@@ -82,10 +82,6 @@ The following example deploys an external secrets operator to a managed cluster
8282 kind : Policy
8383 metadata :
8484 name : policy-eso
85- annotations :
86- policy.open-cluster-management.io/standards : NIST SP 800-53
87- policy.open-cluster-management.io/categories : CM Configuration Management
88- policy.open-cluster-management.io/controls : CM-2 Baseline Configuration
8985 spec :
9086 remediationAction : inform
9187 disabled : false
@@ -189,26 +185,11 @@ The following example deploys an external secrets operator to a managed cluster
189185
190186 The policy is in ` NonCompliant ` state because the external secrets operator was not found on the managed cluster in the ` default ` namespace.
191187
192- 7 . To automatically install the operator on the managed cluster, edit the policy remediation action to ` enforce ` , then re-apply the policy:
193-
194- ``` Yaml
195- apiVersion : policy.open-cluster-management.io/v1
196- kind : Policy
197- metadata :
198- name : policy-eso
199- annotations :
200- policy.open-cluster-management.io/standards : NIST SP 800-53
201- policy.open-cluster-management.io/categories : CM Configuration Management
202- policy.open-cluster-management.io/controls : CM-2 Baseline Configuration
203- spec :
204- remediationAction : enforce # This top-level 'enforce' will override the OperatorPolicy `spec.remediationAction`
205- ` ` `
188+ 7 . To automatically install the operator on the managed cluster, patch the policy remediation action to ` enforce ` . Note the top-level Policy remediation action ` enforce ` will override the OperatorPolicy remediation action.
206189
207190 ``` Shell
208- $ kubectl apply -n default -f policy-eso.yaml --context ${CTX_HUB_CLUSTER}
209- policy.policy.open-cluster-management.io/policy-eso configured
210- placementbinding.policy.open-cluster-management.io/binding-policy-eso unchanged
211- placement.cluster.open-cluster-management.io/placement-policy-eso unchanged
191+ $ kubectl patch policy policy-eso -n default --context ${CTX_HUB_CLUSTER} --type=merge -p ' {"spec": {"remediationAction": "enforce"}}'
192+ policy.policy.open-cluster-management.io/policy-eso patched
212193 ```
213194
2141958 . Verify the external secrets operator subscription was created:
@@ -252,12 +233,8 @@ By default, the operator policy controller will delete most of the objects creat
252233 kind: Policy
253234 metadata:
254235 name: policy-eso
255- annotations:
256- policy.open-cluster-management.io/standards: NIST SP 800-53
257- policy.open-cluster-management.io/categories: CM Configuration Management
258- policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
259236 spec:
260- remediationAction: enforce
237+ remediationAction: enforce # Ensure remediationAction is set to ` enforce `
261238 disabled: false
262239 policy-templates:
263240 - objectDefinition:
0 commit comments