on push: make

openshift · Nov 8, 2024 · 154aa53 · 154aa53
1 parent 194558b
commit 154aa53
Show file tree

Hide file tree

Showing 4 changed files with 143 additions and 308 deletions.
diff --git a/deploy/acm-policies/50-GENERATED-osd-openshift-operators-redhat.Policy.yaml b/deploy/acm-policies/50-GENERATED-osd-openshift-operators-redhat.Policy.yaml
@@ -32,66 +32,42 @@ spec:
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
+                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        metadata:
-                            name: admin-dedicated-admins
-                            namespace: openshift-operators-redhat
-                        roleRef:
-                            apiGroup: rbac.authorization.k8s.io
-                            kind: ClusterRole
-                            name: admin
-                        subjects:
-                            - apiGroup: rbac.authorization.k8s.io
-                              kind: Group
-                              name: dedicated-admins
+                        name: admin-dedicated-admins
+                        namespace: openshift-operators-redhat
+                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
+                        patchType: merge
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
+                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        metadata:
-                            name: admin-system:serviceaccounts:dedicated-admin
-                            namespace: openshift-operators-redhat
-                        roleRef:
-                            apiGroup: rbac.authorization.k8s.io
-                            kind: ClusterRole
-                            name: admin
-                        subjects:
-                            - apiGroup: rbac.authorization.k8s.io
-                              kind: Group
-                              name: system:serviceaccounts:dedicated-admin
+                        name: admin-system:serviceaccounts:dedicated-admin
+                        namespace: openshift-operators-redhat
+                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
+                        patchType: merge
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
+                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        metadata:
-                            name: openshift-operators-redhat-dedicated-admins
-                            namespace: openshift-operators-redhat
-                        roleRef:
-                            apiGroup: rbac.authorization.k8s.io
-                            kind: ClusterRole
-                            name: dedicated-admins-project
-                        subjects:
-                            - apiGroup: rbac.authorization.k8s.io
-                              kind: Group
-                              name: dedicated-admins
+                        name: openshift-operators-redhat-dedicated-admins
+                        namespace: openshift-operators-redhat
+                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
+                        patchType: merge
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
+                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        metadata:
-                            name: openshift-operators-redhat:serviceaccounts:dedicated-admin
-                            namespace: openshift-operators-redhat
-                        roleRef:
-                            apiGroup: rbac.authorization.k8s.io
-                            kind: ClusterRole
-                            name: dedicated-admins-project
-                        subjects:
-                            - apiGroup: rbac.authorization.k8s.io
-                              kind: Group
-                              name: system:serviceaccounts:dedicated-admin
+                        name: openshift-operators-redhat:serviceaccounts:dedicated-admin
+                        namespace: openshift-operators-redhat
+                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
+                        patchType: merge
                 pruneObjectBehavior: DeleteIfCreated
                 remediationAction: enforce
                 severity: low

diff --git a/hack/00-osd-managed-cluster-config-integration.yaml.tmpl b/hack/00-osd-managed-cluster-config-integration.yaml.tmpl
@@ -6448,66 +6448,42 @@ objects:
                 metadataComplianceType: musthave
                 objectDefinition:
                   apiVersion: rbac.authorization.k8s.io/v1
+                  applyMode: AlwaysApply
                   kind: RoleBinding
-                  metadata:
-                    name: admin-dedicated-admins
-                    namespace: openshift-operators-redhat
-                  roleRef:
-                    apiGroup: rbac.authorization.k8s.io
-                    kind: ClusterRole
-                    name: admin
-                  subjects:
-                  - apiGroup: rbac.authorization.k8s.io
-                    kind: Group
-                    name: dedicated-admins
+                  name: admin-dedicated-admins
+                  namespace: openshift-operators-redhat
+                  patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
+                  patchType: merge
               - complianceType: mustonlyhave
                 metadataComplianceType: musthave
                 objectDefinition:
                   apiVersion: rbac.authorization.k8s.io/v1
+                  applyMode: AlwaysApply
                   kind: RoleBinding
-                  metadata:
-                    name: admin-system:serviceaccounts:dedicated-admin
-                    namespace: openshift-operators-redhat
-                  roleRef:
-                    apiGroup: rbac.authorization.k8s.io
-                    kind: ClusterRole
-                    name: admin
-                  subjects:
-                  - apiGroup: rbac.authorization.k8s.io
-                    kind: Group
-                    name: system:serviceaccounts:dedicated-admin
+                  name: admin-system:serviceaccounts:dedicated-admin
+                  namespace: openshift-operators-redhat
+                  patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
+                  patchType: merge
               - complianceType: mustonlyhave
                 metadataComplianceType: musthave
                 objectDefinition:
                   apiVersion: rbac.authorization.k8s.io/v1
+                  applyMode: AlwaysApply
                   kind: RoleBinding
-                  metadata:
-                    name: openshift-operators-redhat-dedicated-admins
-                    namespace: openshift-operators-redhat
-                  roleRef:
-                    apiGroup: rbac.authorization.k8s.io
-                    kind: ClusterRole
-                    name: dedicated-admins-project
-                  subjects:
-                  - apiGroup: rbac.authorization.k8s.io
-                    kind: Group
-                    name: dedicated-admins
+                  name: openshift-operators-redhat-dedicated-admins
+                  namespace: openshift-operators-redhat
+                  patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
+                  patchType: merge
               - complianceType: mustonlyhave
                 metadataComplianceType: musthave
                 objectDefinition:
                   apiVersion: rbac.authorization.k8s.io/v1
+                  applyMode: AlwaysApply
                   kind: RoleBinding
-                  metadata:
-                    name: openshift-operators-redhat:serviceaccounts:dedicated-admin
-                    namespace: openshift-operators-redhat
-                  roleRef:
-                    apiGroup: rbac.authorization.k8s.io
-                    kind: ClusterRole
-                    name: dedicated-admins-project
-                  subjects:
-                  - apiGroup: rbac.authorization.k8s.io
-                    kind: Group
-                    name: system:serviceaccounts:dedicated-admin
+                  name: openshift-operators-redhat:serviceaccounts:dedicated-admin
+                  namespace: openshift-operators-redhat
+                  patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
+                  patchType: merge
               pruneObjectBehavior: DeleteIfCreated
               remediationAction: enforce
               severity: low
@@ -32224,58 +32200,35 @@ objects:
       kind: Namespace
       metadata:
         name: openshift-operators-redhat
+    patches:
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
-      metadata:
-        name: admin-dedicated-admins
-        namespace: openshift-operators-redhat
-      roleRef:
-        apiGroup: rbac.authorization.k8s.io
-        kind: ClusterRole
-        name: admin
-      subjects:
-      - apiGroup: rbac.authorization.k8s.io
-        kind: Group
-        name: dedicated-admins
+      name: admin-dedicated-admins
+      namespace: openshift-operators-redhat
+      applyMode: AlwaysApply
+      patchType: merge
+      patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
-      metadata:
-        name: admin-system:serviceaccounts:dedicated-admin
-        namespace: openshift-operators-redhat
-      roleRef:
-        apiGroup: rbac.authorization.k8s.io
-        kind: ClusterRole
-        name: admin
-      subjects:
-      - apiGroup: rbac.authorization.k8s.io
-        kind: Group
-        name: system:serviceaccounts:dedicated-admin
+      name: admin-system:serviceaccounts:dedicated-admin
+      namespace: openshift-operators-redhat
+      applyMode: AlwaysApply
+      patchType: merge
+      patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
-      metadata:
-        name: openshift-operators-redhat-dedicated-admins
-        namespace: openshift-operators-redhat
-      roleRef:
-        apiGroup: rbac.authorization.k8s.io
-        kind: ClusterRole
-        name: dedicated-admins-project
-      subjects:
-      - apiGroup: rbac.authorization.k8s.io
-        kind: Group
-        name: dedicated-admins
+      name: openshift-operators-redhat-dedicated-admins
+      namespace: openshift-operators-redhat
+      applyMode: AlwaysApply
+      patchType: merge
+      patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
-      metadata:
-        name: openshift-operators-redhat:serviceaccounts:dedicated-admin
-        namespace: openshift-operators-redhat
-      roleRef:
-        apiGroup: rbac.authorization.k8s.io
-        kind: ClusterRole
-        name: dedicated-admins-project
-      subjects:
-      - apiGroup: rbac.authorization.k8s.io
-        kind: Group
-        name: system:serviceaccounts:dedicated-admin
+      name: openshift-operators-redhat:serviceaccounts:dedicated-admin
+      namespace: openshift-operators-redhat
+      applyMode: AlwaysApply
+      patchType: merge
+      patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
 - apiVersion: hive.openshift.io/v1
   kind: SelectorSyncSet
   metadata: