policy-oauth-htpasswd.yaml

# Configure the htpasswd identity provider to allow users to log in to OpenShift Container Platform with credentials from an htpasswd file.
# Before creating these objects, you must generate a flat file that stores the usernames and passwords for your cluster by using htpasswd. Create or update your flat file by executing the following:
#   htpasswd -c -b -B <htpasswd file> user password
# For more information on configuring the OAuth server, consult the OpenShift documentation:
# htpasswd file: https://docs.openshift.com/container-platform/4.10/authentication/identity_providers/configuring-htpasswd-identity-provider.html#identity-provider-creating-htpasswd-file-linux_configuring-htpasswd-identity-provider
# https://docs.openshift.com/container-platform/4.10/authentication/identity_providers/configuring-htpasswd-identity-provider.html
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-oauth-htpasswd
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management, AC Access Control
    policy.open-cluster-management.io/controls: AC-3 Access Enforcement
    policy.open-cluster-management.io/standards: NIST SP 800-53
spec:
  disabled: false
  policy-templates:
    # Create a secret that stores information about htpasswd users
    # htpasswd: <base64_encoded_htpasswd_file_contents>
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-oauth-htpasswd-secret
        spec:
          object-templates:
            - complianceType: mustonlyhave
              objectDefinition:
                apiVersion: v1
                data:
                  htpasswd: <base64_encoded_htpasswd_file_contents>
                kind: Secret
                metadata:
                  name: htpass-secret
                  namespace: openshift-config
                type: Opaque
          pruneObjectBehavior: DeleteIfCreated
          remediationAction: inform
          severity: high
    # Configure the OAuth for using htpasswd as the identity provider
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-oauth
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: config.openshift.io/v1
                kind: OAuth
                metadata:
                  name: cluster
                spec:
                  identityProviders:
                    - name: htpasswd_provider
                      htpasswd:
                        fileData:
                          name: htpass-secret
                      mappingMethod: claim
                      type: HTPasswd
          pruneObjectBehavior: DeleteIfCreated
          remediationAction: inform
          severity: high
  remediationAction: inform
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: policy-oauth-htpasswd-placement
placementRef:
  name: policy-oauth-htpasswd-placement
  apiGroup: apps.open-cluster-management.io
  kind: PlacementRule
subjects:
  - name: policy-oauth-htpasswd
    apiGroup: policy.open-cluster-management.io
    kind: Policy
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: policy-oauth-htpasswd-placement
spec:
  clusterSelector:
    matchExpressions:
      - key: environment
        operator: In
        values:
          - dev
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable