You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
__optional__|Value that represents how violations are handled as defined in the resource. | string
339
-
|*customMessage* +
340
-
_optional_|Parameter field where you can configure custom messages from your configuration policies, based on the compliance status. You can use the default message from the `.DefaultMessage` parameter and `.Policy` object variable of the current state of the policy from the configuration policy controller. The state of each related object is available at the `.Policy.status.relatedObjects[*].object` parameter section of the configuration policy controller. If you set an `evaluationInterval`, only identifiable information is available. |string
341
-
342
-
|*namespaceSelector* +
343
-
__required__|Value that represents which namespaces the policy is applied.|string
@@ -357,27 +337,10 @@ __required__|The versioned schema of Policy.| string
357
337
__optional__|String value that represents the REST resource.|string
358
338
|*metadata* +
359
339
__required__|Describes rules that define the policy. |object
360
-
| *complianceType* | Used to list expected behavior for roles and other Kubernetes object that must be evaluated or applied to the managed clusters.| string
361
-
| *metadataComplianceType* +
362
-
__optional__| Provides a way for users to process labels and annotations of an object differently than the other fields. The parameter value defaults to the same value of the `ComplianceType` parameter. | string
Copy file name to clipboardExpand all lines: governance/config_policy_ctrl.adoc
+38-38
Original file line number
Diff line number
Diff line change
@@ -9,8 +9,10 @@ When the `remediationAction` for the configuration policy controller is set to `
9
9
10
10
If you have existing Kubernetes manifests that you want to put in a policy, the Policy Generator is a useful tool to accomplish this.
11
11
12
-
[#configuration-policy-sample]
13
-
== Configuration policy sample
12
+
[#configuration-policy-yaml]
13
+
== Configuration policy YAML structure
14
+
15
+
To find the description of a field on your managed cluster, run the command `oc explain --api-version=policy.open-cluster-management.io/v1 ConfigurationPolicy.<field-path>`, and replace `<field-path>` with the path to the field that you need.
14
16
15
17
[source,yaml]
16
18
----
@@ -30,35 +32,40 @@ spec:
30
32
noncompliant: {}
31
33
severity: low
32
34
evaluationInterval:
33
-
compliant:
34
-
noncompliant:
35
+
compliant: ""
36
+
noncompliant: ""
37
+
object-templates-raw: ""
35
38
object-templates: <2>
36
-
- complianceType: musthave
37
-
objectDefinition:
38
-
apiVersion: v1
39
-
kind: Pod
40
-
metadata:
41
-
name: pod
42
-
spec:
43
-
containers:
44
-
- image: pod-image
45
-
name: pod-name
46
-
ports:
47
-
- containerPort: 80
48
-
- complianceType: musthave
49
-
objectDefinition:
50
-
apiVersion: v1
51
-
kind: ConfigMap
52
-
metadata:
53
-
name: myconfig
54
-
namespace: default
55
-
data:
56
-
testData: hello
57
-
spec:
58
-
...
39
+
- complianceType: musthave
40
+
metadataComplianceType:
41
+
recordDiff: ""
42
+
recreateOption: ""
43
+
objectSelector:
44
+
matchLabels: {}
45
+
matchExpressions: []
46
+
objectDefinition:
47
+
apiVersion: v1
48
+
kind: Pod
49
+
metadata:
50
+
name: pod
51
+
spec:
52
+
containers:
53
+
- image: pod-image
54
+
name: pod-name
55
+
ports:
56
+
- containerPort: 80
57
+
- complianceType: mustonlyhave
58
+
objectDefinition:
59
+
apiVersion: v1
60
+
kind: ConfigMap
61
+
metadata:
62
+
name: myconfig
63
+
namespace: default
64
+
data:
65
+
testData: hello
59
66
----
60
67
<1> Configuration policies that specify an object without a name can only be set to `inform`. When the `remediationAction` for the configuration policy is set to `enforce`, the controller applies the specified configuration to the target managed cluster.
61
-
<2> A Kubernetes object is defined in the `object-templates` array in the configuration policy, where fields of the configuration policy controller is compared with objects on the managed cluster. You can also use templated values within configuration policies. For more information, see _Template processing_.
68
+
<2> A Kubernetes object is defined in the `object-templates` array in the configuration policy, where fields of the configuration policy controller is compared with objects on the managed cluster. You can also use templated values within configuration policies. For more advanced use cases, specify a string in `object-templates-raw` to create the `object-templates` that you want. For more information, see _Template processing_.
62
69
63
70
[#configuration-policy-yaml-table]
64
71
== Configuration policy YAML table
@@ -89,22 +96,15 @@ spec:
89
96
90
97
| `spec.customMessage`
91
98
| Optional
92
-
a| Based on the current compliance, use this section to configure the compliance messages sent by the configuration policy to use one of the specified Go templates. You can use the default message from the `.DefaultMessage` parameter and `.Policy` object variable of the current state of the policy from the configuration policy controller. See the state of each related object in the following parameter section of the configuration policy controller:
93
-
94
-
[source,yaml]
95
-
----
96
-
.Policy.status.relatedObjects[*].object
97
-
----
98
-
99
-
If you set an `evaluationInterval`, only identifiable information is available.
99
+
| Use this section to configure the compliance message sent by the configuration policy based on the current compliance. Each message configuration is a string that can contain Go templates. The context variables `.DefaultMessage` and `.Policy` are available for use in the templates. You can access the default message using the `.DefaultMessage` parameter. The `.Policy` context variable contains the current policy object, including its status. For example, you can access the state of each related object by specifying `.Policy.status.relatedObjects[*].object`. If you set an `evaluationInterval` other than `watch`, only the kind, name, and namespace of the related objects are available.
100
100
101
101
| `spec.customMessage.compliant`
102
102
| Optional
103
-
| Use this field to configure custom messages for configuration policies that are compliant. UTF-8 encoded characters, including emoji and foreign characters are supported values.
103
+
| Use this field to configure custom messages for configuration policies that are compliant. Go templates and UTF-8 encoded characters, including emoji and foreign characters, are supported values.
104
104
105
105
| `spec.customMessage.noncompliant`
106
106
| Optional
107
-
| Use this field to configure custom messages for configuration policies that are non-compliant. UTF-8 encoded characters, along with emoji and foreign characters are supported values.
107
+
| Use this field to configure custom messages for configuration policies that are non-compliant. Go templates and UTF-8 encoded characters, along with emoji and foreign characters, are supported values.
0 commit comments