Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml

@@ -0,0 +1,90 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PolicyGenerator
+metadata:
+  name: kyverno-bestpractices
+placementBindingDefaults:
+  name: kyverno-bestpractices
+policyDefaults:
+  policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"}
+  categories:
+    - CM Configuration Management
+  controls:
+    - CM-2 Baseline Configuration
+  namespace: kyverno-policies
+  remediationAction: enforce
+  severity: medium
+  policySets:
+    - kyverno-best-practices
+  standards:
+    - generic
+  generatePlacementWhenInSet: false
+policies:
+- name: policy-require-pod-probes
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/validate-probes-policy.yaml
+- name: require-requests-limits
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/require-requests-limits-policy.yaml
+- name: application-field-validation
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/application-field-validation.yaml
+- name: application-prevent-default-project
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/application-prevent-default-project.yaml
+- name: check-deprecated-apis
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/check-deprecated-apis.yaml
+- name: check-openshift-deprecated-apis
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/check-openshift-deprecated-apis.yaml
+- name: disallow-jenkins-pipeline-strategy
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-jenkins-pipeline-strategy.yaml
+- name: disallow-latest-tag
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-latest-tag.yaml
+policySets:
+  - description: Kyverno Best Practices
+    name: kyverno-best-practices
+    placement:
+      placementRuleName: kyverno

cluster-config/components/kyverno-acm/base/generate/generate.sh

@@ -0,0 +1,3 @@
+cp -R ../../../kyverno/overlays/policies policies
+kustomize --enable-helm --enable-alpha-plugins build . > ../kyverno-acm-policies.yaml
+rm -rf policies

cluster-config/components/kyverno-acm/base/generate/kustomization.yaml

@@ -0,0 +1,17 @@
+generators:
+- best-practices-policyGenerator.yaml
+- security-policyGenerator.yaml
+
+patches:
+  - target:
+      kind: ClusterPolicy
+    patch: |-
+      - op: replace
+        path: /spec/validationFailureAction
+        value: enforce
+  # Using Argo to deliver policies so just keep reporting on PolicyReports
+  - target:
+      kind: Policy
+    patch: |-
+      - op: remove
+        path: /spec/policy-templates/0

cluster-config/components/kyverno-acm/base/generate/security-policyGenerator.yaml

@@ -0,0 +1,42 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PolicyGenerator
+metadata:
+  name: kyverno-security
+placementBindingDefaults:
+  name: kyverno-security
+policyDefaults:
+  policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"}
+  categories:
+    - CM Configuration Management
+  controls:
+    - CM-2 Baseline Configuration
+  namespace: kyverno-policies
+  remediationAction: enforce
+  severity: medium
+  policySets:
+    - kyverno-security
+  standards:
+    - generic
+  generatePlacementWhenInSet: false
+policies:
+- name: disallow-scc-anyuid
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-anyuid-scc-policy.yaml
+- name: require-tls-routes
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/require-tls-routes.yaml
+policySets:
+  - description: Kyverno Security
+    name: kyverno-security
+    placement:
+      placementRuleName: kyverno