From 44d79433b81a138d1eb2b1fdb5769de99a9d39c6 Mon Sep 17 00:00:00 2001 From: Brian Jarvis Date: Thu, 21 Dec 2023 15:55:05 -0500 Subject: [PATCH] Add policy to setup download of PolicyGenerator from hub Signed-off-by: Brian Jarvis --- .../policy-sets/community/README.md | 1 + .../consoleclidownload.yml | 11 +++ .../policygenerator-download/deployment.yml | 91 +++++++++++++++++++ .../policygenerator-download/generator.yml | 30 ++++++ .../kustomization.yaml | 6 ++ .../policygenerator-download/namespace.yml | 5 + .../policygenerator-download/route.yml | 20 ++++ .../policygenerator-download/service.yml | 21 +++++ 8 files changed, 185 insertions(+) create mode 100644 policygenerator/policy-sets/community/policygenerator-download/consoleclidownload.yml create mode 100644 policygenerator/policy-sets/community/policygenerator-download/deployment.yml create mode 100644 policygenerator/policy-sets/community/policygenerator-download/generator.yml create mode 100644 policygenerator/policy-sets/community/policygenerator-download/kustomization.yaml create mode 100644 policygenerator/policy-sets/community/policygenerator-download/namespace.yml create mode 100644 policygenerator/policy-sets/community/policygenerator-download/route.yml create mode 100644 policygenerator/policy-sets/community/policygenerator-download/service.yml diff --git a/policygenerator/policy-sets/community/README.md b/policygenerator/policy-sets/community/README.md index 83bce7b62..cc2262eef 100644 --- a/policygenerator/policy-sets/community/README.md +++ b/policygenerator/policy-sets/community/README.md @@ -13,3 +13,4 @@ Policy | Description | Prerequisites [Kyverno Policy Sets](./kyverno) | The Kyverno policy sets are provided to help you apply best practices around security, multitenancy and applications. See the details for each each of the policy sets in the `kyverno` subdirectories. | The Kyverno `PolicySets` require the Kyverno helm chart to be installed on each managed cluster where you want to install the `PolicySets`. Use the policy [`policy-install-kyverno`](https://raw.githubusercontent.com/open-cluster-management-io/policy-collection/main/community/CM-Configuration-Management/policy-install-kyverno.yaml) to install kyverno and the policy [`policy-kyverno-config-exclude-resources`](https://raw.githubusercontent.com/open-cluster-management-io/policy-collection/main/community/CM-Configuration-Management/policy-kyverno-config-exclude-resources.yaml) to update Kyverno resource filters. The `PolicySet` uses cluster `Placement` and not the `PlacementRule` placement mechanism. For more details on Kyverno `PolicySet` installation, see the [README.md](./kyverno/README.md). [Zettaset Xcrypt](./zts-xcrypt) |The zettaset policy set deploys the policies for encryption of disk devices| See the [Zettaset README (https://github.com/zettaset/zettaset-public/) to learn more about Zettaset Xcrypt Deployment. [Setup for OpenShift Platform Plus](./openshift-plus-setup) | The Setup for OpenShift Platform Plus policy set applies several policies that prepares the Red Had Advancend Cluster Management for Kubernetes hub cluster for OpenShift Platform Plus components. | The Setup for OpenShift Platform Plus policy set works with only the hub cluster. See the policy set [README.md](./openshift-plus-setup/README.md) for more information on prerequisites. The `PolicySet` uses cluster `Placement` and not the `PlacementRule` placement mechanism. Red Hat Advanced Cluster Management version 2.7 is required to install this PolicySet. +[PolicyGenerator Download](./policygenerator-download) | Configures a webserver to host the PolicyGenerator and adds the download to the OpenShift CLI Download page on the OpenShift Console. This ensures the version downloaded matches the version of Red Hat Advanced Cluster Management running on the hub. | Red Hat Advanced Cluster Management version 2.8 is required to install this Policy. \ No newline at end of file diff --git a/policygenerator/policy-sets/community/policygenerator-download/consoleclidownload.yml b/policygenerator/policy-sets/community/policygenerator-download/consoleclidownload.yml new file mode 100644 index 000000000..f478d796a --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/consoleclidownload.yml @@ -0,0 +1,11 @@ +--- +apiVersion: console.openshift.io/v1 +kind: ConsoleCLIDownload +metadata: + name: policygenerator +spec: + description: The Policy Generator is a part of the Red Hat Advanced Cluster Management for Kubernetes application lifecycle subscription GitOps workflow that generates Red Hat Advanced Cluster Management policies using Kustomize. The Policy Generator builds Red Hat Advanced Cluster Management policies from Kubernetes manifest YAML files, which are provided through a PolicyGenerator manifest YAML file that is used to configure it. The Policy Generator is implemented as a Kustomize generator plug-in. + displayName: 'Advanced Cluster Management - v{{ (lookup "operator.open-cluster-management.io/v1" "MultiClusterHub" "open-cluster-management" "multiclusterhub").status.currentVersion }}' + links: + - href: 'https://policygen-downloader.{{ (lookup "config.openshift.io/v1" "Ingress" "" "cluster").spec.domain }}/PolicyGenerator' + text: Download PolicyGenerator for Linux for x86_64 diff --git a/policygenerator/policy-sets/community/policygenerator-download/deployment.yml b/policygenerator/policy-sets/community/policygenerator-download/deployment.yml new file mode 100644 index 000000000..76282c68e --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/deployment.yml @@ -0,0 +1,91 @@ +--- +apiVersion: policy.open-cluster-management.io/v1 +kind: ConfigurationPolicy +metadata: + name: policygen-downloader +spec: + remediationAction: enforce + severity: low + object-templates-raw: | + {{- $ocmDeployment := (lookup "apps/v1" "Deployment" "open-cluster-management" "multicluster-operators-hub-subscription") }} + {{- $ocmContainer := "" }} + {{- range $cn := $ocmDeployment.spec.template.spec.containers }} + {{- if eq $cn.name "multicluster-operators-hub-subscription" }} + {{- $ocmContainer = $cn }} + {{- break }} + {{- end }} + {{- end }} + + - complianceType: musthave + objectDefinition: + kind: Deployment + apiVersion: apps/v1 + metadata: + name: policygen-downloader + namespace: open-cluster-management-downloader + labels: + app: policygen-downloader + spec: + replicas: 1 + selector: + matchLabels: + app: policygen-downloader + template: + metadata: + labels: + app: policygen-downloader + deployment: policygen-downloader + spec: + {{- if not (empty $ocmDeployment.spec.template.spec.nodeSelector) }} + nodeSelector: + {{- range $k, $v := $ocmDeployment.spec.template.spec.nodeSelector }} + {{ $k }}: {{ (empty $v) | ternary "''" $v }} + {{- end }} + {{- end }} + initContainers: + - args: + - -c + - cp /etc/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator + /policy-generator/PolicyGenerator + command: + - /bin/bash + image: {{ $ocmContainer.image }} + name: policy-generator-install + volumeMounts: + - mountPath: /policy-generator + name: policy-generator + containers: + - name: policygen-downloader + image: registry.access.redhat.com/ubi8/httpd-24:latest + ports: + - containerPort: 8080 + protocol: TCP + resources: {} + imagePullPolicy: Always + volumeMounts: + - mountPath: /var/www/html/ + name: policy-generator + + {{- if not (empty $ocmDeployment.spec.template.spec.tolerations) }} + tolerations: + {{- range $tol := $ocmDeployment.spec.template.spec.tolerations }} + - key: {{ $tol.key }} + operator: {{ $tol.operator }} + {{- if not (empty $tol.effect) }} + effect: {{ $tol.effect }} + {{- end }} + {{- if not (empty $tol.value) }} + value: {{ $tol.val }} + {{- end }} + {{- end }} + {{- end }} + + volumes: + - emptyDir: {} + name: policy-generator + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 25% + maxSurge: 25% + revisionHistoryLimit: 10 diff --git a/policygenerator/policy-sets/community/policygenerator-download/generator.yml b/policygenerator/policy-sets/community/policygenerator-download/generator.yml new file mode 100644 index 000000000..4d9def4f3 --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/generator.yml @@ -0,0 +1,30 @@ +--- +apiVersion: policy.open-cluster-management.io/v1 +kind: PolicyGenerator +metadata: + name: policygenerator-download +policyDefaults: + namespace: policies + remediationAction: inform ## Change to enforce to create the downloader objects on the cluster + ## set the default compliance annotations + categories: + - CM Configuration Management + controls: + - CM-2 Baseline Configuration + standards: + - NIST SP 800-53 + severity: low + placement: + labelSelector: + matchLabels: + name: local-cluster + +policies: + - name: acm-policygenerator-downloader + manifests: + - path: namespace.yml + - path: deployment.yml + - path: service.yml + - path: route.yml + - path: consoleclidownload.yml + complianceType: mustonlyhave diff --git a/policygenerator/policy-sets/community/policygenerator-download/kustomization.yaml b/policygenerator/policy-sets/community/policygenerator-download/kustomization.yaml new file mode 100644 index 000000000..ea8397b73 --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + + +generators: + - generator.yml diff --git a/policygenerator/policy-sets/community/policygenerator-download/namespace.yml b/policygenerator/policy-sets/community/policygenerator-download/namespace.yml new file mode 100644 index 000000000..0fe73f85b --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/namespace.yml @@ -0,0 +1,5 @@ +--- +kind: Namespace +apiVersion: v1 +metadata: + name: open-cluster-management-downloader diff --git a/policygenerator/policy-sets/community/policygenerator-download/route.yml b/policygenerator/policy-sets/community/policygenerator-download/route.yml new file mode 100644 index 000000000..b9c34c76e --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/route.yml @@ -0,0 +1,20 @@ +--- +kind: Route +apiVersion: route.openshift.io/v1 +metadata: + name: policygen-downloader + namespace: open-cluster-management-downloader + labels: + app: policygen-downloader +spec: + host: 'policygen-downloader.{{ (lookup "config.openshift.io/v1" "Ingress" "" "cluster").spec.domain }}' + to: + kind: Service + name: policygen-downloader + weight: 100 + port: + targetPort: 8080-tcp + tls: + termination: edge + insecureEdgeTerminationPolicy: Redirect + wildcardPolicy: None diff --git a/policygenerator/policy-sets/community/policygenerator-download/service.yml b/policygenerator/policy-sets/community/policygenerator-download/service.yml new file mode 100644 index 000000000..0f8a7c1b3 --- /dev/null +++ b/policygenerator/policy-sets/community/policygenerator-download/service.yml @@ -0,0 +1,21 @@ +--- +kind: Service +apiVersion: v1 +metadata: + name: policygen-downloader + namespace: open-cluster-management-downloader + labels: + app: policygen-downloader +spec: + ipFamilies: + - IPv4 + ports: + - name: 8080-tcp + protocol: TCP + port: 8080 + targetPort: 8080 + internalTrafficPolicy: Cluster + type: ClusterIP + sessionAffinity: None + selector: + app: policygen-downloader