policy-compliance-operator.yaml

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-compliance-operator
  namespace: openshift-acm-policies
  annotations:
    policy.open-cluster-management.io/categories: Compliance
    policy.open-cluster-management.io/controls: Install
    policy.open-cluster-management.io/standards: General
spec:
  disabled: false
  remediationAction: enforce
  policy-templates:

    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-compliance-operator-install
        spec:
          remediationAction: enforce
          severity: low

          namespaceSelector:
            include: ["openshift-compliance"]

          object-templates:
            - complianceType: musthave
              objectDefinition:

                apiVersion: operators.coreos.com/v1alpha1
                kind: Subscription
                metadata:
                  labels:
                    operators.coreos.com/compliance-operator.openshift-compliance: ''
                  name: compliance-operator
                  namespace: openshift-compliance

                spec:
                  channel: stable
                  installPlanApproval: Automatic
                  name: compliance-operator
                  source: redhat-operators
                  sourceNamespace: openshift-marketplace

            - complianceType: musthave
              objectDefinition:

                apiVersion: compliance.openshift.io/v1alpha1
                kind: ScanSettingBinding
                metadata:
                  name: cis-compliance
                profiles:
                  - name: ocp4-cis-node
                    kind: Profile
                    apiGroup: compliance.openshift.io/v1alpha1
                  - name: ocp4-cis
                    kind: Profile
                    apiGroup: compliance.openshift.io/v1alpha1
                settingsRef:
                  name: default
                  kind: ScanSetting
                  apiGroup: compliance.openshift.io/v1alpha1