Skip to content

Commit 7d73a19

Browse files
dhaiducekdhaiducek
authored
Implement the Placement API (#30)
* Implement the Placement API Sync changes from: - open-cluster-management-io/ocm-kustomize-generator-plugins#3 Signed-off-by: Dale Haiducek <[email protected]> * Evaluate symlinks to verify the paths Signed-off-by: Dale Haiducek <[email protected]>
1 parent f1b7026 commit 7d73a19

File tree

11 files changed

+1077
-274
lines changed

11 files changed

+1077
-274
lines changed

‎README.md‎

Lines changed: 57 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,13 @@
22

33
## Overview
44

5-
The Policy Generator constructs Open Cluster Management policies from Kubernetes YAML files provided through a PolicyGenerator Custom Resource. The Policy Generator is a binary compiled for use as a [kustomize](https://kustomize.io/) exec plugin.
5+
The Policy Generator constructs Open Cluster Management policies from Kubernetes YAML files provided
6+
through a PolicyGenerator Custom Resource. The Policy Generator is a binary compiled for use as a
7+
[kustomize](https://kustomize.io/) exec plugin.
68

79
For more about Open Cluster Management and its Policy Framework:
8-
- [Open Cluster Management website](open-cluster-management.io/)
10+
11+
- [Open Cluster Management website](https://open-cluster-management.io/)
912
- [Governance Policy Framework](https://open-cluster-management.io/getting-started/integration/policy-framework/)
1013
- [Policy Collection repository](https://github.com/open-cluster-management/policy-collection)
1114

@@ -23,70 +26,78 @@ For more about Open Cluster Management and its Policy Framework:
2326

2427
2. Create the plugin directory:
2528

26-
```bash
27-
mkdir -p ${HOME}/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator
28-
```
29+
```bash
30+
mkdir -p ${HOME}/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator
31+
```
2932

3033
3. Move the binary to the plugin directory:
3134

32-
- Linux:
35+
- Linux:
3336

34-
```bash
35-
chmod +x linux-amd64-PolicyGenerator
36-
mv linux-amd64-PolicyGenerator ${HOME}/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
37-
```
37+
```bash
38+
chmod +x linux-amd64-PolicyGenerator
39+
mv linux-amd64-PolicyGenerator ${HOME}/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
40+
```
3841

39-
- MacOS:
42+
- MacOS:
4043

41-
```bash
42-
chmod +x darwin-amd64-PolicyGenerator
43-
mv darwin-amd64-PolicyGenerator ${HOME}/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
44-
```
44+
```bash
45+
chmod +x darwin-amd64-PolicyGenerator
46+
mv darwin-amd64-PolicyGenerator ${HOME}/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
47+
```
4548

4649
##### Build and install from source
4750

4851
1. Build the plugin binary (only needed once or to update the plugin):
49-
```bash
50-
make build
51-
```
52-
**NOTE:** This will default to placing the binary in `${HOME}/.config/kustomize/plugin/`. You can change this by exporting `KUSTOMIZE_PLUGIN_HOME` to a different path.
52+
```bash
53+
make build
54+
```
55+
**NOTE:** This will default to placing the binary in `${HOME}/.config/kustomize/plugin/`. You can
56+
change this by exporting `KUSTOMIZE_PLUGIN_HOME` to a different path.
5357

5458
#### Configuration
5559

56-
1. Create a `kustomization.yaml` file that points to `PolicyGenerator` manifest(s), with any additional desired patches or customizations (see [`examples/policyGenerator.yaml`](./examples/policyGenerator.yaml) for an example):
57-
```yaml
58-
generators:
59-
- path/to/generator/file.yaml
60-
...
61-
```
62-
- To read more about the `PolicyGenerator` YAML, see [About the PolicyGenerator plugin](./docs/policygenerator.md)
60+
1. Create a `kustomization.yaml` file that points to `PolicyGenerator` manifest(s), with any
61+
additional desired patches or customizations (see
62+
[`examples/policyGenerator.yaml`](./examples/policyGenerator.yaml) for an example):
63+
64+
```yaml
65+
generators:
66+
- path/to/generator/file.yaml
67+
```
68+
69+
- To read more about the `PolicyGenerator` YAML, see
70+
[About the PolicyGenerator plugin](./docs/policygenerator.md)
6371

6472
2. To use the plugin to generate policies, do one of:
65-
- Utilize the `examples/` directory in this repository (the directory can be modified by exporting a new path to `SOURCE_DIR`):
66-
```bash
67-
make generate
68-
```
69-
- From any directory with a `kustomization.yaml` file pointing to `PolicyGenerator` manifests:
70-
```bash
71-
kustomize build --enable-alpha-plugins
72-
```
73+
- Utilize the `examples/` directory in this repository (the directory can be modified by
74+
exporting a new path to `SOURCE_DIR`):
75+
```bash
76+
make generate
77+
```
78+
- From any directory with a `kustomization.yaml` file pointing to `PolicyGenerator` manifests:
79+
```bash
80+
kustomize build --enable-alpha-plugins
81+
```
7382

7483
### As a standalone binary
7584

7685
In order to bypass Kustomize and run the generator binary directly:
7786

7887
1. Build the binary:
79-
```bash
80-
make build-binary
81-
```
88+
89+
```bash
90+
make build-binary
91+
```
8292

8393
2. Run the binary from the location of the PolicyGenerator manifest(s):
84-
```bash
85-
path/to/PolicyGenerator <path/to/file/1> ... <path/to/file/n>
86-
```
87-
- For example:
88-
```bash
89-
cd examples
90-
../PolicyGenerator policyGenerator.yaml
91-
```
92-
**NOTE:** To print the trace in the case of an error, you can add the `--debug` flag to the arguments.
94+
```bash
95+
path/to/PolicyGenerator <path/to/file/1> ... <path/to/file/n>
96+
```
97+
- For example:
98+
```bash
99+
cd examples
100+
../PolicyGenerator policyGenerator.yaml
101+
```
102+
**NOTE:** To print the trace in the case of an error, you can add the `--debug` flag to the
103+
arguments.

‎docs/policygenerator-reference.yaml‎

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,11 @@ policyDefaults:
2121
# annotation. This defaults to ["CM-2 Baseline Configuration"].
2222
controls:
2323
- "CM-2 Baseline Configuration"
24-
# Optional. This determines if a single configuration policy should be
25-
# generated for all the manifests being wrapped in the policy.
26-
# If set to false, a configuration policy per manifest will be generated.
27-
# This defaults to true.
24+
# Optional. This determines if a single configuration policy should be generated for all the
25+
# manifests being wrapped in the policy. If set to false, a configuration policy per manifest will
26+
# be generated. This defaults to true.
2827
consolidateManifests: true
29-
# Optional. When the policy references a Kyverno policy manifest, this determines if an additonal
28+
# Optional. When the policy references a Kyverno policy manifest, this determines if an additional
3029
# configuration policy should be generated in order to receive policy violations in Open Cluster
3130
# Management when the Kyverno policy has been violated. This defaults to true.
3231
informKyvernoPolicies: true
@@ -35,15 +34,22 @@ policyDefaults:
3534
# Optional. The placement configuration for the policies. This defaults to a placement
3635
# configuration that matches all clusters.
3736
placement:
38-
# To specify a placement, specify key:value pair cluster selectors. (See placementRulePath to
39-
# specify an existing file instead.)
37+
# To specify a placement rule, specify key:value pair cluster selectors. (See placementRulePath
38+
# to specify an existing file instead.)
4039
clusterSelectors: {}
40+
# To specify a placement, specify key:value pair cluster label selectors. (See placementPath to
41+
# specify an existing file instead.)
42+
labelSelector: {}
4143
# Optional. Specifying a name will consolidate placement rules that contain the same cluster
4244
# selectors.
4345
name: ""
44-
# To reuse an existing placement rule, specify the path here relative to the kustomization.yaml
45-
# file. If given, this placement rule will be used by all policies by default. (See
46-
# clusterSelectors to generate a new Placement instead.)
46+
# To reuse an existing placement manifest, specify the path here relative to the
47+
# kustomization.yaml file. If given, this placement will be used by all policies by default.
48+
# (See clusterSelectors to generate a new Placement instead.)
49+
placementPath: ""
50+
# To reuse an existing placement rule manifest, specify the path here relative to the
51+
# kustomization.yaml file. If given, this placement rule will be used by all policies by
52+
# default. (See clusterSelectors to generate a new PlacementRule instead.)
4753
placementRulePath: ""
4854
# Optional. The remediation action ("inform" or "enforce") for each configuration policy. This
4955
# defaults to "inform".
@@ -58,14 +64,14 @@ policyDefaults:
5864
# Required. The list of policies to create along with overrides to either the default values or, if
5965
# set, the values given in policyDefaults.
6066
policies:
61-
# Required. The name of the policy to create.
67+
# Required. The name of the policy to create.
6268
- name: ""
6369
# Required. The list of Kubernetes resource object manifests to include in the policy.
6470
manifests:
65-
# Required. Path to a single file or a flat directory of files relative to the
66-
# kustomization.yaml file. This path cannot be in a directory outside of the directory with
67-
# the kustomization.yaml file. Subdirectories within the directory with kustomization.yaml
68-
# file are allowed.
71+
# Required. Path to a single file or a flat directory of files relative to the
72+
# kustomization.yaml file. This path cannot be in a directory outside of the directory with
73+
# the kustomization.yaml file. Subdirectories within the directory with kustomization.yaml
74+
# file are allowed.
6975
- path: ""
7076
# Optional. (See policy[0].complianceType for description.)
7177
complianceType: "musthave"

‎docs/policygenerator.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,15 @@ generator plugin to be enabled.
1818

1919
By default, a Placement and PlacementBinding are created for each policy with the policy name as the
2020
suffix. To signal that you'd like to consolidate policies that use the same Placement under a single
21-
PlacementBinding, either specify `placement.placementRulePath` to an existing Placement manifest or
22-
set `placement.name` along with `placement.clusterSelectors`. When the PlacementBinding is
23-
consolidated in this way, `placementBindingDefaults.name` must be specified so that the generator
24-
can create unique names for the bindings.
21+
PlacementBinding, either specify `placement.placementRulePath` to an existing Placement manifest or set
22+
`placement.name` along with `placement.clusterSelectors`. When the PlacementBinding is consolidated in
23+
this way, `placementBindingDefaults.name` must be specified so that the generator can create unique
24+
names for the bindings.
25+
26+
The PlacementRule kind in the `apps.open-cluster-management.io` API group is used by default if no
27+
placement is given. However, you can use the Placement kind in the
28+
`cluster.open-cluster-management.io` API group by specifying a Placement manifest in
29+
`placement.placementPath` or specifying labels in `placement.labelSelector`.
2530

2631
## Policy expanders
2732

‎examples/input/placement.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: cluster.open-cluster-management.io/v1alpha1
2+
kind: Placement
3+
metadata:
4+
labels:
5+
custom: myApp
6+
name: placement-red-hat-cloud
7+
namespace: my-policies
8+
spec:
9+
predicates:
10+
requiredClusterSelector:
11+
labelSelector:
12+
matchExpressions:
13+
- key: cloud
14+
operator: In
15+
values:
16+
- red hat

‎examples/policyGenerator.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ placementBindingDefaults:
66
name: my-placement-binding
77
policyDefaults:
88
# categories: []
9+
# complianceType: "musthave"
910
controls:
1011
- PR.DS-1 Data-at-rest
1112
namespace: my-policies

0 commit comments

Comments
 (0)