Chapter 2. Policy deployment strategy
The Kubernetes API is used to define and interact with policies. You are responsible for ensuring that the environment meets internal enterprise security standards for software engineering, secure engineering, resiliency, security, and regulatory compliance for workloads hosted on Kubernetes clusters.
Deployment options
The
CertificatePolicy,ConfigurationPolicy, andOperatorPolicypolicies and Gatekeeper constraints can be deployed to your managed clusters in two ways. You can deploy policies to your managed clusters by using the Hub cluster policy framework or Deploying policies with external tools. View the following descriptions of each option:- Hub cluster policy framework
-
The first approach is to leverage the policy framework on the hub cluster. This involves defining the policies and Gatekeeper constraints within a
Policyobject on the hub cluster and leveraging aPlacementandPlacementBindingto select which clusters the policies get deployed to. The policy framework handles the delivery to the managed cluster and the status aggregation back to the hub cluster. ThePolicyobjects are represented in the Policies table in the Red Hat Advanced Cluster Management for Kubernetes console. - Deploying policies with external tools
- Alternatively, you can use an external tool, such as Red Hat OpenShift GitOps, to deliver the policies and Gatekeeper constraints directly to the managed cluster. Your policies are shown in the Discovered policies table in the Red Hat Advanced Cluster Management console and can be a helpful option if a configuration management strategy is already in place, but there is a desire to supplement the strategy with Red Hat Advanced Cluster Management policies.
See the following comparison table to learn which option supports specific features, which helps you make a decision on which deployment strategy is more suitable for your use case:
| Feature | Policy framework | Deployed with external tools |
|---|---|---|
| Hub cluster templating | Yes | Yes, but requires additional setup. |
| Managed cluster templating | Yes | Yes |
| Red Hat Advanced Cluster Management console support | Yes | Yes, you can view policies that are deployed by external tools from the Discover policies table. Policies that are deployed with external tools are not displayed from the Governance Overview dashboard. You must enable the search service on your managed cluster. |
| Policy grouping |
Yes, you can have a combination of statuses and deployments through |
You can use Kubernetes labels on your policy resources to logically group related policies and view the Discovered policies table. You can also use Argo CD |
| Policy event history | You can view the last 10 events per cluster per policy stored on your hub cluster. | You can view the last 10 events in the status of the policy on your managed cluster. |
| Policy dependencies | Yes | No. Alternatively, you can use the Argo CD sync waves feature to define dependencies. |
| Policy Generator | Yes | No |
| OpenShift GitOps health checks You must complete extra configuration for Argo CD versions earlier than 2.13. | Yes | Yes |
| OpenShift GitOps applying native Kubernetes manifests and Red Hat Advanced Cluster Management policy on the managed cluster | No, you must deploy a policy on your Red Hat Advanced Cluster Management hub cluster. | Yes |
| Policy status metric on the hub cluster for alerts | Yes |
Yes, |
| Running Ansible jobs on violated policies |
Yes, use the | No |
Additional resources
2.1. Policy deployment with external tools
To deploy CertificatePolicy, ConfigurationPolicy, OperatorPolicy resources, and Gatekeeper constraints directly to your managed cluster, you can use an external tool such as Red Hat OpenShift GitOps.
Deployment workflow
Your
CertificatePolicy,ConfigurationPolicy,OperatorPolicypolicies must be in theopen-cluster-management-policiesnamespace or the managed cluster namespace. Policies in other namespaces are ignored and do not receive a status. If you are using a Red Hat OpenShift GitOps version with an Argo CD version earlier than 2.13, you must configure Red Hat Advanced Cluster Management for Kubernetes policy health checks.
The OpenShift GitOps service account must have permission to manage Red Hat Advanced Cluster Management for Kubernetes policies. Deploy policies with OpenShift GitOps and view the policies from the Discovered policies table of the Governance dashboard. The policies are grouped by the policy name and kind fields.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}