policy-gatekeeper-operator-downstream.yaml

# This policy verifies the installation of the official and supported version of
# the Gatekeeper Operator on the managed clusters.
#
# If set to "enforce" it'll install the operator.
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-gatekeeper-operator
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  remediationAction: inform
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1beta1
        kind: OperatorPolicy
        metadata:
          name: operatorpolicy-gatekeeper-operator
        spec:
          remediationAction: inform
          severity: high
          complianceType: musthave
          upgradeApproval: Automatic
          subscription:
            channel: stable
            name: gatekeeper-operator-product
            namespace: openshift-operators
            source: redhat-operators
            sourceNamespace: openshift-marketplace
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: gatekeeper
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: operator.gatekeeper.sh/v1alpha1
                kind: Gatekeeper
                metadata:
                  name: gatekeeper
                spec:
                  audit:
                    auditChunkSize: 500
                    logLevel: INFO
                    replicas: 1
                  validatingWebhook: Enabled
                  mutatingWebhook: Disabled
                  webhook:
                    emitAdmissionEvents: Enabled
                    logLevel: INFO
                    replicas: 2
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: gatekeeper-status
        spec:
          remediationAction: inform
          severity: high
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                kind: Pod
                metadata:
                  namespace: openshift-gatekeeper-system
                  labels:
                    control-plane: audit-controller
                status:
                  phase: Running # check the pod status to determine if operator is running or not
            - complianceType: musthave
              objectDefinition:
                apiVersion: v1
                kind: Pod
                metadata:
                  namespace: openshift-gatekeeper-system
                  labels:
                    control-plane: controller-manager
                status:
                  phase: Running # check the pod status to determine if operator is running or not