diff --git a/telco-hub/configuration/reference-crs-kube-compare/compare_ignore b/telco-hub/configuration/reference-crs-kube-compare/compare_ignore index 3256e41aa..969abe05e 100644 --- a/telco-hub/configuration/reference-crs-kube-compare/compare_ignore +++ b/telco-hub/configuration/reference-crs-kube-compare/compare_ignore @@ -33,6 +33,10 @@ required/gitops/addPluginsPolicy.yaml # not include the full policy content due to policy templating. required/acm/observabilityRoutePolicy.yaml +# cert-manager config CRs (user-specific, and policies with hub-side templating) +optional/cert-manager/certManagerRootCAExpirationPolicy.yaml +optional/cert-manager/kustomization.yaml + required/gitops/extra-manifests-policy.yaml # ArgoCD files kustomization.yaml diff --git a/telco-hub/configuration/reference-crs-kube-compare/default_value.yaml b/telco-hub/configuration/reference-crs-kube-compare/default_value.yaml index 6fa23b32b..83848a9b2 100644 --- a/telco-hub/configuration/reference-crs-kube-compare/default_value.yaml +++ b/telco-hub/configuration/reference-crs-kube-compare/default_value.yaml @@ -479,6 +479,7 @@ optional_cert_manager_certManagerCertificatePolicy: include: - openshift-ingress - openshift-config + - cert-manager optional_cert_manager_certManagerSubscription: - spec: diff --git a/telco-hub/configuration/reference-crs-kube-compare/metadata.yaml b/telco-hub/configuration/reference-crs-kube-compare/metadata.yaml index 55177d742..d089be122 100644 --- a/telco-hub/configuration/reference-crs-kube-compare/metadata.yaml +++ b/telco-hub/configuration/reference-crs-kube-compare/metadata.yaml @@ -38,6 +38,17 @@ parts: - path: optional/cert-manager/certManagerCertificatePolicy.yaml - path: optional/cert-manager/certManagerCertificatePolicyPlacement.yaml - path: optional/cert-manager/certManagerCertificatePolicyPlacementBinding.yaml + - name: cert-manager-root-ca-monitoring + description: |- + Root CA expiration monitoring via PrometheusRule + allOrNoneOf: + - path: optional/cert-manager/certManagerRootCAExpirationPolicy.yaml + config: + ignore-unspecified-fields: true + fieldsToOmitRefs: + - templates + - path: optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml + - path: optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml - name: optional-storage components: - name: local-storage-operator diff --git a/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml index df50e2185..e42c7dc16 100644 --- a/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml +++ b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml @@ -19,7 +19,7 @@ spec: spec: minimumDuration: {{ .spec.minimumDuration | default "720h" }} namespaceSelector: - include:{{- template "unorderedListAllowExtra" (list .spec.namespaceSelector.include (list "openshift-ingress" "openshift-config") ) }} + include:{{- template "unorderedListAllowExtra" (list .spec.namespaceSelector.include (list "openshift-ingress" "openshift-config" "cert-manager") ) }} remediationAction: inform severity: low remediationAction: inform diff --git a/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml new file mode 100644 index 000000000..b323e1c7b --- /dev/null +++ b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: policy.open-cluster-management.io/v1 +kind: Policy +metadata: + name: root-ca-expiration-monitor + namespace: default + annotations: + policy.open-cluster-management.io/categories: SC System and Communications Protection + policy.open-cluster-management.io/controls: SC-8 Transmission Confidentiality and Integrity + policy.open-cluster-management.io/standards: NIST 800-53 +spec: + disabled: false + remediationAction: enforce diff --git a/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml new file mode 100644 index 000000000..5a1e716b6 --- /dev/null +++ b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta1 +kind: Placement +metadata: + name: root-ca-expiration-placement + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "-11" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + predicates: + - requiredClusterSelector: + labelSelector: + matchExpressions: + - key: local-cluster + operator: In + values: + - "true" diff --git a/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml new file mode 100644 index 000000000..f9ec1fd7a --- /dev/null +++ b/telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: policy.open-cluster-management.io/v1 +kind: PlacementBinding +metadata: + name: root-ca-expiration-placementbinding + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "-11" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +placementRef: + name: root-ca-expiration-placement + apiGroup: cluster.open-cluster-management.io + kind: Placement +subjects: + - name: root-ca-expiration-monitor + apiGroup: policy.open-cluster-management.io + kind: Policy diff --git a/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml index b46e29ca5..de65769a7 100644 --- a/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml +++ b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml @@ -22,6 +22,7 @@ spec: include: - openshift-ingress - openshift-config + - cert-manager remediationAction: inform severity: low remediationAction: inform diff --git a/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml new file mode 100644 index 000000000..56ac3bee1 --- /dev/null +++ b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml @@ -0,0 +1,59 @@ +--- +# ACM Policy to create a PrometheusRule that alerts on root CA +# certificate expiration. Monitors the cert-manager certificate +# expiration metric and fires warnings at 90 days and critical +# alerts at 30 days before expiry. +apiVersion: policy.open-cluster-management.io/v1 +kind: Policy +metadata: + name: root-ca-expiration-monitor + namespace: default + annotations: + policy.open-cluster-management.io/categories: SC System and Communications Protection + policy.open-cluster-management.io/controls: SC-8 Transmission Confidentiality and Integrity + policy.open-cluster-management.io/standards: NIST 800-53 + argocd.argoproj.io/sync-wave: "-10" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + disabled: false + policy-templates: + - objectDefinition: + apiVersion: policy.open-cluster-management.io/v1 + kind: ConfigurationPolicy + metadata: + name: root-ca-expiration-prometheusrule + spec: + remediationAction: enforce + severity: high + object-templates: + - complianceType: musthave + objectDefinition: + apiVersion: monitoring.coreos.com/v1 + kind: PrometheusRule + metadata: + name: cert-manager-root-ca-expiration + namespace: cert-manager-operator + spec: + groups: + - name: cert-manager-root-ca + rules: + - alert: CertManagerRootCAExpiringSoon + annotations: + summary: 'Root CA certificate {{`{{ $labels.name }}`}} is expiring soon' + description: 'The root CA certificate {{`{{ $labels.name }}`}} in namespace {{`{{ $labels.namespace }}`}} expires in less than 90 days.' + # Update name="root-ca" if your cert-manager Certificate resource uses a different name + expr: | + certmanager_certificate_expiration_timestamp_seconds{name="root-ca",namespace="cert-manager"} - time() < 90 * 24 * 3600 + for: 1h + labels: + severity: warning + - alert: CertManagerRootCAExpirationCritical + annotations: + summary: 'Root CA certificate {{`{{ $labels.name }}`}} is about to expire' + description: 'The root CA certificate {{`{{ $labels.name }}`}} in namespace {{`{{ $labels.namespace }}`}} expires in less than 30 days. Immediate action required.' + expr: | + certmanager_certificate_expiration_timestamp_seconds{name="root-ca",namespace="cert-manager"} - time() < 30 * 24 * 3600 + for: 1h + labels: + severity: critical + remediationAction: enforce diff --git a/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml new file mode 100644 index 000000000..5a1e716b6 --- /dev/null +++ b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: cluster.open-cluster-management.io/v1beta1 +kind: Placement +metadata: + name: root-ca-expiration-placement + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "-11" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + predicates: + - requiredClusterSelector: + labelSelector: + matchExpressions: + - key: local-cluster + operator: In + values: + - "true" diff --git a/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml new file mode 100644 index 000000000..f9ec1fd7a --- /dev/null +++ b/telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: policy.open-cluster-management.io/v1 +kind: PlacementBinding +metadata: + name: root-ca-expiration-placementbinding + namespace: default + annotations: + argocd.argoproj.io/sync-wave: "-11" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +placementRef: + name: root-ca-expiration-placement + apiGroup: cluster.open-cluster-management.io + kind: Placement +subjects: + - name: root-ca-expiration-monitor + apiGroup: policy.open-cluster-management.io + kind: Policy diff --git a/telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml b/telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml index 78bb41b41..efe561fb8 100644 --- a/telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml +++ b/telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml @@ -13,3 +13,6 @@ resources: - certManagerCertificatePolicy.yaml - certManagerCertificatePolicyPlacement.yaml - certManagerCertificatePolicyPlacementBinding.yaml + - certManagerRootCAExpirationPolicy.yaml + - certManagerRootCAExpirationPolicyPlacement.yaml + - certManagerRootCAExpirationPolicyPlacementBinding.yaml