Red Hat OpenShift
Connect Red Hat OpenShift to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Red Hat OpenShift to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.
| Category | Cloud Infrastructure |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Red Hat OpenShift's guide | docs.redhat.com |
Connect with an API token
-
In Red Hat OpenShift:
- Create a dedicated service account:
oc create sa <service_account_name> -n <project_name>. - Create a token for it outside a pod:
oc create token <service_account_name> -n <project_name>, and copy the token. - Create a cluster role with
oc create clusterrole <name> --verb=<verb> --resource=<resource>that grants only what Safeguard reads: get on oauths and apiservers (config.openshift.io); get on configs (imageregistry.operator.openshift.io); get and list on securitycontextconstraints and clusterrolebindings. - Bind it to the service account with
oc adm policy add-cluster-role-to-user <role> system:serviceaccount:<project_name>:<service_account_name>.
Red Hat OpenShift's public documentation does not cover every step.
Source: docs.redhat.com, docs.redhat.com, docs.redhat.com, checked 2026-10-07.
The permissions Safeguard needs:
get: oauths, apiservers (config.openshift.io),get: configs (imageregistry.operator.openshift.io),get, list: securitycontextconstraints, clusterrolebindings. - Create a dedicated service account:
-
On Compliance › Connectors, open Red Hat OpenShift, click Connect, choose API token and fill in:
Field What to enter API server URL Optional. For example: https://api.cluster.acme.example:6443 Service account token Optional. Stored encrypted and never shown again. Cluster CA certificate (PEM) (optional) Paste the whole key, including the BEGIN and END lines. Or, instead: Kubeconfig (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read Red Hat OpenShift and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.3, CC6.6, CC6.8, CC7.2 | 5 |
| ISO/IEC 27001 | Automated tests | A.8.2, A.8.5, A.8.9, A.8.15 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(4), 164.312(a)(1), 164.312(b), 164.312(d) | 4 |
| PCI DSS | Automated tests | 2.2.1, 7.2.2, 10.2.1 | 5 |
| NIST CSF 2.0 | Automated tests | DE.CM-09, PR.AA-03, PR.AA-05, PR.PS-01 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks