Skip to content

Commit 89804eb

Browse files
authored
Reconfigure Policy (#452)
With the consolidated section, it was necessary to redefine the landing page. Signed-off-by: Dale Haiducek <[email protected]>
1 parent a933503 commit 89804eb

File tree

5 files changed

+39
-34
lines changed

5 files changed

+39
-34
lines changed

content/en/docs/getting-started/integration/policy-controllers/_index.md

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,34 @@ title: Policy
33
weight: 1
44
---
55

6-
The [Policy API]({{< ref "docs/getting-started/integration/policy-controllers/policy" >}}) on the hub delivers the policies defined in `spec.policy-templates` to the managed
7-
clusters via the [policy framework controllers]({{< ref "docs/getting-started/integration/policy-controllers/policy-framework" >}}). Once on the managed
8-
cluster, these _Policy Templates_ are acted upon by the associated controller on the managed cluster. The policy
9-
framework supports delivering the _Policy Template_ kinds listed.
6+
The Policy Add-on enables auditing and enforcement of configuration across clusters managed by OCM, enhancing security,
7+
easing maintenance burdens, and increasing consistency across the clusters for your compliance and reliability
8+
requirements.
109

10+
View the following sections to learn more about the Policy Add-on:
1111

12-
## [Configuration policy]({{< ref "docs/getting-started/integration/policy-controllers/configuration-policy" >}})
12+
- ### [Policy framework]({{< ref "docs/getting-started/integration/policy-controllers/policy-framework" >}})
1313

14-
The `ConfigurationPolicy` is provided by OCM and defines Kubernetes manifests to compare with objects that currently
15-
exist on the cluster. The action that the `ConfigurationPolicy` will take is determined by its `complianceType`.
16-
Compliance types include `musthave`, `mustnothave`, and `mustonlyhave`. `musthave` means the object should have the
17-
listed keys and values as a subset of the larger object. `mustnothave` means an object matching the listed keys and
18-
values should not exist. `mustonlyhave` ensures objects only exist with the keys and values exactly as defined.
14+
Learn about the architecture of the Policy Add-on that delivers policies defined on the hub cluster to the managed
15+
clusters and how to install and enable the add-on for your OCM clusters.
1916

20-
## [Open Policy Agent Gatekeeper]({{< ref "docs/getting-started/integration/policy-controllers/gatekeeper" >}})
17+
- ### [Policy API concepts]({{< ref "docs/getting-started/integration/policy-controllers/policy" >}})
2118

22-
Gatekeeper is a validating webhook with auditing capabilities that can enforce custom resource definition-based
23-
policies that are run with the Open Policy Agent (OPA). Gatekeeper `ConstraintTemplates` and constraints can be
24-
provided in an OCM `Policy` to sync to managed clusters that have Gatekeeper installed on them.
19+
Learn about the APIs that the Policy Add-on uses and how the APIs are related to one another to deliver policies to
20+
the clusters managed by OCM.
21+
22+
- ### Supported managed cluster policy engines
23+
24+
- #### [Configuration policy]({{< ref "docs/getting-started/integration/policy-controllers/configuration-policy" >}})
25+
26+
The `ConfigurationPolicy` is provided by OCM and defines Kubernetes manifests to compare with objects that currently
27+
exist on the cluster. The action that the `ConfigurationPolicy` will take is determined by its `complianceType`.
28+
Compliance types include `musthave`, `mustnothave`, and `mustonlyhave`. `musthave` means the object should have the
29+
listed keys and values as a subset of the larger object. `mustnothave` means an object matching the listed keys and
30+
values should not exist. `mustonlyhave` ensures objects only exist with the keys and values exactly as defined.
31+
32+
- #### [Open Policy Agent Gatekeeper]({{< ref "docs/getting-started/integration/policy-controllers/gatekeeper" >}})
33+
34+
Gatekeeper is a validating webhook with auditing capabilities that can enforce custom resource definition-based
35+
policies that are run with the Open Policy Agent (OPA). Gatekeeper `ConstraintTemplates` and constraints can be
36+
provided in an OCM `Policy` to sync to managed clusters that have Gatekeeper installed on them.

content/en/docs/getting-started/integration/policy-controllers/configuration-policy.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ hide_summary: true
77
The `ConfigurationPolicy` defines Kubernetes manifests to compare with objects that currently exist on the cluster. The
88
Configuration policy controller is provided by Open Cluster Management and runs on managed clusters.
99

10-
10+
View the [Policy API concepts]({{< ref
11+
"docs/getting-started/integration/policy-controllers/policy#managed-cluster-policy-controllers" >}}) page to learn more
12+
about the `ConfigurationPolicy` API.
1113

1214
## Prerequisites
1315

content/en/docs/getting-started/integration/policy-controllers/gatekeeper.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@ that can enforce custom resource definition-based policies that are run with the
99
constraints can be used to evaluate Kubernetes resource compliance. You can leverage OPA as the policy engine, and use
1010
Rego as the policy language.
1111

12-
13-
1412
## Installing Gatekeeper
1513

1614
See the [Gatekeeper documentation](https://open-policy-agent.github.io/gatekeeper/website/docs/install) to install the

content/en/docs/getting-started/integration/policy-controllers/policy-framework.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
---
22
title: Policy framework
3-
weight: 2
3+
weight: 1
4+
hide_summary: true
45
aliases:
56
- /getting-started/integration/policy-framework/
67
---
78

89
The policy framework provides governance capabilities to OCM managed Kubernetes clusters. Policies provide visibility
910
and drive remediation for various security and configuration aspects to help IT administrators meet their requirements.
1011

11-
12-
1312
## API Concepts
1413

1514
View the [Policy API]({{< ref "docs/getting-started/integration/policy-controllers/policy" >}}) page for additional details about the Policy API managed by the Policy Framework

content/en/docs/getting-started/integration/policy-controllers/policy.md

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,17 @@
11
---
2-
title: Policy
3-
weight: 1
2+
title: Policy API concepts
3+
weight: 2
4+
hide_summary: true
45
aliases:
56
- /concepts/policy/
67
- /docs/concepts/policy/
78
---
89

9-
10-
1110
## Overview
1211

13-
Note: this is also covered in the
14-
[Open Cluster Management - Configuring Your Kubernetes Fleet With the Policy Addon](https://www.youtube.com/watch?v=ZZH654t5YpI)
15-
video.
16-
17-
[![Open Cluster Management - Configuring Your Kubernetes Fleet With the Policy Addon](https://img.youtube.com/vi/ZZH654t5YpI/0.jpg)](https://www.youtube.com/watch?v=ZZH654t5YpI)
18-
1912
The policy framework has the following API concepts:
2013

21-
- [_Policy Templates_](#managed-cluster-policy-controllers) are the policies that perform a desired check or action. For
14+
- [_Policy Templates_](#managed-cluster-policy-controllers) are the policies that perform a desired check or action on a managed cluster. For
2215
example,
2316
[ConfigurationPolicy]( {{< ref "docs/getting-started/integration/policy-controllers#install-the-configuration-policy-controller" >}})
2417
objects are embedded in `Policy` objects under the `policy-templates` array.
@@ -30,9 +23,10 @@ The policy framework has the following API concepts:
3023
[Placement]({{< ref "docs/concepts/content-placement/placement" >}}).
3124
- A [`PlacementBinding`](#placementbinding) binds a [Placement]({{< ref "docs/concepts/content-placement/placement" >}}) to a `Policy` or `PolicySet`.
3225

33-
The second half of the
34-
[KubeCon NA 2022 - OCM Multicluster App & Config Management](/kubecon-na-2022-ocm-multicluster-app-and-config-management.pdf)
35-
also covers an overview of the Policy addon.
26+
**Additional resources:**
27+
- View the following resources to learn more about the Policy Addon:
28+
- Video: [Open Cluster Management - Configuring Your Kubernetes Fleet With the Policy Addon](https://www.youtube.com/watch?v=ZZH654t5YpI)
29+
- Slides: [KubeCon NA 2022 - OCM Multicluster App & Config Management](/kubecon-na-2022-ocm-multicluster-app-and-config-management.pdf)
3630

3731
## Policy
3832

0 commit comments

Comments
 (0)