Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml

@@ -0,0 +1,90 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PolicyGenerator
+metadata:
+  name: kyverno-bestpractices
+placementBindingDefaults:
+  name: kyverno-bestpractices
+policyDefaults:
+  policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"}
+  categories:
+    - CM Configuration Management
+  controls:
+    - CM-2 Baseline Configuration
+  namespace: kyverno-policies
+  remediationAction: enforce
+  severity: medium
+  policySets:
+    - kyverno-best-practices
+  standards:
+    - generic
+  generatePlacementWhenInSet: false
+policies:
+- name: policy-require-pod-probes
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/validate-probes-policy.yaml
+- name: require-requests-limits
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/require-requests-limits-policy.yaml
+- name: application-field-validation
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/application-field-validation.yaml
+- name: application-prevent-default-project
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/application-prevent-default-project.yaml
+- name: check-deprecated-apis
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/check-deprecated-apis.yaml
+- name: check-openshift-deprecated-apis
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/check-openshift-deprecated-apis.yaml
+- name: disallow-jenkins-pipeline-strategy
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-jenkins-pipeline-strategy.yaml
+- name: disallow-latest-tag
+  categories:
+    - setup
+  controls:
+    - setup
+  disabled: false
+  manifests:
+    - path: policies/disallow-latest-tag.yaml
+policySets:
+  - description: Kyverno Best Practices
+    name: kyverno-best-practices
+    placement:
+      placementRuleName: kyverno