mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
e247646f0d
engineering feedback applied peer review addressed Changed version number to 0.1.56 Updated to 0.1.57 QE feedback applied
54 lines
1.7 KiB
Plaintext
54 lines
1.7 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/compliance_operator/compliance-operator-advanced.adoc
|
|
|
|
:_content-type: PROCEDURE
|
|
[id="compliance-priorityclass_{context}"]
|
|
= Setting `PriorityClass` for `ScanSetting` scans
|
|
|
|
In large scale environments, the default `PriorityClass` object can be too low to guarantee Pods execute scans on time. For clusters that must maintain compliance or guarantee automated scanning, it is recommended to set the `PriorityClass` variable to ensure the Compliance Operator is always given priority in resource constrained situations.
|
|
|
|
.Procedure
|
|
|
|
* Set the `PriorityClass` variable:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
apiVersion: compliance.openshift.io/v1alpha1
|
|
strictNodeScan: true
|
|
metadata:
|
|
name: default
|
|
namespace: openshift-compliance
|
|
priorityClass: compliance-high-priority <1>
|
|
kind: ScanSetting
|
|
showNotApplicable: false
|
|
rawResultStorage:
|
|
nodeSelector:
|
|
node-role.kubernetes.io/master: ''
|
|
pvAccessModes:
|
|
- ReadWriteOnce
|
|
rotation: 3
|
|
size: 1Gi
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
- effect: NoExecute
|
|
key: node.kubernetes.io/not-ready
|
|
operator: Exists
|
|
tolerationSeconds: 300
|
|
- effect: NoExecute
|
|
key: node.kubernetes.io/unreachable
|
|
operator: Exists
|
|
tolerationSeconds: 300
|
|
- effect: NoSchedule
|
|
key: node.kubernetes.io/memory-pressure
|
|
operator: Exists
|
|
schedule: 0 1 * * *
|
|
roles:
|
|
- master
|
|
- worker
|
|
scanTolerations:
|
|
- operator: Exists
|
|
----
|
|
<1> If the `PriorityClass` referenced in the `ScanSetting` cannot be found, the Operator will leave the `PriorityClass` empty, issue a warning, and continue scheduling scans without a `PriorityClass`. |