update namespace for gatekeeper related policies (#68)

* update gatekeeper policy to openshift-gatekeeper-system * use different namespace for gatekeeper operator
open-cluster-management-io · Dec 19, 2020 · 8153562 · 8153562
1 parent ca6d599
commit 8153562
Show file tree

Hide file tree

Showing 6 changed files with 10 additions and 15 deletions.
diff --git a/community/CM-Configuration-Management/policy-gatekeeper-allowed-external-ips.yaml b/community/CM-Configuration-Management/policy-gatekeeper-allowed-external-ips.yaml
@@ -96,7 +96,7 @@ spec:
                 apiVersion: v1
                 kind: Event
                 metadata:
-                  namespace: gatekeeper-system
+                  namespace: openshift-gatekeeper-system # set it to the actual namespace where gatekeeper is running if different
                   annotations:
                     constraint_action: deny
                     constraint_kind: K8sExternalIPs

diff --git a/community/CM-Configuration-Management/policy-gatekeeper-container-image-latest.yaml b/community/CM-Configuration-Management/policy-gatekeeper-container-image-latest.yaml
@@ -411,7 +411,6 @@ spec:
                   name: containerimagelatest
                 status:
                   totalViolations: 0
-                  violations: []
     - objectDefinition:
         apiVersion: policy.open-cluster-management.io/v1
         kind: ConfigurationPolicy
@@ -426,7 +425,7 @@ spec:
                 apiVersion: v1
                 kind: Event
                 metadata:
-                  namespace: gatekeeper-system
+                  namespace: openshift-gatekeeper-system # set it to the actual namespace where gatekeeper is running if different
                   annotations:
                     constraint_action: deny
                     constraint_kind: ContainerImageLatest

diff --git a/community/CM-Configuration-Management/policy-gatekeeper-container-livenessprobenotset.yaml b/community/CM-Configuration-Management/policy-gatekeeper-container-livenessprobenotset.yaml
@@ -411,7 +411,6 @@ spec:
                   name: containerlivenessprobenotset
                 status:
                   totalViolations: 0
-                  violations: []
     - objectDefinition:
         apiVersion: policy.open-cluster-management.io/v1
         kind: ConfigurationPolicy
@@ -426,7 +425,7 @@ spec:
                 apiVersion: v1
                 kind: Event
                 metadata:
-                  namespace: gatekeeper-system
+                  namespace: openshift-gatekeeper-system # set it to the actual namespace where gatekeeper is running if different
                   annotations:
                     constraint_action: deny
                     constraint_kind: ContainerLivenessprobeNotset

diff --git a/community/CM-Configuration-Management/policy-gatekeeper-container-readinessprobenotset.yaml b/community/CM-Configuration-Management/policy-gatekeeper-container-readinessprobenotset.yaml
@@ -411,7 +411,6 @@ spec:
                   name: containerreadinessprobenotset
                 status:
                   totalViolations: 0
-                  violations: []
     - objectDefinition:
         apiVersion: policy.open-cluster-management.io/v1
         kind: ConfigurationPolicy
@@ -426,7 +425,7 @@ spec:
                 apiVersion: v1
                 kind: Event
                 metadata:
-                  namespace: gatekeeper-system
+                  namespace: openshift-gatekeeper-system # set it to the actual namespace where gatekeeper is running if different
                   annotations:
                     constraint_action: deny
                     constraint_kind: ContainerReadinessprobeNotset

diff --git a/community/CM-Configuration-Management/policy-gatekeeper-operator.yaml b/community/CM-Configuration-Management/policy-gatekeeper-operator.yaml
@@ -24,7 +24,7 @@ spec:
               apiVersion: v1
               kind: Namespace
               metadata:
-                name: gatekeeper-system
+                name: openshift-gatekeeper-operator
   - objectDefinition:
       apiVersion: policy.open-cluster-management.io/v1
       kind: ConfigurationPolicy
@@ -40,7 +40,7 @@ spec:
               kind: CatalogSource
               metadata:
                 name: gatekeeper-operator
-                namespace: gatekeeper-system
+                namespace: openshift-gatekeeper-operator
               spec:
                 displayName: Gatekeeper Operator Upstream
                 publisher: github.com/font/gatekeeper-operator
@@ -64,7 +64,7 @@ spec:
               kind: OperatorGroup
               metadata:
                 name: gatekeeper-operator
-                namespace: gatekeeper-system
+                namespace: openshift-gatekeeper-operator
   - objectDefinition:
       apiVersion: policy.open-cluster-management.io/v1
       kind: ConfigurationPolicy
@@ -80,12 +80,12 @@ spec:
               kind: Subscription
               metadata:
                 name: gatekeeper-operator-sub
-                namespace: gatekeeper-system
+                namespace: openshift-gatekeeper-operator
               spec:
                 channel: alpha
                 name: gatekeeper-operator
                 source: gatekeeper-operator
-                sourceNamespace: gatekeeper-system
+                sourceNamespace: openshift-gatekeeper-operator
   - objectDefinition:
       apiVersion: policy.open-cluster-management.io/v1
       kind: ConfigurationPolicy
@@ -101,7 +101,6 @@ spec:
               kind: Gatekeeper
               metadata:
                 name: gatekeeper
-                namespace: gatekeeper-system
               spec:
                 audit:
                   logLevel: INFO

diff --git a/community/CM-Configuration-Management/policy-gatekeeper-sample.yaml b/community/CM-Configuration-Management/policy-gatekeeper-sample.yaml
@@ -77,7 +77,6 @@ spec:
                   name: ns-must-have-gk
                 status:
                   totalViolations: 0
-                  violations: []
     - objectDefinition:
         apiVersion: policy.open-cluster-management.io/v1
         kind: ConfigurationPolicy
@@ -92,7 +91,7 @@ spec:
                 apiVersion: v1
                 kind: Event
                 metadata:
-                  namespace: gatekeeper-system
+                  namespace: openshift-gatekeeper-system # set it to the actual namespace where gatekeeper is running if different
                   annotations:
                     constraint_action: deny
                     constraint_kind: K8sRequiredLabels