Generalizing Policy-as-Code for Compliance Posture Management on Multi-Cloud Infrastructure
summary
Describes adding support for HyperShift hosted control planes to Compliance Operator by generalizing ComplianceAsCode rules: policies now use namespace placeholders and per-control-plane runtime parameters so one operator on the management cluster can scan many control planes that are hosted elsewhere. Facts come from kube API and host files, checks run with OpenSCAP/XCCDF, results expose Prometheus metrics and custom resources, and automated remediations run via manifests or Ansible — enabling consistent, multi-cluster compliance posture across managed HyperShift clusters.
AI-written summary · about
chapters (4)
- 0:00Start
- 13:38ComplianceAsCode: sets of check rules and remediation scripts
- 15:04Architecture: Compliance Operator with ComplianceAsCode
- 15:49Compliance Operator for HyperShift managed clusters
related talks
32mShift-Left Compliance
32mCompliance As Code: Shift-Left and Shift-Right Approaches in a Cloud World
31mAccess Policies for Hybrid Cloud Environments
43mPolicy-as-code for Any Cloud to Any Edge Automation
32mCloud Native Policy as Code: Principles and Best Practices
31mA Comprehensive Approach to Cloud Security Posture Management
30mHow to implement compliance at scale with the Three Lines of Defense model
33mCompliance as Code - Lessons Learned From Regulated Organizations