:_mod-docs-content-type: ASSEMBLY
[id="compliance-operator-installation"]
= Installing the Compliance Operator
include::_attributes/common-attributes.adoc[]
:context: compliance-operator-installation

toc::[]

[role="_abstract"]
Before you can use the Compliance Operator, you must ensure it is deployed in the cluster.

[IMPORTANT]
====
All cluster nodes must have the same release version in order for this Operator to function properly.
As an example, for nodes running {op-system}, all nodes must have the same {op-system} version.
====

[IMPORTANT]
====
The Compliance Operator might report incorrect results on managed platforms, such as OpenShift Dedicated, Red{nbsp}Hat OpenShift Service on AWS Classic, and Microsoft Azure Red{nbsp}Hat OpenShift. For more information, see the Knowledgebase article on Compliance Operator reports on Managed Services.
====

[IMPORTANT]
====
Before deploying the Compliance Operator, you are required to define persistent storage in your cluster to store the raw results output. For more information, see "Persistent storage overview" and "Managing the default storage class".
====

[IMPORTANT]
====
If the `restricted` Security Context Constraints (SCC) have been modified to contain the `system:authenticated` group or has added `requiredDropCapabilities`, the Compliance Operator might not function properly due to permissions issues. You can create a custom SCC for the Compliance Operator scanner pod service account. For more information, see "Creating a custom SCC for the Compliance Operator".
====

include::modules/compliance-operator-console-installation.adoc[leveloffset=+1]

include::modules/compliance-operator-cli-installation.adoc[leveloffset=+1]

include::modules/compliance-operator-rosa-installation.adoc[leveloffset=+1]

[IMPORTANT]
====
If the `restricted` Security Context Constraints (SCC) have been modified to contain the `system:authenticated` group or has added `requiredDropCapabilities`, the Compliance Operator may not function properly due to permissions issues.

You can create a custom SCC for the Compliance Operator scanner pod service account. For more information, see "Creating a custom SCC for the Compliance Operator".
====

// only applies to 4.11+
include::modules/compliance-operator-hcp-install.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources

// 4.13+
* xref:../../../hosted_control_planes/index.adoc#hcp-overview[{hcp-capital} overview]
//
// 4.11-4.12, commenting out of 4.13-main
//* xref:../../../architecture/control-plane.adoc#hosted-control-planes-overview_control-plane[Overview of {hcp} (Technology Preview)]
* link:https://access.redhat.com/solutions/6983418[Compliance Operator reports incorrect results on Managed Services]
* xref:../../../storage/understanding-persistent-storage.adoc#persistent-storage-overview_understanding-persistent-storage[Persistent storage overview]
* xref:../../../storage/container_storage_interface/persistent-storage-csi-sc-manage.adoc#persistent-storage-csi-sc-manage[Managing the default storage class]
* xref:../../../security/compliance_operator/co-scans/compliance-operator-advanced.adoc#compliance-custom-scc_compliance-advanced[Creating a custom SCC for the Compliance Operator]
* xref:../../../disconnected/using-olm.adoc#olm-restricted-networks[Using Operator Lifecycle Manager in disconnected environments]
