forked from open-cluster-management-io/policy-collection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathpolicy-install-triliovault-for-kubernetes-using-helm.yaml
126 lines (125 loc) · 4.64 KB
/
policy-install-triliovault-for-kubernetes-using-helm.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# This policy deploys Triliovault for Kubernetes (TVK) to all non-OpenShift clusters
# with a label "protected-by=triliovault" using Helm. To deploy a basic (trial) license,
# use the policy to deploy license for Triliovault for Kubernetes available at
# ./CM-Configuration-Management/policy-create-license-triliovault-for-kubernetes-upstream.yaml.
# Please conact [email protected] for further support.
#
# Note that it is set to enforce by default.
#
# Please refer product documentation at https://docs.trilio.io/kubernetes/overview/readme
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: install-tvk-helm
annotations:
policy.open-cluster-management.io/categories: CA Security Assessment and Authorization
policy.open-cluster-management.io/standards: NIST SP 800-53
policy.open-cluster-management.io/controls: CA-2 Security Assessments, CA-7 Continuous Monitoring
spec:
disabled: false
remediationAction: inform
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: tvk-ns-trilio-system
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: trilio-system
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: tvk-chart-ns
spec:
remediationAction: inform
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: hchartsk8strilionet-trilio-chart-ns
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-tvk-application
spec:
remediationAction: enforce
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: app.k8s.io/v1beta1
kind: Application
metadata:
name: tvk
namespace: trilio-system
spec:
componentKinds:
- group: apps.open-cluster-management.io
kind: Subscription
descriptor: {}
selector:
matchExpressions:
- key: app
operator: In
values:
- tvk
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-tvk-channel
spec:
remediationAction: enforce
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: apps.open-cluster-management.io/v1
kind: Channel
metadata:
annotations:
apps.open-cluster-management.io/reconcile-rate: medium
name: hchartsk8strilionet-trilio-chart
namespace: hchartsk8strilionet-trilio-chart-ns
spec:
pathname: 'https://charts.k8strilio.net/trilio-stable/k8s-triliovault-operator'
type: HelmRepo
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-tvk-subscription
spec:
remediationAction: enforce
severity: high
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: apps.open-cluster-management.io/v1
kind: Subscription
metadata:
name: tvk-subscription-1
namespace: trilio-system
annotations: {}
labels:
app: tvk
apps.open-cluster-management.io/reconcile-rate: medium
spec:
name: k8s-triliovault-operator
channel: hchartsk8strilionet-trilio-chart-ns/hchartsk8strilionet-trilio-chart
packageOverrides:
- packageName: k8s-triliovault-operator
packageAlias: k8s-triliovault-operator