docs: add operator policy guide - #556
Merged
openshift-merge-bot[bot] merged 1 commit intoMay 19, 2026
Merged
Conversation
✅ Deploy Preview for open-cluster-management ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
WalkthroughAdds Operator Policy documentation: index subsection, policy-kinds list entry, and a new operator-policy page with front matter, prerequisites, enablement, a worked example (inform→enforce), verification, and cleanup instructions. ChangesOperator Policy Documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md`:
- Around line 228-253: The cleanup instructions are contradictory: the text says
the OperatorPolicy deletion runs only when spec.complianceType is set to
mustnothave AND spec.remediationAction is set to enforce, but the example YAML
shows remediationAction: inform; update the example policy YAML (the Policy
resource in the snippet) to set spec.remediationAction: enforce and ensure
spec.complianceType: mustnothave (and keep the removalBehavior block shown
earlier) so the example matches the described behavior for OperatorPolicy and
removalBehavior.
- Around line 38-39: The code blocks include shell prompts like "$ clusteradm
addon enable addon --names config-policy-controller --clusters <cluster_name>
--context ${CTX_HUB_CLUSTER}" which triggers markdownlint MD014; remove the
leading "$ " from these command lines (e.g., the clusteradm addon enable command
and the other similar blocks) so the fenced code blocks contain only the raw
command, ensuring consistent lint-clean markdown across the file.
- Around line 141-149: The ordered-step numbering in the example procedure is
incorrect (it jumps from Step 1 to Step 3); update the numbered list so the
kubectl apply command block is Step 2 and subsequent items are renumbered
sequentially (e.g., ensure the lines containing the kubectl apply command, the
ManagedClusterSetBinding instruction, and the Placement verification read Steps
2, 3, and 4 respectively), and verify references to ManagedClusterSetBinding and
Placement remain unchanged.
- Line 62: Replace the shell alias usage in the command snippet so it is
copy/paste-safe: change the example command that starts with "k describe pod
config-policy-controller-5888b6cbc5-lvwdj -n open-cluster-management-agent-addon
--context ${CTX_MANAGED_CLUSTER} | grep enable-operator-policy" to use the full
"kubectl" binary (i.e., "kubectl describe ...") so users without a "k" alias can
run the command successfully.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3385cdd2-256e-41cb-a95b-16f09f2dbfb8
📒 Files selected for processing (3)
content/en/docs/getting-started/integration/policy-controllers/_index.mdcontent/en/docs/getting-started/integration/policy-controllers/operator-policy.mdcontent/en/docs/getting-started/integration/policy-controllers/policy.md
jan-law
force-pushed
the
10409-operator-policy
branch
2 times, most recently
from
May 5, 2026 19:58
2d1a735 to
c62b6b2
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
content/en/docs/getting-started/integration/policy-controllers/operator-policy.md (1)
38-40:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winRemove
$prompts from shell command blocks.These fenced command blocks still use leading
$, which triggers markdownlint MD014 and reduces copy/paste reliability in docs.Also applies to: 45-48, 53-55, 60-66, 146-150, 157-163, 170-173, 178-188, 208-212, 217-220, 227-230, 273-277, 282-289, 294-296
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md` around lines 38 - 40, Remove the leading "$" prompts from all fenced shell command blocks in content/en/docs/getting-started/integration/policy-controllers/operator-policy.md so they pass markdownlint MD014 and copy/paste cleanly; locate the code fences that contain commands such as "clusteradm addon enable addon --names config-policy-controller --clusters <cluster_name> --context ${CTX_HUB_CLUSTER}" and the other blocks noted (lines around the ranges in the review) and edit each block to strip the leading "$ " from each command line while preserving the rest of the content and fences.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md`:
- Around line 81-140: The YAML examples have incorrect indentation causing
top-level keys (e.g., remediationAction, disabled, policy-templates,
placementRef, subjects, predicates) to be siblings of metadata instead of nested
under their parent spec blocks; update the Policy (metadata.name: policy-eso /
kind: Policy), OperatorPolicy objectDefinition (metadata.name: policy-eso /
kind: OperatorPolicy), PlacementBinding (name: binding-policy-eso / kind:
PlacementBinding) and Placement (name: placement-policy-eso / kind: Placement)
YAML so that each remediationAction, disabled, policy-templates, placementRef,
subjects and predicates are indented under the respective spec: block, and apply
the same indentation fix to the other listed snippets (lines ~195-205, ~251-270)
to ensure kubectl apply will accept the manifests.
---
Duplicate comments:
In
`@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md`:
- Around line 38-40: Remove the leading "$" prompts from all fenced shell
command blocks in
content/en/docs/getting-started/integration/policy-controllers/operator-policy.md
so they pass markdownlint MD014 and copy/paste cleanly; locate the code fences
that contain commands such as "clusteradm addon enable addon --names
config-policy-controller --clusters <cluster_name> --context ${CTX_HUB_CLUSTER}"
and the other blocks noted (lines around the ranges in the review) and edit each
block to strip the leading "$ " from each command line while preserving the rest
of the content and fences.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 97958104-f056-43b3-8565-c2d8f84b4e3f
📒 Files selected for processing (3)
content/en/docs/getting-started/integration/policy-controllers/_index.mdcontent/en/docs/getting-started/integration/policy-controllers/operator-policy.mdcontent/en/docs/getting-started/integration/policy-controllers/policy.md
✅ Files skipped from review due to trivial changes (2)
- content/en/docs/getting-started/integration/policy-controllers/_index.md
- content/en/docs/getting-started/integration/policy-controllers/policy.md
jan-law
force-pushed
the
10409-operator-policy
branch
from
May 5, 2026 20:25
c62b6b2 to
d85873d
Compare
JustinKuli
approved these changes
May 7, 2026
JustinKuli
left a comment
JustinKuli
left a comment
Member
There was a problem hiding this comment.
/approve
/hold
Looks good overall to me! Minor suggestions you can skip if you want.
jan-law
force-pushed
the
10409-operator-policy
branch
from
May 7, 2026 21:23
30c908f to
933673b
Compare
Member
|
/cc @dhaiducek |
dhaiducek
suggested changes
May 11, 2026
jan-law
force-pushed
the
10409-operator-policy
branch
from
May 13, 2026 15:28
933673b to
b33854a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
content/en/docs/getting-started/integration/policy-controllers/operator-policy.md (1)
114-125:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPlacementBinding example is missing
spec, so the YAML shape is invalid.
placementRefandsubjectsmust be nested underspecforPlacementBinding. As written, this manifest is not structurally correct.Suggested doc fix
apiVersion: policy.open-cluster-management.io/v1 kind: PlacementBinding metadata: name: binding-policy-eso - placementRef: - name: placement-policy-eso - kind: Placement - apiGroup: cluster.open-cluster-management.io - subjects: - - name: policy-eso - kind: Policy - apiGroup: policy.open-cluster-management.io + spec: + placementRef: + name: placement-policy-eso + kind: Placement + apiGroup: cluster.open-cluster-management.io + subjects: + - name: policy-eso + kind: Policy + apiGroup: policy.open-cluster-management.ioIn Open Cluster Management, what is the required schema for a PlacementBinding (policy.open-cluster-management.io/v1)? Specifically, are placementRef and subjects required under spec?🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md` around lines 114 - 125, The PlacementBinding manifest is invalid because placementRef and subjects are placed at top-level instead of under spec; update the PlacementBinding resource (kind: PlacementBinding, apiVersion: policy.open-cluster-management.io/v1) so that metadata remains top-level and add a spec object containing placementRef and subjects (i.e., move the existing placementRef and subjects keys into spec) to conform to the required PlacementBinding schema.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md`:
- Line 38: The command string mistakenly includes a duplicate token ("addon")
and omits the required --namespace flag; update the invocation that currently
uses "clusteradm addon enable addon --names config-policy-controller --clusters
<cluster_name> --context ${CTX_HUB_CLUSTER}" to use the proper syntax for
clusteradm addon enable (remove the extra "addon") and append the required
--namespace <namespace> parameter so the final call uses "clusteradm addon
enable --names config-policy-controller --clusters <cluster_name> --context
${CTX_HUB_CLUSTER} --namespace <namespace>" (fix the literal command string
containing clusteradm, addon enable, --names and --namespace).
---
Duplicate comments:
In
`@content/en/docs/getting-started/integration/policy-controllers/operator-policy.md`:
- Around line 114-125: The PlacementBinding manifest is invalid because
placementRef and subjects are placed at top-level instead of under spec; update
the PlacementBinding resource (kind: PlacementBinding, apiVersion:
policy.open-cluster-management.io/v1) so that metadata remains top-level and add
a spec object containing placementRef and subjects (i.e., move the existing
placementRef and subjects keys into spec) to conform to the required
PlacementBinding schema.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2ea0a55e-f41d-454e-93aa-0507af158f92
📒 Files selected for processing (3)
content/en/docs/getting-started/integration/policy-controllers/_index.mdcontent/en/docs/getting-started/integration/policy-controllers/operator-policy.mdcontent/en/docs/getting-started/integration/policy-controllers/policy.md
✅ Files skipped from review due to trivial changes (2)
- content/en/docs/getting-started/integration/policy-controllers/_index.md
- content/en/docs/getting-started/integration/policy-controllers/policy.md
Contributor
Author
|
/hold operator policy will be enabled by default soon, after which I will update this guide |
jan-law
force-pushed
the
10409-operator-policy
branch
from
May 13, 2026 19:18
b33854a to
5c65c6b
Compare
JustinKuli
reviewed
May 13, 2026
ref: https://redhat.atlassian.net/browse/ACM-10409 Signed-off-by: Janelle Law <jalaw@redhat.com> Remove duplicate addon token Signed-off-by: Janelle Law <jalaw@redhat.com>
jan-law
force-pushed
the
10409-operator-policy
branch
from
May 13, 2026 19:41
5c65c6b to
be1fef3
Compare
Contributor
Author
|
/unhold |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dhaiducek, jan-law, JustinKuli The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit May 19, 2026
b5cf3f2
into
open-cluster-management-io:main
8 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ref: https://redhat.atlassian.net/browse/ACM-10409
hugo serverSummary by CodeRabbit