apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: scan-nist-800-53
  annotations:
    policy.open-cluster-management.io/standards: NIST-CSF
    policy.open-cluster-management.io/categories: PR.IP Information Protection Processes and Procedures
    policy.open-cluster-management.io/controls: PR.IP-1 Baseline Configuration
spec:
  remediationAction: enforce
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: scan-nist-800-53
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: mustnothave
              objectDefinition:
                apiVersion: compliance.openshift.io/v1alpha1
                kind: ComplianceCheckResult
                metadata:
                  namespace: openshift-compliance
                  labels:
                    compliance.openshift.io/check-status: FAIL
                    compliance.openshift.io/suite: cis-compliance
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-scan-nist-800-53
placementRef:
  name: placement-scan-nist-800-53
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
  - name: scan-nist-800-53
    kind: Policy
    apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-scan-nist-800-53
spec:
  clusterConditions:
    - status: 'True'
      type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      - {key: vendor, operator: In, values: ["OpenShift"]}