gnelson/ocp-docs-suggestions-1k-pr huggingface dataset:
Original: The following graphic shows the architecture with the StackRox Scanner and Scanner V4 components. Installation of Scanner V4 is optional, but provides additional benefits.
[discrete]
[id="installation-differences-architecture_{context}"]
== Installation differences

When you install {product-title-short} on {ocp} by using the Operator, {product-title-short} installs a lightweight version of Scanner on every secured cluster. The lightweight Scanner enables the scanning of images in the integrated OpenShift image registry. When you install {product-title-short} on {ocp} or Kubernetes by using the Helm install method with the _default_ values, the lightweight version of Scanner is not installed. To install the lightweight Scanner on the secured cluster by using Helm, you must set the `scanner.disable=false` parameter. You cannot install the lightweight Scanner by using the `roxctl` installation method.
Revised: When you install {product-title-short} on {ocp} by using the Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry ACS integrates with when delegated scanning enabled.
Original: The following graphic shows the architecture with the StackRox Scanner and Scanner V4 components. Installation of Scanner V4 is optional, but provides additional benefits.
[discrete]
[id="installation-differences-architecture_{context}"]
== Installation differences

When you install {product-title-short} on {ocp} by using the Operator, {product-title-short} installs a lightweight version of Scanner on every secured cluster. The lightweight Scanner enables the scanning of images in the integrated OpenShift image registry. When you install {product-title-short} on {ocp} or Kubernetes by using the Helm install method with the _default_ values, the lightweight version of Scanner is not installed. To install the lightweight Scanner on the secured cluster by using Helm, you must set the `scanner.disable=false` parameter. You cannot install the lightweight Scanner by using the `roxctl` installation method.
Revised: When you install {product-title-short} on {ocp} by using the Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4 on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Original: * Scanner V4: Beginning with {product-title-short} version 4.4, a new scanner is introduced that is built on link:https://github.com/quay/claircore[ClairCore], which also powers the link:https://github.com/quay/clair[Clair] scanner. Scanner V4 supports scanning of language and OS-specific image components. You do not have to create an integration to use this scanner, but you must enable it during or after installation. For version 4.4, if you enable this scanner, you must also enable the StackRox Scanner. For more information about Scanner V4, including links to the installation documentation, see xref:../operating/examine-images-for-vulnerabilities.adoc#about-scanner-v4_examine-images-for-vulnerabilities[About {product-title-short} Scanner V4].
* StackRox Scanner: This scanner is the default scanner in {product-title-short}. It originates from a fork of the Clair v2 open source scanner.
+
[IMPORTANT]
====
Even if you have Scanner V4 enabled, at this time, the StackRox Scanner must still be enabled to provide scanning of RHCOS nodes and platform vulnerabilities such as {osp}, Kubernetes, and Istio. Support for that functionality in Scanner V4 is planned for a future release. Do not disable the StackRox Scanner.
====
Revised: * Scanner V4: This scanner is built on link:https://github.com/quay/claircore[Claircore], which also powers the link:https://github.com/quay/clair[Clair] scanner. Scanner V4 supports scanning of language and OS-specific image components. Scanner V4 is enabled by default during installation. For more information about Scanner V4, including links to the installation documentation, see xref:../operating/examine-images-for-vulnerabilities.adoc#about-scanner-v4_examine-images-for-vulnerabilities[About {product-title-short} Scanner V4].
* StackRox Scanner: This scanner originates from a fork of the Clair v2 open source scanner. If delegated scanning is configured and only the StackRox Scanner is installed on secured clusters, StackRox Scanner must also be enabled on the cluster where Central is installed or delegated scanning will not work.
Original: * Scanner V4: Beginning with {product-title-short} version 4.4, a new scanner is introduced that is built on link:https://github.com/quay/claircore[ClairCore], which also powers the link:https://github.com/quay/clair[Clair] scanner. Scanner V4 supports scanning of language and OS-specific image components. You do not have to create an integration to use this scanner, but you must enable it during or after installation. For version 4.4, if you enable this scanner, you must also enable the StackRox Scanner. For more information about Scanner V4, including links to the installation documentation, see xref:../operating/examine-images-for-vulnerabilities.adoc#about-scanner-v4_examine-images-for-vulnerabilities[About {product-title-short} Scanner V4].
* StackRox Scanner: This scanner is the default scanner in {product-title-short}. It originates from a fork of the Clair v2 open source scanner.
+
[IMPORTANT]
====
Even if you have Scanner V4 enabled, at this time, the StackRox Scanner must still be enabled to provide scanning of RHCOS nodes and platform vulnerabilities such as {osp}, Kubernetes, and Istio. Support for that functionality in Scanner V4 is planned for a future release. Do not disable the StackRox Scanner.
====
* link:https://github.com/quay/clair[Clair]: As of version 4.4, you can enable Scanner V4 in {product-title-short} to provide functionality provided by ClairCore, which also powers the Clair V4 scanner. However, you can configure Clair V4 as the scanner by configuring an integration.
* link:https://cloud.google.com/container-registry/docs/container-analysis[Google Container Analysis]
The StackRox Scanner, in conjunction with Scanner V4 (optional), is the preferred image vulnerability scanner to use with {product-title-short}.
For more information about scanning container images with the StackRox Scanner and Scanner V4, see xref:../operating/examine-images-for-vulnerabilities.adoc#scanning-images_examine-images-for-vulnerabilities[Scanning images].
Revised: Scanner V4 is the preferred image vulnerability scanner to use with {product-title-short}, because only Scanner V4 provides full functionality and features.
Original: ** *Scanner V4 Indexer*: The Scanner V4 Indexer performs image indexing, previously known as image analysis. Given an image and registry credentials, the Indexer pulls the image from the registry. It finds the base operating system, if it exists, and looks for packages. It stores and outputs an index report, which contains the findings for the given image.
Revised: ** *Scanner V4 Indexer*: The Scanner V4 Indexer performs image indexing, previously known as image analysis. Given an image and registry credentials, the Indexer pulls the image from the registry, finds the base operating system, if it exists, and looks for packages. The Indexer then stores and outputs an index report, which contains the findings for the given image.
Original: When you install {product-title-short} on {ocp} by using the Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4  on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Revised: When you install {product-title-short} on {ocp} by using the Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4 on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Original: | `scannerV4.disable`
| Use `false` to enable Scanner V4. When setting this parameter, the StackRox Scanner must also be enabled by setting `scanner.disable=false`. Until feature parity between the StackRox Scanner and Scanner V4 is reached, Scanner V4 can only be used in combination with the StackRox Scanner. Enabling Scanner V4 without also enabling the StackRox Scanner is not supported. When you set this parameter to `true` with the `helm upgrade` command, Helm removes the existing Scanner V4 deployment.
Revised: * `true`: Scanner V4 is not deployed.

* `false`: Scanner V4 is deployed.
Original: | `scannerV4.disable`
| Use `false` to enable Scanner V4. When setting this parameter, the StackRox Scanner must also be enabled by setting `scanner.disable=false`. Until feature parity between the StackRox Scanner and Scanner V4 is reached, Scanner V4 can only be used in combination with the StackRox Scanner. Enabling Scanner V4 without also enabling the StackRox Scanner is not supported. When you set this parameter to `true` with the `helm upgrade` command, Helm removes the existing Scanner V4 deployment.
Revised: * New installations: Scanner V4 is deployed.

* Upgrades: Scanner V4 is not deployed.
Original: Sources for vulnerabilities depend on the scanner that is used in your system. {product-title-short} contains two scanners: StackRox Scanner and Scanner V4. StackRox Scanner is the default scanner and is deprecated beginning with release 4.6. Scanner V4 was introduced in release 4.4 and is the recommended image scanner.
Revised: Sources for vulnerabilities depend on the scanner that is used in your system. {product-title-short} contains two scanners: StackRox Scanner and Scanner V4.
Original: * *Top NVD CVSS*: Shows the highest severity scores from the National Vulnerability Database (NVD) to enable standardized impact assessments.
+
[NOTE]
====
You can see the *Top NVD CVSS* column only if you have enabled Scanner V4.
====
* *EPSS probability*: The likelihood that the vulnerability will be exploited according to the link:https://www.first.org/epss/model[Exploit Prediction Scoring System (EPSS)]. This EPSS data provides a percentage estimate of the probability that exploitation of this vulnerability will be observed in the next 30 days. The EPSS collects data of observed exploitation activity from partners, and exploitation activity does not mean that an attempted exploitation was successful. The EPSS score should be used as a single data point _along with other information_, such as the age of the CVE, to help you prioritize the vulnerabilities to address. For more information, see link:https://access.redhat.com/articles/7106599[{product-title-short} and EPSS].
Revised: * *EPSS probability*: The likelihood that the vulnerability could be exploited according to the link:https://www.first.org/epss/model[Exploit Prediction Scoring System (EPSS)]. This EPSS data provides a percentage estimate of the probability that exploitation of this vulnerability will be observed in the next 30 days. The EPSS collects data of observed exploitation activity from partners, and exploitation activity does not mean that an attempted exploitation was successful. The EPSS score should be used as a single data point _along with other information_, such as the age of the CVE, to help you prioritize the vulnerabilities to address. For more information, see link:https://access.redhat.com/articles/7106599[{product-title-short} and EPSS]. This information is visible only when using Scanner V4.
Original: For version 4.4, {product-title-short} provides two scanners: the StackRox Scanner and Scanner V4. Both scanners can examine images in secured clusters connected in your network. Secured cluster scanning is enabled by default in {osp} environments deployed by using the Operator or when delegated scanning is used. See "Accessing delegated image scanning" for more information.
Revised: {product-title-short} provides two scanners: the StackRox Scanner and Scanner V4. Scanner V4 is enabled by default when installing {product-title-short} on images where Central is installed and on secured clusters. The StackRox Scanner is deprecated.
Original: The scanners in {product-title-short} analyze each image layer to find packages and match them against known vulnerabilities by comparing them with a vulnerability database populated from different sources. Depending on the scanner used, sources include the National Vulnerability Database (NVD), the Open Source Vulnerabilities (OSV) database, and operating system vulnerability feeds.
The {product-title-short} Scanner V4 uses the OSV database available at link:https://osv.dev/[OSV.dev] under link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0].
The StackRox Scanner originates from a fork of the Clair v2 open source scanner and is the default scanner. In version 4.4, {product-title-short} introduced Scanner V4, built on ClairCore, which provides additional image scanning features.
Revised: Scanner V4, built on Claircore, is the default scanner as of release 4.8. The StackRox Scanner, which originates from a fork of the Clair v2 open source scanner, is deprecated.
Original: When you install {product-title-short} on {ocp} by using the {product-title-short} Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4  on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Revised: When you install {product-title-short} on {ocp} by using the {product-title-short} Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4 on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Original: | Use `false` to enable Scanner V4. When setting this parameter, the StackRox Scanner must also be enabled by setting `scanner.disable=false`. Until feature parity between the StackRox Scanner and Scanner V4 is reached, Scanner V4 can only be used in combination with the StackRox Scanner. Enabling Scanner V4 without also enabling the StackRox Scanner is not supported. When you set this parameter to `true` with the `helm upgrade` command, Helm removes the existing Scanner V4 deployment.
Revised: * Upgrades from pre-4.8: Scanner V4 is not deployed.
Original: | Use `false` to enable Scanner V4. When setting this parameter, the StackRox Scanner must also be enabled by setting `scanner.disable=false`. Until feature parity between the StackRox Scanner and Scanner V4 is reached, Scanner V4 can only be used in combination with the StackRox Scanner. Enabling Scanner V4 without also enabling the StackRox Scanner is not supported. When you set this parameter to `true` with the `helm upgrade` command, Helm removes the existing Scanner V4 deployment.
Revised: If no value is specified, the following defaulting behavior occurs:
Original: Beginning with version 4.4, {product-title-short} includes two image vulnerability scanners: StackRox Scanner and Scanner V4. StackRox Scanner is planned to be removed in a future release, but is still required at this time to perform node and platform scanning. Scanner V4 is the preferred image scanner because it provides additional features over the StackRox Scanner, such as expanded language and operating system support and data from additional vulnerability sources.
Revised: It version 4.4, Scanner V4 was initially introduced in {product-title-short}, coexisting with StackRox Scanner. As of release 4.8 the old StackRox Scanner is officially deprecated and scheduled for future removal, while Scanner V4 has become the default image scanner.
Original: When you install {product-title-short} on {ocp} by using the {product-title-short} Operator, or on {ocp} or Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4 on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Revised: When you install {product-title-short} on {ocp} by using the {product-title-short} Operator, or on any supported Kubernetes by using Helm with the `secured-cluster-services` Helm chart, {product-title-short} installs Scanner V4 components on every secured cluster. This enables the scanning of images in the integrated OpenShift image registry or in any registry that {product-title-short} integrates with when delegated scanning is enabled. You can choose to not install Scanner V4 on the secured clusters and install it only on the cluster where Central is installed. See "Enabling Scanner V4" for more information.
Original: | Enables Scanner V4. The default value is `default`, which is disabled. To enable Scanner V4, set this parameter to `Enabled`.
Revised: | If this setting is not specified, Scanner V4 is enabled for new installations, by default. For updates from an earlier release, it will not be enabled in the upgrade by default, if Scanner V4 was not previously enabled. Disabling Scanner V4 negatively impacts the ability of {product-title-scan} to provide thorough and accurate scanning results.
Original: With {product-title}, you can analyze images for vulnerabilities using the {product-title-short} scanners, or you can xref:../integration/integrate-with-image-vulnerability-scanners.adoc#integrate-with-image-vulnerability-scanners[configure an integration] to use another supported scanner.
The scanners in {product-title-short} analyze each image layer to find packages and match them against known vulnerabilities by comparing them with a vulnerability database populated from different sources. Depending on the scanner used, sources include the National Vulnerability Database (NVD), the Open Source Vulnerabilities (OSV) database, and operating system vulnerability feeds.
The {product-title-short} Scanner V4 uses the OSV database available at link:https://osv.dev/[OSV.dev] under link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0].
{product-title-short} contains two scanners: the StackRox Scanner and Scanner V4.
Revised: {product-title-short} contains two scanners: Scanner V4 and StackRox Scanner.
Original: * Access to the cluster as a user with the cluster-admin role.

* The {gcp-short} Filestore CSI Driver Operator and {gcp-short} Filestore CSI driver installed.
Revised: * You have access to the cluster as a user with the cluster-admin role.

* You have installed the {gcp-short} Filestore CSI Driver Operator and {gcp-short} Filestore CSI driver.
Original: <1> *NFS export options parameter*: `nfs-export-options-on-create` has to start with '[ and end with }]', otherwise YAML cannot parse it. Also, parameters must be in ​​quotations marks, otherwise a parsing error occurs during persistent volume claim (PVC) creation.
Revised: <1> *NFS export options parameter*: `nfs-export-options-on-create` must start with `'[ and end with }]'`, otherwise YAML cannot parse it. Also, parameters must be in ​​quotations marks, otherwise a parsing error occurs during persistent volume claim (PVC) creation.
Original: <4> *IP ranges*: List of either an IPv4 addresses in the format {octet1}.{octet2}.{octet3}.{octet4}, or CIDR ranges in the format {octet1}.{octet2}.{octet3}.{octet4}/{mask size}, which can mount the file share. Overlapping IP ranges are not allowed, both within and across NfsExportOptions. An error is returned. The limit is 64 IP ranges or addresses for each `FileShareConfig` among all NFS export options.
Revised: <4> *IP ranges*: List of either an IPv4 addresses in the format `{octet1}.{octet2}.{octet3}.{octet4}`, or CIDR ranges in the format `{octet1}.{octet2}.{octet3}.{octet4}/{mask size}`, which can mount the file share. Overlapping IP ranges are not allowed, both within and across `NfsExportOptions`, otherwise an error is returned. The limit is 64 IP ranges or addresses for each `FileShareConfig` among all NFS export options.
Original: * For {ocp-product-title} 4.17 and later, the {ols-short} icon disappears When you click *Create Namespace* or *Create Project* from one of the following locations in the {ocp-product-title} web console:
Revised: * For {ocp-product-title} 4.17 and later, the {ols-short} icon disappears when you click *Create Namespace* or *Create Project* from one of the following locations in the {ocp-product-title} web console:
Original: * Changing the value of the `quota` parameter in the `spec.ols.quota_handlers.conf` specification of the `OLSConfig` CR file does not take effect until the currently defined quota period expires.
Revised: * Changing the value of the `quota` parameter in the `spec.ols.quota_handlers.conf` specification of the `OLSConfig` custom resource file does not take effect until the currently defined quota period expires.
Original: * When configuring a downward metrics device on an {ibm-z-name} system using a VM preference, the `spec.preference.name` value must be set to `rhel.9.s390x` or another available preference with the format `*.s390x`.
Revised: When configuring a downward-metrics device on an {ibm-z-name} system that uses a VM preference, set the `spec.preference.name` value to `rhel.9.s390x` or another available `<rhel_version>.s390x` preference.
Original: * Before this update, when you used `skopeo` or a similar tool to inspect the {pipelines-title} Operator bundle, an incorrect name, `serverless-operator`, was displayed. With this update, the issue is resolved and the correct name, `openshift-pipelines-operator-rh`, is displayed.
Revised: * Before this update, adding a label to a pull request could unintentionally trigger a PipelineRun. With this fix, adding a label to a pull request only initiates a `PipelineRun` that is specifically configured to be triggered by the addition of that particular label.
Original: * Before this update, when you used `skopeo` or a similar tool to inspect the {pipelines-title} Operator bundle, an incorrect name, `serverless-operator`, was displayed. With this update, the issue is resolved and the correct name, `openshift-pipelines-operator-rh`, is displayed.
Revised: * Before this update, when using {pac}, adding a label to a pull request could unintentionally trigger a `PipelineRun`. With this fix, adding a label to a pull request only initiates a `PipelineRun` that is specifically configured to be triggered by the addition of that particular label.