1.6. 生成用于安装 GitOps Operator 的策略

1.6.1. 生成安装 OpenShift Container Platform GitOps 的策略
复制链接

您可以使用 Policy Generator 生成安装 OpenShift Container Platform GitOps 的策略。OpenShift Container Platform GitOps operator 提供了 all namespaces 安装模式，您可以在以下示例中查看。创建名为 openshift-gitops-subscription.yaml 的 Subscription 清单文件，如下例所示：

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: openshift-gitops-operator
  namespace: openshift-operators
spec:
  channel: stable
  name: openshift-gitops-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: openshift-gitops-operator
  namespace: openshift-operators
spec:
  channel: stable
  name: openshift-gitops-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

Copy to Clipboard

Toggle word wrap

要固定到 Operator 的特定版本，您可以添加以下参数和值： spec.startingCSV: openshift-gitops-operator.v<version>。将 <version> 替换为您的首选版本。

需要 PolicyGenerator 配置文件。使用名为 policy-generator-config.yaml 的配置文件来生成策略，以便在所有 OpenShift Container Platform 受管集群上安装 OpenShift Container Platform GitOps。请参见以下示例：

apiVersion: policy.open-cluster-management.io/v1
kind: PolicyGenerator
metadata:
  name: install-openshift-gitops
policyDefaults:
  namespace: policies
  placement:
    clusterSelectors:
      vendor: "OpenShift"
  remediationAction: enforce
policies:
  - name: install-openshift-gitops
    manifests:
      - path: openshift-gitops-subscription.yaml

apiVersion: policy.open-cluster-management.io/v1
kind: PolicyGenerator
metadata:
  name: install-openshift-gitops
policyDefaults:
  namespace: policies
  placement:
    clusterSelectors:
      vendor: "OpenShift"
  remediationAction: enforce
policies:
  - name: install-openshift-gitops
    manifests:
      - path: openshift-gitops-subscription.yaml

Copy to Clipboard

Toggle word wrap

最后所需的文件是 kustomization.yaml，它需要以下配置：

generators:
  - policy-generator-config.yaml

generators:
  - policy-generator-config.yaml

Copy to Clipboard

Toggle word wrap

生成的策略可能类似以下带有 PlacementRule 的文件（已弃用）：

apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-install-openshift-gitops
  namespace: policies
spec:
  clusterSelector:
    matchExpressions:
      - key: vendor
        operator: In
        values:
          - OpenShift
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-install-openshift-gitops
  namespace: policies
placementRef:
  apiGroup: apps.open-cluster-management.io
  kind: PlacementRule
  name: placement-install-openshift-gitops
subjects:
  - apiGroup: policy.open-cluster-management.io
    kind: Policy
    name: install-openshift-gitops
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/description:
  name: install-openshift-gitops
  namespace: policies
spec:
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: install-openshift-gitops
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: operators.coreos.com/v1alpha1
                kind: Subscription
                metadata:
                  name: openshift-gitops-operator
                  namespace: openshift-operators
                spec:
                  channel: stable
                  name: openshift-gitops-operator
                  source: redhat-operators
                  sourceNamespace: openshift-marketplace
          remediationAction: enforce
          severity: low

apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-install-openshift-gitops
  namespace: policies
spec:
  clusterSelector:
    matchExpressions:
      - key: vendor
        operator: In
        values:
          - OpenShift
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-install-openshift-gitops
  namespace: policies
placementRef:
  apiGroup: apps.open-cluster-management.io
  kind: PlacementRule
  name: placement-install-openshift-gitops
subjects:
  - apiGroup: policy.open-cluster-management.io
    kind: Policy
    name: install-openshift-gitops
---
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/description:
  name: install-openshift-gitops
  namespace: policies
spec:
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: install-openshift-gitops
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: operators.coreos.com/v1alpha1
                kind: Subscription
                metadata:
                  name: openshift-gitops-operator
                  namespace: openshift-operators
                spec:
                  channel: stable
                  name: openshift-gitops-operator
                  source: redhat-operators
                  sourceNamespace: openshift-marketplace
          remediationAction: enforce
          severity: low

Copy to Clipboard

Toggle word wrap

支持 OpenShift Container Platform 文档中的从清单生成的策略。OpenShift Container Platform 文档中的任何配置指南都可以使用 Policy Generator 应用。

1.6.2. 使用带有 OperatorGroup 的策略依赖项
复制链接

当使用 OperatorGroup 清单安装 Operator 时，OperatorGroup 必须在创建 Subscription 前存在于集群中。使用策略依赖项功能以及 Policy Generator 来确保 OperatorGroup 策略在强制实施 订阅 策略前兼容。

通过按您想要的顺序列出清单来设置策略依赖项。例如，您可能想要首先创建命名空间策略，然后创建 OperatorGroup，最后再创建 Subscription。

启用 policyDefaults.orderManifests 参数，并在 Policy Generator 配置清单中禁用 policyDefaults.consolidateManifests，以自动设置清单之间的依赖项。

1.6.3. 其他资源
复制链接

请参阅生成安装 Compliance Operator 的策略。
如需了解更多详细信息，请参阅使用 GitOps 部署策略。
如需了解更多详细信息，请参阅了解 OpenShift GitOps 和 Operator 文档。
请参阅 Adding Operators to a cluster - 使用 CLI 从 OperatorHub 安装
如需了解更多详细信息，请参阅 Compliance Operator 文档。
请参阅 所有命名空间 安装模式。
请参阅 命名空间 安装模式。
请参阅在部署 pod 前使用初始容器执行任务。
请参阅 Argo CD。
查看 OpenShift Container Platform 支持的 YAML 输入示例：
- 配置审计日志策略
- 关于将日志转发到第三方系统

1.6.1. 生成安装 OpenShift Container Platform GitOps 的策略
复制链接

1.6.2. 使用带有 OperatorGroup 的策略依赖项
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

1.6. 生成用于安装 GitOps Operator 的策略

1.6.1. 生成安装 OpenShift Container Platform GitOps 的策略复制链接链接已复制到粘贴板!

1.6.2. 使用带有 OperatorGroup 的策略依赖项复制链接链接已复制到粘贴板!

1.6.3. 其他资源复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

1.6.1. 生成安装 OpenShift Container Platform GitOps 的策略
复制链接

1.6.2. 使用带有 OperatorGroup 的策略依赖项
复制链接

1.6.3. 其他资源
复制链接