Hardening Scripts Collection

OpenShift clusters must meet compliance standards like CIS, E8, Moderate, and PCI-DSS. The Compliance Operator scans clusters for violations and generates remediation objects (usually MachineConfigs) to fix them. This repository automates the full workflow: installing the operator, running scans, collecting remediations, merging overlapping MachineConfigs, organizing them by topic, and generating compliance reports. A live dashboard tracks remediation progress across OCP versions.

Quick Start

# Install the operator (auto-deploys storage if needed)
./core/install-compliance-operator.sh

# Scan all profiles (E8, CIS, Moderate, PCI-DSS). Use --platform ocp|rhcos to filter.
./core/create-scan.sh

# Collect and process results
./core/collect-complianceremediations.sh
python3 core/combine-machineconfigs-by-path.py --src-dir complianceremediations --out-dir complianceremediations --no-move
./core/organize-machine-configs.sh
./core/generate-compliance-markdown.sh

# Or run everything in one command
make full-workflow

Guides

Guide	Description
Scripts Reference	All scripts with flags, examples, and usage
Make Targets	Complete list of Makefile targets
Runbook	Step-by-step procedures for onboarding new OCP versions and maintaining compliance tracking
QE Guide	Quality engineering guide for validating scan results and testing remediations
Troubleshooting	Common issues, CI failures, operator versioning
Modular Approach	Modular MachineConfig design using .d directories

Safety Notes

• MachineConfig changes trigger rolling node reboots. Nodes reboot one at a time, which can take 10-45 minutes per pool.
• Use --dry-run on combine-machineconfigs-by-path.py and organize-machine-configs.sh to preview changes before writing files.
• Always review generated YAML before applying to production clusters.

Repository Structure

core/               Main compliance workflow scripts
utilities/          Cleanup, management, and image mirroring utilities
modular/            Modular MachineConfig tools using .d directory includes
lab-tools/          BeakerLab-specific utilities (provisioning, kubeconfig)
misc/               Helpers (network policies, pull secrets, loopback devices)
scripts/            Preflight checks, validation, and analysis scripts
tests/              Python unit tests and expected-results baselines
lib/                Shared library (common.sh, compliance_utils.py)
docs/               Jekyll-based compliance dashboard (GitHub Pages)
model-context/      Modular MachineConfig design notes

Requirements

Tool	Needed for	Install
oc	All cluster operations	OpenShift CLI docs
yq	YAML processing in scripts	brew install yq / go install github.com/mikefarah/yq/v4@latest
jq	JSON processing (export, QE validation)	brew install jq
python3 + requirements.txt	Combining MachineConfigs, tests, dashboard tooling	pip install -r requirements.txt
shellcheck, shfmt	Linting (make lint)	brew install shellcheck shfmt
jekyll	Local dashboard (make serve-docs)	make install-jekyll
skopeo	Image mirroring (optional)	brew install skopeo
oscap	Offline RHCOS scans (optional)	openscap-scanner

Development

make lint              # Run all linters (Python + Bash)
make python-test       # Run pytest
make test-compliance   # Run full CI validation on local cluster
make preflight         # Check all dependencies
make serve-docs        # Serve dashboard locally

Related Projects

• Compliance Operator — The upstream operator
• Compliance Operator Dashboard — Go + React web UI for compliance management