主页
产品
Red Hat Advanced Cluster Management for Kubernetes
2.10
监管
2.10. 策略依赖项

2.10. 策略依赖项

只有在集群中的其他策略处于特定状态时，才会使用依赖项来激活策略。当不满足依赖项条件时，策略被标记为 Pending，资源不会在受管集群上创建。有关策略状态中的条件状态的更多详细信息。

您可以使用策略依赖项来控制对象的应用方式的顺序。例如，如果您有一个 Operator 策略以及 Operator 所管理的资源的另一个策略，您可以设置第二个策略的依赖项，以便它不会尝试创建资源，直到安装 Operator 前不会尝试创建资源。这有助于在受管集群上的性能。

需要的访问权限：策略管理员

查看以下策略依赖项示例，只有 upstream-compliance-operator 策略已在受管集群中合规时才会创建 ScanSettingBinding ：

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/description:
  name: moderate-compliance-scan
  namespace: default
spec:
  dependencies: 
  - apiVersion: policy.open-cluster-management.io/v1
    compliance: Compliant
    kind: Policy
    name: upstream-compliance-operator
    namespace: default
  disabled: false
  policy-templates:
  - extraDependencies: 
    - apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      name: scan-setting-prerequisite
      compliance: Compliant
    ignorePending: false 
    objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: moderate-compliance-scan
      spec:
        object-templates:
        - complianceType: musthave
          objectDefinition:
            apiVersion: compliance.openshift.io/v1alpha1
            kind: ScanSettingBinding
            metadata:
              name: moderate
              namespace: openshift-compliance
            profiles:
            - apiGroup: compliance.openshift.io/v1alpha1
              kind: Profile
              name: ocp4-moderate
            - apiGroup: compliance.openshift.io/v1alpha1
              kind: Profile
              name: ocp4-moderate-node
            settingsRef:
              apiGroup: compliance.openshift.io/v1alpha1
              kind: ScanSetting
              name: default
        remediationAction: enforce
        severity: low

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/description:
  name: moderate-compliance-scan
  namespace: default
spec:
  dependencies:


  - apiVersion: policy.open-cluster-management.io/v1
    compliance: Compliant
    kind: Policy
    name: upstream-compliance-operator
    namespace: default
  disabled: false
  policy-templates:
  - extraDependencies:


    - apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      name: scan-setting-prerequisite
      compliance: Compliant
    ignorePending: false


    objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: moderate-compliance-scan
      spec:
        object-templates:
        - complianceType: musthave
          objectDefinition:
            apiVersion: compliance.openshift.io/v1alpha1
            kind: ScanSettingBinding
            metadata:
              name: moderate
              namespace: openshift-compliance
            profiles:
            - apiGroup: compliance.openshift.io/v1alpha1
              kind: Profile
              name: ocp4-moderate
            - apiGroup: compliance.openshift.io/v1alpha1
              kind: Profile
              name: ocp4-moderate-node
            settingsRef:
              apiGroup: compliance.openshift.io/v1alpha1
              kind: ScanSetting
              name: default
        remediationAction: enforce
        severity: low

Copy to Clipboard

Toggle word wrap

1: dependencies 字段在 Policy 对象中设置，要求适用于策略中的所有策略模板。
2: 可以在单独的策略模板上设置 extraDependencies 字段。例如，可以为配置策略设置参数，并且定义在策略中设置的任何 依赖项 之外必须满足的条件。
3: ignorePending 字段可以在每个单独的策略模板上设置，并在计算总体策略合规性时，配置该模板上的 Pending 状态是否被视为 Compliant 或 NonCompliant。默认情况下，此值设为 false，而 Pending 模板会导致策略变为 NonCompliant。当您将其设置为 true 时，当此模板为 Pending 时，策略仍然可以为 Compliant，这在模板的预期状态下非常有用。

注：您不能使用依赖项根据另一个集群中的策略状态对一个集群应用策略。

返回顶部

2.10. 策略依赖项

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links