Skip to content

Commit 5755a36

Browse files
committed
telco-hub: policy name update
1 parent 24b05c5 commit 5755a36

File tree

2 files changed

+57
-51
lines changed

2 files changed

+57
-51
lines changed

telco-hub/configuration/reference-crs/required/acm/observabilityRoutePolicy.yaml

Lines changed: 56 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -2,65 +2,72 @@
22
apiVersion: policy.open-cluster-management.io/v1
33
kind: Policy
44
metadata:
5-
annotations:
6-
policy.open-cluster-management.io/categories: CM Configuration Management
7-
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
8-
policy.open-cluster-management.io/standards: NIST SP 800-53
9-
ran.openshift.io/ztp-deploy-wave: "1"
10-
name: copy-acm-route
11-
namespace: open-cluster-management-observability
5+
annotations:
6+
policy.open-cluster-management.io/categories: CM Configuration Management
7+
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
8+
policy.open-cluster-management.io/standards: NIST SP 800-53
9+
ran.openshift.io/ztp-deploy-wave: "1"
10+
name: obs-route-policy
11+
namespace: open-cluster-management-observability
1212
spec:
13-
remediationAction: enforce
14-
disabled: false
15-
policy-templates:
16-
- objectDefinition:
17-
apiVersion: policy.open-cluster-management.io/v1
18-
kind: ConfigurationPolicy
19-
metadata:
20-
name: copy-acm-route
21-
spec:
22-
remediationAction: enforce
23-
severity: low
24-
namespaceselector:
25-
exclude:
26-
- kube-*
27-
include:
28-
- '*'
29-
object-templates-raw: |
30-
{{- range (lookup "cluster.open-cluster-management.io/v1" "ManagedCluster" "" "").items }}
31-
- metadataComplianceType: musthave
32-
objectDefinition:
33-
apiVersion: cluster.open-cluster-management.io/v1
34-
kind: ManagedCluster
35-
metadata:
36-
name: {{ .metadata.name }}
37-
annotations:
38-
acm-alertmanager-route: '{{ (lookup "route.openshift.io/v1" "Route" "open-cluster-management-observability" "alertmanager").spec.host }}'
39-
{{- end }}
13+
remediationAction: enforce
14+
disabled: false
15+
policy-templates:
16+
- objectDefinition:
17+
apiVersion: policy.open-cluster-management.io/v1
18+
kind: ConfigurationPolicy
19+
metadata:
20+
name: obs-route-policy
21+
spec:
22+
remediationAction: enforce
23+
severity: low
24+
namespaceSelector:
25+
exclude:
26+
- kube-*
27+
include:
28+
- '*'
29+
object-templates-raw: |
30+
{{- range (lookup "cluster.open-cluster-management.io/v1" "ManagedCluster" "" "").items }}
31+
- metadataComplianceType: musthave
32+
objectDefinition:
33+
apiVersion: cluster.open-cluster-management.io/v1
34+
kind: ManagedCluster
35+
metadata:
36+
name: {{ .metadata.name }}
37+
annotations:
38+
acm-alertmanager-route: '{{ (lookup "route.openshift.io/v1" "Route" "open-cluster-management-observability" "alertmanager").spec.host }}'
39+
{{- end }}
4040
---
41-
apiVersion: apps.open-cluster-management.io/v1
42-
kind: PlacementRule
41+
apiVersion: cluster.open-cluster-management.io/v1beta1
42+
kind: Placement
4343
metadata:
44-
name: copy-acm-route-placementrules
45-
namespace: open-cluster-management-observability
44+
name: obs-route-policy-placement
45+
namespace: open-cluster-management-observability
4646
spec:
47-
clusterSelector:
48-
matchExpressions:
47+
predicates:
48+
- requiredClusterSelector:
49+
labelSelector:
50+
matchExpressions:
4951
- key: local-cluster
5052
operator: In
5153
values:
52-
- "true"
54+
- "true"
55+
tolerations:
56+
- key: cluster.open-cluster-management.io/unavailable
57+
operator: Exists
58+
- key: cluster.open-cluster-management.io/unreachable
59+
operator: Exists
5360
---
5461
apiVersion: policy.open-cluster-management.io/v1
5562
kind: PlacementBinding
5663
metadata:
57-
name: copy-acm-route-placementbinding
58-
namespace: open-cluster-management-observability
64+
name: obs-route-policy-placementbinding
65+
namespace: open-cluster-management-observability
5966
placementRef:
60-
name: copy-acm-route-placementrules
61-
kind: PlacementRule
62-
apiGroup: apps.open-cluster-management.io
67+
name: obs-route-policy-placement
68+
kind: Placement
69+
apiGroup: cluster.open-cluster-management.io
6370
subjects:
64-
- name: copy-acm-route
65-
kind: Policy
66-
apiGroup: policy.open-cluster-management.io
71+
- name: obs-route-policy
72+
kind: Policy
73+
apiGroup: policy.open-cluster-management.io

telco-hub/configuration/reference-crs/required/acm/readme.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
Thanos secret.
2828
13. Create the `observabilityMCO.yaml`.
2929
14. When all the installation is done. Apply the `acmPerfSearch.yaml` .This will configure Search CR called `search-v2-operator` considering different performance and scale optimizations.
30-
15. When ACM Observability is configured on a managed cluster through the Core or RAN profile, the default ACM Observability configuration must be merged with the RAN monitoring tuning [ReduceMonitoringFootprint.yaml](../../../../../telco-ran/configuration/source-crs/ReduceMonitoringFootprint.yaml) or Core monitoring config [monitoring-config-cm.yaml](../../../../../telco-core/configuration/reference-crs/optional/other/monitoring-config-cm.yaml) respectively. To ensure that these changes persist, ACM has to stop managing the cluster-monitoring-config ConfigMap, which is set in this annotation [here](../../../../../telco-hub/configuration/reference-crs/required/acm/observabilityMCO.yaml#L13). Additionally, when mco-alerting is disabled, the [copy-acm-route](observabilityRoutePolicy.yaml) policy is provided for propagating the alertmanager route from the hub to all managedclusters.
30+
15. When ACM Observability is configured on a managed cluster through the Core or RAN profile, the default ACM Observability configuration must be merged with the RAN monitoring tuning [ReduceMonitoringFootprint.yaml](../../../../../telco-ran/configuration/source-crs/ReduceMonitoringFootprint.yaml) or Core monitoring config [monitoring-config-cm.yaml](../../../../../telco-core/configuration/reference-crs/optional/other/monitoring-config-cm.yaml) respectively. To ensure that these changes persist, ACM has to stop managing the cluster-monitoring-config ConfigMap, which is set in this annotation [here](../../../../../telco-hub/configuration/reference-crs/required/acm/observabilityMCO.yaml#L13). Additionally, when mco-alerting is disabled, the [obs-route-policy](observabilityRoutePolicy.yaml) is provided for propagating the alertmanager route from the hub acm route to all managedclusters through an annotation.
3131

3232
Back to [Hub Cluster Setup](../../../../README.md).
33-

0 commit comments

Comments
 (0)