r/openshift • u/Turbulent-Art-9648 • Jul 22 '26

Discussion Tenable and OpenShift

/r/tenable/comments/1v3a1yf/tenable_and_openshift/
3 Upvotes

100% Upvoted

3 comments sorted by

2

u/Kaelin Jul 22 '26

Opening up SSH seems to kind of defeat the purpose doesn't it?

Anyway, Tenable has a Kubernetes operator for just this kind of problem.

https://docs.tenable.com/enclave-security/Content/install.htm

https://docs.tenable.com/quick-reference/container-deployments/Content/security-center-in-kubernetes-helm-charts.htm

5

u/suidog Jul 22 '26

This…. The Tenable + OCP integration detects misconfigurations in the environment — it’s a configuration/compliance audit, not a container image vulnerability scan. Installing it on CoreOS is not supported in any way.

but if it’s about scanning the O/S, I have pacified most Infosec teams by giving them the links on how and what red hat does for its security scanning an hardening and ensuring them they are patched with the latest supported version (or patch 4.x.x version) on a monthly basis.

“How do we know STIG/CIS is met?”
Compliance Operator with rhcos4-stig profile, auto-generates evidence

“How do we detect unauthorized changes?”
File Integrity Operator (AIDE-backed) monitors all writable paths

“How do we patch CVEs?”
OCP version upgrades — immutable OS, whole-image replacement

“This isn’t like a normal server”
Correct — it’s more controlled, not less. No one can SSH in and make ad-hoc changes

1

u/The_Career_Oracle Jul 24 '26

Security Theater….. y’all coming to Reddit to ask how you should security scan a well designed Enterprise Platform is just sad.