Skip to content

The governance-policy-framework OCM addon that handles syncing from and to the Hub.

License

Notifications You must be signed in to change notification settings

stolostron/governance-policy-framework-addon

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Folders and files

NameName
Last commit message
Last commit date
Sep 16, 2024
Sep 21, 2024
Oct 24, 2022
Sep 16, 2024
Jul 2, 2024
Feb 17, 2024
Nov 12, 2021
Jul 2, 2024
Feb 13, 2024
Dec 10, 2021
Sep 16, 2024
May 7, 2020
Nov 12, 2021
Jun 1, 2022
Mar 30, 2022
Sep 12, 2022
May 5, 2020
Apr 26, 2022
Nov 15, 2021
Mar 20, 2023
Feb 23, 2021
Jun 14, 2024
Mar 9, 2021
Apr 21, 2023
Sep 12, 2022
Jan 27, 2023
Jul 12, 2021
Sep 16, 2024
Jun 6, 2024
Jul 2, 2024
Feb 13, 2024
Oct 10, 2022
Nov 12, 2021

Repository files navigation

Governance Policy Framework Addon KinD testsLicense

Description

Secret Sync Controller

The secret sync controller runs on managed clusters and syncs the policy-encryption-key Secret from the Hub to the managed cluster. This controller requires access to get, create, update, and delete Secret objects in the managed cluster namespace. Since the managed cluster namespace is not known at build time, the configuration in deploy/operator.yaml grants this access cluster wide. In a production environment, limit this to just the managed cluster namespace.

Spec Sync Controller

The spec sync controller runs on managed clusters, updating local Policy specs to match Policies in the cluster's namespace on the hub cluster.

The controller watches for changes to Policies in the cluster's namespace on the hub cluster to trigger a reconcile. Every reconcile creates/updates/deletes replicated policies on the managed cluster to match the spec from the hub cluster.

Status Sync Controller

The status sync controller runs on managed clusters, updating Policy statuses on both the hub and (local) managed clusters, based on events and changes in the managed cluster.

This controller watches for the following changes to trigger a reconcile:

  1. policy changes in the watched cluster namespace on the managed cluster
  2. events on policies in the watched cluster namespace on the managed cluster

Every reconcile does the following things:

  1. Creates/updates the policy status on the hub and managed cluster in cluster namespace

Template Sync Controller

The template sync controller runs on managed clusters and updates objects defined in the templates of Policies in the cluster namespace.

This controller watches for changes on Policies in the cluster namespace on the managed cluster to trigger a reconcile. On each reconcile, it creates/updates/deletes objects defined in the spec.policy-templates of those Policies.

Getting started

For documentation and installation guidance, see the Open Cluster Management documentation.

Go to the Contributing guide to learn how to get involved.

Check the Security guide if you need to report a security issue.

Build and deploy locally

You will need kind installed.

make kind-bootstrap-cluster-dev
make build-images
make kind-deploy-controller-dev

Running tests

make test-dependencies
make test

make e2e-dependencies
make e2e-test

Clean up

make kind-delete-cluster

deploy/operator.yaml

The deploy/operator.yaml file is generated via Kustomize. The deploy/rbac directory of Kustomize files is managed by the operator-sdk and Kubebuilder using markers. After updating the markers or any of the Kustomize files, you may regenerate deploy/operator.yaml by running make generate-operator-yaml.

References

  • The governance-policy-framework-addon is part of the open-cluster-management community. For more information, visit: open-cluster-management.io.

About

The governance-policy-framework OCM addon that handles syncing from and to the Hub.

Resources

License

Code of conduct

Security policy

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Go 92.6%
  • Makefile 5.4%
  • Shell 1.4%
  • Other 0.6%