rblundon
b9b83d1fea
git-subtree-dir: acm-hub-bootstrap git-subtree-split: aea23ee88fafd5cab0e2d9189f872159c5f16b8e
61 lines
2.1 KiB
YAML
61 lines
2.1 KiB
YAML
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: PolicyGenerator
|
|
metadata:
|
|
name: gitops-policy-generator
|
|
policyDefaults:
|
|
namespace: acm-policies
|
|
remediationAction: enforce
|
|
placementBindingDefaults:
|
|
name: "binding-policy-gitops"
|
|
policies:
|
|
- name: policy-eso-secret-store
|
|
configurationPolicyAnnotations:
|
|
apps.open-cluster-management.io/reconcile-option: replace
|
|
manifests:
|
|
- path: manifests/eso/base/
|
|
- name: policy-gitops-subscription
|
|
remediationAction: enforce
|
|
manifests:
|
|
- path: manifests/gitops-subscription/base/
|
|
- name: policy-gitops-instance
|
|
# Needed to fix issue with merging lists resulting in duplicates
|
|
configurationPolicyAnnotations:
|
|
apps.open-cluster-management.io/reconcile-option: replace
|
|
complianceType: "mustonlyhave"
|
|
manifests:
|
|
- path: manifests/gitops-instance/base/
|
|
- name: policy-gitops-bootstrap
|
|
manifests:
|
|
- path: manifests/gitops-bootstrap/base/
|
|
- name: policy-gitops-notifications
|
|
remediationAction: enforce
|
|
manifests:
|
|
- path: manifests/gitops-notifications/base/
|
|
configurationPolicyAnnotations:
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
- name: policy-gitops-alerting
|
|
remediationAction: enforce
|
|
manifests:
|
|
- path: manifests/gitops-alerting/base/
|
|
configurationPolicyAnnotations:
|
|
policy.open-cluster-management.io/disable-templates: "true"
|
|
# Put ESO secrets into separate policy since it's chicken and egg
|
|
# Not being used since I have a global policy that does this but included for example
|
|
# - name: policy-gitops-secrets
|
|
# remediationAction: enforce
|
|
# manifests:
|
|
# - path: manifests/gitops-secrets/base/
|
|
policySets:
|
|
- name: "gitops"
|
|
description: "Policy for bootstrapping cluster with gitops"
|
|
policies:
|
|
- policy-eso-secret-store
|
|
- policy-gitops-subscription
|
|
- policy-gitops-instance
|
|
- policy-gitops-bootstrap
|
|
- policy-gitops-notifications
|
|
- policy-gitops-alerting
|
|
generatePolicySetPlacement: false
|
|
placement:
|
|
name: placement-policy-gitops
|