Retrieving Compliance Operator raw results¶

When proving compliance for your OpenShift Container Platform cluster, you might need to provide the scan results for auditing purposes.

Obtain Compliance Operator raw results from a persistent volume¶

You can view the results of Compliance Operator scans for auditing purposes. The Operator stores the raw results in a persistent volume in Asset Reporting Format (ARF).

Procedure

Explore the ComplianceSuite object:

$ oc get compliancesuites nist-moderate-modified \
-o json -n openshift-compliance | jq '.status.scanStatuses[].resultsStorage'

Example output

{
     "name": "ocp4-moderate",
     "namespace": "openshift-compliance"
}
{
     "name": "nist-moderate-modified-master",
     "namespace": "openshift-compliance"
}
{
     "name": "nist-moderate-modified-worker",
     "namespace": "openshift-compliance"
}

This shows the persistent volume claims where the raw results are accessible.

Verify the raw data location by using the name and namespace of one of the results:

$ oc get pvc -n openshift-compliance rhcos4-moderate-worker

Example output

NAME                    STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
rhcos4-moderate-worker   Bound  pvc-548f6cfe-164b-42fe-ba13-a07cfbc77f3a   1Gi      RWO         gp2         92m

Fetch the raw results by spawning a pod that mounts the volume and copying the results:

$ oc create -n openshift-compliance -f pod.yaml

Example pod.yaml

apiVersion: "v1"
kind: Pod
metadata:
  name: pv-extract
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: pv-extract-pod
      image: registry.access.redhat.com/ubi9/ubi
      command: ["sleep", "3000"]
      volumeMounts:
      - mountPath: "/workers-scan-results"
        name: workers-scan-vol
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]
  volumes:
    - name: workers-scan-vol
      persistentVolumeClaim:
        claimName: rhcos4-moderate-worker

After the pod is running, download the results:
```
$ oc cp pv-extract:/workers-scan-results -n openshift-compliance .
```
Warning

Spawning a pod that mounts the persistent volume will keep the claim as Bound. If the volume’s storage class in use has permissions set to ReadWriteOnce, the volume is only mountable by one pod at a time. You must delete the pod upon completion, or it will not be possible for the Operator to schedule a pod and continue storing results in this location.
After the extraction is complete, the pod can be deleted:
```
$ oc delete pod pv-extract -n openshift-compliance
```