|
2 | 2 | apiVersion: policy.open-cluster-management.io/v1 |
3 | 3 | kind: Policy |
4 | 4 | metadata: |
5 | | - annotations: |
6 | | - policy.open-cluster-management.io/categories: CM Configuration Management |
7 | | - policy.open-cluster-management.io/controls: CM-2 Baseline Configuration |
8 | | - policy.open-cluster-management.io/standards: NIST SP 800-53 |
9 | | - ran.openshift.io/ztp-deploy-wave: "1" |
10 | | - name: copy-acm-route |
11 | | - namespace: open-cluster-management-observability |
| 5 | + annotations: |
| 6 | + policy.open-cluster-management.io/categories: CM Configuration Management |
| 7 | + policy.open-cluster-management.io/controls: CM-2 Baseline Configuration |
| 8 | + policy.open-cluster-management.io/standards: NIST SP 800-53 |
| 9 | + ran.openshift.io/ztp-deploy-wave: "1" |
| 10 | + name: obs-route-policy |
| 11 | + namespace: open-cluster-management-observability |
12 | 12 | spec: |
13 | | - remediationAction: enforce |
14 | | - disabled: false |
15 | | - policy-templates: |
16 | | - - objectDefinition: |
17 | | - apiVersion: policy.open-cluster-management.io/v1 |
18 | | - kind: ConfigurationPolicy |
19 | | - metadata: |
20 | | - name: copy-acm-route |
21 | | - spec: |
22 | | - remediationAction: enforce |
23 | | - severity: low |
24 | | - namespaceselector: |
25 | | - exclude: |
26 | | - - kube-* |
27 | | - include: |
28 | | - - '*' |
29 | | - object-templates-raw: | |
30 | | - {{- range (lookup "cluster.open-cluster-management.io/v1" "ManagedCluster" "" "").items }} |
31 | | - - metadataComplianceType: musthave |
32 | | - objectDefinition: |
33 | | - apiVersion: cluster.open-cluster-management.io/v1 |
34 | | - kind: ManagedCluster |
35 | | - metadata: |
36 | | - name: {{ .metadata.name }} |
37 | | - annotations: |
38 | | - acm-alertmanager-route: '{{ (lookup "route.openshift.io/v1" "Route" "open-cluster-management-observability" "alertmanager").spec.host }}' |
39 | | - {{- end }} |
| 13 | + remediationAction: enforce |
| 14 | + disabled: false |
| 15 | + policy-templates: |
| 16 | + - objectDefinition: |
| 17 | + apiVersion: policy.open-cluster-management.io/v1 |
| 18 | + kind: ConfigurationPolicy |
| 19 | + metadata: |
| 20 | + name: obs-route-policy |
| 21 | + spec: |
| 22 | + remediationAction: enforce |
| 23 | + severity: low |
| 24 | + namespaceSelector: |
| 25 | + exclude: |
| 26 | + - kube-* |
| 27 | + include: |
| 28 | + - '*' |
| 29 | + object-templates-raw: | |
| 30 | + {{- range (lookup "cluster.open-cluster-management.io/v1" "ManagedCluster" "" "").items }} |
| 31 | + - metadataComplianceType: musthave |
| 32 | + objectDefinition: |
| 33 | + apiVersion: cluster.open-cluster-management.io/v1 |
| 34 | + kind: ManagedCluster |
| 35 | + metadata: |
| 36 | + name: {{ .metadata.name }} |
| 37 | + annotations: |
| 38 | + acm-alertmanager-route: '{{ (lookup "route.openshift.io/v1" "Route" "open-cluster-management-observability" "alertmanager").spec.host }}' |
| 39 | + {{- end }} |
40 | 40 | --- |
41 | | -apiVersion: apps.open-cluster-management.io/v1 |
42 | | -kind: PlacementRule |
| 41 | +apiVersion: cluster.open-cluster-management.io/v1beta1 |
| 42 | +kind: Placement |
43 | 43 | metadata: |
44 | | - name: copy-acm-route-placementrules |
45 | | - namespace: open-cluster-management-observability |
| 44 | + name: obs-route-policy-placement |
| 45 | + namespace: open-cluster-management-observability |
46 | 46 | spec: |
47 | | - clusterSelector: |
48 | | - matchExpressions: |
| 47 | + predicates: |
| 48 | + - requiredClusterSelector: |
| 49 | + labelSelector: |
| 50 | + matchExpressions: |
49 | 51 | - key: local-cluster |
50 | 52 | operator: In |
51 | 53 | values: |
52 | | - - "true" |
| 54 | + - "true" |
| 55 | + tolerations: |
| 56 | + - key: cluster.open-cluster-management.io/unavailable |
| 57 | + operator: Exists |
| 58 | + - key: cluster.open-cluster-management.io/unreachable |
| 59 | + operator: Exists |
53 | 60 | --- |
54 | 61 | apiVersion: policy.open-cluster-management.io/v1 |
55 | 62 | kind: PlacementBinding |
56 | 63 | metadata: |
57 | | - name: copy-acm-route-placementbinding |
58 | | - namespace: open-cluster-management-observability |
| 64 | + name: obs-route-policy-placementbinding |
| 65 | + namespace: open-cluster-management-observability |
59 | 66 | placementRef: |
60 | | - name: copy-acm-route-placementrules |
61 | | - kind: PlacementRule |
62 | | - apiGroup: apps.open-cluster-management.io |
| 67 | + name: obs-route-policy-placement |
| 68 | + kind: Placement |
| 69 | + apiGroup: cluster.open-cluster-management.io |
63 | 70 | subjects: |
64 | | - - name: copy-acm-route |
65 | | - kind: Policy |
66 | | - apiGroup: policy.open-cluster-management.io |
| 71 | + - name: obs-route-policy |
| 72 | + kind: Policy |
| 73 | + apiGroup: policy.open-cluster-management.io |
0 commit comments