diff --git a/calico-enterprise/_includes/content/_default-install.mdx b/calico-enterprise/_includes/content/_default-install.mdx index e458061512..31e77d6a3f 100644 --- a/calico-enterprise/_includes/content/_default-install.mdx +++ b/calico-enterprise/_includes/content/_default-install.mdx @@ -6,5 +6,4 @@ | User interface | the $[prodname] web console user interface (with a default of “no access outside the cluster”). | | Logs and data | All nodes configured for log data collection using fluentdLog storage for a single node.
One instance of Elasticsearch and Kibana. | | Threat prevention and detection | Components and dashboards for tracing and blocking suspicious activity. | -| Compliance reporting | Components and dashboards to assess Kubernetes workloads and environments for regulatory compliance to enforce controls, and generate audit and evidence data. | | Scaling | Built-in node scaling using Typha. | diff --git a/calico-enterprise/getting-started/install-on-clusters/kubernetes/helm.mdx b/calico-enterprise/getting-started/install-on-clusters/kubernetes/helm.mdx index 77e666fbf0..dae22733ce 100644 --- a/calico-enterprise/getting-started/install-on-clusters/kubernetes/helm.mdx +++ b/calico-enterprise/getting-started/install-on-clusters/kubernetes/helm.mdx @@ -80,7 +80,7 @@ To install a standard $[prodname] cluster with Helm: 1. [Configure a storage class for Calico Enterprise](../../../operations/logstorage/create-storage). -1. Optional: Compliance and packetcapture features are optional. To enable these features, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install. +1. Optional: Packet capture is an optional feature. To enable it, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install. {'$[version]' === 'master' diff --git a/calico-enterprise/getting-started/install-on-clusters/kubernetes/options-install.mdx b/calico-enterprise/getting-started/install-on-clusters/kubernetes/options-install.mdx index ad753eecd2..5998010b43 100644 --- a/calico-enterprise/getting-started/install-on-clusters/kubernetes/options-install.mdx +++ b/calico-enterprise/getting-started/install-on-clusters/kubernetes/options-install.mdx @@ -34,7 +34,6 @@ Each API in the operator.tigera.io API group configures the installation of a di | **Manager** | Installs the $[prodname] web console. | | **ManagementClusterConnection** | Configures a connection to the management cluster for managed clusters. | | **TigeraStatus** | Displays conditions for a component (available, progressing, or degraded). | -| **Compliance** | Configures the $[prodname] compliance reporting feature (Optional). For managed clusters, ensure compliance reporting is enabled first on the management cluster. | | **PacketCaptureAPI** | Configures the $[prodname] packet capture feature (Optional). | ### Additional configuration diff --git a/calico-enterprise/getting-started/install-on-clusters/kubernetes/quickstart.mdx b/calico-enterprise/getting-started/install-on-clusters/kubernetes/quickstart.mdx index 6d09e80dc7..fcd5931fc4 100644 --- a/calico-enterprise/getting-started/install-on-clusters/kubernetes/quickstart.mdx +++ b/calico-enterprise/getting-started/install-on-clusters/kubernetes/quickstart.mdx @@ -116,7 +116,7 @@ A Linux host that meets the following requirements. --from-file=.dockerconfigjson= ``` -1. Optional: Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation. +1. Optional: Packet capture is an optional feature. To enable it during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation. ```bash curl -O -L $[filesUrl]/manifests/custom-resources.yaml diff --git a/calico-enterprise/getting-started/install-on-clusters/windows-calico/limitations.mdx b/calico-enterprise/getting-started/install-on-clusters/windows-calico/limitations.mdx index 3926708df7..831dc209e5 100644 --- a/calico-enterprise/getting-started/install-on-clusters/windows-calico/limitations.mdx +++ b/calico-enterprise/getting-started/install-on-clusters/windows-calico/limitations.mdx @@ -14,7 +14,7 @@ description: Known limitations of Calico Enterprise for Windows that you should | Policy | - Staged network-policy
- Firewall integrations
- Policy for hosts (host endpoints, including automatic host endpoints)
- Tiered policy: TKG, GKE, AKS
- WAF integration
- AWS firewall integration
- Fortinet integration | | Visibility and troubleshooting | - Packet capture
- DNS logs
- iptable logs
- L7 logs | | Multi-cluster management | - Multi-cluster management federated identity endpoints and services
- Federated endpoint identity and services | -| Compliance and security | - CIS benchmark and other reports
- WireGuard encryption for pod-to-pod traffic and host-to-host traffic | +| Security | - WireGuard encryption for pod-to-pod traffic and host-to-host traffic | | Data plane | - eBPF is a Linux-based feature | ## $[prodname] BGP networking limitations diff --git a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 609ddc2f61..4380f070bb 100644 --- a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -126,21 +126,18 @@ These steps differ based on your cluster type. If you are unsure of your cluster } -1. Optional: Compliance and packetcapture features are optional. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`. +1. Optional: Packet capture is an optional feature. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`. - If your `values.yaml` configuration does not include `compliance` or `packetCaptureAPI`, add them to the configuration and set to `enabled: true` + If your `values.yaml` configuration does not include `packetCaptureAPI`, add it to the configuration and set to `enabled: true` ``` packetCaptureAPI: enabled: true - - compliance: - enabled:true ``` or - If you are using default `values.yaml`, copy the custom `values.yaml` and update compliance and packetCaptureAPI's `enabled` to `true`. Then, replace `` in the next step with this modified `values.yaml` for the Helm upgrade. + If you are using default `values.yaml`, copy the custom `values.yaml` and update packetCaptureAPI's `enabled` to `true`. Then, replace `` in the next step with this modified `values.yaml` for the Helm upgrade. {'$[version]' === 'master' diff --git a/calico-enterprise/installation/install-calico-enterprise-mke-4k.mdx b/calico-enterprise/installation/install-calico-enterprise-mke-4k.mdx index 61e893d3a1..1084f8912d 100644 --- a/calico-enterprise/installation/install-calico-enterprise-mke-4k.mdx +++ b/calico-enterprise/installation/install-calico-enterprise-mke-4k.mdx @@ -106,8 +106,8 @@ In a new terminal, install the $[prodname] CNI. 1. Optional: If your cluster architecture requires any custom Calico Enterprise resources to function at startup, install them now using calicoctl. -1. Optional: Compliance and packet capture features are optional. - To enable these features during installation, download and review the `custom-resources.yaml` file. +1. Optional: Packet capture is an optional feature. + To enable it during installation, download and review the `custom-resources.yaml` file. Uncomment the necessary CRs and use this `custom-resources.yaml` for installation. ```bash diff --git a/calico-enterprise/observability/elastic/audit-overview.mdx b/calico-enterprise/observability/elastic/audit-overview.mdx index bb30451565..4d90b51f1c 100644 --- a/calico-enterprise/observability/elastic/audit-overview.mdx +++ b/calico-enterprise/observability/elastic/audit-overview.mdx @@ -34,12 +34,8 @@ Audit logs are also visible in the Kibana dashboard (indexed by, `tigera_secure_ ![kibana-auditlogs](/img/calico-enterprise/kibana-auditlogs.png) -Finally, audit logs provide the core data for compliance reports. - -![compliance-reports](/img/calico-enterprise/configuration-compliance.png) - ## Required next step -**Kubernetes resources** are also used in compliance reports and other audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, some compliance reports will not work, and audit trails will not provide a complete view to your security team. +**Kubernetes resources** are also used in audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, audit trails will not provide a complete view to your security team. - [Enable Kubernetes audit logs](../kube-audit.mdx) diff --git a/calico-enterprise/observability/elastic/overview.mdx b/calico-enterprise/observability/elastic/overview.mdx index 2959a397b3..6be6d38078 100644 --- a/calico-enterprise/observability/elastic/overview.mdx +++ b/calico-enterprise/observability/elastic/overview.mdx @@ -77,22 +77,6 @@ resourceNames: ['flows', 'dns'] verbs: ['get'] ``` -### Logs for compliance reporting - -$[prodname] compliance reports are based on archived **flow logs** and **audit logs** for these resources: - -- Pods -- Host endpoints -- Service accounts -- Namespaces -- Kubernetes service endpoints -- Global network sets -- $[prodname] and Kubernetes network policies -- Global network policies -- Network sets - -$[prodname] also supports archiving [CloudWatch for EKS audit logs](../../reference/installation/api.mdx#logcollectorspec). - ## Additional resources - [Log storage recommendations](../../operations/logstorage/log-storage-recommendations.mdx) diff --git a/calico-enterprise/observability/kube-audit.mdx b/calico-enterprise/observability/kube-audit.mdx index d960f5d801..f56b08b941 100644 --- a/calico-enterprise/observability/kube-audit.mdx +++ b/calico-enterprise/observability/kube-audit.mdx @@ -15,7 +15,7 @@ Enable Kubernetes audit logs so security teams and auditors can see all the chan ### About Kubernetes audit logs -**Kubernetes resources** are used in $[prodname] compliance reports and other audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, some compliance reports will not work, and audit trails will not provide a complete view to your security team. +**Kubernetes resources** are used in $[prodname] audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, audit trails will not provide a complete view to your security team. You must enable the following Kubernetes resources for each cluster: @@ -27,7 +27,7 @@ You must enable the following Kubernetes resources for each cluster: ### Audit logs in the web console -Like $[prodname] audit logs, Kubernetes audit logs are displayed in the web console in the Timeline dashboard, Kibana dashboard (indexed by, `tigera_secure_ee_audit_kube`), and provide the core data for compliance reports. +Like $[prodname] audit logs, Kubernetes audit logs are displayed in the web console in the Timeline dashboard and Kibana dashboard (indexed by, `tigera_secure_ee_audit_kube`). ## Before you begin @@ -162,7 +162,7 @@ Amazon EKS writes Kubernetes audit logs to [Amazon CloudWatch logs](https://aws. /> 1. Make note of the region where the cluster is hosted (for example, `us-west-2`) for a later step. -### Create a restricted AWS user for compliance reporting +### Create a restricted AWS user for audit log access 1. Go to the **AWS IAM console** and add a user. 1. On the **Add user** page, make these changes: diff --git a/calico-enterprise/operations/license-options.mdx b/calico-enterprise/operations/license-options.mdx index 45fd4155ef..30579f20d1 100644 --- a/calico-enterprise/operations/license-options.mdx +++ b/calico-enterprise/operations/license-options.mdx @@ -33,7 +33,7 @@ Data plane traffic continues to flow without interruption — policy enforcement | $[prodname] resources | Read-only. The Tigera API server rejects create and update requests; get, list, and delete on existing resources still succeed. Calico Open Source resources are not affected. | | Flow, DNS, and audit logs | Stopped. Fluentd is scaled down and logs are no longer forwarded to Elasticsearch. | | Prometheus metrics for $[prodname] components | Stopped. The Operator removes the $[prodname] ServiceMonitor so metrics are no longer scraped. | -| Web console | Service Graph, Kibana, Alerts, and Compliance remain visible in read-only mode; attempts to create or modify resources are not saved. | +| Web console | Service Graph, Kibana, and Alerts remain visible in read-only mode; attempts to create or modify resources are not saved. | We recommend that you proactively manage your license to avoid disruption to observability and management workflows. diff --git a/calico-enterprise/operations/logstorage/create-storage.mdx b/calico-enterprise/operations/logstorage/create-storage.mdx index 096058c573..fa7f31ead4 100644 --- a/calico-enterprise/operations/logstorage/create-storage.mdx +++ b/calico-enterprise/operations/logstorage/create-storage.mdx @@ -1,5 +1,5 @@ --- -description: Configure persistent storage in Calico Enterprise for flow logs, DNS logs, audit logs, and compliance reports before installation. +description: Configure persistent storage in Calico Enterprise for flow logs, DNS logs, and audit logs before installation. --- # Configure storage for logs and reports @@ -11,7 +11,7 @@ import TabItem from '@theme/TabItem'; ## Big picture -Before installing $[prodname], you must configure persistent storage for flow logs, DNS logs, audit logs, and compliance reports. +Before installing $[prodname], you must configure persistent storage for flow logs, DNS logs, and audit logs. ## Concepts diff --git a/calico-enterprise/reference/architecture/overview.mdx b/calico-enterprise/reference/architecture/overview.mdx index cbceb56480..4e3f3e372f 100644 --- a/calico-enterprise/reference/architecture/overview.mdx +++ b/calico-enterprise/reference/architecture/overview.mdx @@ -19,12 +19,11 @@ The following diagram shows the components that comprise a Kubernetes on-premise imageBackgroundColor='white' /> -Calico open-source components are the foundation of $[prodname]. $[prodname] provides value-added components for visibility and troubleshooting, compliance, policy lifecycle management, threat detection, and multi-cluster management. +Calico open-source components are the foundation of $[prodname]. $[prodname] provides value-added components for visibility and troubleshooting, policy lifecycle management, threat detection, and multi-cluster management. ## $[prodname] components - [calicoq](#calicoq) -- [Compliance](#compliance) - [Linseed API and ES gateway](#linseed-api-and-es-gateway) - [Intrusion detection](#intrusion-detection) - [kube-controllers](#kube-controllers) @@ -68,40 +67,6 @@ For cloud providers, $[prodname] has a separate plugin for each major cloud orch **Main task**: A command line tool for policy inspection to ensure policies are configured as intended. For example, you can determine which endpoints a selector or policy matches, or which policies apply to an endpoint. Requires a separate installation. [calicoq](../clis/calicoq/index.mdx). -### Compliance - -**Main task**: Generates compliance reports for the Kubernetes cluster. Report are based on archived flow and audit logs for $[prodname] resources, plus any audit logs you’ve configured for Kubernetes resources in the Kubernetes API server. Compliance reports provide the following high-level information: - -- Protection - - Endpoints explicitly protected using ingress or egress policy -- Policies and services - - Policies and services associated with endpoints - - Policy audit logs -- Traffic - - Allowed ingress/egress traffic to/from namespaces, and to/from the internet - -Compliance is comprised of these components: - -**compliance-snapshotter** - -Handles listing of required Kubernetes and $[prodname] configuration and pushes snapshots to Elasticsearch. Snapshots give you visibility into configuration changes, and how the cluster-wide configuration has evolved within a reporting interval. - -**compliance-reporter** - -Handles report generation. Reads configuration history from Elasticsearch and determines time evolution of cluster-wide configuration, including relationships between policies, endpoints, services and networksets. Data is then passed through a zero-trust aggregator to determine the "worst-case outliers" in the reporting interval. - -**compliance-controller** - -Reads report configuration, and manages creation, deletion, and monitoring of report generation jobs. - -**compliance-server** - -Provides the API for listing, downloading, and rendering reports, and RBAC by performing authentication and authorization through the Kubernetes API server. RBAC is determined from the users RBAC for the GlobalReportType and GlobalReport resources. - -**compliance-benchmarker** - -A daemonset that runs checks in the CIS Kubernetes Benchmark on each node so you can see if Kubernetes is securely deployed. - ### Linseed API and ES gateway The Linseed API uses mTLS to connect to clients, and provides an API to access Elasticsearch data. The ES gateway proxies requests to Elasticsearch, and provides backwards-compatibility for managed clusters that run versions before 3.17. @@ -122,7 +87,7 @@ The Linseed API uses mTLS to connect to clients, and provides an API to access E ### Manager -**Main task**: Provides network traffic visibility, centralized multi-cluster management, threat-defense troubleshooting, policy lifecycle management, and compliance using a browser-based UI for multiple roles/stakeholders. [Manager](../installation/api.mdx#manager). +**Main task**: Provides network traffic visibility, centralized multi-cluster management, threat-defense troubleshooting, and policy lifecycle management using a browser-based UI for multiple roles/stakeholders. [Manager](../installation/api.mdx#manager). ### Packet capture API diff --git a/calico-enterprise/reference/component-resources/configure-resources.mdx b/calico-enterprise/reference/component-resources/configure-resources.mdx index 7281339d8f..606294ae87 100644 --- a/calico-enterprise/reference/component-resources/configure-resources.mdx +++ b/calico-enterprise/reference/component-resources/configure-resources.mdx @@ -157,13 +157,13 @@ This command will output the configured resource requests and limits for the Cal ## Compliance custom resource -The [Compliance](../../reference/installation/api.mdx#compliance) CR provides a way to configure resources for ComplianceControllerDeployment, ComplianceSnapshotterDeployment, ComplianceBenchmarkerDaemonSet, ComplianceServerDeployment, ComplianceReporterPodTemplate. The following sections provide example configurations for this CR. +The Compliance CR provides a way to configure resources for ComplianceControllerDeployment, ComplianceSnapshotterDeployment, ComplianceBenchmarkerDaemonSet, ComplianceServerDeployment, ComplianceReporterPodTemplate. The following sections provide example configurations for this CR. Example Configurations: ### ComplianceControllerDeployment -To configure resource specification for the [ComplianceControllerDeployment](../../reference/installation/api.mdx#compliancecontrollerdeployment), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceControllerDeployment, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceControllerDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-controller","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -198,7 +198,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceSnapshotterDeployment -To configure resource specification for the [ComplianceSnapshotterDeployment](../../reference/installation/api.mdx#compliancesnapshotterdeployment), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceSnapshotterDeployment, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceSnapshotterDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-snapshotter","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -233,7 +233,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceBenchmarkerDaemonSet -To configure resource specification for the [ComplianceBenchmarkerDaemonSet](../../reference/installation/api.mdx#compliancebenchmarkerdaemonset), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceBenchmarkerDaemonSet, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceBenchmarkerDaemonSet":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-benchmarker","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -268,7 +268,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceServerDeployment -To configure resource specification for the [ComplianceServerDeployment](../../reference/installation/api.mdx#complianceserverdeployment), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceServerDeployment, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceServerDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-server","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -303,7 +303,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceReporterPodTemplate. -To configure resource specification for the [ComplianceReporterPodTemplate](../../reference/installation/api.mdx#compliancereporterpodtemplate), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceReporterPodTemplate, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceReporterPodTemplate": {"template": {"spec": {"containers":[{"name":"reporter","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}' diff --git a/calico-enterprise_versioned_docs/version-3.24-1/_includes/content/_default-install.mdx b/calico-enterprise_versioned_docs/version-3.24-1/_includes/content/_default-install.mdx index e458061512..31e77d6a3f 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/_includes/content/_default-install.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/_includes/content/_default-install.mdx @@ -6,5 +6,4 @@ | User interface | the $[prodname] web console user interface (with a default of “no access outside the cluster”). | | Logs and data | All nodes configured for log data collection using fluentdLog storage for a single node.
One instance of Elasticsearch and Kibana. | | Threat prevention and detection | Components and dashboards for tracing and blocking suspicious activity. | -| Compliance reporting | Components and dashboards to assess Kubernetes workloads and environments for regulatory compliance to enforce controls, and generate audit and evidence data. | | Scaling | Built-in node scaling using Typha. | diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/helm.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/helm.mdx index 77e666fbf0..dae22733ce 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/helm.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/helm.mdx @@ -80,7 +80,7 @@ To install a standard $[prodname] cluster with Helm: 1. [Configure a storage class for Calico Enterprise](../../../operations/logstorage/create-storage). -1. Optional: Compliance and packetcapture features are optional. To enable these features, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install. +1. Optional: Packet capture is an optional feature. To enable it, review the `values.yaml` file and set the flag to `enabled: true`. In the next step, use this modified `values.yaml` for the Helm install. {'$[version]' === 'master' diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/options-install.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/options-install.mdx index 339af14607..ff353e0b20 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/options-install.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/options-install.mdx @@ -34,7 +34,6 @@ Each API in the operator.tigera.io API group configures the installation of a di | **Manager** | Installs the $[prodname] web console. | | **ManagementClusterConnection** | Configures a connection to the management cluster for managed clusters. | | **TigeraStatus** | Displays conditions for a component (available, progressing, or degraded). | -| **Compliance** | Configures the $[prodname] compliance reporting feature (Optional). For managed clusters, ensure compliance reporting is enabled first on the management cluster. | | **PacketCaptureAPI** | Configures the $[prodname] packet capture feature (Optional). | ### Additional configuration diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/quickstart.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/quickstart.mdx index 6d09e80dc7..fcd5931fc4 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/quickstart.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/kubernetes/quickstart.mdx @@ -116,7 +116,7 @@ A Linux host that meets the following requirements. --from-file=.dockerconfigjson= ``` -1. Optional: Compliance and packet capture features are optional. To enable these features during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation. +1. Optional: Packet capture is an optional feature. To enable it during installation, download and review the custom-resources.yaml file. Uncomment the necessary CRs and use this custom-resources.yaml for installation. ```bash curl -O -L $[filesUrl]/manifests/custom-resources.yaml diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/windows-calico/limitations.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/windows-calico/limitations.mdx index 3926708df7..831dc209e5 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/windows-calico/limitations.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/install-on-clusters/windows-calico/limitations.mdx @@ -14,7 +14,7 @@ description: Known limitations of Calico Enterprise for Windows that you should | Policy | - Staged network-policy
- Firewall integrations
- Policy for hosts (host endpoints, including automatic host endpoints)
- Tiered policy: TKG, GKE, AKS
- WAF integration
- AWS firewall integration
- Fortinet integration | | Visibility and troubleshooting | - Packet capture
- DNS logs
- iptable logs
- L7 logs | | Multi-cluster management | - Multi-cluster management federated identity endpoints and services
- Federated endpoint identity and services | -| Compliance and security | - CIS benchmark and other reports
- WireGuard encryption for pod-to-pod traffic and host-to-host traffic | +| Security | - WireGuard encryption for pod-to-pod traffic and host-to-host traffic | | Data plane | - eBPF is a Linux-based feature | ## $[prodname] BGP networking limitations diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 609ddc2f61..4380f070bb 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -126,21 +126,18 @@ These steps differ based on your cluster type. If you are unsure of your cluster } -1. Optional: Compliance and packetcapture features are optional. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`. +1. Optional: Packet capture is an optional feature. To enable or maintain the enabled status, review the `values.yaml` file and set the flag to `enabled: true`. - If your `values.yaml` configuration does not include `compliance` or `packetCaptureAPI`, add them to the configuration and set to `enabled: true` + If your `values.yaml` configuration does not include `packetCaptureAPI`, add it to the configuration and set to `enabled: true` ``` packetCaptureAPI: enabled: true - - compliance: - enabled:true ``` or - If you are using default `values.yaml`, copy the custom `values.yaml` and update compliance and packetCaptureAPI's `enabled` to `true`. Then, replace `` in the next step with this modified `values.yaml` for the Helm upgrade. + If you are using default `values.yaml`, copy the custom `values.yaml` and update packetCaptureAPI's `enabled` to `true`. Then, replace `` in the next step with this modified `values.yaml` for the Helm upgrade. {'$[version]' === 'master' diff --git a/calico-enterprise_versioned_docs/version-3.24-1/installation/install-calico-enterprise-mke-4k.mdx b/calico-enterprise_versioned_docs/version-3.24-1/installation/install-calico-enterprise-mke-4k.mdx index 61e893d3a1..1084f8912d 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/installation/install-calico-enterprise-mke-4k.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/installation/install-calico-enterprise-mke-4k.mdx @@ -106,8 +106,8 @@ In a new terminal, install the $[prodname] CNI. 1. Optional: If your cluster architecture requires any custom Calico Enterprise resources to function at startup, install them now using calicoctl. -1. Optional: Compliance and packet capture features are optional. - To enable these features during installation, download and review the `custom-resources.yaml` file. +1. Optional: Packet capture is an optional feature. + To enable it during installation, download and review the `custom-resources.yaml` file. Uncomment the necessary CRs and use this `custom-resources.yaml` for installation. ```bash diff --git a/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/audit-overview.mdx b/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/audit-overview.mdx index bb30451565..4d90b51f1c 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/audit-overview.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/audit-overview.mdx @@ -34,12 +34,8 @@ Audit logs are also visible in the Kibana dashboard (indexed by, `tigera_secure_ ![kibana-auditlogs](/img/calico-enterprise/kibana-auditlogs.png) -Finally, audit logs provide the core data for compliance reports. - -![compliance-reports](/img/calico-enterprise/configuration-compliance.png) - ## Required next step -**Kubernetes resources** are also used in compliance reports and other audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, some compliance reports will not work, and audit trails will not provide a complete view to your security team. +**Kubernetes resources** are also used in audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, audit trails will not provide a complete view to your security team. - [Enable Kubernetes audit logs](../kube-audit.mdx) diff --git a/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/overview.mdx b/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/overview.mdx index 2959a397b3..6be6d38078 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/overview.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/observability/elastic/overview.mdx @@ -77,22 +77,6 @@ resourceNames: ['flows', 'dns'] verbs: ['get'] ``` -### Logs for compliance reporting - -$[prodname] compliance reports are based on archived **flow logs** and **audit logs** for these resources: - -- Pods -- Host endpoints -- Service accounts -- Namespaces -- Kubernetes service endpoints -- Global network sets -- $[prodname] and Kubernetes network policies -- Global network policies -- Network sets - -$[prodname] also supports archiving [CloudWatch for EKS audit logs](../../reference/installation/api.mdx#logcollectorspec). - ## Additional resources - [Log storage recommendations](../../operations/logstorage/log-storage-recommendations.mdx) diff --git a/calico-enterprise_versioned_docs/version-3.24-1/observability/kube-audit.mdx b/calico-enterprise_versioned_docs/version-3.24-1/observability/kube-audit.mdx index d960f5d801..f56b08b941 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/observability/kube-audit.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/observability/kube-audit.mdx @@ -15,7 +15,7 @@ Enable Kubernetes audit logs so security teams and auditors can see all the chan ### About Kubernetes audit logs -**Kubernetes resources** are used in $[prodname] compliance reports and other audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, some compliance reports will not work, and audit trails will not provide a complete view to your security team. +**Kubernetes resources** are used in $[prodname] audit-related features, but they are not enabled by default. You must enable Kubernetes resources through the Kubernetes API server. If you miss this step, audit trails will not provide a complete view to your security team. You must enable the following Kubernetes resources for each cluster: @@ -27,7 +27,7 @@ You must enable the following Kubernetes resources for each cluster: ### Audit logs in the web console -Like $[prodname] audit logs, Kubernetes audit logs are displayed in the web console in the Timeline dashboard, Kibana dashboard (indexed by, `tigera_secure_ee_audit_kube`), and provide the core data for compliance reports. +Like $[prodname] audit logs, Kubernetes audit logs are displayed in the web console in the Timeline dashboard and Kibana dashboard (indexed by, `tigera_secure_ee_audit_kube`). ## Before you begin @@ -162,7 +162,7 @@ Amazon EKS writes Kubernetes audit logs to [Amazon CloudWatch logs](https://aws. /> 1. Make note of the region where the cluster is hosted (for example, `us-west-2`) for a later step. -### Create a restricted AWS user for compliance reporting +### Create a restricted AWS user for audit log access 1. Go to the **AWS IAM console** and add a user. 1. On the **Add user** page, make these changes: diff --git a/calico-enterprise_versioned_docs/version-3.24-1/operations/license-options.mdx b/calico-enterprise_versioned_docs/version-3.24-1/operations/license-options.mdx index 45fd4155ef..30579f20d1 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/operations/license-options.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/operations/license-options.mdx @@ -33,7 +33,7 @@ Data plane traffic continues to flow without interruption — policy enforcement | $[prodname] resources | Read-only. The Tigera API server rejects create and update requests; get, list, and delete on existing resources still succeed. Calico Open Source resources are not affected. | | Flow, DNS, and audit logs | Stopped. Fluentd is scaled down and logs are no longer forwarded to Elasticsearch. | | Prometheus metrics for $[prodname] components | Stopped. The Operator removes the $[prodname] ServiceMonitor so metrics are no longer scraped. | -| Web console | Service Graph, Kibana, Alerts, and Compliance remain visible in read-only mode; attempts to create or modify resources are not saved. | +| Web console | Service Graph, Kibana, and Alerts remain visible in read-only mode; attempts to create or modify resources are not saved. | We recommend that you proactively manage your license to avoid disruption to observability and management workflows. diff --git a/calico-enterprise_versioned_docs/version-3.24-1/operations/logstorage/create-storage.mdx b/calico-enterprise_versioned_docs/version-3.24-1/operations/logstorage/create-storage.mdx index 83971f6516..8c09a70111 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/operations/logstorage/create-storage.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/operations/logstorage/create-storage.mdx @@ -1,5 +1,5 @@ --- -description: Configure persistent storage in Calico Enterprise for flow logs, DNS logs, audit logs, and compliance reports before installation. +description: Configure persistent storage in Calico Enterprise for flow logs, DNS logs, and audit logs before installation. --- # Configure storage for logs and reports @@ -11,7 +11,7 @@ import TabItem from '@theme/TabItem'; ## Big picture -Before installing $[prodname], you must configure persistent storage for flow logs, DNS logs, audit logs, and compliance reports. +Before installing $[prodname], you must configure persistent storage for flow logs, DNS logs, and audit logs. ## Concepts diff --git a/calico-enterprise_versioned_docs/version-3.24-1/reference/architecture/overview.mdx b/calico-enterprise_versioned_docs/version-3.24-1/reference/architecture/overview.mdx index cbceb56480..4e3f3e372f 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/reference/architecture/overview.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/reference/architecture/overview.mdx @@ -19,12 +19,11 @@ The following diagram shows the components that comprise a Kubernetes on-premise imageBackgroundColor='white' /> -Calico open-source components are the foundation of $[prodname]. $[prodname] provides value-added components for visibility and troubleshooting, compliance, policy lifecycle management, threat detection, and multi-cluster management. +Calico open-source components are the foundation of $[prodname]. $[prodname] provides value-added components for visibility and troubleshooting, policy lifecycle management, threat detection, and multi-cluster management. ## $[prodname] components - [calicoq](#calicoq) -- [Compliance](#compliance) - [Linseed API and ES gateway](#linseed-api-and-es-gateway) - [Intrusion detection](#intrusion-detection) - [kube-controllers](#kube-controllers) @@ -68,40 +67,6 @@ For cloud providers, $[prodname] has a separate plugin for each major cloud orch **Main task**: A command line tool for policy inspection to ensure policies are configured as intended. For example, you can determine which endpoints a selector or policy matches, or which policies apply to an endpoint. Requires a separate installation. [calicoq](../clis/calicoq/index.mdx). -### Compliance - -**Main task**: Generates compliance reports for the Kubernetes cluster. Report are based on archived flow and audit logs for $[prodname] resources, plus any audit logs you’ve configured for Kubernetes resources in the Kubernetes API server. Compliance reports provide the following high-level information: - -- Protection - - Endpoints explicitly protected using ingress or egress policy -- Policies and services - - Policies and services associated with endpoints - - Policy audit logs -- Traffic - - Allowed ingress/egress traffic to/from namespaces, and to/from the internet - -Compliance is comprised of these components: - -**compliance-snapshotter** - -Handles listing of required Kubernetes and $[prodname] configuration and pushes snapshots to Elasticsearch. Snapshots give you visibility into configuration changes, and how the cluster-wide configuration has evolved within a reporting interval. - -**compliance-reporter** - -Handles report generation. Reads configuration history from Elasticsearch and determines time evolution of cluster-wide configuration, including relationships between policies, endpoints, services and networksets. Data is then passed through a zero-trust aggregator to determine the "worst-case outliers" in the reporting interval. - -**compliance-controller** - -Reads report configuration, and manages creation, deletion, and monitoring of report generation jobs. - -**compliance-server** - -Provides the API for listing, downloading, and rendering reports, and RBAC by performing authentication and authorization through the Kubernetes API server. RBAC is determined from the users RBAC for the GlobalReportType and GlobalReport resources. - -**compliance-benchmarker** - -A daemonset that runs checks in the CIS Kubernetes Benchmark on each node so you can see if Kubernetes is securely deployed. - ### Linseed API and ES gateway The Linseed API uses mTLS to connect to clients, and provides an API to access Elasticsearch data. The ES gateway proxies requests to Elasticsearch, and provides backwards-compatibility for managed clusters that run versions before 3.17. @@ -122,7 +87,7 @@ The Linseed API uses mTLS to connect to clients, and provides an API to access E ### Manager -**Main task**: Provides network traffic visibility, centralized multi-cluster management, threat-defense troubleshooting, policy lifecycle management, and compliance using a browser-based UI for multiple roles/stakeholders. [Manager](../installation/api.mdx#manager). +**Main task**: Provides network traffic visibility, centralized multi-cluster management, threat-defense troubleshooting, and policy lifecycle management using a browser-based UI for multiple roles/stakeholders. [Manager](../installation/api.mdx#manager). ### Packet capture API diff --git a/calico-enterprise_versioned_docs/version-3.24-1/reference/component-resources/configure-resources.mdx b/calico-enterprise_versioned_docs/version-3.24-1/reference/component-resources/configure-resources.mdx index 7281339d8f..606294ae87 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/reference/component-resources/configure-resources.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/reference/component-resources/configure-resources.mdx @@ -157,13 +157,13 @@ This command will output the configured resource requests and limits for the Cal ## Compliance custom resource -The [Compliance](../../reference/installation/api.mdx#compliance) CR provides a way to configure resources for ComplianceControllerDeployment, ComplianceSnapshotterDeployment, ComplianceBenchmarkerDaemonSet, ComplianceServerDeployment, ComplianceReporterPodTemplate. The following sections provide example configurations for this CR. +The Compliance CR provides a way to configure resources for ComplianceControllerDeployment, ComplianceSnapshotterDeployment, ComplianceBenchmarkerDaemonSet, ComplianceServerDeployment, ComplianceReporterPodTemplate. The following sections provide example configurations for this CR. Example Configurations: ### ComplianceControllerDeployment -To configure resource specification for the [ComplianceControllerDeployment](../../reference/installation/api.mdx#compliancecontrollerdeployment), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceControllerDeployment, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceControllerDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-controller","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -198,7 +198,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceSnapshotterDeployment -To configure resource specification for the [ComplianceSnapshotterDeployment](../../reference/installation/api.mdx#compliancesnapshotterdeployment), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceSnapshotterDeployment, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceSnapshotterDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-snapshotter","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -233,7 +233,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceBenchmarkerDaemonSet -To configure resource specification for the [ComplianceBenchmarkerDaemonSet](../../reference/installation/api.mdx#compliancebenchmarkerdaemonset), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceBenchmarkerDaemonSet, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceBenchmarkerDaemonSet":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-benchmarker","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -268,7 +268,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceServerDeployment -To configure resource specification for the [ComplianceServerDeployment](../../reference/installation/api.mdx#complianceserverdeployment), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceServerDeployment, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceServerDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"compliance-server","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}}' @@ -303,7 +303,7 @@ This command will output the configured resource requests and limits for the Com ### ComplianceReporterPodTemplate. -To configure resource specification for the [ComplianceReporterPodTemplate](../../reference/installation/api.mdx#compliancereporterpodtemplate), patch the Compliance CR using the below command: +To configure resource specification for the ComplianceReporterPodTemplate, patch the Compliance CR using the below command: ```bash kubectl patch compliance tigera-secure --type=merge --patch='{"spec": {"complianceReporterPodTemplate": {"template": {"spec": {"containers":[{"name":"reporter","resources":{"limits":{"cpu":"1", "memory":"1000Mi"},"requests":{"cpu":"100m", "memory":"100Mi"}}}]}}}}}' diff --git a/src/utils/linkChecker.js b/src/utils/linkChecker.js index 7a08452107..e529d5d596 100644 --- a/src/utils/linkChecker.js +++ b/src/utils/linkChecker.js @@ -34,6 +34,8 @@ const defaultSkipList = [ /^https?:\/\/docs\.redhat\.com\/.*/, /^https?:\/\/access\.redhat\.com\/.*/, /^https?:\/\/docs\.mirantis\.com\/.*/, + // VMware Tanzu docs 502 the crawler (post-Broadcom migration); linked from the TKG install page. + /^https?:\/\/docs\.vmware\.com\/.*/, 'https://en.wikipedia.org/wiki/Autonomous_System_(Internet', 'https://github.com/dims/etcd3-gateway.git@5a3157a122368c2314c7a961f61722e47355f981', 'https://installer.calicocloud.io:443/', diff --git a/static/_redirects b/static/_redirects index fa993af1f1..f8618d2960 100644 --- a/static/_redirects +++ b/static/_redirects @@ -439,3 +439,10 @@ /v2.2 /v2.2/introduction/ 301 /v2.1 /v2.1/introduction/ 301 /master /calico-enterprise/next/about/about-calico-enterprise/ 301 + +# Calico Enterprise 3.24 - compliance reporting feature removed (DOCS-2992) +/calico-enterprise/3.24/compliance/overview /calico-enterprise/3.24/release-notes 301 +/calico-enterprise/3.24/compliance/enable-compliance /calico-enterprise/3.24/release-notes 301 +/calico-enterprise/3.24/compliance/compliance-reports-cis /calico-enterprise/3.24/release-notes 301 +/calico-enterprise/3.24/reference/resources/compliance-reports/* /calico-enterprise/3.24/reference/resources/ 301 +/calico-enterprise/3.24/reference/resources/globalreport /calico-enterprise/3.24/reference/resources/ 301