---
title: Installing the Compliance Operator
---

# Installing the Compliance Operator {#compliance-operator-installation}

Before you can use the Compliance Operator, you must ensure it is deployed in the cluster.

> [!IMPORTANT]
> All cluster nodes must have the same release version in order for this Operator to function properly. As an example, for nodes running RHCOS, all nodes must have the same RHCOS version.

> [!IMPORTANT]
> The Compliance Operator might report incorrect results on managed platforms, such as OpenShift Dedicated, Red Hat OpenShift Service on AWS Classic, and Microsoft Azure Red Hat OpenShift. For more information, see the Knowledgebase article on Compliance Operator reports on Managed Services.

> [!IMPORTANT]
> Before deploying the Compliance Operator, you are required to define persistent storage in your cluster to store the raw results output. For more information, see "Persistent storage overview" and "Managing the default storage class".

> [!IMPORTANT]
> If the `restricted` Security Context Constraints (SCC) have been modified to contain the `system:authenticated` group or has added `requiredDropCapabilities`, the Compliance Operator might not function properly due to permissions issues. You can create a custom SCC for the Compliance Operator scanner pod service account. For more information, see Additional resources.

## Installing the Compliance Operator through the web console {#installing-compliance-operator-web-console_compliance-operator-installation}

You can install the Compliance Operator through the OpenShift Container Platform web console by using the OperatorHub interface.

**Prerequisites**

- You must have `admin` privileges.
- You must have a `StorageClass` resource configured.

**Procedure**

1. In the OpenShift Container Platform web console, navigate to **Ecosystem** → **Software Catalog**.
2. Search for the Compliance Operator, then click **Install**.
3. Keep the default selection of **Installation mode** and **namespace** to ensure that the Operator will be installed to the `openshift-compliance` namespace.
4. Click **Install**.

**Verification**

To confirm that the installation is successful:

1. Navigate to the **Ecosystem** → **Installed Operators** page.
2. Check that the Compliance Operator is installed in the `openshift-compliance` namespace and its status is `Succeeded`.

If the Operator is not installed successfully:

1. Navigate to the **Ecosystem** → **Installed Operators** page and inspect the `Status` column for any errors or failures.
2. Navigate to the **Workloads** → **Pods** page and check the logs in any pods in the `openshift-compliance` project that are reporting issues.

## Installing the Compliance Operator using the CLI {#installing-compliance-operator-cli_compliance-operator-installation}

You can install the Compliance Operator by using the OpenShift CLI by creating the required namespace, Operator group, and subscription objects.

**Prerequisites**

- You must have `admin` privileges.
- You must have a `StorageClass` resource configured.

**Procedure**

1. Define a `Namespace` object:

   ```yaml {title="Example namespace-object.yaml"}
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
       pod-security.kubernetes.io/enforce: privileged
     name: openshift-compliance
   ```

   where:

   `metadata.labels.pod-security.kubernetes.io/enforce`
   :   Specifies the pod security label that must be set to `privileged` at the namespace level in OpenShift Container Platform 4.22.
2. Create the `Namespace` object:

   ```terminal
   $ oc create -f namespace-object.yaml
   ```
3. Define an `OperatorGroup` object:

   ```yaml {title="Example operator-group-object.yaml"}
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: compliance-operator
     namespace: openshift-compliance
   spec:
     targetNamespaces:
     - openshift-compliance
   ```
4. Create the `OperatorGroup` object:

   ```terminal
   $ oc create -f operator-group-object.yaml
   ```
5. Define a `Subscription` object:

   ```yaml {title="Example subscription-object.yaml"}
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: compliance-operator-sub
     namespace: openshift-compliance
   spec:
     channel: "stable"
     installPlanApproval: Automatic
     name: compliance-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   ```
6. Create the `Subscription` object:

   ```terminal
   $ oc create -f subscription-object.yaml
   ```

   > [!NOTE]
   > If you are setting the global scheduler feature and enable `defaultNodeSelector`, you must create the namespace manually and update the annotations of the `openshift-compliance` namespace, or the namespace where the Compliance Operator was installed, with `openshift.io/node-selector: “”`. This removes the default node selector and prevents deployment failures.

**Verification**

1. Verify the installation succeeded by inspecting the CSV file:

   ```terminal
   $ oc get csv -n openshift-compliance
   ```
2. Verify that the Compliance Operator is up and running:

   ```terminal
   $ oc get deploy -n openshift-compliance
   ```

## Installing the Compliance Operator on ROSA hosted control planes (HCP) {#installing-compliance-operator-rosa_compliance-operator-installation}

You can install the Compliance Operator on Red Hat OpenShift Service on AWS by using the OpenShift CLI by creating the required namespace, Operator group, and subscription objects.

As of the Compliance Operator 1.5.0 release, the Operator is tested against Red Hat OpenShift Service on AWS using Hosted control planes.

Red Hat OpenShift Service on AWS Hosted control planes clusters have restricted access to the control plane, which is managed by Red Hat. By default, the Compliance Operator will schedule to nodes within the `master` node pool, which is not available in Red Hat OpenShift Service on AWS Hosted control planes installations. This requires you to configure the `Subscription` object in a way that allows the Operator to schedule on available node pools. This step is necessary for a successful installation on Red Hat OpenShift Service on AWS Hosted control planes clusters.

**Prerequisites**

- You must have `admin` privileges.
- You must have a `StorageClass` resource configured.

**Procedure**

1. Define a `Namespace` object:

   ```yaml {title="Example namespace-object.yaml file"}
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
       pod-security.kubernetes.io/enforce: privileged
     name: openshift-compliance
   ```

   where:

   `metadata.labels.pod-security.kubernetes.io/enforce`
   :   Specifies the pod security label that must be set to `privileged` at the namespace level in OpenShift Container Platform 4.22.
2. Create the `Namespace` object by running the following command:

   ```terminal
   $ oc create -f namespace-object.yaml
   ```
3. Define an `OperatorGroup` object:

   ```yaml {title="Example operator-group-object.yaml file"}
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: compliance-operator
     namespace: openshift-compliance
   spec:
     targetNamespaces:
     - openshift-compliance
   ```
4. Create the `OperatorGroup` object by running the following command:

   ```terminal
   $ oc create -f operator-group-object.yaml
   ```
5. Define a `Subscription` object:

   ```yaml {title="Example subscription-object.yaml file"}
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: compliance-operator-sub
     namespace: openshift-compliance
   spec:
     channel: "stable"
     installPlanApproval: Automatic
     name: compliance-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       nodeSelector:
         node-role.kubernetes.io/worker: ""
   ```

   - Update the Operator deployment to deploy on `worker` nodes.
6. Create the `Subscription` object by running the following command:

   ```terminal
   $ oc create -f subscription-object.yaml
   ```

**Verification**

1. Verify that the installation succeeded by running the following command to inspect the cluster service version (CSV) file:

   ```terminal
   $ oc get csv -n openshift-compliance
   ```
2. Verify that the Compliance Operator is up and running by using the following command:

   ```terminal
   $ oc get deploy -n openshift-compliance
   ```

## Installing the Compliance Operator on hosted control planes {#installing-compliance-operator-hcp_compliance-operator-installation}

Install the Compliance Operator on hosted control planes by creating a `Subscription` file in the software catalog so you can run compliance scans in a hosted control plane environment.

> [!IMPORTANT]
> Hosted control planes is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
>
> For more information about the support scope of Red Hat Technology Preview features, see [Technology Preview Features Support Scope](https://access.redhat.com/support/offerings/techpreview/).

**Prerequisites**

- You must have `admin` privileges.

**Procedure**

1. Define a `Namespace` object similar to the following:

   ```yaml {title="Example namespace-object.yaml"}
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
       pod-security.kubernetes.io/enforce: privileged
     name: openshift-compliance
   ```

   - In OpenShift Container Platform 4.22, the pod security label must be set to `privileged` at the namespace level.
2. Create the `Namespace` object by running the following command:

   ```terminal
   $ oc create -f namespace-object.yaml
   ```
3. Define an `OperatorGroup` object:

   ```yaml {title="Example operator-group-object.yaml"}
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: compliance-operator
     namespace: openshift-compliance
   spec:
     targetNamespaces:
     - openshift-compliance
   ```
4. Create the `OperatorGroup` object by running the following command:

   ```terminal
   $ oc create -f operator-group-object.yaml
   ```
5. Define a `Subscription` object:

   ```yaml {title="Example subscription-object.yaml"}
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: compliance-operator-sub
     namespace: openshift-compliance
   spec:
     channel: "stable"
     installPlanApproval: Automatic
     name: compliance-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       nodeSelector:
         node-role.kubernetes.io/worker: ""
       env:
       - name: PLATFORM
         value: "HyperShift"
   ```
6. Create the `Subscription` object by running the following command:

   ```terminal
   $ oc create -f subscription-object.yaml
   ```

**Verification**

1. Verify the installation succeeded by inspecting the CSV file by running the following command:

   ```terminal
   $ oc get csv -n openshift-compliance
   ```
2. Verify that the Compliance Operator is up and running by running the following command:

   ```terminal
   $ oc get deploy -n openshift-compliance
   ```

**Additional resources**
{._additional-resources}

- [Compliance Operator reports incorrect results on Managed Services](https://access.redhat.com/solutions/6983418)
- [Persistent storage overview](/openshift-docs-markdown/storage/understanding-persistent-storage#persistent-storage-overview_understanding-persistent-storage)
- [Managing the default storage class](/openshift-docs-markdown/storage/container_storage_interface/persistent-storage-csi-sc-manage#persistent-storage-csi-sc-manage)
- [Creating a custom SCC for the Compliance Operator](/openshift-docs-markdown/security/compliance_operator/co-scans/compliance-operator-advanced#compliance-custom-scc_compliance-advanced)
- [Using Operator Lifecycle Manager in disconnected environments](/openshift-docs-markdown/disconnected/using-olm#olm-restricted-networks)