1.5. 使用 Red Hat OpenShift GitOps 管理策略定义

从控制台创建 ClusterRole。您的 ClusterRole 可能类似以下示例：

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openshift-gitops-policy-admin
rules:
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    apiGroups:
      - policy.open-cluster-management.io
    resources:
      - policies
      - configurationpolicies
      - certificatepolicies
      - operatorpolicies
      - policysets
      - placementbindings
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    apiGroups:
      - apps.open-cluster-management.io
    resources:
      - placementrules
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    apiGroups:
      - cluster.open-cluster-management.io
    resources:
      - placements
      - placements/status
      - placementdecisions
      - placementdecisions/status

另外，创建一个 ClusterRoleBinding 对象来授予 OpenShift GitOps 服务帐户对 openshift-gitops-policy-admin ClusterRole 对象的访问权限。ClusterRoleBinding 可能类似以下示例：

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openshift-gitops-policy-admin
subjects:
  - kind: ServiceAccount
    name: openshift-gitops-argocd-application-controller
    namespace: openshift-gitops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: openshift-gitops-policy-admin

注： - 当使用 OpenShift GitOps 部署 Red Hat Advanced Cluster Management 策略定义时，会在每个受管集群命名空间中创建一个策略副本，以解决 hub 模板的不同。这些副本称为复制策略。- 为了防止 OpenShift GitOps 重复删除此复制策略，或者显示 Argo CD 应用程序 没有同步，argocd.argoproj.io/compare-options：IgnoreExtraneous 注解由 Red Hat Advanced Cluster Management 策略框架自动在每个复制策略上设置。

要为您的 CertificatePolicy 资源配置健康检查，请使用以下命令编辑 ArgoCD 资源：

oc -n openshift-gitops edit argocd openshift-gitops

您的 ArgoCD 资源可能类似以下 YAML 文件：

apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: openshift-gitops
  namespace: openshift-gitops
spec:
  resourceHealthChecks:
    - group: policy.open-cluster-management.io
      kind: CertificatePolicy
      check: |
	hs = {}
	if obj.status == nil or obj.status.compliant == nil then
	  hs.status = "Progressing"
	  hs.message = "Waiting for the status to be reported"
	  return hs
	end
	if obj.status.compliant == "Compliant" then
	  hs.status = "Healthy" hs.message = "All certificates found comply with the policy"
	  return hs
	else hs.status = "Degraded"
          hs.message = "At least one certificate does not comply with the policy"
	  return hs
        end

要在 CertificatePolicy,ConfigurationPolicy,OperatorPolicy, 和 Policy 资源中添加健康检查，请运行以下命令下载 argocd-policy-healthchecks.yaml ：

wget https://raw.githubusercontent.com/open-cluster-management-io/policy-collection/main/stable/CM-Configuration-Management/argocd-policy-healthchecks.yaml

要应用 argocd-policy-healthchecks.yaml 策略，请运行以下命令：

oc apply -f ./argocd-policy-healthchecks.yaml