apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
  creationTimestamp: "2025-09-19T13:00:32Z"
  generation: 1
  labels:
    hive.openshift.io/managed: "true"
    policy.open-cluster-management.io/cluster-name: 2ldg9p0tjamj3npk8e84t704einhqrh0
    policy.open-cluster-management.io/cluster-namespace: 2ldg9p0tjamj3npk8e84t704einhqrh0
    policy.open-cluster-management.io/root-policy: openshift-acm-policies.osd-user-workload-monitoring-sp
  name: openshift-acm-policies.osd-user-workload-monitoring-sp
  namespace: 2ldg9p0tjamj3npk8e84t704einhqrh0
  resourceVersion: "344361045"
  uid: ec480123-878e-4f83-bdef-95276c13eaea
spec:
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: osd-user-workload-monitoring-sp
      spec:
        evaluationInterval:
          compliant: 2h
          noncompliant: 45s
        namespaceSelector:
          exclude:
          - kube-*
          - openshift*
          - ops-health-monitoring
          - management-infra
          - default
          - logging
          - sre-app-check
          include:
          - '*'
        object-templates:
        - complianceType: mustonlyhave
          metadataComplianceType: musthave
          objectDefinition:
            apiVersion: rbac.authorization.k8s.io/v1
            kind: RoleBinding
            metadata:
              name: dedicated-admins-alert-routing-edit-0
            roleRef:
              apiGroup: rbac.authorization.k8s.io
              kind: ClusterRole
              name: alert-routing-edit
            subjects:
            - apiGroup: rbac.authorization.k8s.io
              kind: Group
              name: dedicated-admins
        pruneObjectBehavior: DeleteIfCreated
        remediationAction: enforce
        severity: low
  remediationAction: enforce
status:
  compliant: NonCompliant
  details:
  - compliant: NonCompliant
    history:
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7c612422c76
      lastTimestamp: "2025-09-19T15:12:45Z"
      message: 'NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        in namespace cluster-density-ms-4 is missing, and cannot be created, reason:
        `rolebindings.rbac.authorization.k8s.io "dedicated-admins-alert-routing-edit-0"
        is forbidden: unable to create new content in namespace cluster-density-ms-4
        because it is being terminated`'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7c60e491e27
      lastTimestamp: "2025-09-19T15:12:45Z"
      message: NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        not found in namespace cluster-density-ms-4
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7bd2046953f
      lastTimestamp: "2025-09-19T15:12:07Z"
      message: 'Compliant; notification - rolebindings [dedicated-admins-alert-routing-edit-0]
        found as specified in namespaces: ak-test, cluster-density-ms-0, cluster-density-ms-1,
        cluster-density-ms-10, cluster-density-ms-11, cluster-density-ms-12, cluster-density-ms-13,
        cluster-density-ms-14, cluster-density-ms-15, cluster-density-ms-16, cluster-density-ms-17,
        cluster-density-ms-18, cluster-density-ms-19, cluster-density-ms-2, cluster-density-ms-20,
        cluster-density-ms-21, cluster-density-ms-22, cluster-density-ms-23, cluster-density-ms-24,
        cluster-density-ms-25, cluster-density-ms-26, cluster-density-ms-3, cluster-density-ms-4,
        cluster-density-ms-5, cluster-density-ms-6, cluster-density-ms-9, dedicated-admin,
        open-cluster-management-2ldg9p0tjamj3npk8e84t704einhqrh0, open-cluster-management-agent-addon;
        rolebindings [dedicated-admins-alert-routing-edit-0] was created successfully
        in namespaces: cluster-density-ms-7, cluster-density-ms-8'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7bd1eceef2c
      lastTimestamp: "2025-09-19T15:12:07Z"
      message: 'NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        not found in namespaces: cluster-density-ms-7, cluster-density-ms-8'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7bba149b8ba
      lastTimestamp: "2025-09-19T15:12:01Z"
      message: 'NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        in namespace cluster-density-ms-8 is missing, and cannot be created, reason:
        `namespaces "cluster-density-ms-8" not found`'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7bb9e747943
      lastTimestamp: "2025-09-19T15:12:00Z"
      message: NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        not found in namespace cluster-density-ms-8
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7b0d79dd9e7
      lastTimestamp: "2025-09-19T15:11:14Z"
      message: 'Compliant; notification - rolebindings [dedicated-admins-alert-routing-edit-0]
        found as specified in namespaces: ak-test, cluster-density-ms-0, cluster-density-ms-1,
        cluster-density-ms-10, cluster-density-ms-11, cluster-density-ms-12, cluster-density-ms-13,
        cluster-density-ms-14, cluster-density-ms-15, cluster-density-ms-16, cluster-density-ms-17,
        cluster-density-ms-18, cluster-density-ms-19, cluster-density-ms-2, cluster-density-ms-20,
        cluster-density-ms-23, cluster-density-ms-24, cluster-density-ms-25, cluster-density-ms-26,
        cluster-density-ms-3, cluster-density-ms-4, cluster-density-ms-5, cluster-density-ms-6,
        cluster-density-ms-7, cluster-density-ms-8, cluster-density-ms-9, dedicated-admin,
        open-cluster-management-2ldg9p0tjamj3npk8e84t704einhqrh0, open-cluster-management-agent-addon;
        rolebindings [dedicated-admins-alert-routing-edit-0] was created successfully
        in namespaces: cluster-density-ms-21, cluster-density-ms-22'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7b0d64050d2
      lastTimestamp: "2025-09-19T15:11:14Z"
      message: 'NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        not found in namespaces: cluster-density-ms-21, cluster-density-ms-22'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7afd1f6d53d
      lastTimestamp: "2025-09-19T15:11:10Z"
      message: 'NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        in namespace cluster-density-ms-22 is missing, and cannot be created, reason:
        `rolebindings.rbac.authorization.k8s.io "dedicated-admins-alert-routing-edit-0"
        is forbidden: unable to create new content in namespace cluster-density-ms-22
        because it is being terminated`'
    - eventName: openshift-acm-policies.osd-user-workload-monitoring-sp.1866b7afcdcc06ea
      lastTimestamp: "2025-09-19T15:11:10Z"
      message: NonCompliant; violation - rolebindings [dedicated-admins-alert-routing-edit-0]
        not found in namespace cluster-density-ms-22
    templateMeta:
      creationTimestamp: null
      name: osd-user-workload-monitoring-sp
