apiVersion: policy.open-cluster-management.io/v1
kind: PolicyGenerator
metadata:
  name: gitops-policy-generator
policyDefaults:
  namespace: acm-policies
  remediationAction: enforce
placementBindingDefaults:
  name: "binding-policy-gitops"
policies:
  - name: policy-eso-secret-store
    configurationPolicyAnnotations:
      apps.open-cluster-management.io/reconcile-option: replace
    manifests:
      - path: manifests/eso/base/
  - name: policy-gitops-subscription
    remediationAction: enforce
    manifests:
      - path: manifests/gitops-subscription/base/
  - name: policy-gitops-instance
    # Needed to fix issue with merging lists resulting in duplicates
    configurationPolicyAnnotations:
      apps.open-cluster-management.io/reconcile-option: replace
    complianceType: "mustonlyhave"
    manifests:
      - path: manifests/gitops-instance/base/
  - name: policy-gitops-bootstrap
    manifests:
      - path: manifests/gitops-bootstrap/base/
  - name: policy-gitops-notifications
    remediationAction: enforce
    manifests:
      - path: manifests/gitops-notifications/base/
    configurationPolicyAnnotations:
      policy.open-cluster-management.io/disable-templates: "true"
  - name: policy-gitops-alerting
    remediationAction: enforce
    manifests:
      - path: manifests/gitops-alerting/base/
    configurationPolicyAnnotations:
      policy.open-cluster-management.io/disable-templates: "true"
  # Put ESO secrets into separate policy since it's chicken and egg
  # Not being used since I have a global policy that does this but included for example
  # - name: policy-gitops-secrets
  #   remediationAction: enforce
  #   manifests:
  #     - path: manifests/gitops-secrets/base/
policySets:
  - name: "gitops"
    description: "Policy for bootstrapping cluster with gitops"
    policies:
      - policy-eso-secret-store
      - policy-gitops-subscription
      - policy-gitops-instance
      - policy-gitops-bootstrap
      - policy-gitops-notifications
      - policy-gitops-alerting
    generatePolicySetPlacement: false
    placement:
      name: placement-policy-gitops