The Compliance Operator is an open-source operator for Red Hat OpenShift that runs compliance scans on Kubernetes clusters and can apply remediations for the findings it reports. It uses OpenSCAP to scan against security benchmarks and baselines. The software runs inside the customer's own OpenShift cluster. Red Hat documents the operator in the security and compliance guide of OpenShift Container Platform, and the code is published on GitHub under the Apache-2.0 licence.
The operator is a component of OpenShift. Red Hat, Inc. is headquartered in Raleigh, North Carolina, and its parent company is IBM. Because the software runs on infrastructure the organisation controls, scan results and cluster data are stored within that environment. The Apache-2.0 licence allows the code to be reviewed and reused. What remains for a European organisation is support and the update path, which follow the OpenShift subscription and its US-based vendor.