Create an ACM policy set for Advanced Cluster Security Secured Clusters #438

gparvin · 2023-12-08T19:23:23Z

This takes part of the OPP Policy Set and organizes a solution that only applies the ACS Secured Clusters to ACM OpenShift managed clusters.

Refs:

https://issues.redhat.com/browse/ACM-8934

mprahl · 2024-05-16T19:02:09Z

policygenerator/policy-sets/community/acs-secure/README.md

+
+## Installation
+
+The ACS PolicySet for Secured Clusters contains two `PolicySets` that will be deployed.i


Suggested change

The ACS PolicySet for Secured Clusters contains two `PolicySets` that will be deployed.i

The ACS PolicySet for Secured Clusters contains two `PolicySets` that will be deployed.

mprahl · 2024-05-16T19:02:47Z

policygenerator/policy-sets/community/acs-secure/README.md

+Prior to applying the `PolicySet`, perform these steps:
+
+1. To allow for subscriptions to be applied below you must apply and set to enforce the policy [policy-configure-subscription-admin-hub.yaml](https://github.com/open-cluster-management-io/policy-collection/blob/main/community/CM-Configuration-Management/policy-configure-subscription-admin-hub.yaml).
+2. Install the Policy generator Kustomize plugin by following the [installation instructions](https://github.com/stolostron/policy-generator-plugin#installation). It is recommended to use Kustomize v4.5+.


Suggested change

2. Install the Policy generator Kustomize plugin by following the [installation instructions](https://github.com/stolostron/policy-generator-plugin#installation). It is recommended to use Kustomize v4.5+.

2. Install the Policy generator Kustomize plugin by following the [installation instructions](https://github.com/open-cluster-management-io/policy-generator-plugin#installation). It is recommended to use Kustomize v4.5+.

mprahl · 2024-05-16T19:03:26Z

policygenerator/policy-sets/community/acs-secure/README.md

+
+Prior to applying the `PolicySet`, perform these steps:
+
+1. To allow for subscriptions to be applied below you must apply and set to enforce the policy [policy-configure-subscription-admin-hub.yaml](https://github.com/open-cluster-management-io/policy-collection/blob/main/community/CM-Configuration-Management/policy-configure-subscription-admin-hub.yaml).


This only applies if using App Sub, so maybe this is not a required step.

mprahl · 2024-05-16T19:03:37Z

policygenerator/policy-sets/community/acs-secure/README.md

+
+1. To allow for subscriptions to be applied below you must apply and set to enforce the policy [policy-configure-subscription-admin-hub.yaml](https://github.com/open-cluster-management-io/policy-collection/blob/main/community/CM-Configuration-Management/policy-configure-subscription-admin-hub.yaml).
+2. Install the Policy generator Kustomize plugin by following the [installation instructions](https://github.com/stolostron/policy-generator-plugin#installation). It is recommended to use Kustomize v4.5+.
+3. Policies are installed to the `policies` namespace.  i


Suggested change

3. Policies are installed to the `policies` namespace. i

3. Policies are installed to the `policies` namespace.

mprahl · 2024-05-16T19:04:23Z

policygenerator/policy-sets/community/acs-secure/README.md

+3. Policies are installed to the `policies` namespace.  i
+   Make sure the placement bindings match this namespace for the hub and other managed clusters.
+   Example yaml to apply a ManagedClusterSetBinding for the policies namespace.
+    ```apiVersion: cluster.open-cluster-management.io/v1beta2


Suggested change

```apiVersion: cluster.open-cluster-management.io/v1beta2

```yaml

apiVersion: cluster.open-cluster-management.io/v1beta2

mprahl · 2024-05-16T19:06:54Z

.../policy-sets/community/acs-secure/input-sensor/policy-advanced-managed-cluster-security.yaml

+  clusterName: |
+    {{ fromSecret "open-cluster-management-agent" "hub-kubeconfig-secret" "cluster-name" | base64dec }}


Suggested change

clusterName: |

{{ fromSecret "open-cluster-management-agent" "hub-kubeconfig-secret" "cluster-name" | base64dec }}

clusterName: {{hub .ManagedClusterName hub}}

mprahl · 2024-05-16T19:11:25Z

policygenerator/policy-sets/community/acs-secure/policyGenerator.yaml

+      each managed cluster.
+    name: acs-sensors-hub-info
+    placement:
+      placementPath: placement/hub-placement.yaml


I think you could now directly define the cluster selector in the Policy Generator file instead of a placement file:
https://github.com/stolostron/policy-generator-plugin/blob/3ef4ab89c4cecd0012792c9ab886d9f7e6eb3da2/docs/policygenerator-reference.yaml#L133-L142

This has the benefit of getting those default tolerations such as cluster unavailable for free in newer Policy Generator versions.

mprahl · 2024-05-16T19:12:51Z

.../policy-sets/community/acs-secure/input-sensor/policy-advanced-managed-cluster-security.yaml

+spec: {}
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription


Once ACM 2.11 is out, I recommend changing this to OperatorPolicy so that the status information is much richer.

policygenerator/policy-sets/community/acs-secure/README.md

mprahl · 2024-05-17T12:43:47Z

policygenerator/policy-sets/community/acs-secure/README.md

+
+## Prerequisites
+To install Advanced Cluster Security Secured Clusters using this PolicySet, 
+you must first have already installed your Advanced Cluster Security Central Server.


Suggested change

you must first have already installed your Advanced Cluster Security Central Server.

you must have already installed your Advanced Cluster Security Central Server.

mprahl · 2024-05-17T12:54:00Z

policygenerator/policy-sets/community/acs-secure/policyGenerator.yaml

+  manifests:
+    - path: input-sensor/acs-check-certificates.yaml
+- name: policy-advanced-managed-cluster-security
+  consolidateManifests: false


Setting this to false means the policy will have a lot of ConfigurationPolicies. I think these could all be in the same ConfigurationPolicy. Perhaps you could have one ConfigurationPolicy for managing the operator installation (to be replaced in 2.11) and the other could be managing the content in the stackrox namespace. Then you could use a policy dependency if you wanted to so that the first policy must be compliant before the second one activates.

I played around with this some yesterday and liked it set to false best. I can play around with some more re-organization too since I would like it to be a bit more streamlined.

mprahl · 2024-05-17T12:54:33Z

policygenerator/policy-sets/community/acs-secure/policyGenerator.yaml

+          - {key: name, operator: In, values: ["local-cluster"]}
+  - description: The Advanced Cluster Security components distributed to all OpenShift
+      managed clusters to secure the clusters.
+    name: acs-sensor-clusters


Is it worth having this additional policy set if it's just going to contain one policy?

I like having the PolicySet even if there is only one policy.

This takes part of the OPP Policy Set and organizes a solution that only applies the ACS Secured Clusters to ACM OpenShift managed clusters. Refs: - https://issues.redhat.com/browse/ACM-8934 Signed-off-by: Gus Parvin <[email protected]>

kylape · 2024-05-21T21:55:28Z

I tried this PR out again just now, and I can confirm that it no longer requires the other PolicySet as it did before. The instructions were easy to follow as well.

openshift-ci · 2024-05-22T20:22:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gparvin, mprahl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [gparvin,mprahl]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot added the dco-signoff: yes label Dec 8, 2023

openshift-ci bot requested review from mprahl and yiraeChristineKim December 8, 2023 19:23

openshift-ci bot added the approved label Dec 8, 2023

gparvin force-pushed the sensors-policyset branch from 598360c to b376786 Compare May 16, 2024 18:10

mprahl reviewed May 16, 2024

View reviewed changes

gparvin force-pushed the sensors-policyset branch 2 times, most recently from cbe5fd4 to f427160 Compare May 16, 2024 20:43

mprahl reviewed May 17, 2024

View reviewed changes

policygenerator/policy-sets/community/acs-secure/README.md Show resolved Hide resolved

mprahl reviewed May 17, 2024

View reviewed changes

gparvin force-pushed the sensors-policyset branch from f427160 to ede9f26 Compare May 17, 2024 12:45

mprahl reviewed May 17, 2024

View reviewed changes

gparvin force-pushed the sensors-policyset branch from ede9f26 to 179dbf7 Compare May 17, 2024 14:17

mprahl approved these changes May 22, 2024

View reviewed changes

openshift-ci bot assigned mprahl May 22, 2024

openshift-ci bot added the lgtm label May 22, 2024

openshift-merge-bot bot merged commit 88e602a into open-cluster-management-io:main May 22, 2024
3 checks passed

magic-mirror-bot bot mentioned this pull request May 22, 2024

🤖 Sync from open-cluster-management-io/policy-collection: #438 stolostron/policy-collection#69

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create an ACM policy set for Advanced Cluster Security Secured Clusters #438

Create an ACM policy set for Advanced Cluster Security Secured Clusters #438

gparvin commented Dec 8, 2023

mprahl May 16, 2024

mprahl May 16, 2024

mprahl May 16, 2024

mprahl May 16, 2024

mprahl May 16, 2024 •

edited

Loading

mprahl May 16, 2024

mprahl May 16, 2024

mprahl May 16, 2024

mprahl May 17, 2024

mprahl May 17, 2024

gparvin May 17, 2024

mprahl May 17, 2024

gparvin May 17, 2024

kylape commented May 21, 2024

openshift-ci bot commented May 22, 2024


		## Installation

		The ACS PolicySet for Secured Clusters contains two `PolicySets` that will be deployed.i

	2. Install the Policy generator Kustomize plugin by following the [installation instructions](https://github.com/stolostron/policy-generator-plugin#installation). It is recommended to use Kustomize v4.5+.
	2. Install the Policy generator Kustomize plugin by following the [installation instructions](https://github.com/open-cluster-management-io/policy-generator-plugin#installation). It is recommended to use Kustomize v4.5+.


		Prior to applying the `PolicySet`, perform these steps:

		1. To allow for subscriptions to be applied below you must apply and set to enforce the policy [policy-configure-subscription-admin-hub.yaml](https://github.com/open-cluster-management-io/policy-collection/blob/main/community/CM-Configuration-Management/policy-configure-subscription-admin-hub.yaml).

	3. Policies are installed to the `policies` namespace. i
	3. Policies are installed to the `policies` namespace.

		clusterName: \|
		{{ fromSecret "open-cluster-management-agent" "hub-kubeconfig-secret" "cluster-name" \| base64dec }}

	clusterName: \|
	{{ fromSecret "open-cluster-management-agent" "hub-kubeconfig-secret" "cluster-name" \| base64dec }}
	clusterName: {{hub .ManagedClusterName hub}}

	you must first have already installed your Advanced Cluster Security Central Server.
	you must have already installed your Advanced Cluster Security Central Server.

Create an ACM policy set for Advanced Cluster Security Secured Clusters #438

Create an ACM policy set for Advanced Cluster Security Secured Clusters #438

Conversation

gparvin commented Dec 8, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mprahl May 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kylape commented May 21, 2024

openshift-ci bot commented May 22, 2024

mprahl May 16, 2024 •

edited

Loading