Merge pull request #80406 from sheriff-rh/CO-1.6.0

CO 1.6.0 release notes

Author: kalexand-rh

_topic_maps/_topic_map.yml

@@ -1056,6 +1056,8 @@ Topics:
     File: co-overview
   - Name: Compliance Operator release notes
     File: compliance-operator-release-notes
+  - Name: Compliance Operator support
+    File: co-support
   - Name: Compliance Operator concepts
     Dir: co-concepts
     Topics:
@@ -1089,7 +1091,7 @@ Topics:
       File: compliance-operator-remediation
     - Name: Performing advanced Compliance Operator tasks
       File: compliance-operator-advanced
-    - Name: Troubleshooting the Compliance Operator
+    - Name: Troubleshooting Compliance Operator scans
       File: compliance-operator-troubleshooting
     - Name: Using the oc-compliance plugin
       File: oc-compliance-plug-in-using

modules/co-scansetting-resources.adoc

@@ -0,0 +1,84 @@
+// Module included in the following assemblies:
+//
+// * security/compliance_operator/co-scans/compliance-operator-troubleshooting.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="co-scansetting-resources_{context}"]
+= Configuring ScanSetting resources
+
+When using the Compliance Operator in a cluster that contains more than 500 MachineConfigs, the `ocp4-pci-dss-api-checks-pod` pod may pause in the `init` phase when performing a `Platform` scan.
+
+[NOTE]
+====
+Resource constraints applied in this process overwrites the existing resource constraints.
+====
+
+.Procedure
+
+. Confirm the `ocp4-pci-dss-api-checks-pod` pod is stuck in the `Init:OOMKilled` status: 
++
+[source,terminal]
+----
+$ oc get pod ocp4-pci-dss-api-checks-pod -w
+----
++
+.Example output
+[source,terminal]
+----
+NAME                          READY   STATUS     RESTARTS        AGE
+ocp4-pci-dss-api-checks-pod   0/2     Init:1/2   8 (5m56s ago)   25m
+ocp4-pci-dss-api-checks-pod   0/2     Init:OOMKilled   8 (6m19s ago)   26m
+----
+
+. Edit the  `scanLimits` attribute in the `ScanSetting` CR to increase the available memory for the `ocp4-pci-dss-api-checks-pod` pod:
++
+[source,yaml]
+----
+timeout: 30m
+strictNodeScan: true
+metadata:
+  name: default
+  namespace: openshift-compliance
+kind: ScanSetting
+showNotApplicable: false
+rawResultStorage:
+  nodeSelector:
+    node-role.kubernetes.io/master: ''
+  pvAccessModes:
+    - ReadWriteOnce
+  rotation: 3
+  size: 1Gi
+  tolerations:
+    - effect: NoSchedule
+      key: node-role.kubernetes.io/master
+      operator: Exists
+    - effect: NoExecute
+      key: node.kubernetes.io/not-ready
+      operator: Exists
+      tolerationSeconds: 300
+    - effect: NoExecute
+      key: node.kubernetes.io/unreachable
+      operator: Exists
+      tolerationSeconds: 300
+    - effect: NoSchedule
+      key: node.kubernetes.io/memory-pressure
+      operator: Exists
+schedule: 0 1 * * *
+roles:
+  - master
+  - worker
+apiVersion: compliance.openshift.io/v1alpha1
+maxRetryOnTimeout: 3
+scanTolerations:
+  - operator: Exists
+scanLimits:
+  memory: 1024Mi <1>
+----
+<1> The default setting is `500Mi`.
+
+. Apply the `ScanSetting` CR to your cluster: 
++
+[source,terminal]
+----
+$ oc apply -f scansetting.yaml
+----

modules/compliance-must-gather.adoc

@@ -0,0 +1,23 @@
+// Module included in the following assemblies:
+//
+// * security/compliance_operator/co-support.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="compliance-must-gather_{context}"]
+= Using the must-gather tool for the Compliance Operator
+
+Starting in Compliance Operator v1.6.0, you can collect data about the Compliance Operator resources by running the `must-gather` command with the Compliance Operator image.
+
+[NOTE]
+====
+Consider using the `must-gather` tool when opening support cases or filing bug reports, as it provides additional details about the Operator configuration and logs.
+====
+
+.Procedure
+
+* Run the following command to collect data about the Compliance Operator: 
++
+[source,terminal]
+----
+$ oc adm must-gather --image=$(oc get csv compliance-operator.v1.6.0 -o=jsonpath='{.spec.relatedImages[?(@.name=="must-gather")].image}')
+----

modules/compliance-operator-cli-installation.adoc

@@ -9,6 +9,7 @@
 .Prerequisites
 
 * You must have `admin` privileges.
+* You must have a `StorageClass` resource configured.
 
 .Procedure
 

modules/compliance-operator-console-installation.adoc

@@ -9,6 +9,7 @@
 .Prerequisites
 
 * You must have `admin` privileges.
+* You must have a `StorageClass` resource configured.
 
 .Procedure
 

modules/compliance-operator-rosa-installation.adoc

@@ -13,6 +13,7 @@ As of the Compliance Operator 1.5.0 release, the Operator is tested against {pro
 .Prerequisites
 
 * You must have `admin` privileges.
+* You must have a `StorageClass` resource configured.
 
 .Procedure
 

modules/compliance-profiles.adoc

@@ -12,28 +12,51 @@ There are several profiles available as part of the Compliance Operator installa
 +
 [source,terminal]
 ----
-$ oc get -n openshift-compliance profiles.compliance
+$ oc get profile.compliance -n openshift-compliance
 ----
 +
 .Example output
 [source,terminal]
 ----
-NAME                 AGE
-ocp4-cis             94m
-ocp4-cis-node        94m
-ocp4-e8              94m
-ocp4-high            94m
-ocp4-high-node       94m
-ocp4-moderate        94m
-ocp4-moderate-node   94m
-ocp4-nerc-cip        94m
-ocp4-nerc-cip-node   94m
-ocp4-pci-dss         94m
-ocp4-pci-dss-node    94m
-rhcos4-e8            94m
-rhcos4-high          94m
-rhcos4-moderate      94m
-rhcos4-nerc-cip      94m
+NAME                       AGE     VERSION
+ocp4-cis                   3h49m   1.5.0
+ocp4-cis-1-4               3h49m   1.4.0
+ocp4-cis-1-5               3h49m   1.5.0
+ocp4-cis-node              3h49m   1.5.0
+ocp4-cis-node-1-4          3h49m   1.4.0
+ocp4-cis-node-1-5          3h49m   1.5.0
+ocp4-e8                    3h49m   
+ocp4-high                  3h49m   Revision 4
+ocp4-high-node             3h49m   Revision 4
+ocp4-high-node-rev-4       3h49m   Revision 4
+ocp4-high-rev-4            3h49m   Revision 4
+ocp4-moderate              3h49m   Revision 4
+ocp4-moderate-node         3h49m   Revision 4
+ocp4-moderate-node-rev-4   3h49m   Revision 4
+ocp4-moderate-rev-4        3h49m   Revision 4
+ocp4-nerc-cip              3h49m   
+ocp4-nerc-cip-node         3h49m   
+ocp4-pci-dss               3h49m   3.2.1
+ocp4-pci-dss-3-2           3h49m   3.2.1
+ocp4-pci-dss-4-0           3h49m   4.0.0
+ocp4-pci-dss-node          3h49m   3.2.1
+ocp4-pci-dss-node-3-2      3h49m   3.2.1
+ocp4-pci-dss-node-4-0      3h49m   4.0.0
+ocp4-stig                  3h49m   V2R1
+ocp4-stig-node             3h49m   V2R1
+ocp4-stig-node-v1r1        3h49m   V1R1
+ocp4-stig-node-v2r1        3h49m   V2R1
+ocp4-stig-v1r1             3h49m   V1R1
+ocp4-stig-v2r1             3h49m   V2R1
+rhcos4-e8                  3h49m   
+rhcos4-high                3h49m   Revision 4
+rhcos4-high-rev-4          3h49m   Revision 4
+rhcos4-moderate            3h49m   Revision 4
+rhcos4-moderate-rev-4      3h49m   Revision 4
+rhcos4-nerc-cip            3h49m   
+rhcos4-stig                3h49m   V2R1
+rhcos4-stig-v1r1           3h49m   V1R1
+rhcos4-stig-v2r1           3h49m   V2R1
 ----
 +
 These profiles represent different compliance benchmarks. Each profile has the product name that it applies to added as a prefix to the profile’s name. `ocp4-e8` applies the Essential 8 benchmark to the {product-title} product, while `rhcos4-e8` applies the Essential 8 benchmark to the {op-system-first} product.