policy-idp-sample-github.yaml

# This policy sets up the configuration for applying Github Identity provider to all managed clusters
# in the cluster-set :`authrealm-sample-github-clusterset` and with label authdeployment: sample-github
# This configures the AuthRealm resource as well as the managed-cluster placement rules

# PRE-REQS : The Github OAuth app must have been already created in  Github.
# the placeholders CLIENTID and CLIENTSECRET in this file must  be replaced with the values from this Github Oauth App

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
  name: policy-idp-sample-github
spec:
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-idp-sample-github
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                kind: Namespace
                metadata:
                  labels:
                    control-plane: controller-manager
                  name: authrealm-sample-github-ns
            - complianceType: musthave
              objectDefinition:
                apiVersion: cluster.open-cluster-management.io/v1beta2
                kind: ManagedClusterSet
                metadata:
                  name: authrealm-sample-github-clusterset
                  namespace: authrealm-sample-github-ns
            - complianceType: musthave
              objectDefinition:
                apiVersion: cluster.open-cluster-management.io/v1alpha1
                kind: Placement
                metadata:
                  name: authrealm-sample-github-placement
                  namespace: authrealm-sample-github-ns
                spec:
                  predicates:
                    - requiredClusterSelector:
                        labelSelector:
                          matchLabels:
                            authdeployment: sample-github
            - complianceType: musthave
              objectDefinition:
                apiVersion: cluster.open-cluster-management.io/v1beta2
                kind: ManagedClusterSetBinding
                metadata:
                  name: authrealm-sample-github-clusterset
                  namespace: authrealm-sample-github-ns
                spec:
                  clusterSet: authrealm-sample-github-clusterset
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                data:
                  clientSecret: CLIENTSECRET # # Replace with Github OAuth App Client Secret
                kind: Secret
                metadata:
                  name: authrealm-sample-github-client-secret
                  namespace: authrealm-sample-github-ns
                type: Opaque
            - complianceType: musthave
              objectDefinition:
                apiVersion: identityconfig.identitatem.io/v1alpha1
                kind: AuthRealm
                metadata:
                  name: authrealm-sample-github
                  namespace: authrealm-sample-github-ns
                spec:
                  identityProviders:
                    - github:
                        clientID: CLIENTID # Replace with Github OAuth App Client Id
                        clientSecret:
                          name: authrealm-sample-github-client-secret
                      mappingMethod: add
                      name: sample-github-idp
                      type: GitHub
                  placementRef:
                    name: authrealm-sample-github-placement
                  routeSubDomain: sample-github-idp
                  type: dex
          remediationAction: inform
          severity: medium
  remediationAction: enforce