Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert existing policies to operator policies for installing operators #466

Closed
wants to merge 1 commit into from
Closed

Convert existing policies to operator policies for installing operators #466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 18 additions & 72 deletions stable/CA-Security-Assessment-and-Authorization/policy-compliance-operator-install.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,79 +17,25 @@ spec:
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
name: comp-operator-ns
name: operatorpolicy-comp-operator
spec:
remediationAction: inform # will be overridden by remediationAction in parent policy
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: openshift-compliance
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: comp-operator-operator-group
spec:
remediationAction: inform # will be overridden by remediationAction in parent policy
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: compliance-operator
namespace: openshift-compliance
spec:
targetNamespaces:
- openshift-compliance
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: comp-operator-subscription
spec:
remediationAction: inform # will be overridden by remediationAction in parent policy
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: compliance-operator
namespace: openshift-compliance
spec:
installPlanApproval: Automatic
name: compliance-operator
source: redhat-operators
sourceNamespace: openshift-marketplace
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: comp-operator-status
spec:
remediationAction: inform # will be overridden by remediationAction in parent policy
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
namespace: openshift-compliance
spec:
displayName: Compliance Operator
status:
phase: Succeeded # check the csv status to determine if operator is running or not
complianceType: musthave
operatorGroup:
name: compliance-operator
namespace: openshift-compliance
targetNamespaces:
- openshift-compliance
subscription:
name: compliance-operator
namespace: openshift-compliance
installPlanApproval: Automatic
source: redhat-operators
sourceNamespace: openshift-marketplace
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
Expand All @@ -110,8 +56,8 @@ metadata:
name: placement-policy-comp-operator
spec:
clusterConditions:
- status: "True"
- status: 'True'
type: ManagedClusterConditionAvailable
clusterSelector:
matchExpressions:
- {key: vendor, operator: In, values: ["OpenShift"]}
- { key: vendor, operator: In, values: ['OpenShift'] }
178 changes: 76 additions & 102 deletions stable/CM-Configuration-Management/policy-gatekeeper-operator-downstream.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,102 +14,76 @@ spec:
remediationAction: inform
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: gatekeeper-operator-product-sub
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: gatekeeper-operator-product
namespace: openshift-operators
spec:
channel: stable
installPlanApproval: Automatic
name: gatekeeper-operator-product
source: redhat-operators
sourceNamespace: openshift-marketplace
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: gatekeeper-operator-status
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
namespace: openshift-gatekeeper-system
spec:
displayName: Gatekeeper Operator
status:
phase: Succeeded # check the csv status to determine if operator is running or not
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: gatekeeper
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operator.gatekeeper.sh/v1alpha1
kind: Gatekeeper
metadata:
name: gatekeeper
spec:
audit:
auditChunkSize: 500
logLevel: INFO
replicas: 1
validatingWebhook: Enabled
mutatingWebhook: Disabled
webhook:
emitAdmissionEvents: Enabled
logLevel: INFO
replicas: 2
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: gatekeeper-status
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Pod
metadata:
namespace: openshift-gatekeeper-system
labels:
control-plane: audit-controller
status:
phase: Running # check the pod status to determine if operator is running or not
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Pod
metadata:
namespace: openshift-gatekeeper-system
labels:
control-plane: controller-manager
status:
phase: Running # check the pod status to determine if operator is running or not
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
name: operatorpolicy-gatekeeper-operator
spec:
remediationAction: inform
severity: high
complianceType: musthave
subscription:
channel: stable
name: gatekeeper-operator-product
namespace: openshift-operators
installPlanApproval: Automatic
source: redhat-operators
sourceNamespace: openshift-marketplace
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: gatekeeper
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operator.gatekeeper.sh/v1alpha1
kind: Gatekeeper
metadata:
name: gatekeeper
spec:
audit:
logLevel: INFO
replicas: 1
validatingWebhook: Enabled
mutatingWebhook: Disabled
webhook:
emitAdmissionEvents: Enabled
logLevel: INFO
replicas: 2
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: gatekeeper-status
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Pod
metadata:
namespace: openshift-gatekeeper-system
labels:
control-plane: audit-controller
status:
phase: Running # check the pod status to determine if operator is running or not
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Pod
metadata:
namespace: openshift-gatekeeper-system
labels:
control-plane: controller-manager
status:
phase: Running # check the pod status to determine if operator is running or not
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
Expand All @@ -120,18 +94,18 @@ placementRef:
kind: PlacementRule
apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-gatekeeper-operator
kind: Policy
apiGroup: policy.open-cluster-management.io
- name: policy-gatekeeper-operator
kind: Policy
apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
name: placement-policy-gatekeeper-operator
spec:
clusterConditions:
- status: "True"
type: ManagedClusterConditionAvailable
- status: 'True'
type: ManagedClusterConditionAvailable
clusterSelector:
matchExpressions:
- {key: environment, operator: In, values: ["dev"]}
- { key: environment, operator: In, values: ['dev'] }
64 changes: 19 additions & 45 deletions stable/SI-System-and-Information-Integrity/policy-imagemanifestvuln.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,46 +11,20 @@ spec:
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
name: policy-imagemanifestvuln-example-sub
name: operatorpolicy-imagemanifestvuln
spec:
remediationAction: inform # the policy-template spec.remediationAction is overridden by the preceding parameter value for spec.remediationAction.
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: container-security-operator
namespace: openshift-operators
spec:
# channel: quay-v3.3 # specify a specific channel if desired
installPlanApproval: Automatic
name: container-security-operator
source: redhat-operators
sourceNamespace: openshift-marketplace
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-imagemanifestvuln-status
spec:
remediationAction: inform # will be overridden by remediationAction in parent policy
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
namespace: openshift-operators
spec:
displayName: Red Hat Quay Container Security Operator
status:
phase: Succeeded # check the csv status to determine if operator is running or not
complianceType: musthave
subscription:
name: container-security-operator
namespace: openshift-operators
installPlanApproval: Automatic
source: redhat-operators
sourceNamespace: openshift-marketplace
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
Expand All @@ -60,8 +34,8 @@ spec:
remediationAction: inform # the policy-template spec.remediationAction is overridden by the preceding parameter value for spec.remediationAction.
severity: high
namespaceSelector:
exclude: ["kube-*"]
include: ["*"]
exclude: ['kube-*']
include: ['*']
object-templates:
- complianceType: mustnothave # mustnothave any ImageManifestVuln object
objectDefinition:
Expand All @@ -77,18 +51,18 @@ placementRef:
kind: PlacementRule
apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-imagemanifestvuln
kind: Policy
apiGroup: policy.open-cluster-management.io
- name: policy-imagemanifestvuln
kind: Policy
apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
name: placement-policy-imagemanifestvuln
spec:
clusterConditions:
- status: "True"
type: ManagedClusterConditionAvailable
- status: 'True'
type: ManagedClusterConditionAvailable
clusterSelector:
matchExpressions:
- {key: environment, operator: In, values: ["dev"]}
- { key: environment, operator: In, values: ['dev'] }