policy-odf.yaml

# This policy verifies the installation of the official version of
# the OpenShift Data Foundation on the managed clusters.
#
# If set to "enforce" it'll install the operator.
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
  name: policy-odf-operator
spec:
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: odf-namespace
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                kind: Namespace
                metadata:
                  name: openshift-storage
          remediationAction: inform
          severity: high
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1beta1
        kind: OperatorPolicy
        metadata:
          name: odf-operator
        spec:
          remediationAction: inform
          severity: high
          complianceType: musthave
          operatorGroup:
            name: openshift-storage
            namespace: openshift-storage
            targetNamespaces:
              - openshift-storage
          subscription:
            name: odf-operator
            namespace: openshift-storage
            installPlanApproval: Automatic
            source: redhat-operators
            sourceNamespace: openshift-marketplace
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: odf-storagecluster
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: odf.openshift.io/v1alpha1
                kind: StorageSystem
                metadata:
                  name: ocs-storagecluster-storagesystem
                  namespace: openshift-storage
                spec:
                  kind: storagecluster.ocs.openshift.io/v1
                  name: ocs-storagecluster
                  namespace: openshift-storage
            - complianceType: musthave
              objectDefinition:
                apiVersion: ocs.openshift.io/v1
                kind: StorageCluster
                metadata:
                  annotations:
                    uninstall.ocs.openshift.io/cleanup-policy: delete
                    uninstall.ocs.openshift.io/mode: graceful
                  name: ocs-storagecluster
                  namespace: openshift-storage
                spec:
                  arbiter: {}
                  encryption:
                    kms: {}
                  externalStorage: {}
                  managedResources:
                    cephBlockPools: {}
                    cephCluster: {}
                    cephConfig: {}
                    cephDashboard: {}
                    cephFilesystems: {}
                    cephObjectStoreUsers: {}
                    cephObjectStores: {}
                    cephToolbox: {}
                  mirroring: {}
                  nodeTopologies: {}
                  storageDeviceSets:
                  - config: {}
                    count: 1
                    dataPVCTemplate:
                      metadata: {}
                      spec:
                        accessModes:
                        - ReadWriteOnce
                        resources:
                          requests:
                            storage: 100Gi
                        storageClassName: gp3-csi
                        volumeMode: Block
                      status: {}
                    name: ocs-deviceset-gp3-csi
                    placement: {}
                    portable: true
                    preparePlacement: {}
                    replica: 3
                    resources: {}
          remediationAction: inform
          severity: low
  remediationAction: inform