Retrieving Compliance Operator raw results

When proving compliance for your OKD cluster, you might need to provide the scan results for auditing purposes.

Obtaining Compliance Operator raw results from a persistent volume

Procedure

The Compliance Operator generates and stores the raw results in a persistent volume. These results are in Asset Reporting Format (ARF).

  1. Explore the ComplianceSuite object:

    1. $ oc get compliancesuites nist-moderate-modified -o json \
    2.     | jq '.status.scanStatuses[].resultsStorage'
    3.     {
    4.       "name": "rhcos4-moderate-worker",
    5.       "namespace": "openshift-compliance"
    6.     }
    7.     {
    8.       "name": "rhcos4-moderate-master",
    9.       "namespace": "openshift-compliance"
    10.     }

    This shows the persistent volume claims where the raw results are accessible.

  2. Verify the raw data location by using the name and namespace of one of the results:

    1. $ oc get pvc -n openshift-compliance rhcos4-moderate-worker

    Example output

    1. NAME                     STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
    2. rhcos4-moderate-worker   Bound    pvc-548f6cfe-164b-42fe-ba13-a07cfbc77f3a   1Gi        RWO            gp2            92m

  3. Fetch the raw results by spawning a pod that mounts the volume and copying the results:

    Example pod

    1. apiVersion: "v1"
    2. kind: Pod
    3. metadata:
    4.   name: pv-extract
    5. spec:
    6.   containers:
    7.     - name: pv-extract-pod
    8.       image: registry.access.redhat.com/ubi8/ubi
    9.       command: ["sleep", "3000"]
    10.       volumeMounts:
    11.       - mountPath: "/workers-scan-results"
    12.         name: workers-scan-vol
    13.   volumes:
    14.     - name: workers-scan-vol
    15.       persistentVolumeClaim:
    16.         claimName: rhcos4-moderate-worker

  4. After the pod is running, download the results:

    1. $ oc cp pv-extract:/workers-scan-results .

    Spawning a pod that mounts the persistent volume will keep the claim as Bound. If the volume’s storage class in use has permissions set to ReadWriteOnce, the volume is only mountable by one pod at a time. You must delete the pod upon completion, or it will be possible for the Operator to schedule a pod and continue storing results in this location.

  5. After the extraction is complete, the pod can be deleted:

    1. $ oc delete pod pv-extract