安全性

查看以下集群生命周期 RBAC 操作。

创建和管理所有受管集群：

管理名为 cluster-name 的受管集群：

查看名为 cluster-name 的受管集群：

请参阅 ManagedClusterSets 以了解有关管理 ManagedClusterSet 资源的信息。

查看以下集群生命周期控制台和 API RBAC 表：

在创建一个应用程序时，subscription 命名空间会被创建，配置映射会在 subscription 命名空间中创建。如果需要应用订阅，则必须是订阅管理员。有关管理应用程序的更多信息，请参阅创建和管理订阅。

要执行应用程序生命周期任务，具有 admin 角色的用户必须有权访问创建的应用程序所在的命名空间，以及 managedcluster 命名空间。例如，在命名空间 "N" 中创建应用程序所需的访问权限是命名空间范围的绑定到命名空间 "N" 的 admin 角色。

查看以下应用程序生命周期控制台和 API RBAC 表：

要执行监管生命周期操作，用户必须有权访问创建策略的命名空间，以及访问应用策略的 managedcluster 命名空间。

请参见以下示例：

查看以下监管生命周期控制台和 API RBAC 表：

要使用可观察功能，您必须分配 cluster-admin 或 open-cluster-management:cluster-manager-admin 角色。查看以下可观察功能列表：

创建、更新和删除 MultiClusterObservability 自定义资源。查看以下 RBAC 表：

如需了解更多与集群安全相关的信息，请参阅安全部分。

确认您的 Red Hat Advanced Cluster Management for Kubernetes 集群正在运行。

运行以下命令，备份现有 Red Hat Advanced Cluster Management for Kubernetes 证书资源：

oc get cert multicloud-ca-cert -n open-cluster-management -o yaml > multicloud-ca-cert-backup.yaml

完成以下步骤，使用 OpenSSL 创建 root CA 证书：

替换了 root CA 后，必须刷新所有由 root CA 签名的证书，且必须重启使用这些证书的服务。Cert-manager 从 root CA 创建默认签发者，因此由 cert-manager 签发以及由默认 ClusterIssuer 签名的所有证书都必须刷新。

删除与每个 cert-manager 证书关联的 Kubernetes secret，以刷新证书并重启使用该证书的服务。运行以下命令：

oc delete secret -n open-cluster-management $(oc get cert -n open-cluster-management -o wide | grep multicloud-ca-issuer | awk '{print $3}')

要恢复 root CA 证书，请完成以下步骤来更新 CA 签发者：

刷新所有使用该 CA 的 cert-manager 证书。如需更多信息，请参阅前述部分“刷新 cert-manager 证书”。

有关由 Red Hat Advanced Cluster Management for Kubernates 创建和管理的证书的更多信息，请参阅证书。

将您的 management-ingress 证书和私钥准备妥当。如果需要，您可以使用 OpenSSL 生成 TLS 证书。将证书上的通用名称参数 CN 设置为 manangement-ingress。如果您要生成证书，请加入以下设置：

[ req ]               # Main settings
default_bits = 2048       # Default key size in bits.
prompt = no               # Disables prompting for certificate values so the configuration file values are used.
default_md = sha256       # Specifies the digest algorithm.
req_extensions = req_ext  # Specifies the configuration file section that includes any extensions.
distinguished_name = dn   # Specifies the section that includes the distinguished name information.

[ dn ]               # Distinguished name settings
C = US                    # Country
ST = North Carolina             # State or province
L = Raleigh                # Locality
O = Red Hat Open Shift     # Organization
OU = Red Hat Advanced Container Management        # Organizational unit
CN = management-ingress  # Common name.

[ req_ext ]          # Extensions
subjectAltName = @alt_names # Subject alternative names

[ alt_names ]        # Subject alternative names
DNS.1 = management-ingress
DNS.2 = multicloud-console.apps.grchub2.dev08.red-chesterfield.com
DNS.3 = localhost
DNS.4 = 127.0.0.1

[ v3_ext ]          # x509v3 extensions
authorityKeyIdentifier=keyid,issuer:always  # Specifies the public key that corresponds to the private key that is used to sign a certificate.
basicConstraints=CA:FALSE                   # Indicates whether the certificate is a CA certificate during the certificate chain verification process.
#keyUsage=keyEncipherment,dataEncipherment   # Defines the purpose of the key that is contained in the certificate.
extendedKeyUsage=serverAuth                 # Defines the purposes for which the public key can be used.
subjectAltName=@alt_names                   # Identifies the subject alternative names for the identify that is bound to the public key by the CA.

完成以下步骤以替换您的 BYO 入口证书：

有关由 Red Hat Advanced Cluster Management for Kubernates 创建和管理的证书的更多信息，请参阅证书。返回 Security 以了解更多有关保护集群的信息。

Name:         configuration-policy-example
Namespace:
Labels:
APIVersion:   policy.open-cluster-management.io/v1
Kind:         ConfigPolicy
Metadata:
  Finalizers:
    finalizer.policy.open-cluster-management.io
Spec:
  Conditions:
    Ownership:
    NamespaceSelector:
      Exclude:
      Include:
    RemediationAction:
 Status:
   CompliancyDetails:
     Configuration-Policy-Example:
       Default:
       Kube - Public:
   Compliant:          Compliant
 Events:

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigPolicy
metadata:
  name: policy-config
spec:
  namespaceSelector:
    include: ["default"]
    exclude: []
  remediationAction: inform
    severity: low
    object-templates:
    - complianceType: musthave
      objectDefinition:
        apiVersion: v1
        kind: Pod
        metadata:
          name: nginx-pod
        spec:
          containers:
          - image: nginx:1.7.9
            name: nginx
            ports:
           - containerPort: 80

了解策略将如何应用到您的 hub 集群中。如需更多详细信息，请参阅策略示例。了解如何创建和自定义策略，请参阅管理安全策略。

有关控制器的更多信息，请参阅策略控制器。

查看证书策略的以下示例，并查看 YAML 表中的元素：

apiVersion: policy.open-cluster-management.io/v1
kind: CertificatePolicy
metadata:
  name: certificate-policy-example
  namespace:
  labels: category=system-and-information-integrity
spec:
  namespaceSelector:
    include: ["default"]
    exclude: ["kube-*"]
  remediationAction:
  severity:
  minimumDuration:
  minimumCADuration:
  maximumDuration:
  maximumCADuration:
  allowedSANPattern:
  disallowedSANPattern:

当在 hub 集群上创建证书策略控制器时，会在受管集群上创建复制策略。受管集群上的证书策略可能类似以下文件：

apiVersion: policy.open-cluster-management.io/v1
kind: CertificatePolicy
metadata:
  name: certificate-policy-1
  namespace: kube-system
  label:
    category: "System-Integrity"
spec:
  namespaceSelector:
    include: ["default", "kube-*"]
    exclude: ["kube-system"]
  remediationAction: inform
  minimumDuration: 100h
  minimumCADuration: 200h
  maximumDuration: 2161h
  maximumCADuration: 43920h
  allowedSANPattern: "[[:alpha:]]"
  disallowedSANPattern: "[\\*]"

了解如何管理证书策略，请参阅管理证书策略以了解更多详细信息。有关更多主题，请参阅策略控制器。

查看 IAM 策略的以下示例，并查看 YAML 表中的参数：

apiVersion: policy.open-cluster-management.io/v1
kind: IamPolicy
metadata:
  name:
spec:
  severity:
  namespaceSelector:
    include:
    exclude:
  remediationAction:
  maxClusterRoleBindingUsers:

查看以下参数表以获详细信息：

apiVersion: policy.open-cluster-management.io/v1
kind: IamPolicy # limit clusteradminrole and report violation
metadata:
  name: {{name}}-example
spec:
  severity: medium
  namespaceSelector:
    include: ["*"]
    exclude: ["kube-*", "openshift-*"]
  remediationAction: inform # will be overridden by remediationAction in parent policy
  maxClusterRoleBindingUsers: 5

了解如何管理 IAM 策略，请参阅管理 IAM 策略以了解更多详细信息。有关更多主题，请参阅策略控制器。

使用 multicloud-operators-policy-controller 仓库中的策略控制器框架。完成以下步骤来创建策略控制器：

您的策略控制器可以正常工作。

将自定义策略控制器部署到集群，并将策略控制器与监管和风险仪表板集成。完成以下步骤：

您的内存用量策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-limitrange
     namespace:
   spec:
     complianceType:
     remediationAction:
     namespaces:
       exclude:
       include:
     object-templates:
       - complianceType:
         objectDefinition:
           apiVersion:
           kind:
           metadata:
             name:
           spec:
             limits:
             - default:
                 memory:
               defaultRequest:
                 memory:
               type:
           ...

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-limitrange
     namespace: mcm
   spec:
     complianceType: musthave
     remediationAction: inform
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     object-templates:
       - complianceType: musthave
         objectDefinition:
           apiVersion: v1
           kind: LimitRange # limit memory usage
           metadata:
             name: mem-limit-range
           spec:
             limits:
             - default:
                 memory: 512Mi
               defaultRequest:
                 memory: 256Mi
               type: Container
           ...

如需更多信息，请参阅管理内存用量策略。查看由控制器监控的其他配置策略，请参阅 Kubernetes 配置策略控制器页面。

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-namespace-1
     namespace:
   spec:
     complianceType:
     remediationAction:
     namespaces:
       exclude:
       include:
     object-templates:
       - complianceType:
         objectDefinition:
           kind:
           apiVersion:
           metadata:
             name:
        ...

您的命名空间策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-namespace-1
     namespace: open-cluster-management
   spec:
     complianceType: musthave
     remediationAction: inform
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     object-templates:
       - complianceType: musthave
         objectDefinition:
           kind: Namespace # must have namespace 'prod'
           apiVersion: v1
           metadata:
             name: prod
        ...

管理命名空间策略。如需更多信息，请参阅管理命名空间策略。如需了解其他配置策略，请参阅 Kubernetes 配置策略控制器。

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-imagemanifestvulnpolicy
  namespace: default
  annotations:
    policy.open-cluster-management.io/standards: NIST-CSF
    policy.open-cluster-management.io/categories: DE.CM Security Continuous Monitoring
    policy.open-cluster-management.io/controls: DE.CM-8 Vulnerability Scans
spec:
  remediationAction:
  disabled:
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name:
      spec:
        remediationAction:
        severity: high
        object-templates:
          - complianceType:
            objectDefinition:
              apiVersion: operators.coreos.com/v1alpha1
              kind: Subscription
              metadata:
                name: container-security-operator
                namespace:
              spec:
                channel:
                installPlanApproval:
                name:
                source:
                sourceNamespace:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name:
      spec:
        remediationAction:
        severity:
        namespaceSelector:
          exclude:
          include:
        object-templates:
          - complianceType:
            objectDefinition:
              apiVersion: secscan.quay.redhat.com/v1alpha1
              kind: ImageManifestVuln # checking for a kind
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-imagemanifestvulnpolicy
  namespace: default
placementRef:
  name:
  kind:
  apiGroup:
subjects:
- name:
  kind:
  apiGroup:
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-imagemanifestvulnpolicy
  namespace: default
spec:
  clusterConditions:
  - status:
    type:
  clusterSelector:
    matchExpressions:
      []  # selects all clusters if not specified

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-imagemanifestvulnpolicy
  namespace: default
  annotations:
    policy.open-cluster-management.io/standards: NIST-CSF
    policy.open-cluster-management.io/categories: DE.CM Security Continuous Monitoring
    policy.open-cluster-management.io/controls: DE.CM-8 Vulnerability Scans
spec:
  remediationAction: inform
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: policy-imagemanifestvulnpolicy-example-sub
      spec:
        remediationAction: inform # will be overridden by remediationAction in parent policy
        severity: high
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: operators.coreos.com/v1alpha1
              kind: Subscription
              metadata:
                name: container-security-operator
                namespace: openshift-operators
              spec:
                channel: quay-v3.3
                installPlanApproval: Automatic
                name: container-security-operator
                source: redhat-operators
                sourceNamespace: openshift-marketplace
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: policy-imagemanifestvulnpolicy-example-imv
      spec:
        remediationAction: inform # will be overridden by remediationAction in parent policy
        severity: high
        namespaceSelector:
          exclude: ["kube-*"]
          include: ["*"]
        object-templates:
          - complianceType: mustnothave # mustnothave any ImageManifestVuln object
            objectDefinition:
              apiVersion: secscan.quay.redhat.com/v1alpha1
              kind: ImageManifestVuln # checking for a kind
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-imagemanifestvulnpolicy
  namespace: default
placementRef:
  name: placement-policy-imagemanifestvulnpolicy
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-imagemanifestvulnpolicy
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-imagemanifestvulnpolicy
  namespace: default
spec:
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      []  # selects all clusters if not specified

有关更多信息，请参阅管理镜像漏洞策略。查看由配置控制器监控的其他配置策略，请参阅 Kubernetes 配置策略控制器。

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-pod
     namespace:
   spec:
     complianceType:
     remediationAction:
     namespaces:
       exclude:
       include:
     object-templates:
       - complianceType:
         objectDefinition:
           apiVersion:
           kind: Pod # nginx pod must exist
           metadata:
             name:
           spec:
             containers:
             - image:
               name:
               ports:
               - containerPort:
        ...

您的 Pod nginx 策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-pod
     namespace: open-cluster-management
   spec:
     complianceType: musthave
     remediationAction: inform
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     object-templates:
       - complianceType: musthave
         objectDefinition:
           apiVersion: v1
           kind: Pod # nginx pod must exist
           metadata:
             name: nginx-pod
           spec:
             containers:
             - image: nginx:1.7.9
               name: nginx
               ports:
               - containerPort: 80
        ...

了解如何管理 Pod nginx 策略，请参阅管理 Pod nginx 策略以了解更多详细信息。查看由配置控制器监控的其他配置策略，请参阅 Kubernetes 配置策略控制器。请参阅管理安全策略以管理其他策略。

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-podsecuritypolicy
     namespace:
   spec:
     complianceType:
     remediationAction:
     namespaces:
       exclude:
       include:
     object-templates:
       - complianceType:
         objectDefinition:
           apiVersion:
           kind: PodSecurityPolicy # no privileged pods
           metadata:
             name:
             annotations:
           spec:
             privileged:
             allowPrivilegeEscalation:
             allowedCapabilities:
             volumes:
             hostNetwork:
             hostPorts:
             hostIPC:
             hostPID:
             runAsUser:
               rule:
             seLinux:
               rule:
             supplementalGroups:
               rule:
             fsGroup:
               rule:
        ...

您的 Pod 安全策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-podsecuritypolicy
     namespace: open-cluster-management
   spec:
     complianceType: musthave
     remediationAction: inform
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     object-templates:
       - complianceType: musthave
         objectDefinition:
           apiVersion: policy/v1beta1
           kind: PodSecurityPolicy # no privileged pods
           metadata:
             name: restricted-open-cluster-management
             annotations:
            seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
           spec:
             privileged: false # no priviliedged pods
             allowPrivilegeEscalation: false
             allowedCapabilities:
             - '*'
             volumes:
             - '*'
             hostNetwork: true
             hostPorts:
             - min: 1000 # ports < 1000 are reserved
               max: 65535
             hostIPC: false
             hostPID: false
             runAsUser:
               rule: 'RunAsAny'
             seLinux:
               rule: 'RunAsAny'
             supplementalGroups:
               rule: 'RunAsAny'
             fsGroup:
               rule: 'RunAsAny'
        ...

如需更多信息，请参阅管理 Pod 安全策略。查看由控制器监控的其他配置策略，请参阅 Kubernetes 配置策略控制器页面。

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-role
  namespace:
  annotations:
    policy.open-cluster-management.io/standards: NIST-CSF
    policy.open-cluster-management.io/categories: PR.AC Identity Management Authentication and Access Control
    policy.open-cluster-management.io/controls: PR.AC-4 Access Control
spec:
  remediationAction: inform
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-role-example
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: high
          namespaceSelector:
            exclude: ["kube-*"]
            include: ["default"]
          object-templates:
            - complianceType: mustonlyhave # role definition should exact match
              objectDefinition:
                apiVersion: rbac.authorization.k8s.io/v1
                kind: Role
                metadata:
                  name: sample-role
                rules:
                  - apiGroups: ["extensions", "apps"]
                    resources: ["deployments"]
                    verbs: ["get", "list", "watch", "delete","patch"]
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-role
  namespace:
placementRef:
  name: placement-policy-role
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-role
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-role
  namespace:
spec:
  clusterConditions:
    - type: ManagedClusterConditionAvailable
      status: "True"
  clusterSelector:
    matchExpressions:
      []

         ...

应用角色策略来为集群中的特定角色设置规则和权限。有关角色的更多信息，请参阅基于角色的访问控制。您的角色策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-role
     namespace: open-cluster-management
   spec:
     complianceType: musthave
     remediationAction: inform
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     role-templates:
       - apiVersion: open-cluster-management.io/v1/v1alpha1 # role must follow defined permissions
         metadata:
           namespace: "" # will be inferred
           name: operator-role-policy
         selector:
           matchLabels:
             dev: "true"
         complianceType: musthave # at this level, it means the role must exist with the rules that it must have the following
         rules:
           - complianceType: musthave # at this level, it means if the role exists the rule is a musthave
             policyRule:
               apiGroups: ["extensions", "apps"]
               resources: ["deployments"]
               verbs: ["get", "list", "watch", "create", "delete","patch"]
          - complianceType: "mustnothave" # at this level, it means if the role exists the rule is a mustnothave
            policyRule:
              apiGroups: ["core"]
              resources: ["secrets"]
              verbs: ["get", "list", "watch","delete", "create", "update", "patch"]
         ...

如需更多信息，请参阅管理角色策略。查看由控制器监控的其他配置策略，请参阅 Kubernetes 配置策略控制器页面。了解有关 Red Hat Advanced Cluster Management for Kubernates RBAC 的更多信息，请参阅基于角色的访问控制。

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name:
     namespace:
   spec:
     complianceType:
     remediationAction:
     namespaces:
       exclude:
       include:
     object-templates:
       - complianceType:
         objectDefinition:
           kind: RoleBinding # role binding must exist
           apiVersion: rbac.authorization.k8s.io/v1
           metadata:
             name: operate-pods-rolebinding
           subjects:
           - kind: User
             name: admin # Name is case sensitive
             apiGroup:
           roleRef:
             kind: Role #this must be Role or ClusterRole
             name: operator # this must match the name of the Role or ClusterRole you wish to bind to
             apiGroup: rbac.authorization.k8s.io
       ...

rolebinding 策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-rolebinding
     namespace: open-cluster-management
   spec:
     complianceType: musthave
     remediationAction: inform
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     object-templates:
       - complianceType: musthave
         objectDefinition:
           kind: RoleBinding # role binding must exist
           apiVersion: rbac.authorization.k8s.io/v1
           metadata:
             name: operate-pods-rolebinding
           subjects:
           - kind: User
             name: admin # Name is case sensitive
             apiGroup: rbac.authorization.k8s.io
           roleRef:
             kind: Role #this must be Role or ClusterRole
             name: operator # this must match the name of the Role or ClusterRole you wish to bind to
             apiGroup: rbac.authorization.k8s.io
       ...

了解如何管理 rolebinding 策略，请参阅管理 rolebinding 策略以了解更多详细信息。如需了解其他配置策略，请参阅 Kubernetes 配置策略控制器。请参阅管理安全策略以管理其他策略。

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-scc
  namespace: open-cluster-management-policies
spec:
  complianceType:
  remediationAction:
  namespaces:
    exclude:
    include:
  object-templates:
    - complianceType:
      objectDefinition:
        apiVersion:
        kind: SecurityContextConstraints # restricted scc
        metadata:
          annotations:
            kubernetes.io/description:
          name: sample-restricted-scc
        allowHostDirVolumePlugin:
        allowHostIPC:
        allowHostNetwork:
        allowHostPID:
        allowHostPorts:
        allowPrivilegeEscalation:
        allowPrivilegedContainer:
        allowedCapabilities:
        defaultAddCapabilities:
        fsGroup:
         type:
        groups:
        - system:
        priority:
        readOnlyRootFilesystem:
        requiredDropCapabilities:
        runAsUser:
          type:
        seLinuxContext:
          type:
        supplementalGroups:
          type:
        users:
        volumes:

有关 SCC 策略内容的解释，请参阅 OpenShift Container Platform 文档中的关于安全性上下文约束。

应用安全性上下文约束 (SCC) 策略，通过在策略中定义条件来控制 Pod 的权限。如需更多信息，请参阅管理安全性上下文约束 (SCC)。您的 SCC 策略可能类似以下 YAML 文件：

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-scc
     namespace: open-cluster-management
     annotations:
       policy.open-cluster-management.io/standards: NIST-CSF
       policy.open-cluster-management.io/categories: PR.PT Protective Technology
       policy.open-cluster-management.io/controls: PR.PT-3 Least Functionality
   spec:
     complianceType: musthave
     remediationAction: inform
     disabled: false
     namespaces:
       exclude: ["kube-*"]
       include: ["default"]
     object-templates:
       - complianceType: musthave
         objectDefinition:
           apiVersion: security.openshift.io/v1
           kind: SecurityContextConstraints # restricted scc
           metadata:
             annotations:
               kubernetes.io/description: restricted denies access to all host features and requires pods to be run with a UID, and SELinux context that are allocated to the namespace.  This is the most restrictive SCC and it is used by default for authenticated users.
             name: sample-restricted-scc
           allowHostDirVolumePlugin: false
           allowHostIPC: false
           allowHostNetwork: false
           allowHostPID: false
           allowHostPorts: false
           allowPrivilegeEscalation: true
           allowPrivilegedContainer: false
           allowedCapabilities: []
           defaultAddCapabilities: []
           fsGroup:
             type: MustRunAs
           groups:
           - system:authenticated
           priority: null
           readOnlyRootFilesystem: false
           requiredDropCapabilities:
           - KILL
           - MKNOD
           - SETUID
           - SETGID
           runAsUser:
             type: MustRunAsRange
           seLinuxContext:
             type: MustRunAs
           supplementalGroups:
             type: RunAsAny
           users: []
           volumes:
           - configMap
           - downwardAPI
           - emptyDir
           - persistentVolumeClaim
           - projected
           - secret
   ---
   apiVersion: apps.open-cluster-management.io/v1
   kind: PlacementBinding
   metadata:
     name: binding-policy-scc
     namespace: open-cluster-management-policies
   placementRef:
     name: placement-policy-scc
     kind: PlacementRule
     apiGroup: apps.open-cluster-management.io
   subjects:
   - name: policy-scc
     kind: Policy
     apiGroup: policy.mcm.ibm.com
   ---
   apiVersion: apps.open-cluster-management.io/v1
   kind: PlacementBinding
   metadata:
     name: policy-scc-production-clusters
     namespace: open-cluster-management-policies
   placementRef:
     name: production-clusters
     kind: PlacementRule
     apiGroup: apps.open-cluster-management.io
   subjects:
   - name: policy-scc
     kind: Policy
     apiGroup: policy.mcm.ibm.com
   ---
   apiVersion: apps.open-cluster-management.io/v1
   kind: PlacementRule
   metadata:
     name: placement-policy-scc
     namespace: open-cluster-management-policies
   spec:
     clusterConditions:
       - type: ManagedClusterConditionAvailable
         status: "True"
     clusterSelector:
       matchExpressions: []

要了解如何管理 SCC 策略，请参阅管理安全性上下文约束策略以了解更多详细信息。如需了解其他配置策略，请参阅 Kubernetes 配置策略控制器。请参阅管理安全策略以管理其他策略。

etcd-encryption 策略可能类似以下 YAML 文件：

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-etcdencryption
  namespace:
spec:
  complianceType:
  remediationAction:
  namespaces:
    exclude:
    include:
  object-templates:
    - complianceType:
      objectDefinition:
        apiVersion: config.openshift.io/v1
        kind: APIServer
        metadata:
          name: cluster
        spec:
          encryption:
            type:
        ...

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-etcdencryption
  namespace: default
spec:
  complianceType: musthave
  remediationAction: inform
  namespaces:
    exclude: ["kube-*"]
    include: ["default"]
  object-templates:
    - complianceType: musthave
      objectDefinition:
        apiVersion: config.openshift.io/v1
        kind: APIServer
        metadata:
          name: cluster
        spec:
          encryption:
            type: aescbc
        ...

如需更多信息，请参阅管理 ETCD 加密策略。查看由控制器监控的其他配置策略，请参阅 Kubernetes 配置策略控制器页面。

您可以使用命令行界面 (CLI) 或者从控制台创建安全策略。需要集群管理员访问权限。

重要：您必须定义一个 PlacementPolicy 和 PlacementBinding，才能将您的策略应用到特定的集群。为 Cluster binding 字段输入一个值来定义 PlacementPolicy 和 PlacementBinding。查看 Red Hat Advanced Cluster Management 策略所需的对象定义：

在策略概述中查看策略 YAML 文件的更多描述。

查看以下部分以了解如何更新安全策略。

您可以使用命令行界面 (CLI) 或者从控制台为配置策略创建 YAML 文件。查看以下部分以创建配置策略：

查看以下部分以了解如何更新配置策略。

通过 CLI 或控制台删除配置策略。

您的策略已删除。

查看配置策略示例，请参阅策略示例。请参阅管理安全策略以管理其他策略。

您可以使用命令行界面 (CLI) 或者从控制台为镜像漏洞策略创建 YAML。查看以下部分以创建镜像漏洞策略：

从控制台创建镜像漏洞策略时，也会在 YAML 编辑器中创建 YAML 文件。完成以下步骤，从控制台创建镜像漏洞策略：

镜像漏洞策略已创建。

查看以下部分以了解如何更新镜像漏洞策略。

您可以使用命令行界面 (CLI) 或者从控制台为内存用量策略创建 YAML 文件。查看以下部分以创建内存用量策略：

查看以下部分以了解如何更新内存用量策略。

您可以使用命令行界面 (CLI) 或者从控制台为命名空间策略创建 YAML 文件。查看以下部分以创建命名空间策略：

查看以下部分以了解如何更新命名空间策略。

您可以从命令行界面 (CLI) 或者从控制台为 Pod nginx 策略创建 YAML。查看以下部分以创建 Pod nginx 策略：

从控制台创建 Pod nginx 策略时，也会在 YAML 编辑器中创建 YAML 文件。完成以下步骤，从控制台创建 Pod nginx 策略：

从控制台查看您的 Pod nginx 策略

您可以在控制台中查看任何 Pod nginx 策略及其状态。

查看以下部分以了解如何更新 Pod nginx 策略。

您可以使用命令行界面 (CLI) 或者从控制台为 Pod 安全策略创建 YAML 文件。查看以下部分以创建 Pod 安全策略：

查看以下部分以了解如何更新 Pod 安全策略。

您可以使用命令行界面 (CLI) 或者从控制台为角色策略创建 YAML 文件。查看以下部分以创建角色策略：

查看以下部分以了解如何更新角色策略。

您可以使用命令行界面 (CLI) 或者从控制台为 rolebinding 策略创建 YAML 文件。查看以下部分以创建 rolebinding 策略：

查看以下部分以了解如何更新 rolebinding 策略。

您可以使用命令行界面 (CLI) 或者从控制台为 SCC 策略创建 YAML 文件。查看以下部分以创建 SCC 策略：

查看以下部分以了解如何更新 SCC 策略。

您可以使用命令行界面 (CLI) 或者从控制台为证书策略创建 YAML 文件。查看以下部分以创建证书策略：

您可以使用命令行界面 (CLI) 或者从控制台为 IAM 策略创建 YAML 文件。

查看以下部分以了解如何更新 IAM 策略。

您可以使用命令行界面（CLI）或者从控制台为加密策略创建 YAML 文件。查看以下部分以创建加密策略：

查看以下部分以了解如何更新加密策略。

您可以使用命令行界面（CLI）为 gatekeeper 策略创建 YAML 文件。使用 Red Hat Advanced Cluster Management for Kubernetes 配置策略，将 gatekeeper 策略从 hub 集群传播到受管集群。查看以下部分，为准入和审核场景创建 gatekeeper 策略：

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-gatekeeper
  namespace: default
  annotations:
    policy.open-cluster-management.io/standards:
    policy.open-cluster-management.io/categories:
    policy.open-cluster-management.io/controls:
spec:
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-gatekeeper-k8srequiredlabels
        spec:
          remediationAction: enforce # will be overridden by remediationAction in parent policy
          severity: low
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: templates.gatekeeper.sh/v1beta1
                kind: ConstraintTemplate
                metadata:
                  name: k8srequiredlabels
                spec:
                  crd:
                    spec:
                      names:
                        kind: K8sRequiredLabels
                      validation:
                        # Schema for the `parameters` field
                        openAPIV3Schema:
                          properties:
                            labels:
                              type: array
                              items: string
                  targets:
                    - target: admission.k8s.gatekeeper.sh
                      rego: |
                        package k8srequiredlabels
                        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
                          provided := {label | input.review.object.metadata.labels[label]}
                          required := {label | label := input.parameters.labels[_]}
                          missing := required - provided
                          count(missing) > 0
                          msg := sprintf("you must provide labels: %v", [missing])
                        }
            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: K8sRequiredLabels
                metadata:
                  name: ns-must-have-gk
                spec:
                  match:
                    kinds:
                      - apiGroups: [""]
                        kinds: ["Namespace"]
                  parameters:
                    labels: ["gatekeeper"]
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-gatekeeper-admission
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: low
          object-templates:
            - complianceType: mustnothave
              objectDefinition:
                apiVersion: v1
                kind: Event
                metadata:
                  namespace: gatekeeper-system
                  annotations:
                    constraint_action: deny
                    constraint_kind: K8sRequiredLabels
                    constraint_name: ns-must-have-gk
                    event_type: violation