-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathpolicy-acs-secured-cluster.yaml
185 lines (167 loc) · 6.52 KB
/
policy-acs-secured-cluster.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
## WARNING !!!!!!!!
## PRIOR TO ADD THIS POLICY, YOU WILL NEED TO ADD THE StackRox CLUSTER
## INIT BUNDLE SECRETS INTO THE HUB CLUSTER IN NAMESPACE: openshift-acm-policies
## WARNING !!!!!!!!
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-acs-secured-cluster
namespace: openshift-acm-policies
annotations:
policy.open-cluster-management.io/categories: Security
policy.open-cluster-management.io/controls: Configurations
policy.open-cluster-management.io/standards: Configurations
spec:
remediationAction: enforce
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-acs-namespace
spec:
remediationAction: inform
severity: low
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: stackrox
name: stackrox
spec:
finalizers:
- kubernetes
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-acs-operator
spec:
remediationAction: inform
severity: low
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
labels:
operators.coreos.com/rhacs-operator.openshift-operators: ""
name: rhacs-operator
namespace: openshift-operators
spec:
channel: stable
installPlanApproval: Automatic
name: rhacs-operator
source: redhat-operators
sourceNamespace: openshift-marketplace
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-acs-secret-bundle
spec:
remediationAction: inform
severity: low
namespaceSelector:
include:
- "stackrox"
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Secret
metadata:
annotations:
init-bundle.stackrox.io/created-at: ""
init-bundle.stackrox.io/expires-at: ""
init-bundle.stackrox.io/id: ID
init-bundle.stackrox.io/name: secured-clusters
creationTimestamp: null
name: collector-tls
data:
ca.pem: |
{{hub fromSecret "openshift-acm-policies" "collector-tls" "ca.pem" hub}}
collector-cert.pem: |
{{hub fromSecret "openshift-acm-policies" "collector-tls" "collector-cert.pem" hub}}
collector-key.pem: |
{{hub fromSecret "openshift-acm-policies" "collector-tls" "collector-key.pem" hub}}
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Secret
metadata:
annotations:
init-bundle.stackrox.io/created-at: ""
init-bundle.stackrox.io/expires-at: ""
init-bundle.stackrox.io/id: ID
init-bundle.stackrox.io/name: secured-clusters
creationTimestamp: null
name: sensor-tls
data:
ca.pem: |
{{hub fromSecret "openshift-acm-policies" "sensor-tls" "ca.pem" hub}}
sensor-cert.pem: |
{{hub fromSecret "openshift-acm-policies" "sensor-tls" "sensor-cert.pem" hub}}
sensor-key.pem: |
{{hub fromSecret "openshift-acm-policies" "sensor-tls" "sensor-key.pem" hub}}
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Secret
metadata:
annotations:
init-bundle.stackrox.io/created-at: ""
init-bundle.stackrox.io/expires-at: ""
init-bundle.stackrox.io/id: ID
init-bundle.stackrox.io/name: secured-clusters
creationTimestamp: null
name: admission-control-tls
data:
admission-control-cert.pem: |
{{hub fromSecret "openshift-acm-policies" "admission-control-tls" "admission-control-cert.pem" hub}}
admission-control-key.pem: |
{{hub fromSecret "openshift-acm-policies" "admission-control-tls" "admission-control-key.pem" hub}}
ca.pem: |
{{hub fromSecret "openshift-acm-policies" "admission-control-tls" "ca.pem" hub}}
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-acs-secured-cluster-obj
spec:
remediationAction: inform
severity: low
namespaceSelector:
include:
- "stackrox"
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: platform.stackrox.io/v1alpha1
kind: SecuredCluster
metadata:
namespace: stackrox
name: stackrox-secured-cluster-services
spec:
# clusterName: '{{ (lookup "config.openshift.io/v1" "Infrastructure" "default" "cluster").status.infrastructureName }}'
clusterName: '{{ fromClusterClaim "name" | upper }}'
auditLogs:
collection: Auto
centralEndpoint: 'central-rhacs-operator.apps.maindeck.fleetcarrier.ca:443'
admissionControl:
bypass: BreakGlassAnnotation
contactImageScanners: DoNotScanInline
listenOnCreates: true
listenOnEvents: true
listenOnUpdates: true
timeoutSeconds: 3
perNode:
collector:
collection: KernelModule
imageFlavor: Regular
taintToleration: TolerateTaints