Merge pull request stolostron#7600 from stolostron/jcberger-18037-template-addon

https://issues.redhat.com/browse/ACM-18037

Author: jc-berger

governance/adv_template_process.adoc

@@ -11,6 +11,7 @@ Continue reading for advanced template use-cases:
 * <<bypass-template-processing,Bypassing template processing>>
 * <<object-selector,Configuration policy object selector>>
 * <<raw-object-template-processing,Processing raw templates in configuration policies>>
+* <<resolve-hub-templates, Resolving hub templates after defining configuration policies >>
 
 [#special-annotation-processing]
 == Special annotation for reprocessing
@@ -166,9 +167,64 @@ spec:
     {{- end }}
 ----
 
+[#resolve-hub-templates]
+== Resolving hub templates after defining configuration policies 
+
+By default, if you use the hub templates in the `ConfigurationPolicy` and `OperatorPolicy` resources, you must correspond the `Policy` resources that are defined on the hub cluster with these resources. 
+
+You can define configuration policies directly on the managed clusters. For example, {gitops-short} is one that you can define configuration policies directly on the managed cluster. To resolve hub templates on the managed cluster in that situation, you can enable the `governance-standalone-hub-templating` add-on. 
+
+To enable the `governance-standalone-hub-templating` add-on, complete the following steps: 
+
+. On your hub cluster, go to the managed cluster namespace. 
+. Create a `ManagedClusterAddOn` resource with the `governance-standalone-hub-templating` name by using the following YAML sample: 
+
++
+[source,yaml]
+----
+apiVersion: addon.open-cluster-management.io/v1alpha1
+kind: ManagedClusterAddOn
+metadata:
+  name: governance-standalone-hub-templating
+  namespace: <cluster name>
+  labels:
+    cluster.open-cluster-management.io/backup: ''
+spec:
+  installNamespace: open-cluster-management-agent-addon
+----
+
+By default, the agent on the managed cluster only has access to the `ManagedCluster` resources on the hub cluster. You can use the `.ManagedClusterLabels` template variable in the hub cluster templates inside the `ConfigurationPolicies` that are deployed directly to the managed cluster. 
+
+If you want the hub template to access other resources, such as the `lookup` or `fromConfigMap` function calls, you must add those specific permissions to the add-on group. You can add these permissions through resources, such as `Roles`, `ClusterRoles`, `RoleBindings`, and `ClusterRoleBindings`. 
+
+The name of the add-on group depends on the name of your managed cluster, but it has the following standard form: `system:open-cluster-management:cluster:<cluster name>:addon:governance-standalone-hub-templating`.
+
+To allow access to `Configmaps` in your managed cluster namespace on your hub cluster, complete the following steps: 
+
+. Add the `Role` resource by running the following command: 
+
++
+[source,bash]
+----
+oc create role -n <cluster name> cm-reader --verb=get,list,watch --resource=configmaps
+----
+
+. Add the `Rolebinding` by running the following command: 
+
++
+[source,bash]
+----
+oc create rolebinding -n <cluster name> cm-reader-binding --role=cm-reader --group=system:open-cluster-management:cluster:<cluster name>:addon:governance-standalone-hub-templating
+----
+
+. To ensure these resources on the hub cluster get backed up and restored, add the following label to each resource that you create: `cluster.open-cluster-management.io/backup`. 
+
+After you add these resources, the add-on can resolve the hub templates, and the state of the policy gets saved on a secret on the managed clusters. This secret prevents interruptions if the hub cluster becomes temporarily unavailable to the managed cluster.
+
 [#additional-resources-hub-temp]
 == Additional resources
 
+*  See xref:../business_continuity/backup_restore/backup_arch.adoc#resources-that-are-backed-up[Resources that are backed up] for more details on backing up and restoring resources. 
 * See xref:../governance/template_functions.adoc#template-functions[Template functions] for more details.
 * Return to xref:../governance/template_support_intro.adoc#template-processing[Template processing].
 * See xref:../governance/manage_policies.adoc#policy-cli-commands[Policy CLI] for tools to resolve Go templates locally.

governance/pol_deploy_ext_tools.adoc

@@ -14,4 +14,5 @@ The {gitops-short} service account must have permission to manage {acm} policies
 == Additional resources
 
 * See link:../gitops/gitops_manage_policy_def.adoc#config-gitops-healthcheck[Configuring policy health checks in {gitops-short}].
-* See link:../gitops_manage_policy_def.adoc#create-clusterrole-gitops[Creating a ClusterRole resource for {gitops}].
+* See link:../gitops_manage_policy_def.adoc#create-clusterrole-gitops[Creating a ClusterRole resource for {gitops}].
+* See link:../governance/adv_template_process.adoc#resolve-hub-templates[Resolving hub templates after defining configuration policies]. 

release_notes/acm_whats_new.adoc

@@ -76,6 +76,8 @@ See link:../observability/observe_environments_intro.adoc#observing-environments
 [#governance-whats-new]
 == Governance
 
+* In earlier versions, the policy framework on the hub was required to resolve hub templates. This requirement made you have to put the `ConfigurationPolicy` into a `Policy` on the hub cluster for distribution through the `Placement`. With this update, you can use the `governance-standalone-hub-templating` add-on to resolve hub templates directly on managed clusters, when the `ConfigurationPolicy` is created outside of the policy framework.
+
 * `ValidatingAdmissionPolicyBindings` now appear in the `Discovered` policies tab in the Governance console. Additionally, you can also see other policy types that are in your managed clusters. The `ValidatingAdmissionPolicyBindings` details include other resources on the cluster that you can use to configure its behavior.
 
 * Gatekeeper Mutation resources now appear in the `Discovered` policies tab in the Governance console. Use the  Gatekeeper Mutation resource to view details of your managed clusters, including which resources might have been mutated by these policies.