---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/description: ""
    policy.open-cluster-management.io/standards: NIST SP 800-53
  name: service-account-mustonlyhave
  namespace: openshift-gitops
spec:
  copyPolicyMetadata: false
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: sa-test
      spec:
        object-templates:
        - complianceType: mustonlyhave
          objectDefinition:
            apiVersion: v1
            kind: ServiceAccount
            metadata:
              name: sa-test
              namespace: sa-test
        pruneObjectBehavior: None
        remediationAction: enforce
        severity: medium
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: sa-test-ns
      spec:
        object-templates:
        - complianceType: mustonlyhave
          objectDefinition:
            apiVersion: v1
            kind: Namespace
            metadata:
              name: sa-test
        pruneObjectBehavior: None
        remediationAction: enforce
        severity: medium
  remediationAction: enforce
---
apiVersion: policy.open-cluster-management.io/v1beta1
kind: PolicySet
metadata:
  name: hub-cluster
spec:
  description: "Policies for cluster configuration"
  policies:
    - service-account-mustonlyhave
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-hub-cluster
placementRef:
  apiGroup: cluster.open-cluster-management.io
  kind: Placement
  name: placement-hub-openshift
subjects:
  - apiGroup: policy.open-cluster-management.io
    kind: PolicySet
    name: hub-cluster
---
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: Placement
metadata:
  annotations:
  name: placement-hub-openshift
  namespace: openshift-gitops
spec:
  clusterSets:
  - develop
  predicates:
  - requiredClusterSelector:
      labelSelector:
        matchExpressions:
        - key: local-cluster
          operator: In
          values:
          - "true"
