From 1cd8cb4a5dda9bd49e43b27aab58a705e847b8be Mon Sep 17 00:00:00 2001 From: Dale Haiducek <19750917+dhaiducek@users.noreply.github.com> Date: Fri, 3 Jan 2025 17:04:35 -0500 Subject: [PATCH] PlacementRule ==> Placement Replaces all PlacementRule with Placement, preparing for its pending removal. ref: https://issues.redhat.com/browse/ACM-16843 Signed-off-by: Dale Haiducek <19750917+dhaiducek@users.noreply.github.com> --- Makefile | 9 +- README.md | 103 +++++++++++------- build/clean-up-cluster.sh | 11 +- .../audit/audit-pod-kind-field-filter.yaml | 13 ++- .../audit/audit-pod-kind.yaml | 19 +++- .../audit/audit-role-multiple-ns.yaml | 19 +++- .../audit/audit-role-single-ns.yaml | 19 +++- .../create/create-role-multiple-ns.yaml | 19 +++- .../create/create-role-single-ns.yaml | 19 +++- .../delete/delete-role-multiple-ns.yaml | 19 +++- .../delete/delete-role-single-ns.yaml | 19 +++- .../gatekeeper/gatekeeper-install.yaml | 19 +++- .../gatekeeper/gatekeeper-policy-sample.yaml | 14 ++- .../merge-patch-role-multiple-ns.yaml | 19 +++- .../merge-patch-role-single-ns.yaml | 19 +++- .../replace-patch-role-multiple-ns.yaml | 19 +++- .../replace-patch-role-single-ns.yaml | 19 +++- test/common/common.go | 52 ++++++++- test/common/gvr.go | 10 +- test/common/policy_utils.go | 86 +++++++++++---- test/configuration_policy_prune.go | 75 +++++++------ test/e2e/cert_policy_test.go | 4 +- test/e2e/configuration_policy_test.go | 40 +++---- test/e2e/e2e_suite_test.go | 25 ++++- test/e2e/hub_templates_encryption_test.go | 28 ++++- test/e2e/policySet_e2e_test.go | 19 ++-- .../hubtemplates_variables_test.go | 8 +- test/integration/integration_suite_test.go | 34 ++---- .../operator_policy_complianceconfig_test.go | 8 +- .../integration/operator_policy_error_test.go | 4 +- .../policy_diff_generation_test.go | 2 +- .../policy_hub_templates_21440_test.go | 2 +- .../policy_install_operator_test.go | 4 +- .../policy_multiline_templatization_test.go | 21 ++-- test/integration/policy_set_test.go | 2 +- test/performance/performance.go | 2 +- .../resources/templates/cfgmap-plc.yaml | 22 ++-- test/policy_ordering.go | 41 ++++--- test/resources/cert_policy/cert-policy.yaml | 19 +++- .../role-policy-musthave.yaml | 19 +++- .../role-policy-mustnothave.yaml | 19 +++- .../role-policy-mustonlyhave.yaml | 19 +++- .../cm-policy-prune-all.yaml | 19 +++- .../cm-policy-prune-default.yaml | 19 +++- .../cm-policy-prune-if-created.yaml | 19 +++- .../cm-policy-prune-none.yaml | 19 +++- .../diff_generation/diff_generation.yaml | 21 ++-- .../gatekeeper/policy-uninstall-gk.yaml | 6 + .../test-hub-encryption.yaml | 19 +++- .../mclabels-fromcm-pol.yaml | 19 +++- .../mclabels-range-pol.yaml | 19 +++- .../test-op-complianceconfig-1-modified.yaml | 19 +++- .../test-op-complianceconfig-1.yaml | 19 +++- .../test-op-complianceconfig-modified.yaml | 19 +++- .../test-op-complianceconfig.yaml | 19 +++- .../operator_policy/test-op-err-correct.yaml | 19 +++- .../operator_policy/test-op-err-initial.yaml | 19 +++- .../policy-hub-templates-21440.yaml | 19 +++- .../policy_info_metric/compliant.yaml | 19 +++- .../policy_info_metric/noncompliant.yaml | 19 +++- .../clean-up-grcqeoptest-ns.yaml | 26 +++-- .../operator_policy_all_defaults.yaml | 26 +++-- .../operator_policy_no_group.yaml | 26 +++-- .../operator_policy_with_group.yaml | 26 +++-- .../policy-multiline-temp-hub.yaml | 19 +++- .../policy-multiline-temp-nohub.yaml | 19 +++- .../dep-plcset-statuscheck.yaml | 2 +- .../resources/policy_ordering/dep-plcset.yaml | 19 +++- .../dep-policy-dep-on-plcset.yaml | 19 +++- .../policy_ordering/dep-policy-deppol.yaml | 19 +++- .../dep-policy-extradepconfig.yaml | 19 +++- .../dep-policy-ignorepending.yaml | 19 +++- .../policy_ordering/dep-policy-initial.yaml | 19 +++- .../policy_report_metric/compliant.yaml | 19 +++- .../policy_report_metric/noncompliant.yaml | 19 +++- test/resources/policy_set/statuscheck-1.yaml | 2 +- test/resources/policy_set/statuscheck-2.yaml | 2 +- test/resources/policy_set/statuscheck-3.yaml | 2 +- test/resources/policy_set/statuscheck-4.yaml | 2 +- test/resources/policy_set/statuscheck-5.yaml | 2 +- test/resources/policy_set/statuscheck-6.yaml | 2 +- test/resources/policy_set/test-policyset.yaml | 19 +++- .../invalid-cr-template.yaml | 19 +++- .../pretend-policy-template.yaml | 19 +++- .../verify_metrics/noncompliant.yaml | 19 +++- test/template_sync_errors.go | 8 +- 86 files changed, 1068 insertions(+), 598 deletions(-) diff --git a/Makefile b/Makefile index dc0462a3..512b67a8 100644 --- a/Makefile +++ b/Makefile @@ -242,7 +242,6 @@ kind-delete-cluster: .PHONY: install-crds install-crds: @echo installing crds on hub - kubectl apply -f https://raw.githubusercontent.com/$(CALLER_REPO)/multicloud-operators-subscription/$(RELEASE_BRANCH)/deploy/hub-common/apps.open-cluster-management.io_placementrules_crd.yaml --kubeconfig=$(PWD)/kubeconfig_$(HUB_CLUSTER_NAME) kubectl apply -f https://raw.githubusercontent.com/open-cluster-management-io/api/$(OCM_API_COMMIT)/cluster/v1/0000_00_clusters.open-cluster-management.io_managedclusters.crd.yaml --kubeconfig=$(PWD)/kubeconfig_$(HUB_CLUSTER_NAME) kubectl apply -f https://raw.githubusercontent.com/open-cluster-management-io/api/$(OCM_API_COMMIT)/cluster/v1beta1/0000_02_clusters.open-cluster-management.io_placements.crd.yaml --kubeconfig=$(PWD)/kubeconfig_$(HUB_CLUSTER_NAME) kubectl apply -f https://raw.githubusercontent.com/open-cluster-management-io/api/$(OCM_API_COMMIT)/cluster/v1beta1/0000_03_clusters.open-cluster-management.io_placementdecisions.crd.yaml --kubeconfig=$(PWD)/kubeconfig_$(HUB_CLUSTER_NAME) @@ -269,15 +268,17 @@ e2e-dependencies: K8SCLIENT ?= oc GINKGO = $(LOCAL_BIN)/ginkgo IS_HOSTED ?= false +PATCH_DECISIONS ?= true MANAGED_CLUSTER_NAMESPACE ?= $(MANAGED_CLUSTER_NAME) .PHONY: e2e-test e2e-test: e2e-dependencies - $(GINKGO) -v $(TEST_ARGS) test/e2e -- -cluster_namespace=$(MANAGED_CLUSTER_NAMESPACE) -k8s_client=$(K8SCLIENT) -is_hosted=$(IS_HOSTED) -cluster_namespace_on_hub=$(CLUSTER_NAMESPACE_ON_HUB) + $(GINKGO) -v $(TEST_ARGS) test/e2e -- -cluster_namespace=$(MANAGED_CLUSTER_NAMESPACE) -k8s_client=$(K8SCLIENT) -is_hosted=$(IS_HOSTED) -patch_decisions=$(PATCH_DECISIONS) -cluster_namespace_on_hub=$(CLUSTER_NAMESPACE_ON_HUB) .PHONY: e2e-test-hosted -e2e-test-hosted: CLUSTER_NAMESPACE_ON_HUB=cluster2 -e2e-test-hosted: IS_HOSTED=true +e2e-test-hosted: CLUSTER_NAMESPACE_ON_HUB=cluster2 +e2e-test-hosted: IS_HOSTED=true +e2e-test-hosted: PATCH_DECISIONS=false e2e-test-hosted: MANAGED_CLUSTER_NAMESPACE=cluster2-hosted e2e-test-hosted: e2e-test diff --git a/README.md b/README.md index 3c571925..9d334a61 100644 --- a/README.md +++ b/README.md @@ -1,20 +1,22 @@ -[comment]: # ( Copyright Contributors to the Open Cluster Management project ) +[comment]: # " Copyright Contributors to the Open Cluster Management project " # Governance Policy Framework + [![GRC Integration Test](https://github.com/stolostron/governance-policy-framework/actions/workflows/integration.yml/badge.svg)](https://github.com/stolostron/governance-policy-framework/actions/workflows/integration.yml) Open Cluster Management - Governance Policy Framework -The policy framework provides governance capability to gain visibility, and drive remediation for various security and configuration aspects to help meet such enterprise standards. +The policy framework provides governance capability to gain visibility, and drive remediation for +various security and configuration aspects to help meet such enterprise standards. ## What it does -View the following functions of the policy framework: +View the following functions of the policy framework: -* Distributes policies to managed clusters from hub cluster. -* Collects policy execution results from managed cluster to hub cluster. -* Supports multiple policy engines and policy languages. -* Provides an extensible mechanism to bring your own policy. +- Distributes policies to managed clusters from hub cluster. +- Collects policy execution results from managed cluster to hub cluster. +- Supports multiple policy engines and policy languages. +- Provides an extensible mechanism to bring your own policy. ## Architecture @@ -22,32 +24,37 @@ View the following functions of the policy framework: The governance policy framework consists of following components: -- Govenance policy framework: A framework to distribute various supported policies to managed clusters and collect results to be sent to the hub cluster. - - [Policy propagator](https://github.com/stolostron/governance-policy-propagator) - - [Governance policy framework addon](https://github.com/stolostron/governance-policy-framework-addon) -- Policy controllers: Policy engines that run on managed clusters to evaluate policy rules distributed by the policy framework and generate results. - - [Configuration policy controller](https://github.com/stolostron/config-policy-controller) - - [Usage examples](./doc/configuration-policy/README.md) - - [Certificate policy controller](https://github.com/stolostron/cert-policy-controller) - - Third-party - - [Gatekeeper](https://github.com/open-policy-agent/gatekeeper) - - [Kyverno](https://github.com/kyverno/kyverno/) +- Govenance policy framework: A framework to distribute various supported policies to managed + clusters and collect results to be sent to the hub cluster. + - [Policy propagator](https://github.com/stolostron/governance-policy-propagator) + - [Governance policy framework addon](https://github.com/stolostron/governance-policy-framework-addon) +- Policy controllers: Policy engines that run on managed clusters to evaluate policy rules + distributed by the policy framework and generate results. + - [Configuration policy controller](https://github.com/stolostron/config-policy-controller) + - [Usage examples](./doc/configuration-policy/README.md) + - [Certificate policy controller](https://github.com/stolostron/cert-policy-controller) + - Third-party + - [Gatekeeper](https://github.com/open-policy-agent/gatekeeper) + - [Kyverno](https://github.com/kyverno/kyverno/) ## The Policy CRDs -The `Policy` is the Custom Resource Definition (CRD), created for policy framework controllers to monitor. It acts as a vehicle to deliver policies to managed cluster and collect results to send to the hub cluster. +The `Policy` is the Custom Resource Definition (CRD), created for policy framework controllers to +monitor. It acts as a vehicle to deliver policies to managed cluster and collect results to send to +the hub cluster. View the following example specification of a `Policy` object: + ```yaml apiVersion: policy.open-cluster-management.io/v1 kind: Policy metadata: name: policy-pod spec: - remediationAction: inform # [inform/enforce] If set, it defines the remediationAction globally. - disabled: false # [true/false] If true, the policy will not be distributed to the managed cluster. - policy-templates: - - objectDefinition: # Use `objectDefinition` to wrap the policy resource to be distributed to the managed cluster + remediationAction: inform # [inform/enforce] If set, it defines the remediationAction globally. + disabled: false # [true/false] If true, the policy will not be distributed to the managed cluster. + policy-templates: + - objectDefinition: # Use `objectDefinition` to wrap the policy resource to be distributed to the managed cluster apiVersion: policy.open-cluster-management.io/v1 kind: ConfigurationPolicy metadata: @@ -58,21 +65,23 @@ spec: - complianceType: musthave objectDefinition: apiVersion: v1 - kind: Pod + kind: Pod metadata: name: sample-nginx-pod namespace: default spec: containers: - - image: nginx:1.7.9 - name: nginx - ports: - - containerPort: 80 + - image: nginx:1.7.9 + name: nginx + ports: + - containerPort: 80 ``` -The `PlacementBinding` CRD is used to bind the `Policy` with a `PlacementRule`. Only a bound `Policy` is distributed to a managed cluster by the policy framework. +The `PlacementBinding` CRD is used to bind the `Policy` with a `Placement`. Only a bound `Policy` is +distributed to a managed cluster by the policy framework. View the following example specification of a `PlacementBinding` object: + ```yaml apiVersion: policy.open-cluster-management.io/v1 kind: PlacementBinding @@ -80,35 +89,45 @@ metadata: name: binding-policy-pod placementRef: name: placement-policy-pod - kind: PlacementRule - apiGroup: apps.open-cluster-management.io + kind: Placement + apiGroup: cluster.open-cluster-management.io subjects: -- name: policy-pod - kind: Policy - apiGroup: policy.open-cluster-management.io + - name: policy-pod + kind: Policy + apiGroup: policy.open-cluster-management.io ``` -The `PlacementRule` CRD is used to determine the target clusters to distribute policies to. +The `Placement` CRD is used to determine the target clusters to distribute policies to. + +View the following example specification of a `Placement` object: -View the following example specification of a `PlacementRule` object: ```yaml -apiVersion: apps.open-cluster-management.io/v1 -kind: PlacementRule +apiVersion: cluster.open-cluster-management.io/v1beta1 +kind: Placement metadata: name: placement-policy-pod spec: - clusterSelector: - matchExpressions: - - {key: environment, operator: In, values: ["dev"]} + predicates: + - requiredClusterSelector: + labelSelector: + matchExpressions: + - { key: environment, operator: In, values: ["dev"] } + tolerations: + - key: cluster.open-cluster-management.io/unreachable + operator: Exists + - key: cluster.open-cluster-management.io/unavailable + operator: Exists ``` ## How to install it -You can find installation instructions from [Open Cluster Management](https://open-cluster-management.io/) website. +You can find installation instructions from +[Open Cluster Management](https://open-cluster-management.io/) website. ## More policies -You can find more policies or contribute to the open repository, [policy-collection](https://github.com/stolostron/policy-collection). +You can find more policies or contribute to the open repository, +[policy-collection](https://github.com/stolostron/policy-collection).