policy-enable-if-ns-exists-templatized.yaml

# This demonstrates enabling root policy based on status of a resource on the hub-cluster , using templates
# Below shows two policies
# 1 - policy-conditionalconfigmap : Enforces a configmap resource in namespace "test", it is disabled by default.
# 2 - policy-conditionalconfigmap-enabler : Checks if namespace "test" exists  and if it exists , 
#                                           enables the above policy #1 (policy-conditionalconfigmap) that enforces a configmap .

# NOTE
# The file has 2 related policies clubbed together, 
# when deploying through GRC UI Editor pls copy paste each policy resource individually as the ui can handle only one policy at a time.
# pls make sure to deploy both policies in the same namespace and replace any placeholder <POLICIESNS> in this file with the policy namespace.


apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-conditionalconfigmap
  annotations:
    policy.open-cluster-management.io/standards: NIST 800-53, NIST-CSF
    policy.open-cluster-management.io/categories: CM Configuration Management, PR.IP Information Protection Processes and Procedures
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration, PR.IP-1 Baseline Configuration
spec:
  remediationAction: enforce
  disabled: true #policy is disabled by default, will be enabled by enabler policy (see below) if/when namespace "test" of the configmap resource exists 
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-conditionalconfigmap
        spec:
          remediationAction: inform
          severity: low
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                kind: ConfigMap
                metadata:
                  name: sampleconfig
                  namespace: test
                data:
                  foo: "bar"
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-conditionalconfigmap-enabler
  annotations:
    policy.open-cluster-management.io/standards: NIST 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  remediationAction: enforce
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-conditionalconfigmap-enabler
        spec:
          remediationAction: inform
          severity: low
          object-templates:
            - complianceType: musthave
              objectDefinition:
                kind: Policy
                apiVersion: policy.open-cluster-management.io/v1
                metadata:
                  name: policy-conditionalconfigmap #name should match the name of the root policy that is being enabled
                  namespace: <POLICIESNS> #namespace should match the ns of the root policy that is being enabled
                spec: 
                  # disable is set to true if namespace does not exist else it is set to false , 
                  disabled: '{{ ne (lookup "v1" "Namespace" "" "test").metadata.name "test" |  print | toBool }}'
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-conditionalconfigmap-common
placementRef:
  name: placement-policy-conditionalconfigmap-common
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
  - name: policy-conditionalconfigmap
    kind: Policy
    apiGroup: policy.open-cluster-management.io
  - name: policy-conditionalconfigmap-enabler
    kind: Policy
    apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-conditionalconfigmap-common
spec:
  clusterConditions:
    - status: 'True'
      type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      - key: local-cluster
        operator: In
        values:
          - 'true'