1.5. 使用 Red Hat OpenShift GitOps 管理策略定义

使用以下命令编辑 OpenShift GitOps argocd 对象：

oc -n openshift-gitops edit argocd openshift-gitops

要将 Policy Generator 更新至较新的版本，请将 Init 容器使用的 registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9 镜像添加到较新的标签。将 & lt;version > 参数替换为 ArgoCD 资源中的最新 Red Hat Advanced Cluster Management 版本。

您的 ArgoCD 资源可能类似以下 YAML 文件：

apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: openshift-gitops
  namespace: openshift-gitops
spec:
  kustomizeBuildOptions: --enable-alpha-plugins
  repo:
    env:
    - name: KUSTOMIZE_PLUGIN_HOME
      value: /etc/kustomize/plugin
    initContainers:
    - args:
      - -c
      - cp /policy-generator/PolicyGenerator-not-fips-compliant /policy-generator-tmp/PolicyGenerator
      command:
      - /bin/bash
      image: registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9:v<version>
      name: policy-generator-install
      volumeMounts:
      - mountPath: /policy-generator-tmp
        name: policy-generator
    volumeMounts:
    - mountPath: /etc/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator
      name: policy-generator
    volumes:
    - emptyDir: {}
      name: policy-generator

注： 另外，您可以创建一个包含 ArgoCD 清单和模板的 ConfigurationPolicy 资源，以匹配 MulticlusterHub 中设置的版本：

image: '{{ (index (lookup "apps/v1" "Deployment" "open-cluster-management" "multicluster-operators-hub-subscription").spec.template.spec.containers 0).image }}'

如果要在生成策略前在 Kustomize 目录中启用 Helm chart 处理，请在 spec.repo.env 字段中将 POLICY_GEN_ENABLE_HELM 环境变量设置为 "true" ：

env:
- name: POLICY_GEN_ENABLE_HELM
  value: "true"

要创建、读取、更新和删除策略和放置，请创建一个 ClusterRoleBinding 对象来授予 OpenShift GitOps 服务帐户对 Red Hat Advanced Cluster Management hub 集群的访问权限。ClusterRoleBinding 可能类似以下资源：

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openshift-gitops-policy-admin
subjects:
  - kind: ServiceAccount
    name: openshift-gitops-argocd-application-controller
    namespace: openshift-gitops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: openshift-gitops-policy-admin