Epic Goal

Support hub templates in ConfigurationPolicies, without defining hub Policies. A new addon will allow an agent on the managed cluster to lookup resources on the hub cluster. ConfigurationPolicies distributed to managed clusters via tools like ArgoCD will be able to use hub templates.

Why is this important?

The distribution of policies through the policy framework on the hub can be complicated, between the details of Placement and PlacementBindings. Some users prefer to deploy resources like ConfigurationPolicies directly to their managed clusters. But one of the main advantages to ConfigurationPolicy is the ability to have templates, to fill in certain pieces of information at runtime. Without this feature, ConfigurationPolicies deployed outside of the policy's hub framework will not have access to hub resources in templates, which can be a major limitation. 

Scenarios

1. Without using the hub policy framework, ConfigurationPolicies should be able to use hub templates. 
2. Users will be able to opt-in to this feature by turning on the new addon per managed cluster.
3. Users will be able to specify exactly which resources on the hub are accessible to the ConfigurationPolicies on the managed clusters.

Acceptance Criteria

There must be a sample hub ConfigurationPolicy enabling the feature and configuring some initial permissions for it to use, to help users onboard to the feature.

Dependencies (internal and external)

1. ...

Previous Work (Optional):

1. https://github.com/open-cluster-management-io/enhancements/tree/main/enhancements/sig-policy/134-standalone-hub-templates 

Open questions:

1. …

Done Checklist

• CI - CI is running, tests are automated and merged.
• Release Enablement <link to Feature Enablement Presentation>
• DEV - Upstream code and tests merged: <link to meaningful PR or GitHub
  Issue>
• DEV - Upstream documentation merged: <link to meaningful PR or GitHub
  Issue>
• DEV - Downstream build attached to advisory: <link to errata>
• QE - Test plans in Polarion: <link or reference to Polarion>
• QE - Automated tests merged: <link or reference to automated tests>
• DOC - Doc issue opened with a completed template. Separate doc issue
  opened for any deprecation, removal, or any current known
  issue/troubleshooting removal from the doc, if applicable.