Skip to content

Commit de57887

Browse files
gparvinopenshift-merge-bot[bot]
gparvin
authored and
openshift-merge-bot[bot]
committed
Make it easier to install openshift gitops argocd and include health
Creating a policy set to make setup of openshift gitops easier. It sets up the generator and configures health checks for policies. Signed-off-by: Gus Parvin <[email protected]>
1 parent f59e3b5 commit de57887

File tree

8 files changed

+217
-1
lines changed

8 files changed

+217
-1
lines changed

‎policygenerator/policy-sets/community/openshift-gitops/README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Setup OpenShift Gitops
2+
3+
## Installation
4+
5+
This PolicySet only deploys OpenShift Gitops to the hub cluster. In addition to deploying
6+
OpenShift Gitops, configuration sets up the following:
7+
- The plugin for the policy generator is configured
8+
- Health scripts for Policy resources are configured
9+

‎policygenerator/policy-sets/community/openshift-gitops/kustomization.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
generators:
2+
- ./policyGenerator.yaml
3+
commonLabels:
4+
open-cluster-management.io/policy-set: openshift-gitops
5+
commonAnnotations:
6+
argocd.argoproj.io/compare-options: IgnoreExtraneous

‎policygenerator/policy-sets/community/openshift-gitops/placement.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: cluster.open-cluster-management.io/v1beta1
2+
kind: Placement
3+
metadata:
4+
name: placement-openshift-gitops
5+
namespace: open-cluster-management-global-set
6+
spec:
7+
predicates:
8+
- requiredClusterSelector:
9+
labelSelector:
10+
matchExpressions:
11+
- {key: name, operator: In, values: ["local-cluster"]}

‎policygenerator/policy-sets/community/openshift-gitops/policy-openshift-gitops-grc.yaml

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ArgoCD
3+
metadata:
4+
name: openshift-gitops
5+
namespace: openshift-gitops
6+
spec:
7+
repo:
8+
env:
9+
- name: KUSTOMIZE_PLUGIN_HOME
10+
value: /etc/kustomize/plugin
11+
- name: POLICY_GEN_ENABLE_HELM
12+
value: "true"
13+
initContainers:
14+
- args:
15+
- -c
16+
- cp /etc/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
17+
/policy-generator/PolicyGenerator
18+
command:
19+
- /bin/bash
20+
image: 'registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel8:v{{ (lookup "operator.open-cluster-management.io/v1" "MultiClusterHub" "open-cluster-management" "multiclusterhub").status.currentVersion }}'
21+
name: policy-generator-install
22+
volumeMounts:
23+
- mountPath: /policy-generator
24+
name: policy-generator
25+
volumeMounts:
26+
- mountPath: /etc/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator
27+
name: policy-generator
28+
volumes:
29+
- emptyDir: {}
30+
name: policy-generator
31+
kustomizeBuildOptions: --enable-alpha-plugins
32+
resourceHealthChecks:
33+
- check: |
34+
hs = {}
35+
if obj.status ~= nil then
36+
if obj.status.compliant ~= nil then
37+
if obj.status.compliant == "Compliant" then
38+
hs.status = "Healthy"
39+
hs.message = "Policy is Compliant"
40+
return hs
41+
end
42+
if obj.status.compliant == "Pending" then
43+
hs.status = "Progressing"
44+
hs.message = "Policy is waiting for a dependency"
45+
return hs
46+
end
47+
if obj.status.compliant == "NonCompliant" then
48+
hs.status = "Degraded"
49+
hs.message = "Policy is NonCompliant"
50+
return hs
51+
end
52+
end
53+
end
54+
hs.status = "Healthy"
55+
hs.message = "Policy has not completed placement"
56+
return hs
57+
group: policy.open-cluster-management.io
58+
kind: Policy
59+
- check: |
60+
hs = {}
61+
hs.status = "Healthy"
62+
hs.message = "PolicySet has not completed placement"
63+
if obj.status ~= nil and obj.status.compliant ~= nil then
64+
if obj.status.compliant == "Compliant" then
65+
hs.status = "Healthy"
66+
end
67+
if obj.status.compliant == "Pending" then
68+
hs.status = "Progressing"
69+
end
70+
if obj.status.compliant == "NonCompliant" then
71+
hs.status = "Degraded"
72+
end
73+
end
74+
if obj.status ~= nil and obj.status.statusMessage ~= nil then
75+
hs.message = obj.status.statusMessage
76+
end
77+
return hs
78+
group: policy.open-cluster-management.io
79+
kind: PolicySet
80+
---
81+
kind: ClusterRole
82+
apiVersion: rbac.authorization.k8s.io/v1
83+
metadata:
84+
name: openshift-gitops-policy-admin
85+
rules:
86+
- verbs:
87+
- get
88+
- list
89+
- watch
90+
- create
91+
- update
92+
- patch
93+
- delete
94+
apiGroups:
95+
- policy.open-cluster-management.io
96+
resources:
97+
- policies
98+
- policysets
99+
- placementbindings
100+
- verbs:
101+
- get
102+
- list
103+
- watch
104+
- create
105+
- update
106+
- patch
107+
- delete
108+
apiGroups:
109+
- apps.open-cluster-management.io
110+
resources:
111+
- placementrules
112+
- verbs:
113+
- get
114+
- list
115+
- watch
116+
- create
117+
- update
118+
- patch
119+
- delete
120+
apiGroups:
121+
- cluster.open-cluster-management.io
122+
resources:
123+
- placements
124+
- placements/status
125+
- placementdecisions
126+
- placementdecisions/status
127+
---
128+
kind: ClusterRoleBinding
129+
apiVersion: rbac.authorization.k8s.io/v1
130+
metadata:
131+
name: openshift-gitops-policy-admin
132+
subjects:
133+
- kind: ServiceAccount
134+
name: openshift-gitops-argocd-application-controller
135+
namespace: openshift-gitops
136+
roleRef:
137+
apiGroup: rbac.authorization.k8s.io
138+
kind: ClusterRole
139+
name: openshift-gitops-policy-admin

‎policygenerator/policy-sets/community/openshift-gitops/policy-openshift-gitops.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: operators.coreos.com/v1alpha1
2+
kind: Subscription
3+
metadata:
4+
name: openshift-gitops-operator
5+
namespace: openshift-operators
6+
labels:
7+
operators.coreos.com/openshift-gitops-operator.openshift-operators: ''
8+
spec:
9+
channel: latest
10+
installPlanApproval: Automatic
11+
name: openshift-gitops-operator
12+
source: redhat-operators
13+
sourceNamespace: openshift-marketplace

‎policygenerator/policy-sets/community/openshift-gitops/policyGenerator.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: policy.open-cluster-management.io/v1
2+
kind: PolicyGenerator
3+
metadata:
4+
name: policy-opp-prereqs
5+
placementBindingDefaults:
6+
name: binding-policy-openshift-gitops
7+
policyDefaults:
8+
categories:
9+
- CM Configuration Management
10+
controls:
11+
- CM-2 Baseline Configuration
12+
namespace: open-cluster-management-global-set
13+
policySets:
14+
- openshift-gitops
15+
remediationAction: enforce
16+
severity: medium
17+
standards:
18+
- NIST SP 800-53
19+
policies:
20+
- name: openshift-gitops
21+
manifests:
22+
- path: policy-openshift-gitops.yaml
23+
- name: openshift-gitops-grc
24+
dependencies:
25+
- name: openshift-gitops
26+
manifests:
27+
- path: policy-openshift-gitops-grc.yaml
28+
policySets:
29+
- description: Applies the OpenShift Gitops subscription and configures
30+
OpenShift Gitops to work with the Governance APIs
31+
name: openshift-gitops
32+
placement:
33+
placementPath: placement.yaml

‎policygenerator/policy-sets/community/openshift-plus-setup/kustomization.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
generators:
22
- ./policyGenerator.yaml
33
commonLabels:
4-
open-cluster-management.io/policy-set: openshift-plus
4+
open-cluster-management.io/policy-set: openshift-plus-setup
5+
commonAnnotations:
6+
argocd.argoproj.io/compare-options: IgnoreExtraneous
7+

‎policygenerator/policy-sets/stable/openshift-plus/kustomization.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@ generators:
22
- ./policyGenerator.yaml
33
commonLabels:
44
open-cluster-management.io/policy-set: openshift-plus
5+
commonAnnotations:
6+
argocd.argoproj.io/compare-options: IgnoreExtraneous

0 commit comments

Comments
 (0)