
You must have a StorageClass resource configured.

Procedure

Define a Namespace object:
Example namespace-object.yaml
```
apiVersion: v1
kind: Namespace
metadata:
  labels:
    openshift.io/cluster-monitoring: "true"
    pod-security.kubernetes.io/enforce: privileged
  name: openshift-compliance
```
where:

metadata.labels.pod-security.kubernetes.io/enforce

Specifies the pod security label that must be set to privileged at the namespace level in Red Hat OpenShift Container Platform {product-version}.
Create the Namespace object:
```
$ oc create -f namespace-object.yaml
```

Define an OperatorGroup object:

Example operator-group-object.yaml

apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: compliance-operator
  namespace: openshift-compliance
spec:
  targetNamespaces:
  - openshift-compliance

Create the OperatorGroup object:

$ oc create -f operator-group-object.yaml

Define a Subscription object:

Example subscription-object.yaml

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: compliance-operator-sub
  namespace: openshift-compliance
spec:
  channel: "stable"
  installPlanApproval: Automatic
  name: compliance-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

Create the Subscription object:

$ oc create -f subscription-object.yaml

If you are setting the global scheduler feature and enable defaultNodeSelector, you must create the namespace manually and update the annotations of the openshift-compliance namespace, or the namespace where the Compliance Operator was installed, with openshift.io/node-selector: “”. This removes the default node selector and prevents deployment failures.

Verification

Verify the installation succeeded by inspecting the CSV file:
```
$ oc get csv -n openshift-compliance
```
Verify that the Compliance Operator is up and running:
```
$ oc get deploy -n openshift-compliance
```