initial acm config

tmp/acm-hub-bootstrap-old/components/policies/cert-expiration/base/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- policy-cert-expiration.yaml

tmp/acm-hub-bootstrap-old/components/policies/cert-expiration/base/policy-cert-expiration.yaml

@@ -0,0 +1,50 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  name: certificate-expiration
+  annotations:
+    policy.open-cluster-management.io/categories: SC System and Communications Protection
+    policy.open-cluster-management.io/standards: NIST SP 800-53
+    policy.open-cluster-management.io/controls: SC-8 Transmission Confidentiality and Integrity
+spec:
+  disabled: false
+  remediationAction: inform
+  policy-templates:
+    - objectDefinition:
+        apiVersion: policy.open-cluster-management.io/v1
+        kind: CertificatePolicy
+        metadata:
+          name: policy-certificate
+        spec:
+          namespaceSelector:
+            include:
+              - default
+            exclude:
+              - kube-*
+          remediationAction: inform
+          severity: low
+          minimumDuration: 300h
+---
+apiVersion: apps.open-cluster-management.io/v1
+kind: PlacementRule
+metadata:
+  name: certificate-expiration-placement
+spec:
+  clusterSelector:
+    matchExpressions: []
+  clusterConditions:
+    - status: "True"
+      type: ManagedClusterConditionAvailable
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: certificate-expiration-placement
+placementRef:
+  name: certificate-expiration-placement
+  apiGroup: apps.open-cluster-management.io
+  kind: PlacementRule
+subjects:
+  - name: certificate-expiration
+    apiGroup: policy.open-cluster-management.io
+    kind: Policy