Skip to content

Latest commit

 

History

History
71 lines (62 loc) · 2.96 KB

namespace_policy.md

File metadata and controls

71 lines (62 loc) · 2.96 KB

Namespace policy

Kubernetes configuration policy controller monitors the status of your namespace policy. Apply the namespace policy to define specific rules for your namespace. Learn more details about the namespace policy structure in the following sections.

Namespace policy YAML structure

apiVersion: policy.mcm.ibm.com/v1alpha1
kind: Policy
metadata:
  name: policy-namespace-1
  namespace:
spec:
  complianceType:
  remediationAction:
  namespaces:
    exclude:
    include:
  object-templates:
    - complianceType:
      objectDefinition:
        kind:
        apiVersion:
        metadata:
          name:
     ...

Namespace policy YAML table

Field Description
apiVersion Required. Set the value to policy.mcm.ibm.com/v1alpha1.
kind Required. Set the value to Policy to indicate the type of policy.
metadata.name Required. The name for identifying the policy resource.
metadata.namespaces Optional.
spec.namespace Required. The namespaces within the hub cluster that the policy is applied to. Enter parameter values for include, which are the namespaces you want to apply to the policy to. exclude specifies the namespaces you explicitly do not want to apply the policy to. Note: A namespace that is specified in the object template of a policy controller, overrides the namespace in the corresponding parent policy.
remediationAction Optional. Specifies the remediation of your policy. The parameter values are enforce and inform. Important: Some policies may not support the enforce feature.
disabled Required. Set the value to true or false. The disabled parameter provides the ability to enable and disable your policies.
spec.complianceType Required. Set the value to "musthave"
spec.object-template Optional. Used to list any other Kubernetes object that must be evaluated or applied to the managed clusters.
{: caption="Table 1. Required and optional definition fields" caption-side="top"}

Namespace policy sample

Your namespace policy might resemble the following YAML file:

apiVersion: policy.mcm.ibm.com/v1alpha1
kind: Policy
metadata:
  name: policy-namespace-1
  namespace: mcm 
spec:
  complianceType: musthave
  remediationAction: inform
  namespaces:
    exclude: ["kube-*"]
    include: ["default"]
  object-templates:
    - complianceType: musthave
      objectDefinition:
        kind: Namespace # must have namespace 'prod'
        apiVersion: v1
        metadata:
          name: prod
     ...

Manage your namespace policy. See Managing namespace policies for more information. See Kubernetes configuration policy controller to learn about other configuration policies.