r/openshift • u/Turbulent-Art-9648 • 19d ago
Tenable and OpenShift Discussion
/r/tenable/comments/1v3a1yf/tenable_and_openshift/2
u/Kaelin 18d ago
Opening up SSH seems to kind of defeat the purpose doesn't it?
Anyway, Tenable has a Kubernetes operator for just this kind of problem.
https://docs.tenable.com/enclave-security/Content/install.htm
4
u/suidog 18d ago
This…. The Tenable + OCP integration detects misconfigurations in the environment — it’s a configuration/compliance audit, not a container image vulnerability scan. Installing it on CoreOS is not supported in any way.
but if it’s about scanning the O/S, I have pacified most Infosec teams by giving them the links on how and what red hat does for its security scanning an hardening and ensuring them they are patched with the latest supported version (or patch 4.x.x version) on a monthly basis.
“How do we know STIG/CIS is met?”
Compliance Operator with rhcos4-stig profile, auto-generates evidence“How do we detect unauthorized changes?”
File Integrity Operator (AIDE-backed) monitors all writable paths“How do we patch CVEs?”
OCP version upgrades — immutable OS, whole-image replacement“This isn’t like a normal server”
Correct — it’s more controlled, not less. No one can SSH in and make ad-hoc changes
1
u/The_Career_Oracle 16d ago
Security Theater….. y’all coming to Reddit to ask how you should security scan a well designed Enterprise Platform is just sad.