mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
57 lines
2.4 KiB
Plaintext
57 lines
2.4 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/compliance_operator/co-concepts/compliance-operator-crd.adoc
|
|
|
|
:_mod-docs-content-type: CONCEPT
|
|
[id="tailored-profile-object_{context}"]
|
|
= TailoredProfile object
|
|
|
|
Use the `TailoredProfile` object to modify the default `Profile` object based on your organization requirements. You can enable or disable rules, set variable values, and provide justification for the customization. After validation, the `TailoredProfile` object creates a `ConfigMap`, which can be referenced by a `ComplianceScan` object.
|
|
|
|
[TIP]
|
|
====
|
|
You can use the `TailoredProfile` object by referencing it in a `ScanSettingBinding` object. For more information about `ScanSettingBinding`, see ScanSettingBinding object.
|
|
====
|
|
|
|
.Example `TailoredProfile` object
|
|
[source,yaml]
|
|
----
|
|
apiVersion: compliance.openshift.io/v1alpha1
|
|
kind: TailoredProfile
|
|
metadata:
|
|
name: rhcos4-with-usb
|
|
spec:
|
|
extends: rhcos4-moderate <1>
|
|
title: <title of the tailored profile>
|
|
disableRules:
|
|
- name: <name of a rule object to be disabled>
|
|
rationale: <description of why this rule is checked>
|
|
status:
|
|
id: xccdf_compliance.openshift.io_profile_rhcos4-with-usb <2>
|
|
outputRef:
|
|
name: rhcos4-with-usb-tp <3>
|
|
namespace: openshift-compliance
|
|
state: READY <4>
|
|
----
|
|
|
|
<1> This is optional. Name of the `Profile` object upon which the `TailoredProfile` is built. If no value is set, a new profile is created from the `enableRules` list.
|
|
<2> Specifies the XCCDF name of the tailored profile.
|
|
<3> Specifies the `ConfigMap` name, which can be used as the value of the `tailoringConfigMap.name` attribute of a `ComplianceScan`.
|
|
<4> Shows the state of the object such as `READY`, `PENDING`, and `FAILURE`. If the state of the object is `ERROR`, then the attribute `status.errorMessage` provides the reason for the failure.
|
|
|
|
With the `TailoredProfile` object, it is possible to create a new `Profile` object using the `TailoredProfile` construct. To create a new `Profile`, set the following configuration parameters :
|
|
|
|
* an appropriate title
|
|
* `extends` value must be empty
|
|
* scan type annotation on the `TailoredProfile` object:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
compliance.openshift.io/product-type: Platform/Node
|
|
----
|
|
+
|
|
[NOTE]
|
|
====
|
|
If you have not set the `product-type` annotation, the Compliance Operator defaults to `Platform` scan type. Adding the `-node` suffix to the name of the `TailoredProfile` object results in `node` scan type.
|
|
====
|