Before you can use the Compliance Operator, you must ensure it is deployed in the cluster.

Installing the Compliance Operator through the web console

  • You must have admin privileges.

  1. In the OKD web console, navigate to OperatorsOperatorHub.

  2. Search for the Compliance Operator, then click Install.

  3. Keep the default selection of Installation mode and namespace to ensure that the Operator will be installed to the openshift-compliance namespace.

  4. Click Install.


To confirm that the installation is successful:

  1. Navigate to the OperatorsInstalled Operators page.

  2. Check that the Compliance Operator is installed in the openshift-compliance namespace and its status is Succeeded.

If the Operator is not installed successfully:

  1. Navigate to the OperatorsInstalled Operators page and inspect the Status column for any errors or failures.

  2. Navigate to the WorkloadsPods page and check the logs in any pods in the openshift-compliance project that are reporting issues.

Installing the Compliance Operator using the CLI

  • You must have admin privileges.

  1. Define a Namespace object:

    Example namespace-object.yaml
    apiVersion: v1
    kind: Namespace
        openshift.io/cluster-monitoring: "true"
      name: openshift-compliance
  2. Create the Namespace object:

    $ oc create -f namespace-object.yaml
  3. Define an OperatorGroup object:

    Example operator-group-object.yaml
    apiVersion: operators.coreos.com/v1
    kind: OperatorGroup
      name: compliance-operator
      namespace: openshift-compliance
      - openshift-compliance
  4. Create the OperatorGroup object:

    $ oc create -f operator-group-object.yaml
  5. Define a Subscription object:

    Example subscription-object.yaml
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
      name: compliance-operator-sub
      namespace: openshift-compliance
      channel: "release-0.1"
      installPlanApproval: Automatic
      name: compliance-operator
      source: redhat-operators
      sourceNamespace: openshift-marketplace
  6. Create the Subscription object:

    $ oc create -f subscription-object.yaml

If you are setting the global scheduler feature and enable defaultNodeSelector, you must create the namespace manually and update the annotations of the openshift-compliance namespace, or the namespace where the Compliance Operator was installed, with openshift.io/node-selector: “”. This removes the default node selector and prevents deployment failures.

  1. Verify the installation succeeded by inspecting the CSV file:

    $ oc get csv -n openshift-compliance
  2. Verify that the Compliance Operator is up and running:

    $ oc get deploy -n openshift-compliance

Additional resources