Chapter 9. Create security policies

Procedure

1. Log in to your Red Hat Advanced Cluster Management.
2. Go to the Governance page and click Create policy. As you create your new policy from the console, a YAML file is also created in the YAML editor.
3. To view the YAML editor, select the toggle at the beginning of the Create policy form to enable it.

4. Complete the Create policy form, then select the Submit button. If you choose to create a pod policy, your YAML file might resemble the following policy:

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-pod
     annotations:
       policy.open-cluster-management.io/categories: 'SystemAndCommunicationsProtections,SystemAndInformationIntegrity'
       policy.open-cluster-management.io/controls: 'control example'
       policy.open-cluster-management.io/standards: 'NIST,HIPAA'
       policy.open-cluster-management.io/description:
   spec:
     complianceType: musthave
     namespaces:
       exclude: ["kube*"]
       include: ["default"]
       pruneObjectBehavior: None
     object-templates:
     - complianceType: musthave
       objectDefinition:
         apiVersion: v1
         kind: Pod
         metadata:
           name: pod1
         spec:
           containers:
           - name: pod-name
             image: 'pod-image'
             ports:
             - containerPort: 80
     remediationAction: enforce
     disabled: false

5. Create the following PlacementBinding example:

   apiVersion: policy.open-cluster-management.io/v1
   kind: PlacementBinding
   metadata:
     name: binding-pod
   placementRef:
     name: placement-pod
     kind: Placement
     apiGroup: cluster.open-cluster-management.io
   subjects:
   - name: policy-pod
     kind: Policy
     apiGroup: policy.open-cluster-management.io

6. Create the following Placement example:

   apiVersion: cluster.open-cluster-management.io/v1beta1
    kind: Placement
    metadata:
      name: placement-pod
   spec:
     predicates:
     - requiredClusterSelector:
         labelSelector:
           matchLabels:
             cloud: "IBM"
       tolerations:
           - key: cluster.open-cluster-management.io/unavailable
             operator: Exists
           - key: cluster.open-cluster-management.io/unreachable
             operator: Exists

7. Optional: Add a description for your policy.
8. Click Create Policy.

Procedure

1. Navigate to the Governance page to view a table list of your policies. Note: You can filter the table list of your policies by selecting the Policies tab or Cluster violations tab.
2. Select one of your policies to view more details. The Details, Clusters, and Templates tabs are displayed. When the cluster or policy status cannot be determined, the following message is displayed: No status.
3. Alternatively, select the Policies tab to view the list of policies. Expand a policy row to view the Description, Standards, Controls, and Categories details.

Procedure

1. View details for a specific security policy by running the following command:

   oc get policies.policy.open-cluster-management.io <policy-name> -n <policy-namespace> -o yaml

2. View a description of your security policy by running the following command:

   oc describe policies.policy.open-cluster-management.io <policy-name> -n <policy-namespace>

Procedure

1. Run the following command to create a policy set from the command line:

   oc apply -f <policyset-filename>

2. To create a policy set from the console, log in and select Governance.
3. Select the Policy sets tab.
4. Select the Create policy set button and complete the form.
5. Add the details for your policy set and select the Submit button.

Procedure

1. Add a policy to a policy set from the command-line interface:

   1. Run the following command to edit your policy set:

   oc edit policysets <your-policyset-name>

2. Add the policy name to the list in the policies section of the policy set.

3. Apply your added policy in the placement section of your policy set with the following command:

   oc apply -f <your-added-policy.yaml>

   Note: If you delete the placement binding, the policy is still placed by the policy set.

4. Add a policy to a policy set from the console:

   1. Add a policy to the policy set by selecting the Policy sets tab.
   2. Select the Actions icon and select Edit. The Edit policy set form appears.
   3. Navigate to the Policies section of the form to select a policy to add to the policy set.

Procedure

1. Delete policy sets from the console
2. From the Policy sets tab, select the Actions icon for the policy set. When you click Delete, the Permanently delete Policyset? dialogue box appears.
3. Click the Delete button.

Procedure

1. Log in to your console, navigate to the Governance page to view a table list of your policies.
2. Select the Actions icon > Disable policy. The Disable Policy dialog box appears.
3. Click Disable policy.