apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    cluster-group-upgrades-operator/rname: cnfdf17-group-du-sno-config-policy
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"policy.open-cluster-management.io/v1","kind":"Policy","metadata":{"annotations":{"policy.open-cluster-management.io/categories":"CM Configuration Management","policy.open-cluster-management.io/controls":"CM-2 Baseline Configuration","policy.open-cluster-management.io/standards":"NIST SP 800-53","ran.openshift.io/ztp-deploy-wave":"10"},"labels":{"app.kubernetes.io/instance":"policies"},"name":"group-du-sno-config-policy","namespace":"ztp-group"},"spec":{"disabled":false,"policy-templates":[{"objectDefinition":{"apiVersion":"policy.open-cluster-management.io/v1","kind":"ConfigurationPolicy","metadata":{"name":"group-du-sno-config-policy-config"},"spec":{"evaluationInterval":{"compliant":"10m","noncompliant":"10s"},"namespaceselector":{"exclude":["kube-*"],"include":["*"]},"object-templates":[{"complianceType":"musthave","objectDefinition":{"apiVersion":"v1","kind":"Namespace","metadata":{"name":"{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-test-my-ns\" .ManagedClusterName) hub}}"}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"operator.openshift.io/v1","kind":"Console","metadata":{"annotations":{"include.release.openshift.io/ibm-cloud-managed":"false","include.release.openshift.io/self-managed-high-availability":"false","include.release.openshift.io/single-node-developer":"false","release.openshift.io/create-only":"true"},"name":"cluster"},"spec":{"logLevel":"Normal","managementState":"Managed","operatorLogLevel":"Normal"}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"logging.openshift.io/v1","kind":"ClusterLogForwarder","metadata":{"name":"instance","namespace":"openshift-logging"},"spec":{"inputs":[{"infrastructure":{},"name":"infra-logs"}],"outputs":[{"name":"kafka-open","type":"kafka","url":"tcp://10.46.55.190:9092/test"}],"pipelines":[{"inputRefs":["audit"],"name":"audit-logs","outputRefs":["kafka-open"]},{"inputRefs":["infrastructure"],"name":"infrastructure-logs","outputRefs":["kafka-open"]}]}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"logging.openshift.io/v1","kind":"ClusterLogging","metadata":{"name":"instance","namespace":"openshift-logging"},"spec":{"collection":{"logs":{"fluentd":{},"type":"fluentd"}},"curation":{"curator":{"schedule":"30 3 * * *"},"type":"curator"},"managementState":"Managed"}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"ptp.openshift.io/v1","kind":"PtpConfig","metadata":{"name":"du-ptp-slave","namespace":"openshift-ptp"},"spec":{"profile":[{"interface":"ens1f0","name":"slave","phc2sysOpts":"-a -r -n 24","ptp4lConf":"[global]\n#\n# Default Data Set\n#\ntwoStepFlag 1\nslaveOnly 0\npriority1 128\npriority2 128\ndomainNumber 24\n#utc_offset 37\nclockClass 248\nclockAccuracy 0xFE\noffsetScaledLogVariance 0xFFFF\nfree_running 0\nfreq_est_interval 1\ndscp_event 0\ndscp_general 0\ndataset_comparison ieee1588\nG.8275.defaultDS.localPriority 128\n#\n# Port Data Set\n#\nlogAnnounceInterval -3\nlogSyncInterval -4\nlogMinDelayReqInterval -4\nlogMinPdelayReqInterval -4\nannounceReceiptTimeout 3\nsyncReceiptTimeout 0\ndelayAsymmetry 0\nfault_reset_interval 4\nneighborPropDelayThresh 20000000\nmasterOnly 0\nG.8275.portDS.localPriority 128\n#\n# Run time options\n#\nassume_two_step 0\nlogging_level 6\npath_trace_enabled 0\nfollow_up_info 0\nhybrid_e2e 0\ninhibit_multicast_service 0\nnet_sync_monitor 0\ntc_spanning_tree 0\ntx_timestamp_timeout 1\nunicast_listen 0\nunicast_master_table 0\nunicast_req_duration 3600\nuse_syslog 1\nverbose 0\nsummary_interval 0\nkernel_leap 1\ncheck_fup_sync 0\n#\n# Servo Options\n#\npi_proportional_const 0.0\npi_integral_const 0.0\npi_proportional_scale 0.0\npi_proportional_exponent -0.3\npi_proportional_norm_max 0.7\npi_integral_scale 0.0\npi_integral_exponent 0.4\npi_integral_norm_max 0.3\nstep_threshold 0.0\nfirst_step_threshold 0.00002\nmax_frequency 900000000\nclock_servo pi\nsanity_freq_limit 200000000\nntpshm_segment 0\n#\n# Transport options\n#\ntransportSpecific 0x0\nptp_dst_mac 01:1B:19:00:00:00\np2p_dst_mac 01:80:C2:00:00:0E\nudp_ttl 1\nudp6_scope 0x0E\nuds_address /var/run/ptp4l\n#\n# Default interface options\n#\nclock_type OC\nnetwork_transport L2\ndelay_mechanism E2E\ntime_stamping hardware\ntsproc_mode filter\ndelay_filter moving_median\ndelay_filter_length 10\negressLatency 0\ningressLatency 0\nboundary_clock_jbod 0\n#\n# Clock description\n#\nproductDescription ;;\nrevisionData ;;\nmanufacturerIdentity 00:00:00\nuserDescription ;\ntimeSource 0xA0\n","ptp4lOpts":"-2 -s --summary_interval 0"}],"recommend":[{"match":[{"nodeLabel":"node-role.kubernetes.io/master"}],"priority":4,"profile":"slave"}]}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"sriovnetwork.openshift.io/v1","kind":"SriovOperatorConfig","metadata":{"name":"default","namespace":"openshift-sriov-network-operator"},"spec":{"configDaemonNodeSelector":{"node-role.kubernetes.io/master":""},"disableDrain":true,"enableInjector":true,"enableOperatorWebhook":true}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"local.storage.openshift.io/v1","kind":"LocalVolume","metadata":{"name":"local-disks","namespace":"openshift-local-storage"},"spec":{"logLevel":"Normal","managementState":"Managed","storageClassDevices":[{"devicePaths":["/dev/sdb1"],"fsType":"xfs","storageClassName":"example-storage-class-1","volumeMode":"Filesystem"}]}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"operator.openshift.io/v1","kind":"Network","metadata":{"name":"cluster"},"spec":{"disableNetworkDiagnostics":true}}},{"complianceType":"mustonlyhave","objectDefinition":{"apiVersion":"performance.openshift.io/v2","kind":"PerformanceProfile","metadata":{"name":"openshift-node-performance-profile"},"spec":{"additionalKernelArgs":["rcupdate.rcu_normal_after_boot=0","efi=runtime"],"cpu":{"isolated":"{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-app-cpus\" .ManagedClusterName) hub}}","reserved":"{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-reserved-cpus\" .ManagedClusterName) hub}}"},"hugepages":{"defaultHugepagesSize":"1G","pages":[{"count":1,"node":0,"size":"1G"}]},"machineConfigPoolSelector":{"pools.operator.machineconfiguration.openshift.io/master":""},"nodeSelector":{"node-role.kubernetes.io/master":""},"numa":{"topologyPolicy":"restricted"},"realTimeKernel":{"enabled":true}}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"tuned.openshift.io/v1","kind":"Tuned","metadata":{"name":"performance-patch","namespace":"openshift-cluster-node-tuning-operator"},"spec":{"profile":[{"data":"[main]\nsummary=Configuration changes profile inherited from performance created tuned\ninclude=openshift-node-performance-openshift-node-performance-profile\n[bootloader]\ncmdline_crash=nohz_full={{hub fromConfigMap \"\" \"site-data\" (printf \"%s-app-cpus\" .ManagedClusterName) hub}}\n[sysctl]\nkernel.timer_migration=1\n[scheduler]\ngroup.ice-ptp=0:f:10:*:ice-ptp.*\n[service]\nservice.stalld=start,enable\nservice.chronyd=stop,disable\n","name":"performance-patch"}],"recommend":[{"machineConfigLabels":{"machineconfiguration.openshift.io/role":"master"},"priority":19,"profile":"performance-patch"}]}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"machineconfiguration.openshift.io/v1","kind":"MachineConfig","metadata":{"labels":{"machineconfiguration.openshift.io/role":"master"},"name":"98-icsp-mirror-digest-only-patch"},"spec":{"config":{"ignition":{"version":"3.2.0"},"storage":{"files":[{"contents":{"source":"data:text/plain;charset=utf-8;base64,W1tyZWdpc3RyeV1dCiAgcHJlZml4ID0gIiIKICBsb2NhdGlvbiA9ICJyZWdpc3RyeS5jb25uZWN0LnJlZGhhdC5jb20vaW50ZWwvbjMwMDAtbGFiZWxlciIKICBtaXJyb3ItYnktZGlnZXN0LW9ubHkgPSBmYWxzZQoKICBbW3JlZ2lzdHJ5Lm1pcnJvcl1dCiAgICBsb2NhdGlvbiA9ICJwbGFjZWhvbGRlci5jb206NTAwMC9vbG0vbjMwMDAtbGFiZWxlciIKCltbcmVnaXN0cnldXQogIHByZWZpeCA9ICIiCiAgbG9jYXRpb24gPSAicmVnaXN0cnkuY29ubmVjdC5yZWRoYXQuY29tL2ludGVsL3NyaW92LWZlYy1kYWVtb24iCiAgbWlycm9yLWJ5LWRpZ2VzdC1vbmx5ID0gZmFsc2UKCiAgW1tyZWdpc3RyeS5taXJyb3JdXQogICAgbG9jYXRpb24gPSAicGxhY2Vob2xkZXIuY29tOjUwMDAvb2xtL3NyaW92LWZlYy1kYWVtb24iCgpbW3JlZ2lzdHJ5XV0KICBwcmVmaXggPSAiIgogIGxvY2F0aW9uID0gInJlZ2lzdHJ5LnJlZGhhdC5pby9vcGVuc2hpZnQ0L29zZS1zcmlvdi1uZXR3b3JrLWRldmljZS1wbHVnaW4iCiAgbWlycm9yLWJ5LWRpZ2VzdC1vbmx5ID0gZmFsc2UKCiAgW1tyZWdpc3RyeS5taXJyb3JdXQogICAgbG9jYXRpb24gPSAicGxhY2Vob2xkZXIuY29tOjUwMDAvb2xtL29wZW5zaGlmdDQtb3NlLXNyaW92LW5ldHdvcmstZGV2aWNlLXBsdWdpbiI="},"filesystem":"root","mode":420,"path":"/etc/containers/registries.conf.d/98-master-mirror-by-digest-registries.conf"}]}}}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"sriovnetwork.openshift.io/v1","kind":"SriovNetwork","metadata":{"name":"sriov-nw-du-fh","namespace":"openshift-sriov-network-operator"},"spec":{"networkNamespace":"openshift-sriov-network-operator","resourceName":"du_fh","vlan":123}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"sriovnetwork.openshift.io/v1","kind":"SriovNetworkNodePolicy","metadata":{"name":"sriov-nnp-du-fh","namespace":"openshift-sriov-network-operator"},"spec":{"deviceType":"netdevice","isRdma":true,"nicSelector":{"pfNames":["{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-sriov-nic1\" .ManagedClusterName) hub}}"]},"nodeSelector":{"node-role.kubernetes.io/master":""},"numVfs":8,"priority":10,"resourceName":"du_fh"}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"sriovnetwork.openshift.io/v1","kind":"SriovNetwork","metadata":{"name":"sriov-nw-du-mh","namespace":"openshift-sriov-network-operator"},"spec":{"networkNamespace":"{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-sriovNetworkNamespace\" .ManagedClusterName) hub}}","resourceName":"du_mh","vlan":"{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-vlan\" .ManagedClusterName) | toInt hub}}"}}},{"complianceType":"musthave","objectDefinition":{"apiVersion":"sriovnetwork.openshift.io/v1","kind":"SriovNetworkNodePolicy","metadata":{"name":"sriov-nnp-du-mh","namespace":"openshift-sriov-network-operator"},"spec":{"deviceType":"vfio-pci","isRdma":false,"nicSelector":{"pfNames":["{{hub fromConfigMap \"\" \"site-data\" (printf \"%s-sriov-nic2\" .ManagedClusterName) hub}}"]},"nodeSelector":{"node-role.kubernetes.io/master":""},"numVfs":8,"priority":10,"resourceName":"du_mh"}}},{"complianceType":"mustonlyhave","objectDefinition":{"apiVersion":"machineconfiguration.openshift.io/v1","kind":"MachineConfig","metadata":{"labels":{"machineconfiguration.openshift.io/role":"master"},"name":"02-master-workload-partitioning"},"spec":{"config":{"ignition":{"version":"3.2.0"},"storage":{"files":[{"contents":{"source":"data:text/plain;charset=utf-8;base64,IyBJRE0gdGVzdCB1cGRhdGUKW2NyaW8ucnVudGltZS53b3JrbG9hZHMubWFuYWdlbWVudF0KYWN0aXZhdGlvbl9hbm5vdGF0aW9uID0gInRhcmdldC53b3JrbG9hZC5vcGVuc2hpZnQuaW8vbWFuYWdlbWVudCIKYW5ub3RhdGlvbl9wcmVmaXggPSAicmVzb3VyY2VzLndvcmtsb2FkLm9wZW5zaGlmdC5pbyIKcmVzb3VyY2VzID0geyAiY3B1c2hhcmVzIiA9IDAsICJjcHVzZXQiID0gIjAtMiw0MC00MiIgfQo="},"mode":420,"overwrite":true,"path":"/etc/crio/crio.conf.d/01-workload-partitioning","user":{"name":"root"}},{"contents":{"source":"data:text/plain;charset=utf-8;base64,IyBJRE0gdGVzdCB1cGRhdGUgMgp7CiAgIm1hbmFnZW1lbnQiOiB7CiAgICAiY3B1c2V0IjogIjAtMiw0MC00MiIKICB9Cn0K"},"mode":420,"overwrite":true,"path":"/etc/kubernetes/openshift-workload-pinning","user":{"name":"root"}}]}}}}}],"remediationAction":"inform","severity":"low"}}}],"remediationAction":"inform"}}
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
    ran.openshift.io/ztp-deploy-wave: "10"
  creationTimestamp: "2023-03-14T16:24:06Z"
  generation: 1
  labels:
    app: openshift-cluster-group-upgrades
    app.kubernetes.io/instance: policies
    openshift-cluster-group-upgrades/clusterGroupUpgrade: cnfdf17
    openshift-cluster-group-upgrades/parentPolicyName: group-du-sno-config-policy
    velero.io/exclude-from-backup: "true"
  name: cnfdf17-group-du-sno-config-policy-txwk2
  namespace: ztp-install
  ownerReferences:
  - apiVersion: ran.openshift.io/v1alpha1
    blockOwnerDeletion: true
    controller: true
    kind: ClusterGroupUpgrade
    name: cnfdf17
    uid: eb57623d-3e4f-4ee7-a580-2c8b6c7026da
  resourceVersion: "738438658"
  uid: 14dd1b82-4221-440a-9b1b-ecbc0b64484e
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: cnfdf17-group-du-sno-config-policy-config-8mcvl
      spec:
        evaluationInterval:
          compliant: 10m
          noncompliant: 10s
        namespaceselector:
          exclude:
          - kube-*
          include:
          - '*'
        object-templates:
        - complianceType: musthave
          objectDefinition:
            apiVersion: v1
            kind: Namespace
            metadata:
              name: '{{hub fromConfigMap "ztp-install" "ztp-group.site-data" (printf
                "%s-test-my-ns" .ManagedClusterName) hub}}'
        - complianceType: musthave
          objectDefinition:
            apiVersion: operator.openshift.io/v1
            kind: Console
            metadata:
              annotations:
                include.release.openshift.io/ibm-cloud-managed: "false"
                include.release.openshift.io/self-managed-high-availability: "false"
                include.release.openshift.io/single-node-developer: "false"
                release.openshift.io/create-only: "true"
              name: cluster
            spec:
              logLevel: Normal
              managementState: Managed
              operatorLogLevel: Normal
        - complianceType: musthave
          objectDefinition:
            apiVersion: logging.openshift.io/v1
            kind: ClusterLogForwarder
            metadata:
              name: instance
              namespace: openshift-logging
            spec:
              inputs:
              - infrastructure: {}
                name: infra-logs
              outputs:
              - name: kafka-open
                type: kafka
                url: tcp://10.46.55.190:9092/test
              pipelines:
              - inputRefs:
                - audit
                name: audit-logs
                outputRefs:
                - kafka-open
              - inputRefs:
                - infrastructure
                name: infrastructure-logs
                outputRefs:
                - kafka-open
        - complianceType: musthave
          objectDefinition:
            apiVersion: logging.openshift.io/v1
            kind: ClusterLogging
            metadata:
              name: instance
              namespace: openshift-logging
            spec:
              collection:
                logs:
                  fluentd: {}
                  type: fluentd
              curation:
                curator:
                  schedule: 30 3 * * *
                type: curator
              managementState: Managed
        - complianceType: musthave
          objectDefinition:
            apiVersion: ptp.openshift.io/v1
            kind: PtpConfig
            metadata:
              name: du-ptp-slave
              namespace: openshift-ptp
            spec:
              profile:
              - interface: ens1f0
                name: slave
                phc2sysOpts: -a -r -n 24
                ptp4lConf: |
                  [global]
                  #
                  # Default Data Set
                  #
                  twoStepFlag 1
                  slaveOnly 0
                  priority1 128
                  priority2 128
                  domainNumber 24
                  #utc_offset 37
                  clockClass 248
                  clockAccuracy 0xFE
                  offsetScaledLogVariance 0xFFFF
                  free_running 0
                  freq_est_interval 1
                  dscp_event 0
                  dscp_general 0
                  dataset_comparison ieee1588
                  G.8275.defaultDS.localPriority 128
                  #
                  # Port Data Set
                  #
                  logAnnounceInterval -3
                  logSyncInterval -4
                  logMinDelayReqInterval -4
                  logMinPdelayReqInterval -4
                  announceReceiptTimeout 3
                  syncReceiptTimeout 0
                  delayAsymmetry 0
                  fault_reset_interval 4
                  neighborPropDelayThresh 20000000
                  masterOnly 0
                  G.8275.portDS.localPriority 128
                  #
                  # Run time options
                  #
                  assume_two_step 0
                  logging_level 6
                  path_trace_enabled 0
                  follow_up_info 0
                  hybrid_e2e 0
                  inhibit_multicast_service 0
                  net_sync_monitor 0
                  tc_spanning_tree 0
                  tx_timestamp_timeout 1
                  unicast_listen 0
                  unicast_master_table 0
                  unicast_req_duration 3600
                  use_syslog 1
                  verbose 0
                  summary_interval 0
                  kernel_leap 1
                  check_fup_sync 0
                  #
                  # Servo Options
                  #
                  pi_proportional_const 0.0
                  pi_integral_const 0.0
                  pi_proportional_scale 0.0
                  pi_proportional_exponent -0.3
                  pi_proportional_norm_max 0.7
                  pi_integral_scale 0.0
                  pi_integral_exponent 0.4
                  pi_integral_norm_max 0.3
                  step_threshold 0.0
                  first_step_threshold 0.00002
                  max_frequency 900000000
                  clock_servo pi
                  sanity_freq_limit 200000000
                  ntpshm_segment 0
                  #
                  # Transport options
                  #
                  transportSpecific 0x0
                  ptp_dst_mac 01:1B:19:00:00:00
                  p2p_dst_mac 01:80:C2:00:00:0E
                  udp_ttl 1
                  udp6_scope 0x0E
                  uds_address /var/run/ptp4l
                  #
                  # Default interface options
                  #
                  clock_type OC
                  network_transport L2
                  delay_mechanism E2E
                  time_stamping hardware
                  tsproc_mode filter
                  delay_filter moving_median
                  delay_filter_length 10
                  egressLatency 0
                  ingressLatency 0
                  boundary_clock_jbod 0
                  #
                  # Clock description
                  #
                  productDescription ;;
                  revisionData ;;
                  manufacturerIdentity 00:00:00
                  userDescription ;
                  timeSource 0xA0
                ptp4lOpts: -2 -s --summary_interval 0
              recommend:
              - match:
                - nodeLabel: node-role.kubernetes.io/master
                priority: 4
                profile: slave
        - complianceType: musthave
          objectDefinition:
            apiVersion: sriovnetwork.openshift.io/v1
            kind: SriovOperatorConfig
            metadata:
              name: default
              namespace: openshift-sriov-network-operator
            spec:
              configDaemonNodeSelector:
                node-role.kubernetes.io/master: ""
              disableDrain: true
              enableInjector: true
              enableOperatorWebhook: true
        - complianceType: musthave
          objectDefinition:
            apiVersion: local.storage.openshift.io/v1
            kind: LocalVolume
            metadata:
              name: local-disks
              namespace: openshift-local-storage
            spec:
              logLevel: Normal
              managementState: Managed
              storageClassDevices:
              - devicePaths:
                - /dev/sdb1
                fsType: xfs
                storageClassName: example-storage-class-1
                volumeMode: Filesystem
        - complianceType: musthave
          objectDefinition:
            apiVersion: operator.openshift.io/v1
            kind: Network
            metadata:
              name: cluster
            spec:
              disableNetworkDiagnostics: true
        - complianceType: mustonlyhave
          objectDefinition:
            apiVersion: performance.openshift.io/v2
            kind: PerformanceProfile
            metadata:
              name: openshift-node-performance-profile
            spec:
              additionalKernelArgs:
              - rcupdate.rcu_normal_after_boot=0
              - efi=runtime
              cpu:
                isolated: '{{hub fromConfigMap "ztp-install" "ztp-group.site-data"
                  (printf "%s-app-cpus" .ManagedClusterName) hub}}'
                reserved: '{{hub fromConfigMap "ztp-install" "ztp-group.site-data"
                  (printf "%s-reserved-cpus" .ManagedClusterName) hub}}'
              hugepages:
                defaultHugepagesSize: 1G
                pages:
                - count: 1
                  node: 0
                  size: 1G
              machineConfigPoolSelector:
                pools.operator.machineconfiguration.openshift.io/master: ""
              nodeSelector:
                node-role.kubernetes.io/master: ""
              numa:
                topologyPolicy: restricted
              realTimeKernel:
                enabled: true
        - complianceType: musthave
          objectDefinition:
            apiVersion: tuned.openshift.io/v1
            kind: Tuned
            metadata:
              name: performance-patch
              namespace: openshift-cluster-node-tuning-operator
            spec:
              profile:
              - data: |
                  [main]
                  summary=Configuration changes profile inherited from performance created tuned
                  include=openshift-node-performance-openshift-node-performance-profile
                  [bootloader]
                  cmdline_crash=nohz_full={{hub fromConfigMap "ztp-install" "ztp-group.site-data" (printf "%s-app-cpus" .ManagedClusterName) hub}}
                  [sysctl]
                  kernel.timer_migration=1
                  [scheduler]
                  group.ice-ptp=0:f:10:*:ice-ptp.*
                  [service]
                  service.stalld=start,enable
                  service.chronyd=stop,disable
                name: performance-patch
              recommend:
              - machineConfigLabels:
                  machineconfiguration.openshift.io/role: master
                priority: 19
                profile: performance-patch
        - complianceType: musthave
          objectDefinition:
            apiVersion: machineconfiguration.openshift.io/v1
            kind: MachineConfig
            metadata:
              labels:
                machineconfiguration.openshift.io/role: master
              name: 98-icsp-mirror-digest-only-patch
            spec:
              config:
                ignition:
                  version: 3.2.0
                storage:
                  files:
                  - contents:
                      source: data:text/plain;charset=utf-8;base64,W1tyZWdpc3RyeV1dCiAgcHJlZml4ID0gIiIKICBsb2NhdGlvbiA9ICJyZWdpc3RyeS5jb25uZWN0LnJlZGhhdC5jb20vaW50ZWwvbjMwMDAtbGFiZWxlciIKICBtaXJyb3ItYnktZGlnZXN0LW9ubHkgPSBmYWxzZQoKICBbW3JlZ2lzdHJ5Lm1pcnJvcl1dCiAgICBsb2NhdGlvbiA9ICJwbGFjZWhvbGRlci5jb206NTAwMC9vbG0vbjMwMDAtbGFiZWxlciIKCltbcmVnaXN0cnldXQogIHByZWZpeCA9ICIiCiAgbG9jYXRpb24gPSAicmVnaXN0cnkuY29ubmVjdC5yZWRoYXQuY29tL2ludGVsL3NyaW92LWZlYy1kYWVtb24iCiAgbWlycm9yLWJ5LWRpZ2VzdC1vbmx5ID0gZmFsc2UKCiAgW1tyZWdpc3RyeS5taXJyb3JdXQogICAgbG9jYXRpb24gPSAicGxhY2Vob2xkZXIuY29tOjUwMDAvb2xtL3NyaW92LWZlYy1kYWVtb24iCgpbW3JlZ2lzdHJ5XV0KICBwcmVmaXggPSAiIgogIGxvY2F0aW9uID0gInJlZ2lzdHJ5LnJlZGhhdC5pby9vcGVuc2hpZnQ0L29zZS1zcmlvdi1uZXR3b3JrLWRldmljZS1wbHVnaW4iCiAgbWlycm9yLWJ5LWRpZ2VzdC1vbmx5ID0gZmFsc2UKCiAgW1tyZWdpc3RyeS5taXJyb3JdXQogICAgbG9jYXRpb24gPSAicGxhY2Vob2xkZXIuY29tOjUwMDAvb2xtL29wZW5zaGlmdDQtb3NlLXNyaW92LW5ldHdvcmstZGV2aWNlLXBsdWdpbiI=
                    filesystem: root
                    mode: 420
                    path: /etc/containers/registries.conf.d/98-master-mirror-by-digest-registries.conf
        - complianceType: musthave
          objectDefinition:
            apiVersion: sriovnetwork.openshift.io/v1
            kind: SriovNetwork
            metadata:
              name: sriov-nw-du-fh
              namespace: openshift-sriov-network-operator
            spec:
              networkNamespace: openshift-sriov-network-operator
              resourceName: du_fh
              vlan: 123
        - complianceType: musthave
          objectDefinition:
            apiVersion: sriovnetwork.openshift.io/v1
            kind: SriovNetworkNodePolicy
            metadata:
              name: sriov-nnp-du-fh
              namespace: openshift-sriov-network-operator
            spec:
              deviceType: netdevice
              isRdma: true
              nicSelector:
                pfNames:
                - '{{hub fromConfigMap "ztp-install" "ztp-group.site-data" (printf
                  "%s-sriov-nic1" .ManagedClusterName) hub}}'
              nodeSelector:
                node-role.kubernetes.io/master: ""
              numVfs: 8
              priority: 10
              resourceName: du_fh
        - complianceType: musthave
          objectDefinition:
            apiVersion: sriovnetwork.openshift.io/v1
            kind: SriovNetwork
            metadata:
              name: sriov-nw-du-mh
              namespace: openshift-sriov-network-operator
            spec:
              networkNamespace: '{{hub fromConfigMap "ztp-install" "ztp-group.site-data"
                (printf "%s-sriovNetworkNamespace" .ManagedClusterName) hub}}'
              resourceName: du_mh
              vlan: '{{hub fromConfigMap "ztp-install" "ztp-group.site-data" (printf
                "%s-vlan" .ManagedClusterName) | toInt hub}}'
        - complianceType: musthave
          objectDefinition:
            apiVersion: sriovnetwork.openshift.io/v1
            kind: SriovNetworkNodePolicy
            metadata:
              name: sriov-nnp-du-mh
              namespace: openshift-sriov-network-operator
            spec:
              deviceType: vfio-pci
              isRdma: false
              nicSelector:
                pfNames:
                - '{{hub fromConfigMap "ztp-install" "ztp-group.site-data" (printf
                  "%s-sriov-nic2" .ManagedClusterName) hub}}'
              nodeSelector:
                node-role.kubernetes.io/master: ""
              numVfs: 8
              priority: 10
              resourceName: du_mh
        - complianceType: mustonlyhave
          objectDefinition:
            apiVersion: machineconfiguration.openshift.io/v1
            kind: MachineConfig
            metadata:
              labels:
                machineconfiguration.openshift.io/role: master
              name: 02-master-workload-partitioning
            spec:
              config:
                ignition:
                  version: 3.2.0
                storage:
                  files:
                  - contents:
                      source: data:text/plain;charset=utf-8;base64,IyBJRE0gdGVzdCB1cGRhdGUKW2NyaW8ucnVudGltZS53b3JrbG9hZHMubWFuYWdlbWVudF0KYWN0aXZhdGlvbl9hbm5vdGF0aW9uID0gInRhcmdldC53b3JrbG9hZC5vcGVuc2hpZnQuaW8vbWFuYWdlbWVudCIKYW5ub3RhdGlvbl9wcmVmaXggPSAicmVzb3VyY2VzLndvcmtsb2FkLm9wZW5zaGlmdC5pbyIKcmVzb3VyY2VzID0geyAiY3B1c2hhcmVzIiA9IDAsICJjcHVzZXQiID0gIjAtMiw0MC00MiIgfQo=
                    mode: 420
                    overwrite: true
                    path: /etc/crio/crio.conf.d/01-workload-partitioning
                    user:
                      name: root
                  - contents:
                      source: data:text/plain;charset=utf-8;base64,IyBJRE0gdGVzdCB1cGRhdGUgMgp7CiAgIm1hbmFnZW1lbnQiOiB7CiAgICAiY3B1c2V0IjogIjAtMiw0MC00MiIKICB9Cn0K
                    mode: 420
                    overwrite: true
                    path: /etc/kubernetes/openshift-workload-pinning
                    user:
                      name: root
        remediationAction: inform
        severity: low
  remediationAction: enforce
status:
  compliant: NonCompliant
  placement:
  - placementBinding: cnfdf17-group-du-sno-config-policy-placement-sk484
    placementRule: cnfdf17-group-du-sno-config-policy-placement-sk484
  status:
  - clustername: cnfdf17
    clusternamespace: cnfdf17
    compliant: NonCompliant
