// Module included in the following assemblies:
//
// * security/compliance_operator/co-scans/oc-compliance-plug-in-using.adoc

:_mod-docs-content-type: PROCEDURE
[id="using-scan-setting-bindings_{context}"]
= Using ScanSettingBinding custom resources

[role="_abstract"]
When using the `ScanSetting` and `ScanSettingBinding` custom resources (CRs) that the Compliance Operator provides, it is possible to run scans for multiple profiles while using a common set of scan options, such as `schedule`, `machine roles`, `tolerations`, and so on.
 
Although that is easier than working with multiple `ComplianceSuite` or `ComplianceScan` objects, it can confuse new users.

The `oc compliance bind` subcommand helps you create a `ScanSettingBinding` CR.

.Procedure

. Run:
+
[source,terminal]
----
$ oc compliance bind [--dry-run] -N <binding name> [-S <scansetting name>] <objtype/objname> [..<objtype/objname>]
----
+
* If you omit the `-S` flag, the `default` scan setting provided by the Compliance Operator is used.
* The object type is the Kubernetes object type, which  can be `profile` or `tailoredprofile`. More than one object can be provided.
* The object name is the name of the Kubernetes resource, such as `.metadata.name`.
* Add the `--dry-run` option to display the YAML file of the objects that are created.
+
For example, given the following profiles and scan settings:
+
[source,terminal]
----
$ oc get profile.compliance -n openshift-compliance
----
+
.Example output
[source,terminal]
----
NAME                       AGE     VERSION
ocp4-cis                   3h49m   1.9.0
ocp4-cis-1-9               3h49m   1.9.0
ocp4-cis-node              3h49m   1.9.0
ocp4-cis-node-1-9          3h49m   1.9.0
ocp4-e8                    3h49m
ocp4-high                  3h49m   Revision 4
ocp4-high-node             3h49m   Revision 4
ocp4-high-node-rev-4       3h49m   Revision 4
ocp4-high-rev-4            3h49m   Revision 4
ocp4-moderate              3h49m   Revision 4
ocp4-moderate-node         3h49m   Revision 4
ocp4-moderate-node-rev-4   3h49m   Revision 4
ocp4-moderate-rev-4        3h49m   Revision 4
ocp4-nerc-cip              3h49m
ocp4-nerc-cip-node         3h49m
ocp4-pci-dss               3h49m   4.0.0
ocp4-pci-dss-3-2           3h49m   3.2.1
ocp4-pci-dss-4-0           3h49m   4.0.0
ocp4-pci-dss-node          3h49m   4.0.0
ocp4-pci-dss-node-3-2      3h49m   3.2.1
ocp4-pci-dss-node-4-0      3h49m   4.0.0
ocp4-stig                  3h49m   V2R3
ocp4-stig-node             3h49m   V2R3
ocp4-stig-node-v2r3        3h49m   V2R3
ocp4-stig-v2r3             3h49m   V2R3
rhcos4-e8                  3h49m
rhcos4-high                3h49m   Revision 4
rhcos4-high-rev-4          3h49m   Revision 4
rhcos4-moderate            3h49m   Revision 4
rhcos4-moderate-rev-4      3h49m   Revision 4
rhcos4-nerc-cip            3h49m
rhcos4-stig                3h49m   V2R3
rhcos4-stig-v2r3           3h49m   V2R3

----
+
[source,terminal]
----
$ oc get scansettings -n openshift-compliance
----
+
.Example output
[source,terminal]
----
NAME                 AGE
default              10m
default-auto-apply   10m
----

. To apply the `default` settings to the `ocp4-cis` and `ocp4-cis-node` profiles, run:
+
[source,terminal]
----
$ oc compliance bind -N my-binding profile/ocp4-cis profile/ocp4-cis-node
----
+
.Example output
[source,terminal]
----
Creating ScanSettingBinding my-binding
----
+
After the `ScanSettingBinding` CR is created, the bound profile begins scanning for both profiles with the related settings. Overall, this is the fastest way to begin scanning with the Compliance Operator.
