-
Notifications
You must be signed in to change notification settings - Fork 0
/
policy-push-identity-provider.yaml
136 lines (135 loc) · 4.43 KB
/
policy-push-identity-provider.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-push-identity-provider
namespace: default
annotations:
policy.open-cluster-management.io/categories: CM Configuration Management
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
policy.open-cluster-management.io/standards: NIST SP 800-53
creationTimestamp: 2023-09-15T18:17:04Z
generation: 1
managedFields:
resourceVersion: "68689955"
uid: 9adecad3-cb01-4cc3-bebc-034d4b2a1ba1
spec:
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: push-identity-provider
spec:
namespaceSelector:
exclude:
- kube-*
include:
- default
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
name: cluster
spec:
identityProviders:
- name: htpasswd_provider
htpasswd:
fileData:
name: htpasswd-secret
mappingMethod: claim
type: HTPasswd
- name: ldap_provider
ldap:
attributes:
name:
- cn
email:
- mail
id:
- dn
preferredUsername:
- uid
bindDN: uid=ocp,cn=users,cn=compat,dc=refmobilecloud,dc=ux,dc=nl,dc=tmo
bindPassword:
name: ldap-secret
insecure: true
url: ldap://ref-idm-01.refmobilecloud.ux.nl.tmo/dc=refmobilecloud,dc=ux,dc=nl,dc=tmo?uid?sub?(objectclass=krbprincipalaux)
mappingMethod: claim
type: LDAP
remediationAction: inform
severity: low
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: htpasswd-file
spec:
namespaceSelector:
exclude:
- kube-*
include:
- default
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
data:
htpasswd: ZGV2YWRtaW46JDJ5JDA1JDI1b2dCcnV0dXJNYlRVYlljMjExdi5iSDQxUnA4Zll1NVl6ZjVCMFhNU3NFRlowTnFnQjRDCm11czokYXByMSRSamNzcUFVOSQyUzRobE1GM2JTUjBTTFBOVHQ1Y3EuCm11cy12aWV3OiRhcHIxJHlJdWdRVzd1JEFKTnhTbTNyTi5kSUhobXUzdmVSQy4=
kind: Secret
metadata:
name: htpasswd-secret
namespace: openshift-config
type: Opaque
remediationAction: enforce
severity: low
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: ldap-file
spec:
namespaceSelector:
exclude:
- kube-*
include:
- default
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
data:
bindPassword: dGRkLVZBUzE=
kind: Secret
metadata:
name: ldap-secret
namespace: openshift-config
type: Opaque
remediationAction: enforce
severity: low
remediationAction: enforce
---
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: Placement
metadata:
name: policy-push-identity-provider-placement
namespace: default
spec:
clusterSets:
- global
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: policy-push-identity-provider-placement-binding
namespace: default
placementRef:
name: policy-push-identity-provider-placement
apiGroup: cluster.open-cluster-management.io
kind: Placement
subjects:
- name: policy-push-identity-provider
apiGroup: policy.open-cluster-management.io
kind: Policy