Skip to content

Commit 13b55f9

Browse files
ramya-bangeraramya-bangera
committed
Update the doc link and add the usecase to show custom policy template creation and assignment in the policy guide
Signed-off-by: Ramya Bangera <bangerar@vmware.com>
1 parent cb65605 commit 13b55f9

File tree

3 files changed

+273
-4
lines changed

3 files changed

+273
-4
lines changed

‎docs/guides/tanzu-mission-control_policy.md‎

Lines changed: 137 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ resource "tanzu-mission-control_iam_policy" "namespace_scoped_iam_policy" {
211211
}
212212
```
213213

214-
## Custom Policy on a CLuster Group
214+
## Custom Policy on a Cluster Group
215215

216216
```terraform
217217
/*
@@ -278,5 +278,140 @@ resource "tanzu-mission-control_custom_policy" "cluster_group_scoped_tmc-block-r
278278
## Custom Template and Custom Policy
279279

280280
Template provides a declarative definition of a policy, which can be used to apply custom constraints on managed kubernetes resources.
281-
Custom policy consumes these declared custom templates to enforce specific policies. One must create the custom template before consuming it the custom policy.
281+
Custom policy consumes these declared custom templates to enforce specific policies. One must create the [custom template][custom-policy-template] before consuming it in the custom policy.
282282
Please refer to custom policy template and custom policy terraform scripts within examples.
283+
284+
[custom-policy-template]: https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-using/GUID-F147492B-04FD-4CFD-8D1F-66E36D40D49C.html
285+
286+
## Refer the following example for creating custom policy template and assign it to custom policy
287+
288+
```terraform
289+
/*
290+
NOTE: Creation of custom policy depends on cluster group and custom policy template.
291+
*/
292+
293+
terraform {
294+
required_providers {
295+
tanzu-mission-control = {
296+
source = "vmware/tanzu-mission-control"
297+
}
298+
}
299+
}
300+
301+
# Create cluster group
302+
resource "tanzu-mission-control_cluster_group" "create_cluster_group" {
303+
name = "tf-demo-cluster-group"
304+
}
305+
306+
resource "tanzu-mission-control_custom_policy_template" "sample_template" {
307+
name = "tf-custom-template-test"
308+
309+
spec {
310+
object_type = "ConstraintTemplate"
311+
template_type = "OPAGatekeeper"
312+
313+
data_inventory {
314+
kind = "ConfigMap"
315+
group = "admissionregistration.k8s.io"
316+
version = "v1"
317+
}
318+
319+
data_inventory {
320+
kind = "Deployment"
321+
group = "extensions"
322+
version = "v1"
323+
}
324+
325+
template_manifest = <<YAML
326+
apiVersion: templates.gatekeeper.sh/v1beta1
327+
kind: ConstraintTemplate
328+
metadata:
329+
name: tf-custom-template-test
330+
annotations:
331+
description: Requires Pods to have readiness and/or liveness probes.
332+
spec:
333+
crd:
334+
spec:
335+
names:
336+
kind: tf-custom-template-test
337+
validation:
338+
openAPIV3Schema:
339+
properties:
340+
probes:
341+
type: array
342+
items:
343+
type: string
344+
probeTypes:
345+
type: array
346+
items:
347+
type: string
348+
targets:
349+
- target: admission.k8s.gatekeeper.sh
350+
rego: |
351+
package k8srequiredprobes
352+
probe_type_set = probe_types {
353+
probe_types := {type | type := input.parameters.probeTypes[_]}
354+
}
355+
violation[{"msg": msg}] {
356+
container := input.review.object.spec.containers[_]
357+
probe := input.parameters.probes[_]
358+
probe_is_missing(container, probe)
359+
msg := get_violation_message(container, input.review, probe)
360+
}
361+
probe_is_missing(ctr, probe) = true {
362+
not ctr[probe]
363+
}
364+
probe_is_missing(ctr, probe) = true {
365+
probe_field_empty(ctr, probe)
366+
}
367+
probe_field_empty(ctr, probe) = true {
368+
probe_fields := {field | ctr[probe][field]}
369+
diff_fields := probe_type_set - probe_fields
370+
count(diff_fields) == count(probe_type_set)
371+
}
372+
get_violation_message(container, review, probe) = msg {
373+
msg := sprintf("Container <%v> in your <%v> <%v> has no <%v>", [container.name, review.kind.kind, review.object.metadata.name, probe])
374+
}
375+
YAML
376+
}
377+
}
378+
379+
380+
# Cluster group scoped custom template assigned Custom Policy
381+
resource "tanzu-mission-control_custom_policy" "cluster_group_scoped_custom_template_assigned_custom_policy" {
382+
name = "tf-custom-template-policy-test"
383+
384+
scope {
385+
cluster_group {
386+
cluster_group = tanzu-mission-control_cluster_group.create_cluster_group.name
387+
}
388+
}
389+
390+
spec {
391+
input {
392+
custom {
393+
template_name = tanzu-mission-control_custom_policy_template.sample_template.name
394+
audit = false
395+
396+
target_kubernetes_resources {
397+
api_groups = [
398+
"apps",
399+
]
400+
kinds = [
401+
"Deployment"
402+
]
403+
}
404+
405+
target_kubernetes_resources {
406+
api_groups = [
407+
"apps",
408+
]
409+
kinds = [
410+
"StatefulSet",
411+
]
412+
}
413+
}
414+
}
415+
}
416+
}
417+
```

‎examples/usecases/custom_policy_with_custom_template_usecase.tf‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
/*
2+
NOTE: Creation of custom policy depends on cluster group and custom policy template.
3+
*/
4+
5+
terraform {
6+
required_providers {
7+
tanzu-mission-control = {
8+
source = "vmware/tanzu-mission-control"
9+
}
10+
}
11+
}
12+
13+
# Create cluster group
14+
resource "tanzu-mission-control_cluster_group" "create_cluster_group" {
15+
name = "tf-demo-cluster-group"
16+
}
17+
18+
resource "tanzu-mission-control_custom_policy_template" "sample_template" {
19+
name = "tf-custom-template-test"
20+
21+
spec {
22+
object_type = "ConstraintTemplate"
23+
template_type = "OPAGatekeeper"
24+
25+
data_inventory {
26+
kind = "ConfigMap"
27+
group = "admissionregistration.k8s.io"
28+
version = "v1"
29+
}
30+
31+
data_inventory {
32+
kind = "Deployment"
33+
group = "extensions"
34+
version = "v1"
35+
}
36+
37+
template_manifest = <<YAML
38+
apiVersion: templates.gatekeeper.sh/v1beta1
39+
kind: ConstraintTemplate
40+
metadata:
41+
name: tf-custom-template-test
42+
annotations:
43+
description: Requires Pods to have readiness and/or liveness probes.
44+
spec:
45+
crd:
46+
spec:
47+
names:
48+
kind: tf-custom-template-test
49+
validation:
50+
openAPIV3Schema:
51+
properties:
52+
probes:
53+
type: array
54+
items:
55+
type: string
56+
probeTypes:
57+
type: array
58+
items:
59+
type: string
60+
targets:
61+
- target: admission.k8s.gatekeeper.sh
62+
rego: |
63+
package k8srequiredprobes
64+
probe_type_set = probe_types {
65+
probe_types := {type | type := input.parameters.probeTypes[_]}
66+
}
67+
violation[{"msg": msg}] {
68+
container := input.review.object.spec.containers[_]
69+
probe := input.parameters.probes[_]
70+
probe_is_missing(container, probe)
71+
msg := get_violation_message(container, input.review, probe)
72+
}
73+
probe_is_missing(ctr, probe) = true {
74+
not ctr[probe]
75+
}
76+
probe_is_missing(ctr, probe) = true {
77+
probe_field_empty(ctr, probe)
78+
}
79+
probe_field_empty(ctr, probe) = true {
80+
probe_fields := {field | ctr[probe][field]}
81+
diff_fields := probe_type_set - probe_fields
82+
count(diff_fields) == count(probe_type_set)
83+
}
84+
get_violation_message(container, review, probe) = msg {
85+
msg := sprintf("Container <%v> in your <%v> <%v> has no <%v>", [container.name, review.kind.kind, review.object.metadata.name, probe])
86+
}
87+
YAML
88+
}
89+
}
90+
91+
92+
# Cluster group scoped custom template assigned Custom Policy
93+
resource "tanzu-mission-control_custom_policy" "cluster_group_scoped_custom_template_assigned_custom_policy" {
94+
name = "tf-custom-template-policy-test"
95+
96+
scope {
97+
cluster_group {
98+
cluster_group = tanzu-mission-control_cluster_group.create_cluster_group.name
99+
}
100+
}
101+
102+
spec {
103+
input {
104+
custom {
105+
template_name = tanzu-mission-control_custom_policy_template.sample_template.name
106+
audit = false
107+
108+
target_kubernetes_resources {
109+
api_groups = [
110+
"apps",
111+
]
112+
kinds = [
113+
"Deployment"
114+
]
115+
}
116+
117+
target_kubernetes_resources {
118+
api_groups = [
119+
"apps",
120+
]
121+
kinds = [
122+
"StatefulSet",
123+
]
124+
}
125+
}
126+
}
127+
}
128+
}

‎templates/guides/tanzu-mission-control_policy.md.tmpl‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,18 @@ In the following example, there are multiple dependencies shown.
3737

3838
{{ tffile "examples/usecases/access_policy_usecase.tf" }}
3939

40-
## Custom Policy on a CLuster Group
40+
## Custom Policy on a Cluster Group
4141

4242
{{ tffile "examples/usecases/custom_policy_usecase.tf" }}
4343

4444
## Custom Template and Custom Policy
4545

4646
Template provides a declarative definition of a policy, which can be used to apply custom constraints on managed kubernetes resources.
47-
Custom policy consumes these declared custom templates to enforce specific policies. One must create the custom template before consuming it the custom policy.
47+
Custom policy consumes these declared custom templates to enforce specific policies. One must create the [custom template][custom-policy-template] before consuming it in the custom policy.
4848
Please refer to custom policy template and custom policy terraform scripts within examples.
49+
50+
[custom-policy-template]: https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-using/GUID-F147492B-04FD-4CFD-8D1F-66E36D40D49C.html
51+
52+
## Refer the following example for creating custom policy template and assign it to custom policy
53+
54+
{{ tffile "examples/usecases/custom_policy_with_custom_template_usecase.tf" }}

0 commit comments

Comments
 (0)