Comply known issues
These are the known issues for the Comply 1.x release series.
Running scan tasks in Puppet Enterprise (PE)
Comply uses PE tasks to run compliance scans on nodes. While you can see the scan task in PE, we advise against running them from here as it can have unforeseen effects on both PE and Comply. Instead, run all CIS scans from Comply. You can view the results of the scan in both products.
Running scans on CentOS 7 with Comply 1.0.4
The CentOS 7 benchmark in Comply 1.0.4 has been updated to version 3.1.0. If
you have already installed Comply and set desired
compliance for your CentOS 7 nodes, you need to run
following command on your comply-scarpy pod to
update the benchmark version from 3.0.0 to 3.1.0:
kubectl exec --stdin --tty -n <namespace> $(kubectl get pods -n dio-comply | grep comply-scarpy | awk '{print $1}') -- /bin/scarp upgrade-assessor --assessor_version '4.6.0'This ensures Comply uses the latest CISCAT benchmark and profiles.