-
Create policies namespace:
kubectl create namespace policies --dry-run=client -o yaml | kubectl apply -f -
-
Set up ArgoCD and Placements (from ch-stark/gatekeeper-examples):
for i in 01 02 03; do
curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/setupgitops/${i}_*.yaml | kubectl apply -f -
done
sleep 30
for i in 04 05 06 07 08 09; do
curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/setupgitops/${i}_*.yaml | kubectl apply --validate=false -f -
done
-
Install PolicyGenerator plugin:
mkdir -p ~/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator
curl -sL https://github.com/open-cluster-management-io/policy-generator-plugin/releases/latest/download/darwin-arm64-PolicyGenerator \
-o ~/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
chmod +x ~/.config/kustomize/plugin/policy.open-cluster-management.io/v1/policygenerator/PolicyGenerator
-
Download manifest files locally (PolicyGenerator requires local paths):
cd assets/${TRACE_ID}
python3 -c "
import urllib.request, json, os
base = 'https://api.github.com/repos/ch-stark/gatekeeper-examples/contents'
dirs = ['gatekeeperinstall', 'gatekeeperconfig', 'gatekeeperchecks',
'gatekeeperconstraint', 'extracontrainttemplates',
'checkadmissionevents', 'mutation', 'hub/templates',
'hub/constraints', 'verify-deprecatedapi']
for d in dirs:
os.makedirs(d, exist_ok=True)
with urllib.request.urlopen(f'{base}/{d}') as resp:
for f in json.load(resp):
if f.get('download_url'):
with urllib.request.urlopen(f['download_url']) as r:
with open(f\"{d}/{f['name']}\", 'wb') as out:
out.write(r.read())
"
-
Build and apply policies:
kustomize build --enable-alpha-plugins . | kubectl apply -n policies -f -
-
Label clusters for Gatekeeper deployment:
kubectl label managedcluster local-cluster gatekeeper=true
kubectl label managedcluster <cluster-name> gatekeeper=true
-
Verify deployment:
kubectl get policies -n policies
kubectl get placement -n policies
kubectl get policies -n policies -o custom-columns="NAME:.metadata.name,COMPLIANT:.status.compliant"
