forked from open-cluster-management-io/policy-collection
-
Notifications
You must be signed in to change notification settings - Fork 31
/
policy-nginx-deployment-templatized.yaml
59 lines (57 loc) · 2.71 KB
/
policy-nginx-deployment-templatized.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# This sample policy demonstrates configuring a nginx pod on managedclusters with the configuration customized to the target cluster using managedcluster templates
# In the below policy,
# container image tag is dynamically set based on the ocp version of the target cluster using the fromclusterclaim template
# a couple of example env-variables on the container are also dyanmically set from values of a Secret resource on the target managedcluster using fromSecret template
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-nginx-deployment-templatized
annotations:
policy.open-cluster-management.io/standards: NIST 800-53
policy.open-cluster-management.io/categories: CM Configuration Management
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
remediationAction: inform
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-nginx-deployment
spec:
remediationAction: inform
severity: low
namespaceSelector:
include:
- default
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment-templatized
labels:
app: nginx
spec:
replicas: '{{ if eq (fromClusterClaim "env") "prod" }} {{ 3 | toInt }} {{ else }} {{ 1 | toInt }} {{ end }}'
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
#if ocpversion is 4.9 set nginx version to 1.21.4 else 1.20.2
image: '{{- if eq (fromClusterClaim "version.openshift.io") "4.9.13" -}} nginx:1.21.4 {{- else -}} nginx:1.20.2 {{- end -}}'
ports:
- containerPort: 80
env: # tls key and crt to communicate to hub are dynamically set
- name: hub.tls.crt
value: '{{- fromSecret "open-cluster-management-agent" "hub-kubeconfig-secret" "tls.crt" | base64dec -}}'
- name: hub.tls.key
value: '{{- fromSecret "open-cluster-management-agent" "hub-kubeconfig-secret" "tls.key" | base64dec -}}'