policygenerator-reference.yaml

apiVersion: policy.open-cluster-management.io/v1
kind: PolicyGenerator
metadata:
  # Required. Used to uniquely identify the configuration file.
  name: ""

# Required if multiple policies are consolidated in a PlacementBinding so that the generator can create unique
# PlacementBinding names using the name given here.
placementBindingDefaults:
  # Set an explicit placement binding name to use rather than rely on the default.
  name: ""

# Required. Defaults for policy generation. Any default value listed here can be overridden under an entry in the
# policies array except for "namespace".
policyDefaults:
  # Optional. Array of categories to be used in the policy.open-cluster-management.io/categories annotation. This
  # defaults to ["CM Configuration Management"].
  categories:
    - "CM Configuration Management"
  # Optional. Determines the policy controller behavior when comparing the manifest to objects on the cluster
  # ("musthave",  "mustonlyhave", or "mustnothave"). Defaults to "musthave".
  complianceType: "musthave"
  # Optional. Key-value pairs of annotations to set on generated configuration policies. For example, to disable policy
  # templates, you can set this to: {"policy.open-cluster-management.io/disable-templates": "true"}. This defaults to
  # {}.
  configurationPolicyAnnotations: {}
  # Optional. Array of controls to be used in the policy.open-cluster-management.io/controls annotation. This defaults
  # to ["CM-2 Baseline Configuration"].
  controls:
    - "CM-2 Baseline Configuration"
  # Optional. This determines if a single configuration policy should be generated for all the manifests being wrapped
  # in the policy. If set to false, a configuration policy per manifest will be generated. This defaults to true.
  consolidateManifests: true
  # Optional. If set to true (default), all the policy's labels and annotations will be copied to the replicated policy.
  # If set to false, only the policy framework specific policy labels and annotations will be copied to the replicated
  # policy.
  copyPolicyMetadata: true
  # Optional. customMessage configures the compliance messages emitted by the configuration policy to use one
  # of the specified Go templates based on the current compliance. See the ConfigurationPolicy API documentation for
  # more details.
  customMessage:
    compliant: ""
    noncompliant: ""
  # Optional. A list of objects that should be in specific compliance states before this policy is applied. Cannot be
  # specified when policyDefaults.orderPolicies is set to true.
  dependencies:
    # Required. The name of the object being depended on.
    - name: ""
      # Optional. The namespace of the object being depended on. Will default to the namespace of policies from this
      # generator.
      namespace: ""
      # Optional. The compliance state the object should be in. Defaults to "Compliant"
      compliance: "Compliant"
      # Optional. The kind of the object. Defaults to "Policy", but can also be things like ConfigurationPolicy.
      kind: "Policy"
      # Optional. The APIVersion of the object. Defaults to "policy.open-cluster-management.io/v1"
      apiVersion: "policy.open-cluster-management.io/v1"
  # Optional. The description of the policy to create.
  description: ""
  # Optional. Determines whether the policy is enabled or disabled. A disabled policy will not be propagated to any
  # managed clusters and will show no status as a result.
  disabled: false
  # Optional. Configures the minimum elapsed time before a configuration policy is reevaluated. The default value is
  # `watch` to leverage Kubernetes API watches instead of polling the Kubernetes API server. If the policy spec is
  # changed or if the list of namespaces selected by the policy changes, the policy might be evaluated regardless of the
  # settings here.
  evaluationInterval:
    # These are in the format of durations (e.g. "1h25m3s"). These can also be set to "never" to avoid evaluating the
    # policy after it has become a particular compliance state. The default value for both fields is `watch`.
    compliant: 30m
    noncompliant: watch
  # Optional. A list of objects that should be in specific compliance states before this policy is applied. These are
  # added to each policy template (eg ConfigurationPolicy) separately from the dependencies list. Cannot be specified
  # when policyDefaults.orderManifests is set to true.
  extraDependencies:
    # Required. (See policyDefaults.dependencies.name for description.)
    - name: ""
      # Optional. (See policyDefaults.dependencies.namespace for description.)
      namespace: ""
      # Optional. (See policyDefaults.dependencies.compliance for description.)
      compliance: "Compliant"
      # Optional. (See policyDefaults.dependencies.kind for description.)
      kind: "Policy"
      # Optional. (See policyDefaults.dependencies.apiVersion for description.)
      apiVersion: "policy.open-cluster-management.io/v1"
  # Optional. Changes the default behavior of hub templates.
  hubTemplateOptions:
    # Optional. serviceAccountName is the name of a service account in the same namespace as the policy to use for all hub
    # template lookups. The service account must have list and watch permissions on any object the hub templates
    # look up. If not specified, lookups are restricted to namespaced objects in the same namespace as the policy and
    # to the `ManagedCluster` object associated with the propagated policy.
    serviceAccountName: ""
  # Optional. Determines whether objects created or monitored by the policy should be deleted when the policy is
  # deleted. Pruning only takes place if the remediation action of the policy has been set to "enforce". Example values
  # are "DeleteIfCreated", "DeleteAll", or "None". This defaults to unset, which is equivalent to "None".
  pruneObjectBehavior: "None"
  # Optional. Determines whether to treat the policy as compliant when it is waiting for its dependencies to reach their
  # desired states. Defaults to false.
  ignorePending: false
  # Deprecated: Set informGatekeeperPolicies to false to use Gatekeeper manifests directly without wrapping in a
  # ConfigurationPolicy.
  # Optional. When the policy references a Gatekeeper policy manifest, this determines if an additional configuration
  # policy should be generated in order to receive policy violations in Open Cluster Management when the Gatekeeper
  # policy has been violated. This defaults to true.
  informGatekeeperPolicies: true
  # Optional. When the policy references a Kyverno policy manifest, this determines if an additional configuration
  # policy should be generated in order to receive policy violations in Open Cluster Management when the Kyverno policy
  # has been violated. This defaults to true.
  informKyvernoPolicies: true
  # Optional. Overrides complianceType when comparing the manifest's metadata section to objects on the cluster
  # ("musthave",  "mustonlyhave"). Default is unset to not override complianceType for metadata.
  metadataComplianceType: ""
  # Required. The namespace of all the policies.
  namespace: ""
  # Optional. Determines the list of namespaces to check on the cluster for the given manifest. If a namespace is
  # specified in the manifest, the selector is not necessary. This defaults to no selectors.
  namespaceSelector:
    include: []
    exclude: []
    matchLabels: {}
    matchExpressions: []
  # Optional. Defines the label selector for objects defined in the `objectDefinition`. If there is an object name
  # defined in the `objectDefinition`, the `objectSelector` is ignored.
  objectSelector:
    matchLabels: {}
    matchExpressions: []
  # Optional. Determines whether to define extraDependencies on policy templates so that they are applied in the order
  # they are defined in the manifests list for that policy. Cannot be specified when consolidateManifests is set to
  # true. Cannot be specified at the same time as extraDependencies.
  orderManifests: false
  # Optional. Determines whether to define dependencies on the policies so they are applied in the order they are
  # defined in the policies list. This defaults to false, and all the policies can be applied at the same time. Cannot
  # be specified at the same time as dependencies.
  orderPolicies: false
  # Optional. The placement configuration for the policies. This defaults to a placement configuration that matches all
  # clusters.
  placement:
    # Deprecated: PlacementRule is deprecated. Use labelSelector instead to generate a Placement.
    # To specify a placement rule, specify key:value pair cluster selectors or the full YAML for the desired cluster
    # selectors. (See placementRulePath to specify an existing file instead.)
    clusterSelectors: {}
    # Deprecated: PlacementRule is deprecated. Use labelSelector instead to generate a Placement.
    # To specify a placement rule, specify key:value pair cluster selectors or the full LabelSelector for the desired
    # cluster selector. (See placementRulePath to specify an existing file instead.)
    # For example, to specify a placement rule using matchExpressions:
    #   clusterSelector:
    #     matchExpressions:
    #       - key: provider
    #         operator: NotIn
    #         values:
    #          - "cloud"
    clusterSelector: {}
    # To specify a placement, specify key:value pair cluster label selectors or the full LabelSelector for the desired
    # cluster label selector. (See placementPath to specify an existing file instead.)
    # For example, to specify a placement using matchExpressions:
    #   labelSelector:
    #     matchExpressions:
    #       - key: provider
    #         operator: NotIn
    #         values:
    #          - "cloud"
    labelSelector: {}
    # Optional. Specifying a name will consolidate placement rules that contain the same cluster selectors.
    name: ""
    # To reuse an existing placement manifest, specify the path here relative to the kustomization.yaml file. If given,
    # this placement will be used by all policies by default. (See labelSelector to generate a new Placement instead.)
    placementPath: ""
    # Deprecated: PlacementRule is deprecated. Use placementPath instead to specify a Placement.
    # To reuse an existing placement rule manifest, specify the path here relative to the kustomization.yaml file. If
    # given, this placement rule will be used by all policies by default. (See clusterSelector to generate a new
    # PlacementRule instead.)
    placementRulePath: ""
    # Use a placement that already exists in the cluster in the same namespace as the policy to be generated. It is the
    # responsibility of the administrator to ensure the placement exists. Use of this setting will prevent a Placement
    # from being generated, but the Placement Binding will still be created.
    placementName: ""
    # Deprecated: PlacementRule is deprecated. Use placementName instead to specify a Placement.
    # Use a placement rule that already exists in the cluster in the same namespace as the policy to be generated. It is
    # the responsibility of the administrator to ensure the placement rule exists. Use of this setting will prevent a
    # placement rule from being generated, but the placement binding will still be created.
    placementRuleName: ""
  # Optional. recreateOption describes whether to delete and recreate an object when an update is required. `IfRequired`
  # will recreate the object when updating an immutable field. `Always` will always recreate the object if a mismatch
  # is detected. `RecreateOption` has no effect when the `remediationAction` is `inform`. `IfRequired` has no effect
  # on clusters without dry run update support. The default value is `None`.
  recreateOption: ""
  # Optional. recordDiff specifies whether and where to log the difference between the object on the cluster
  # and the `objectDefinition` parameter in the policy. The supported options are `InStatus` to record the
  # difference in the policy status field, `Log` to log the difference in the `config-policy-controller` pod, and
  # `None` to not log the difference. The default value is `None` for object kinds that include sensitive data such as
  # `ConfigMap`, `OAuthAccessToken`, `OAuthAuthorizeTokens`, `Route`, and `Secret`, or when a templated
  # `objectDefinition` references sensitive data. For all other kinds, the default value is `InStatus`.
  recordDiff: ""
  # Optional. The remediation action ("inform" or "enforce") for each configuration policy. This defaults to "inform".
  remediationAction: "inform"
  # Optional. The severity of the policy violation. This defaults to "low".
  severity: "low"
  # Optional. Array of standards to be used in the policy.open-cluster-management.io/standards annotation. This defaults
  # to ["NIST SP 800-53"].
  standards:
    - "NIST SP 800-53"
  # Optional. Array of policy sets that the policy will join. Policy set details can be defined in the policySets
  # section. When a policy is part of a policy set, a placement binding will not be generated for the policy since one
  # is generated for the set. Set policies[*].generatePlacementWhenInSet or policyDefaults.generatePlacementWhenInSet to
  # override.
  policySets: []
  # Optional. Whether to generate placement manifests for policies. Placement generation occurs except when policies are
  # part of a policy set. Use this setting to turn off placement generation for policies not in policy sets. This
  # defaults to "true".
  generatePolicyPlacement: true
  # Optional. When a policy is part of a policy set, by default the generator will not generate the placement for this
  # policy since a placement is generated for the policy set. If a placement should still be generated, set it to "true"
  # so that the policy will be deployed with both policy placement and policy set placement. This defaults to "false".
  generatePlacementWhenInSet: false
  # Optional. Annotations that the policy will include under its metadata.annotations. It will be applied for all
  # policies unless specified in the policy.
  policyAnnotations: {}
  # Optional. Labels that the policy will include under its metadata.labels. It will be applied for all
  # policies unless specified in the policy.
  policyLabels: {}
  # Optional. Overrides the spec.enforcementAction field of a Gatekeeper constraint. 
  # This only applies to Gatekeeper constraints and is ignored by other manifests. 
  # If not set, the spec.enforcementAction field is not changed.
  gatekeeperEnforcementAction: "deny"
# Optional. Defaults for policy set generation. Any default value listed here can be overridden under an entry in the
# policySets array.
policySetDefaults:
  # Optional. The placement configuration for the policy sets. This defaults to a placement configuration that matches
  # all clusters. If a placement.name is not provided here for placement consolidation, it will fall back to
  # policyDefaults.placement.name, if provided there. (See policyDefaults.placement for description.)
  placement: {}
  # Optional. Whether to generate placement manifests for policy sets. This defaults to "true".
  generatePolicySetPlacement: true

# Required. The list of policies to create along with overrides to either the default values or, if set, the values
# given in policyDefaults.
policies:
  # Required. The name of the policy to create.
  - name: ""
    # Required. The list of Kubernetes resource object manifests to include in the policy.
    manifests:
      # Required. Path to a single file or a flat directory of files relative to the kustomization.yaml file. This path
      # cannot be in a directory outside of the directory with the kustomization.yaml file. Subdirectories within the
      # directory of the kustomization.yaml file are allowed. Kustomization subdirectories are also supported and will
      # not process any YAML files in the subdirectory if a kustomization.yaml file is found.
      # Supported manifests:
      #   1) Non-root policy type manifests such as CertificatePolicy and ConfigurationPolicy that have a
      #      "Policy" suffix. These are not modified except for patches and are directly added as a Policy's
      #      policy-templates entry.
      #   2) Manifests containing only an `object-templates-raw` key. The corresponding value will be used directly in
      #      a generated ConfigurationPolicy without modification, which will then be added as a Policy's 
      #      policy-templates entry.
      #   3) For everything else, ConfigurationPolicy objects are generated to wrap these manifests. The resulting
      #      ConfigurationPolicy is added as a Policy's policy-templates entry.
      - path: ""
        # Optional. This name is used when ConsolidateManifests is set to false and will serve as the ConfigurationPolicy name.
        # If multiple manifests are present in the path, an index number will be appended.
        # If multiple manifests are present and their names are provided, with `consolidateManifests` set to true,
        # the name of the first manifest will be used for all manifest paths.
        name: "my-config-name"
        # Optional. (See policyDefaults.complianceType for description.)
        complianceType: "musthave"
        # Optional. (See policyDefaults.metadataComplianceType for description.)
        metadataComplianceType: ""
        # Optional. (See policyDefaults.namespaceSelector for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        namespaceSelector: {}
        # Optional. (See policyDefaults.objectSelector for description.)
        objectSelector: {}
        # Optional. (See policyDefaults.customMessage for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        customMessage:
          compliant: ""
          noncompliant: ""
        # Optional. (See policyDefaults.evaluationInterval for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        evaluationInterval: {}
        # Optional. (See policyDefaults.extraDependencies for description)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        extraDependencies: []
        # Optional. (See policyDefaults.hubTemplateOptions for description.)
        hubTemplateOptions:
          serviceAccountName: ""
        # Optional. (See policyDefaults.pruneObjectBehavior for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        pruneObjectBehavior: ""
        # Optional. (See policyDefaults.ignorePending for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        ignorePending: false
        # Optional. (See policyDefaults.remediationAction for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        remediationAction: ""
        # Optional. (See policyDefaults.recreateOption for description.)
        recreateOption: ""
        # Optional. (See policyDefaults.recordDiff for description.)
        recordDiff: ""
        # Optional. (See policyDefaults.severity for description.)
        # Cannot be specified when policyDefaults.consolidateManifests is set to true.
        severity: "low"
        # Optional. (See policyDefaults.gatekeeperEnforcementAction for description.)
        gatekeeperEnforcementAction: "warn"
        # (Note: a path to a directory containing a Kustomize manifest is a supported alternative.) Optional. A
        # Kustomize patch to apply to the manifest(s) at the path. If there are multiple manifests, the patch requires
        # the apiVersion, kind, metadata.name, and metadata.namespace (if applicable) fields to be set so Kustomize can
        # identify the manifest the patch applies to.
        patches:
          # Optional: Only required when there are multiple manifests in the path.
          - apiVersion: ""
            # Optional: Only required when there are multiple manifests in the path.
            kind: ""
            metadata:
              # Optional: Only required when there are multiple manifests in the path. Replacing metadata.name is only
              # allowed for a single YAML structure manifest.
              name: ""
              # Optional: Only required when there are multiple manifests in the path and it's a manifest to a
              # namespaced resource. Replace metadata.namespace is only allowed for a single YAML structure manifest.
              namespace: ""
              # An example modification to the manifest
              annotations:
                friends-character: Chandler Bing
        # The OpenAPI schema used to merge patches (useful for non-Kubernetes CRs that contain lists of items)
        openapi:
          # The path to the OpenAPI schema to use when applying patches defined from the `patches` array. 
          path: ""
    # Optional. (See policyDefaults.categories for description.)
    categories:
      - "CM Configuration Management"
    # Optional. (See policyDefaults.complianceType for description.)
    complianceType: "musthave"
    # Optional. (See policyDefaults.configurationPolicyAnnotations for description.)
    configurationPolicyAnnotations: {}
    # Optional. (See policyDefaults.copyPolicyMetadata for description.)
    copyPolicyMetadata: true
    # Optional. (See policyDefaults.customMessage for description.)
    customMessage:
      compliant: ""
      noncompliant: ""
    # Optional. (See policyDefaults.metadataComplianceType for description.)
    metadataComplianceType: ""
    # Optional. (See policyDefaults.controls for description.)
    controls:
      - "CM-2 Baseline Configuration"
    # Optional. (See policyDefaults.dependencies for description.)
    # Cannot be specified when policyDefaults.orderPolicies is set to true.
    dependencies: []
    # Optional. (See policyDefaults.description for description.)
    description: ""
    # Optional. (See policyDefaults.disabled for description.)
    disabled: false
    # Optional. (See policyDefaults.evaluationInterval for description.)
    evaluationInterval: {}
    # Optional. (See policyDefaults.extraDependencies for description.)
    # Cannot be specified when orderManifests is set to true.
    extraDependencies: []
    # Optional. (See policyDefaults.pruneObjectBehavior for description.)
    pruneObjectBehavior: ""
    # Optional. (See policyDefaults.ignorePending for description.)
    ignorePending: false
    # Deprecated: Set informGatekeeperPolicies to false to use Gatekeeper manifests 
    # directly without wrapping in a ConfigurationPolicy.
    # Optional. (See policyDefaults.informGatekeeperPolicies for description.)
    informGatekeeperPolicies: true
    # Optional. (See policyDefaults.informKyvernoPolicies for description.)
    informKyvernoPolicies: true
    # Optional. (See policyDefaults.consolidateManifests for description.)
    consolidateManifests: true
    # Optional. (See policyDefaults.namespaceSelector for description.)
    namespaceSelector: {}
    # Optional. (See policyDefaults.objectSelector for description.)
    objectSelector: {}
    # Optional. (See policyDefaults.orderManifests for description.)
    # Cannot be specified when consolidateManifests is set to true.
    # If set true here, the default extraDependencies will be overwritten.
    orderManifests: false
    # Optional. (See policyDefaults.placement for description.)
    placement: {}
    # Optional. (See policyDefaults.remediationAction for description.)
    remediationAction: ""
    # Optional. (See policyDefaults.recreateOption for description.)
    recreateOption: ""
    # Optional. (See policyDefaults.recordDiff for description.)
    recordDiff: ""
    # Optional. (See policyDefaults.severity for description.)
    severity: "low"
    # Optional. (See policyDefaults.standards for description.)
    standards:
      - "NIST SP 800-53"
    # Optional. (See policyDefaults.policySets for description.)
    policySets: []
    # Optional. (See policyDefaults.generatePolicyPlacement for description.)
    generatePolicyPlacement: true
    # Optional. (See policyDefaults.generatePlacementWhenInSet for description.)
    generatePlacementWhenInSet: false
    # Optional. Annotations that the policy will include under its metadata.annotations. It will overwrite the
    # policyAnnotation defined in the policyDefaults.
    policyAnnotations: {}
    # Optional. (See policyDefaults.policyLabels for description.)
    policyLabels: {}
    # Optional. (See policyDefaults.gatekeeperEnforcementAction for description.)
    gatekeeperEnforcementAction: "dryrun"

# Optional. The list of policy sets to create. To include a policy in a policy set, use policies[*].policySets or
# policyDefaults.policySets or policySets.policies.
policySets:
  # Required. The name of the policy set to create.
  - name: ""
    # Optional. The description of the policy set to create.
    description: ""
    # Optional. The list of policies to be included in the policy set. If policies[*].policySets or
    # policyDefaults.policySets is also specified, the list is merged.
    policies: []
    # Optional. (See policySetDefaults.placement to set a default placement for policy sets. See
    # policyDefaults.placement for description of placement options.)
    placement: {}
    # Optional. (See policySetDefaults.generatePolicySetPlacement for description.)
    generatePolicySetPlacement: true