# This policy verifies the installation of the official and supported version of
# the Gatekeeper Operator on the managed clusters.
#
# If set to "enforce" it'll install the operator.
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-gatekeeper-operator
  namespace: policies
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  remediationAction: enforce
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: gatekeeper-operator-product-sub
      spec:
        remediationAction: inform
        severity: high
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: operators.coreos.com/v1alpha1
              kind: Subscription
              metadata:
                name: gatekeeper-operator-product
                namespace: openshift-operators
              spec:
                channel: stable
                installPlanApproval: Automatic
                name: gatekeeper-operator-product
                source: redhat-operators
                sourceNamespace: openshift-marketplace
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: gatekeeper-operator-status
      spec:
        remediationAction: inform
        severity: high
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: operators.coreos.com/v1alpha1
              kind: ClusterServiceVersion
              metadata:
                namespace: openshift-gatekeeper-system
              spec:
                displayName: Gatekeeper Operator
              status:
                phase: Succeeded   # check the csv status to determine if operator is running or not
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: gatekeeper
      spec:
        remediationAction: inform
        severity: high
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: operator.gatekeeper.sh/v1alpha1
              kind: Gatekeeper
              metadata:
                name: gatekeeper
              spec:
                audit:
                  auditChunkSize: 500
                  logLevel: INFO
                  replicas: 1
                validatingWebhook: Enabled
                mutatingWebhook: Disabled
                webhook:
                  emitAdmissionEvents: Enabled
                  logLevel: INFO
                  replicas: 2
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: gatekeeper-status
      spec:
        remediationAction: inform
        severity: high
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: v1
              kind: Pod
              metadata:
                namespace: openshift-gatekeeper-system
                labels:
                  control-plane: audit-controller
              status:
                phase: Running   # check the pod status to determine if operator is running or not
          - complianceType: musthave
            objectDefinition:
              apiVersion: v1
              kind: Pod
              metadata:
                namespace: openshift-gatekeeper-system
                labels:
                  control-plane: controller-manager
              status:
                phase: Running   # check the pod status to determine if operator is running or not
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: gatekeeper-config
      spec:
        remediationAction: enforce
        severity: high
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: config.gatekeeper.sh/v1alpha1
              kind: Config
              metadata:
                name: config
                namespace: "openshift-gatekeeper-system"
              spec:
                match:
                  - excludedNamespaces: 
                      - ansible-automation-platform
                      - hive
                      - kube-system
                      - local-quay
                      - multicluster-engine
                      - open-cluster-management
                      - open-cluster-management-agent
                      - open-cluster-management-agent-addon
                      - openshift-operators
                      - openshift-console
                      - openshift-console-operator
                      - rhacs-operator
                      - stackrox
                      - openshift-apiserver-operator
                      - openshift-apiserver
                      - openshift-authentication-operator
                      - openshift-authentication
                      - openshift-cloud-controller-manager-operator
                      - openshift-cloud-credential-operator
                      - openshift-cloud-network-config-controller
                      - openshift-cluster-csi-drivers
                      - openshift-cluster-machine-approver
                      - openshift-cluster-node-tuning-operator
                      - openshift-cluster-samples-operator
                      - openshift-cluster-storage-operator
                      - openshift-cluster-version
                      - openshift-config-operator
                      - openshift-controller-manager-operator
                      - openshift-controller-manager
                      - openshift-dns-operator
                      - openshift-etcd-operator
                      - openshift-gatekeeper-operator
                      - openshift-gatekeeper-system
                      - openshift-image-registry
                      - openshift-ingress
                      - openshift-ingress-operator
                      - openshift-insights
                      - openshift-kube-apiserver-operator
                      - openshift-kube-controller-manager-operator
                      - openshift-kube-scheduler-operator
                      - openshift-kube-storage-version-migrator
                      - openshift-kube-storage-version-migrator-operator
                      - openshift-machine-api
                      - openshift-machine-config-operator
                      - openshift-marketplace
                      - openshift-monitoring
                      - openshift-multus
                      - openshift-network-diagnostics
                      - openshift-network-operator
                      - openshift-oauth-apiserver
                      - openshift-operator-lifecycle-manager
                      - openshift-route-controller-manager
                      - openshift-service-ca
                      - openshift-service-ca-operator
                      - open-cluster-management-addon-observability
                      - openshift-terminal
                    processes: 
                      - '*'
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-gatekeeper-operator
  namespace: policies
placementRef:
  name: placement-policy-gatekeeper-operator
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-gatekeeper-operator
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-gatekeeper-operator
  namespace: policies
spec:
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      - key: vendor
        operator: In
        values:
          - "OpenShift"
          
