-
Notifications
You must be signed in to change notification settings - Fork 22
/
policy.open-cluster-management.io_policies.yaml
362 lines (362 loc) · 17.5 KB
/
policy.open-cluster-management.io_policies.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: policies.policy.open-cluster-management.io
spec:
group: policy.open-cluster-management.io
names:
kind: Policy
listKind: PolicyList
plural: policies
shortNames:
- plc
singular: policy
scope: Namespaced
versions:
- additionalPrinterColumns:
- jsonPath: .spec.remediationAction
name: Remediation action
type: string
- jsonPath: .status.compliant
name: Compliance state
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1
schema:
openAPIV3Schema:
description: |-
Policy is the schema for the policies API. Policy wraps other policy engine resources in its
"policy-templates" array in order to deliver the resources to managed clusters.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: |-
PolicySpec defines the configurations of the policy engine resources to deliver to the managed
clusters.
properties:
copyPolicyMetadata:
description: |-
CopyPolicyMetadata specifies whether the labels and annotations of a policy should be copied
when replicating the policy to a managed cluster. If set to "true", all of the labels and
annotations of the policy are copied to the replicated policy. If set to "false", only the
policy framework-specific policy labels and annotations are copied to the replicated policy.
This setting is useful if there is tracking for metadata that should only exist on the root
policy. It is recommended to set this to "false" when using Argo CD to deploy the policy
definition since Argo CD uses metadata for tracking that should not be replicated. The default
value is "true".
type: boolean
dependencies:
description: |-
PolicyDependencies is a list of dependency objects detailed with extra considerations for
compliance that should be fulfilled before applying the policies to the managed clusters.
items:
description: |-
Each PolicyDependency defines an object reference which must be in a certain compliance
state before the policy should be created.
oneOf:
- properties:
kind:
enum:
- CertificatePolicy
- ConfigurationPolicy
namespace:
maxLength: 0
- not:
properties:
kind:
pattern: ^(?:(?:Certificate|Configuration)Policy)$
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
compliance:
description: |-
Compliance is the required ComplianceState of the object that the policy depends on, at the
following path, .status.compliant.
enum:
- Compliant
- Pending
- NonCompliant
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
name:
description: Name is the name of the object that the policy
depends on.
type: string
namespace:
description: Namespace is the namespace of the object that the
policy depends on (optional).
type: string
required:
- compliance
- name
type: object
type: array
disabled:
description: |-
Disabled is a boolean parameter you can use to enable and disable the policy. When disabled,
the policy is removed from managed clusters.
type: boolean
policy-templates:
description: |-
PolicyTemplates is a list of definitions of policy engine resources to apply to managed
clusters along with configurations on how it should be applied.
items:
description: |-
PolicyTemplate is the definition of the policy engine resource to apply to the managed cluster,
along with configurations on how it should be applied.
properties:
extraDependencies:
description: |-
ExtraDependencies is additional PolicyDependencies that only apply to this policy template.
ExtraDependencies is a list of dependency objects detailed with extra considerations for
compliance that should be fulfilled before applying the policy template to the managed
clusters.
items:
description: |-
Each PolicyDependency defines an object reference which must be in a certain compliance
state before the policy should be created.
oneOf:
- properties:
kind:
enum:
- CertificatePolicy
- ConfigurationPolicy
namespace:
maxLength: 0
- not:
properties:
kind:
pattern: ^(?:(?:Certificate|Configuration)Policy)$
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
compliance:
description: |-
Compliance is the required ComplianceState of the object that the policy depends on, at the
following path, .status.compliant.
enum:
- Compliant
- Pending
- NonCompliant
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
name:
description: Name is the name of the object that the policy
depends on.
type: string
namespace:
description: Namespace is the namespace of the object
that the policy depends on (optional).
type: string
required:
- compliance
- name
type: object
type: array
ignorePending:
description: |-
IgnorePending is a boolean parameter to specify whether to ignore the "Pending" status of this
template when calculating the overall policy status. The default value is "false" to not ignore a
"Pending" status.
type: boolean
objectDefinition:
description: A Kubernetes object defining the policy to apply
to a managed cluster
type: object
x-kubernetes-preserve-unknown-fields: true
required:
- objectDefinition
type: object
type: array
remediationAction:
description: |-
RemediationAction specifies the remediation of the policy. The parameter values are "enforce"
and "inform". If specified, the value that is defined overrides any remediationAction parameter
defined in the child policies in the "policy-templates" section. Important: Not all policy
engine kinds support the enforce feature.
enum:
- Inform
- inform
- Enforce
- enforce
type: string
required:
- disabled
- policy-templates
type: object
status:
description: PolicyStatus reports the observed status of the policy resulting
from its policy templates.
properties:
compliant:
description: |-
ComplianceState reports the observed status resulting from the definitions of this policy. This
status field is only used in the replicated policy in the managed cluster namespace.
enum:
- Compliant
- Pending
- NonCompliant
type: string
details:
description: |-
Details is the list of compliance details for each policy template definition. This status
field is only used in the replicated policy in the managed cluster namespace.
items:
description: |-
DetailsPerTemplate reports the current compliance state and list of recent compliance messages
for a given policy template.
properties:
compliant:
description: ComplianceState reports the observed status resulting
from the definitions of the policy.
enum:
- Compliant
- Pending
- NonCompliant
type: string
history:
items:
description: ComplianceHistory reports a compliance message
from a given time and event.
properties:
eventName:
description: EventName is the name of the event attached
to the message.
type: string
lastTimestamp:
description: LastTimestamp is the timestamp of the event
that reported the message.
format: date-time
type: string
message:
description: Message is the compliance message resulting
from evaluating the policy resource.
type: string
type: object
type: array
templateMeta:
type: object
x-kubernetes-preserve-unknown-fields: true
type: object
type: array
placement:
description: |-
Placement is a list of managed cluster placement resources bound to the policy. This status
field is only used in the root policy on the hub cluster.
items:
description: Placement reports how and what managed cluster placement
resources are attached to the policy.
properties:
decisions:
description: Decisions is the list of managed clusters returned
by the placement resource for this binding.
items:
description: PlacementDecision is the cluster name returned
by the placement resource.
properties:
clusterName:
type: string
clusterNamespace:
type: string
type: object
type: array
placement:
description: |-
Placement is the name of the Placement resource, from the cluster.open-cluster-management.io
API group, that is bound to the policy.
type: string
placementBinding:
description: |-
PlacementBinding is the name of the PlacementBinding resource, from the
policies.open-cluster-management.io API group, that binds the placement resource to the policy.
type: string
placementRule:
description: |-
PlacementRule (deprecated) is the name of the PlacementRule resource, from the
apps.open-cluster-management.io API group, that is bound to the policy.
type: string
policySet:
description: |-
PolicySet is the name of the policy set containing this policy and bound to the placement. If
specified, then for this placement the policy is being propagated through this policy set
rather than the policy being bound directly to a placement and propagated individually.
type: string
type: object
type: array
status:
description: |-
Status is a list of managed clusters and the current compliance state of each one. This
status field is only used in the root policy on the hub cluster.
items:
description: |-
CompliancePerClusterStatus reports the name of a managed cluster and its compliance state for
this policy.
properties:
clustername:
type: string
clusternamespace:
type: string
compliant:
description: ComplianceState reports the observed status resulting
from the definitions of the policy.
enum:
- Compliant
- Pending
- NonCompliant
type: string
type: object
type: array
type: object
required:
- metadata
- spec
type: object
served: true
storage: true
subresources:
status: {}