added placement tolerations

Signed-off-by: Christian Stark <cstark@cstark-thinkpadx1carbongen11.muc.csb>

Author: Christian Stark

policygenerator/policy-sets/community/ocp-best-practices/input-tolerations/placement-tolerations.yaml

@@ -0,0 +1,46 @@
+---
+object-templates-raw: |
+  {{/* ##  Gather all Placements from the hub cluster ## */}}
+  {{- $unreachableToleration := "cluster.open-cluster-management.io/unreachable" }}
+  {{- $unavailableToleration := "cluster.open-cluster-management.io/unavailable" }}
+
+  {{- range $pt := (lookup "cluster.open-cluster-management.io/v1beta1" "Placement" "" "").items }}
+    {{- $hasUnreachable := false }}
+    {{- $hasUnavailable := false }}
+
+  - complianceType: musthave
+    objectDefinition:
+      apiVersion: cluster.open-cluster-management.io/v1beta1
+      kind: Placement
+      metadata:
+        name: {{ $pt.metadata.name }}
+        namespace: {{ $pt.metadata.namespace }}
+      spec:
+        tolerations:
+    {{- range $t := $pt.spec.tolerations }}
+      {{/* ##  check if the toleration is unavailable or unreachable ## */}}
+      {{- if eq $t.key $unreachableToleration }}
+        {{- $hasUnreachable = true }}
+      {{- else if eq $t.key $unavailableToleration }}
+        {{- $hasUnavailable = true }}
+      {{- end }}
+          - key: {{ $t.key }}
+            operator: {{ $t.operator }}
+      {{- if not (empty $t.value) }}
+            value: {{ $t.value }}
+      {{- end }}
+      {{- if not (empty $t.tolerationSeconds) }}
+            tolerationSeconds: {{ $t.tolerationSeconds }}
+      {{- end }}
+    {{- end }}
+
+    {{- if not $hasUnreachable }}
+          - key: {{ $unreachableToleration }}
+            operator: Exists
+    {{- end }}
+
+    {{- if not $hasUnavailable  }}
+          - key: {{ $unavailableToleration }}
+            operator: Exists
+    {{- end }}
+  {{- end }}

policygenerator/policy-sets/community/ocp-best-practices/input/hub-placement.yaml

@@ -0,0 +1,11 @@
+apiVersion: cluster.open-cluster-management.io/v1beta1
+kind: Placement
+metadata:
+  name: placement-openshift-plus-hub
+  namespace: policies
+spec:
+  predicates:
+    - requiredClusterSelector:
+        labelSelector:
+          matchExpressions:
+            - {key: "local-cluster", operator: In, values: ["true"]}

policygenerator/policy-sets/community/ocp-best-practices/input/placement.yaml

@@ -9,3 +9,4 @@ spec:
         labelSelector:
           matchExpressions:
             - {key: vendor, operator: In, values: ["OpenShift"]}
+            - {key: "local-cluster", operator: NotIn, values: ["true"]}

policygenerator/policy-sets/community/ocp-best-practices/policyGenerator.yaml

@@ -12,6 +12,7 @@ policyDefaults:
   namespace: policies
   policySets:
     - openshift-best-practices
+    - openshift-best-practices-hub
   remediationAction: enforce
   severity: medium
   standards:
@@ -26,6 +27,8 @@ policies:
     manifests:
       - path: input-admin/policy-remove-kubeadmin.yaml
     remediationAction: "inform"
+    policySets:  
+      - openshift-best-practices     
   - name: policy-config-audit
     categories:
       - AU Audit and Accountability
@@ -34,6 +37,9 @@ policies:
     manifests:
       - path: input-audit/policy-config-audit.yaml
     remediationAction: "enforce"
+    policySets:  
+      - openshift-best-practices-hub 
+      - openshift-best-practices     
   #- name: policy-cert-ocp4
   #  categories:
   #    - SC System and Communications Protection
@@ -45,15 +51,24 @@ policies:
     manifests:
       - path: input-compliance/policy-compliance-operator-install.yaml
     remediationAction: "enforce"
+    policySets:
+      - openshift-best-practices-hub
+      - openshift-best-practices
   - name: policy-compliance-operator-moderate-scan
     manifests:
       - path: input-compliance/policy-compliance-operator-moderate-scan.yaml
     remediationAction: "enforce"
+    policySets:
+      - openshift-best-practices-hub
+      - openshift-best-practices
   - name: policy-compliance-operator-moderate-scan-results
     complianceType: "mustnothave"
     manifests:
       - path: input-compliance/policy-compliance-operator-scan-results.yaml
     remediationAction: "inform"
+    policySets:
+      - openshift-best-practices-hub
+      - openshift-best-practices
   #- name: policy-etcd-backup
   #  manifests:
   #    - path: input-etcd/policy-etcd-backup.yaml
@@ -66,6 +81,9 @@ policies:
     manifests:
       - path: input-etcd/policy-etcdencryption.yaml
     remediationAction: "enforce"
+    policySets:  
+      - openshift-best-practices-hub 
+      - openshift-best-practices     
   - name: policy-file-integrity-operator
     categories:
       - SC System and Communications Protection
@@ -74,6 +92,8 @@ policies:
     manifests:
       - path: input-files/policy-file-integrity-operator.yaml
     remediationAction: "enforce"
+    policySets:  
+      - openshift-best-practices     
   - name: policy-file-integrity-node-status
     complianceType: "mustnothave"
     categories:
@@ -83,6 +103,9 @@ policies:
     manifests:
       - path: input-files/policy-file-integrity-node-status.yaml
     remediationAction: "inform"
+    policySets:  
+      - openshift-best-practices-hub 
+      - openshift-best-practices     
   - name: policy-checkfipscompliance
     categories:
       - CA Security Assessment and Authorization
@@ -91,11 +114,17 @@ policies:
     manifests:
       - path: input-fips/policy-check-fips.yaml
     remediationAction: "inform"
+    policySets:  
+      - openshift-best-practices-hub 
+      - openshift-best-practices 
   - name: policy-checkclusteroperator
     complianceType: "mustnothave"
     manifests:
       - path: input-operators/
     remediationAction: "inform"
+    policySets:  
+      - openshift-best-practices-hub 
+      - openshift-best-practices 
   - name: policy-scc-restricted
     categories:
       - SC System and Communications Protection
@@ -104,8 +133,19 @@ policies:
     manifests:
       - path: input-scc/
     remediationAction: "inform"
+  - name: policy-placement-tolerations
+    severity: critical 
+    remediationAction: inform
+    manifests:
+      - path: input-tolerations/placement-tolerations.yaml
+    policySets:  
+      - openshift-best-practices-hub 
 policySets:
   - description: Applies the OpenShift best practices for how to harden your OpenShift clusters.
     name: openshift-best-practices
     placement:
       placementPath: input/placement.yaml
+  - description: Applies the OpenShift best practices for how to harden your OpenShift clusters on the hub.
+    name: openshift-best-practices-hub       
+    placement:
+      placementPath: input/hub-placement.yaml