Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/kyverno-acm/base/kyverno-acm-policies.yaml

@@ -0,0 +1,475 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: kyverno-bestpractices
+  namespace: kyverno-policies
+placementRef:
+  apiGroup: apps.open-cluster-management.io
+  kind: PlacementRule
+  name: kyverno
+subjects:
+- apiGroup: policy.open-cluster-management.io
+  kind: PolicySet
+  name: kyverno-best-practices
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: kyverno-security
+  namespace: kyverno-policies
+placementRef:
+  apiGroup: apps.open-cluster-management.io
+  kind: PlacementRule
+  name: kyverno
+subjects:
+- apiGroup: policy.open-cluster-management.io
+  kind: PolicySet
+  name: kyverno-security
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: application-field-validation
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-application-field-validation
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: application-field-validation
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: application-field-validation
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: application-prevent-default-project
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-application-prevent-default-project
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: application-prevent-default-project
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: application-prevent-default-project
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: check-deprecated-apis
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-check-deprecated-apis
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: check-deprecated-apis
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: check-deprecated-apis
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: check-openshift-deprecated-apis
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-check-openshift-deprecated-apis
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: check-openshift-deprecated-apis
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: check-openshift-deprecated-apis
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: disallow-jenkins-pipeline-strategy
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-disallow-jenkins-pipeline-strategy
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: disallow-jenkins-pipeline-strategy
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: disallow-jenkins-pipeline-strategy
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: disallow-latest-tag
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-disallow-latest-tag
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: disallow-latest-tag
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: disallow-latest-tag
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: disallow-scc-anyuid
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-disallow-security-context-constraint-anyuid
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: disallow-security-context-constraint-anyuid
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: disallow-security-context-constraint-anyuid
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: policy-require-pod-probes
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-require-pod-probes
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: require-pod-probes
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: require-pod-probes
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: require-requests-limits
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-require-requests-limits
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: require-requests-limits
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: require-requests-limits
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  annotations:
+    policy.open-cluster-management.io/categories: setup
+    policy.open-cluster-management.io/controls: setup
+    policy.open-cluster-management.io/disable-templates: "true"
+    policy.open-cluster-management.io/standards: generic
+  name: require-tls-routes
+  namespace: kyverno-policies
+spec:
+  disabled: false
+  policy-templates:
+  - objectDefinition:
+      apiVersion: policy.open-cluster-management.io/v1
+      kind: ConfigurationPolicy
+      metadata:
+        name: inform-kyverno-check-routes
+      spec:
+        namespaceSelector:
+          exclude:
+          - kube-*
+          include:
+          - '*'
+        object-templates:
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: ClusterPolicyReport
+            results:
+            - policy: check-routes
+              result: fail
+        - complianceType: mustnothave
+          objectDefinition:
+            apiVersion: wgpolicyk8s.io/v1alpha2
+            kind: PolicyReport
+            results:
+            - policy: check-routes
+              result: fail
+        remediationAction: inform
+        severity: medium
+---
+apiVersion: policy.open-cluster-management.io/v1beta1
+kind: PolicySet
+metadata:
+  name: kyverno-best-practices
+  namespace: kyverno-policies
+spec:
+  description: Kyverno Best Practices
+  policies:
+  - application-field-validation
+  - application-prevent-default-project
+  - check-deprecated-apis
+  - check-openshift-deprecated-apis
+  - disallow-jenkins-pipeline-strategy
+  - disallow-latest-tag
+  - policy-require-pod-probes
+  - require-requests-limits
+---
+apiVersion: policy.open-cluster-management.io/v1beta1
+kind: PolicySet
+metadata:
+  name: kyverno-security
+  namespace: kyverno-policies
+spec:
+  description: Kyverno Security
+  policies:
+  - disallow-scc-anyuid
+  - require-tls-routes