Red Hat OpenShift Container Platform

Installing the Compliance Operator on ROSA hosted control planes (HCP)

You can install the Compliance Operator on Red Hat OpenShift Service on AWS by using the OpenShift CLI by creating the required namespace, Operator group, and subscription objects.

As of the Compliance Operator 1.5.0 release, the Operator is tested against Red Hat OpenShift Service on AWS using Hosted control planes.

Red Hat OpenShift Service on AWS Hosted control planes clusters have restricted access to the control plane, which is managed by Red Hat. By default, the Compliance Operator will schedule to nodes within the master node pool, which is not available in Red Hat OpenShift Service on AWS Hosted control planes installations. This requires you to configure the Subscription object in a way that allows the Operator to schedule on available node pools. This step is necessary for a successful installation on Red Hat OpenShift Service on AWS Hosted control planes clusters.

Prerequisites

You must have admin privileges.
You must have a StorageClass resource configured.

Procedure

Define a Namespace object:
Example namespace-object.yaml file
```
apiVersion: v1
kind: Namespace
metadata:
  labels:
    openshift.io/cluster-monitoring: "true"
    pod-security.kubernetes.io/enforce: privileged
  name: openshift-compliance
```
where:

metadata.labels.pod-security.kubernetes.io/enforce

Specifies the pod security label that must be set to privileged at the namespace level in Red Hat OpenShift Container Platform {product-version}.
Create the Namespace object by running the following command:
```
$ oc create -f namespace-object.yaml
```

Define an OperatorGroup object:

Example operator-group-object.yaml file

apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: compliance-operator
  namespace: openshift-compliance
spec:
  targetNamespaces:
  - openshift-compliance

Create the OperatorGroup object by running the following command:
```
$ oc create -f operator-group-object.yaml
```

Define a Subscription object:

Example subscription-object.yaml file

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: compliance-operator-sub
  namespace: openshift-compliance
spec:
  channel: "stable"
  installPlanApproval: Automatic
  name: compliance-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
  config:
    nodeSelector:
      node-role.kubernetes.io/worker: ""

Update the Operator deployment to deploy on worker nodes.

Create the Subscription object by running the following command:
```
$ oc create -f subscription-object.yaml
```

Verification

Verify that the installation succeeded by running the following command to inspect the cluster service version (CSV) file:
```
$ oc get csv -n openshift-compliance
```
Verify that the Compliance Operator is up and running by using the following command:
```
$ oc get deploy -n openshift-compliance
```