Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml

@@ -0,0 +1,90 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PolicyGenerator
+metadata:
+  name: kyverno-bestpractices
+placementBindingDefaults:
+  name: kyverno-bestpractices
+policyDefaults:
+  policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"}
+  categories:
+    - CM Configuration Management
+  controls:
+    - CM-2 Baseline Configuration
+  namespace: kyverno-policies
+  remediationAction: enforce
+  severity: medium
+  policySets:
+    - kyverno-best-practices
+  standards:
+    - generic
+  generatePlacementWhenInSet: false
+policies:
+- name: policy-require-pod-probes
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/validate-probes-policy.yaml
+- name: require-requests-limits
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/require-requests-limits-policy.yaml
+- name: application-field-validation
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/application-field-validation.yaml
+- name: application-prevent-default-project
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/application-prevent-default-project.yaml
+- name: check-deprecated-apis
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/check-deprecated-apis.yaml
+- name: check-openshift-deprecated-apis
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/check-openshift-deprecated-apis.yaml
+- name: disallow-jenkins-pipeline-strategy
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-jenkins-pipeline-strategy.yaml
+- name: disallow-latest-tag
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-latest-tag.yaml
+policySets:
+  - description: Kyverno Best Practices
+    name: kyverno-best-practices
+    placement:
+      placementRuleName: kyverno

cluster-config/components/kyverno-acm/base/generate/generate.sh

@@ -0,0 +1,3 @@
+cp -R ../../../kyverno/overlays/policies policies
+kustomize --enable-helm --enable-alpha-plugins build . > ../kyverno-acm-policies.yaml
+rm -rf policies

cluster-config/components/kyverno-acm/base/generate/kustomization.yaml

@@ -0,0 +1,17 @@
+generators:
+- best-practices-policyGenerator.yaml
+- security-policyGenerator.yaml
+
+patches:
+  - target:
+      kind: ClusterPolicy
+    patch: |-
+      - op: replace
+        path: /spec/validationFailureAction
+        value: enforce
+  # Using Argo to deliver policies so just keep reporting on PolicyReports
+  - target:
+      kind: Policy
+    patch: |-
+      - op: remove
+        path: /spec/policy-templates/0

cluster-config/components/kyverno-acm/base/generate/security-policyGenerator.yaml

@@ -0,0 +1,42 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PolicyGenerator
+metadata:
+  name: kyverno-security
+placementBindingDefaults:
+  name: kyverno-security
+policyDefaults:
+  policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"}
+  categories:
+    - CM Configuration Management
+  controls:
+    - CM-2 Baseline Configuration
+  namespace: kyverno-policies
+  remediationAction: enforce
+  severity: medium
+  policySets:
+    - kyverno-security
+  standards:
+    - generic
+  generatePlacementWhenInSet: false
+policies:
+- name: disallow-scc-anyuid
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-anyuid-scc-policy.yaml
+- name: require-tls-routes
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/require-tls-routes.yaml
+policySets:
+  - description: Kyverno Security
+    name: kyverno-security
+    placement:
+      placementRuleName: kyverno

cluster-config/components/kyverno-acm/base/kustomization.yaml

@@ -0,0 +1,8 @@
+namespace: acm-policies
+
+commonAnnotations:
+  argocd.argoproj.io/compare-options: IgnoreExtraneous
+
+resources:
+- placementrule.yaml
+- kyverno-acm-policies.yaml

cluster-config/components/kyverno-acm/base/kyverno-acm-policies.yaml

@@ -0,0 +1,475 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: kyverno-bestpractices
+  namespace: kyverno-policies
+placementRef:
+  apiGroup: apps.open-cluster-management.io
+  kind: PlacementRule
+  name: kyverno
+subjects:
+- apiGroup: policy.open-cluster-management.io
+  kind: PolicySet
+  name: kyverno-best-practices
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: kyverno-security
+  namespace: kyverno-policies
+placementRef:
+  apiGroup: apps.open-cluster-management.io
+  kind: PlacementRule
+  name: kyverno
+subjects:
+- apiGroup: policy.open-cluster-management.io
+  kind: PolicySet
+  name: kyverno-security
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: application-field-validation
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-application-field-validation
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: application-field-validation
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: application-field-validation
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: application-prevent-default-project
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-application-prevent-default-project
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: application-prevent-default-project
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: application-prevent-default-project
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: check-deprecated-apis
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-check-deprecated-apis
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: check-deprecated-apis
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: check-deprecated-apis
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: check-openshift-deprecated-apis
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-check-openshift-deprecated-apis
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: check-openshift-deprecated-apis
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: check-openshift-deprecated-apis
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: disallow-jenkins-pipeline-strategy
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-disallow-jenkins-pipeline-strategy
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: disallow-jenkins-pipeline-strategy
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: disallow-jenkins-pipeline-strategy
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: disallow-latest-tag
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-disallow-latest-tag
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: disallow-latest-tag
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: disallow-latest-tag
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: disallow-scc-anyuid
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-disallow-security-context-constraint-anyuid
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: disallow-security-context-constraint-anyuid
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: disallow-security-context-constraint-anyuid
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: policy-require-pod-probes
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-require-pod-probes
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: require-pod-probes
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: require-pod-probes
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: require-requests-limits
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-require-requests-limits
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: require-requests-limits
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: require-requests-limits
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: require-tls-routes
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-check-routes
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: check-routes
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: check-routes
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1beta1
+kind: PolicySet
+metadata:
+  name: kyverno-best-practices
+  namespace: kyverno-policies
+spec:
+  description: Kyverno Best Practices
+  policies:
+  - application-field-validation
+  - application-prevent-default-project
+  - check-deprecated-apis
+  - check-openshift-deprecated-apis
+  - disallow-jenkins-pipeline-strategy
+  - disallow-latest-tag
+  - policy-require-pod-probes
+  - require-requests-limits
+---
+apiVersion: policy.open-cluster-management.io/v1beta1
+kind: PolicySet
+metadata:
+  name: kyverno-security
+  namespace: kyverno-policies
+spec:
+  description: Kyverno Security
+  policies:
+  - disallow-scc-anyuid
+  - require-tls-routes

cluster-config/components/kyverno-acm/base/placementrule.yaml

@@ -0,0 +1,14 @@
+apiVersion: apps.open-cluster-management.io/v1
+kind: PlacementRule
+metadata:
+  name: kyverno
+spec:
+  clusterConditions:
+  - status: "True"
+    type: ManagedClusterConditionAvailable
+  clusterSelector:
+    matchExpressions:
+    - key: policies
+      operator: In
+      values:
+      - kyverno