open-cluster-management-io · openshift-merge-bot · Dec 21, 2023 · Dec 21, 2023
diff --git a/policygenerator/policy-sets/community/README.md b/policygenerator/policy-sets/community/README.md
@@ -13,3 +13,4 @@ Policy  | Description | Prerequisites
 [Kyverno Policy Sets](./kyverno) | The Kyverno policy sets are provided to help you apply best practices around security, multitenancy and applications. See the details for each each of the policy sets in the `kyverno` subdirectories. | The Kyverno `PolicySets` require the Kyverno helm chart to be installed on each managed cluster where you want to install the `PolicySets`.  Use the policy [`policy-install-kyverno`](https://raw.githubusercontent.com/open-cluster-management-io/policy-collection/main/community/CM-Configuration-Management/policy-install-kyverno.yaml) to install kyverno and the policy [`policy-kyverno-config-exclude-resources`](https://raw.githubusercontent.com/open-cluster-management-io/policy-collection/main/community/CM-Configuration-Management/policy-kyverno-config-exclude-resources.yaml) to update Kyverno resource filters. The `PolicySet` uses cluster `Placement` and not the `PlacementRule` placement mechanism.  For more details on Kyverno `PolicySet` installation, see the [README.md](./kyverno/README.md).
 [Zettaset Xcrypt](./zts-xcrypt) |The zettaset policy set  deploys the policies for encryption of disk devices| See the [Zettaset README (https://github.com/zettaset/zettaset-public/) to learn more about Zettaset Xcrypt Deployment.
 [Setup for OpenShift Platform Plus](./openshift-plus-setup) | The Setup for OpenShift Platform Plus policy set applies several policies that prepares the Red Had Advancend Cluster Management for Kubernetes hub cluster for OpenShift Platform Plus components. | The Setup for OpenShift Platform Plus policy set works with only the hub cluster. See the policy set [README.md](./openshift-plus-setup/README.md) for more information on prerequisites. The `PolicySet` uses cluster `Placement` and not the `PlacementRule` placement mechanism. Red Hat Advanced Cluster Management version 2.7 is required to install this PolicySet.
+[PolicyGenerator Download](./policygenerator-download) | Configures a webserver to host the PolicyGenerator and adds the download to the OpenShift CLI Download page on the OpenShift Console.  This ensures the version downloaded matches the version of Red Hat Advanced Cluster Management running on the hub. | Red Hat Advanced Cluster Management version 2.8 is required to install this Policy.
diff --git a/policygenerator/policy-sets/community/policygenerator-download/consoleclidownload.yml b/policygenerator/policy-sets/community/policygenerator-download/consoleclidownload.yml
@@ -0,0 +1,11 @@
+---
+apiVersion: console.openshift.io/v1
+kind: ConsoleCLIDownload
+metadata:
+  name: policygenerator
+spec:
+  description: The Policy Generator is a part of the Red Hat Advanced Cluster Management for Kubernetes application lifecycle subscription GitOps workflow that generates Red Hat Advanced Cluster Management policies using Kustomize. The Policy Generator builds Red Hat Advanced Cluster Management policies from Kubernetes manifest YAML files, which are provided through a PolicyGenerator manifest YAML file that is used to configure it. The Policy Generator is implemented as a Kustomize generator plug-in.
+  displayName: 'Advanced Cluster Management - v{{ (lookup "operator.open-cluster-management.io/v1" "MultiClusterHub" "open-cluster-management" "multiclusterhub").status.currentVersion }}'
+  links:
+    - href: 'https://policygen-downloader.{{ (lookup "config.openshift.io/v1" "Ingress" "" "cluster").spec.domain }}/PolicyGenerator'
+      text: Download PolicyGenerator for Linux for x86_64
diff --git a/policygenerator/policy-sets/community/policygenerator-download/deployment.yml b/policygenerator/policy-sets/community/policygenerator-download/deployment.yml
@@ -0,0 +1,91 @@
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: ConfigurationPolicy
+metadata:
+  name: policygen-downloader
+spec:
+  remediationAction: enforce
+  severity: low
+  object-templates-raw: |
+    {{- $ocmDeployment := (lookup "apps/v1" "Deployment" "open-cluster-management" "multicluster-operators-hub-subscription") }}
+    {{- $ocmContainer := "" }}
+    {{- range $cn := $ocmDeployment.spec.template.spec.containers }}
+      {{- if eq $cn.name "multicluster-operators-hub-subscription" }}
+        {{- $ocmContainer = $cn }}
+        {{- break }}
+      {{- end }}
+    {{- end }}
+
+    - complianceType: musthave
+      objectDefinition:
+        kind: Deployment
+        apiVersion: apps/v1
+        metadata:
+          name: policygen-downloader
+          namespace: open-cluster-management-downloader
+          labels:
+            app: policygen-downloader
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app: policygen-downloader
+          template:
+            metadata:
+              labels:
+                app: policygen-downloader
+                deployment: policygen-downloader
+            spec:
+            {{- if not (empty $ocmDeployment.spec.template.spec.nodeSelector) }}
+              nodeSelector:
+              {{- range $k, $v := $ocmDeployment.spec.template.spec.nodeSelector }}
+                {{ $k }}: {{ (empty $v) | ternary "''" $v }}
+              {{- end }}
+            {{- end }}
+              initContainers:
+              - args:
+                - -c
+                - cp /etc/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
+                  /policy-generator/PolicyGenerator
+                command:
+                - /bin/bash
+                image: {{ $ocmContainer.image }}
+                name: policy-generator-install
+                volumeMounts:
+                - mountPath: /policy-generator
+                  name: policy-generator
+              containers:
+                - name: policygen-downloader
+                  image: registry.access.redhat.com/ubi8/httpd-24:latest
+                  ports:
+                    - containerPort: 8080
+                      protocol: TCP
+                  resources: {}
+                  imagePullPolicy: Always
+                  volumeMounts:
+                  - mountPath: /var/www/html/
+                    name: policy-generator
+
+            {{- if not (empty $ocmDeployment.spec.template.spec.tolerations) }}
+              tolerations:
+              {{- range $tol := $ocmDeployment.spec.template.spec.tolerations }}
+                - key: {{ $tol.key }}
+                  operator: {{ $tol.operator }}
+                {{- if not (empty $tol.effect) }}
+                  effect: {{ $tol.effect }}
+                {{- end }}
+                {{- if not (empty $tol.value) }}
+                  value: {{ $tol.val }}
+                {{- end }}
+              {{- end }}
+            {{- end }}
+
+              volumes:
+              - emptyDir: {}
+                name: policy-generator
+          strategy:
+            type: RollingUpdate
+            rollingUpdate:
+              maxUnavailable: 25%
+              maxSurge: 25%
+          revisionHistoryLimit: 10
diff --git a/policygenerator/policy-sets/community/policygenerator-download/generator.yml b/policygenerator/policy-sets/community/policygenerator-download/generator.yml
@@ -0,0 +1,30 @@
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PolicyGenerator
+metadata:
+  name: policygenerator-download
+policyDefaults:
+  namespace: policies
+  remediationAction: inform ## Change to enforce to create the downloader objects on the cluster
+  ## set the default compliance annotations
+  categories:
+    - CM Configuration Management
+  controls: 
+    - CM-2 Baseline Configuration
+  standards:
+    - NIST SP 800-53
+  severity: low
+  placement:
+    labelSelector:
+      matchLabels:
+        name: local-cluster
+
+policies:
+  - name: acm-policygenerator-downloader
+    manifests:
+      - path: namespace.yml
+      - path: deployment.yml
+      - path: service.yml
+      - path: route.yml
+      - path: consoleclidownload.yml
+        complianceType: mustonlyhave
diff --git a/policygenerator/policy-sets/community/policygenerator-download/kustomization.yaml b/policygenerator/policy-sets/community/policygenerator-download/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+
+generators:
+  - generator.yml
diff --git a/policygenerator/policy-sets/community/policygenerator-download/namespace.yml b/policygenerator/policy-sets/community/policygenerator-download/namespace.yml
@@ -0,0 +1,5 @@
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: open-cluster-management-downloader
diff --git a/policygenerator/policy-sets/community/policygenerator-download/route.yml b/policygenerator/policy-sets/community/policygenerator-download/route.yml
@@ -0,0 +1,20 @@
+---
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: policygen-downloader
+  namespace: open-cluster-management-downloader
+  labels:
+    app: policygen-downloader
+spec:
+  host: 'policygen-downloader.{{ (lookup "config.openshift.io/v1" "Ingress" "" "cluster").spec.domain }}'
+  to:
+    kind: Service
+    name: policygen-downloader
+    weight: 100
+  port:
+    targetPort: 8080-tcp
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Redirect
+  wildcardPolicy: None
diff --git a/policygenerator/policy-sets/community/policygenerator-download/service.yml b/policygenerator/policy-sets/community/policygenerator-download/service.yml
@@ -0,0 +1,21 @@
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: policygen-downloader
+  namespace: open-cluster-management-downloader
+  labels:
+    app: policygen-downloader
+spec:
+  ipFamilies:
+    - IPv4
+  ports:
+    - name: 8080-tcp
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
+  internalTrafficPolicy: Cluster
+  type: ClusterIP
+  sessionAffinity: None
+  selector:
+    app: policygen-downloader