apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: [TEST_POLICY_NAME]
  namespace: default
  annotations:
    policy.open-cluster-management.io/standards: 
    policy.open-cluster-management.io/categories: 
    policy.open-cluster-management.io/controls: 
spec:
  remediationAction: inform
  disabled: false
  policy-templates:
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: [TEST_POLICY_NAME]-k8srequiredlabels
      spec:
        remediationAction: enforce
        severity: low
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: templates.gatekeeper.sh/v1beta1
              kind: ConstraintTemplate
              metadata:
                name: k8srequiredlabels
              spec:
                crd:
                  spec:
                    names:
                      kind: K8sRequiredLabels
                    validation:
                      openAPIV3Schema:
                        properties:
                          labels:
                            type: array
                            items: string
                targets:
                  - target: admission.k8s.gatekeeper.sh
                    rego: >
                      package k8srequiredlabels
                      violation[{"msg": msg, "details": {"missing_labels":
                      missing}}] {
                        provided := {label | input.review.object.metadata.labels[label]}
                        required := {label | label := input.parameters.labels[_]}
                        missing := required - provided
                        count(missing) > 0
                        msg := sprintf("you must provide labels: %v", [missing])
                      }
          - complianceType: musthave
            objectDefinition:
              apiVersion: constraints.gatekeeper.sh/v1beta1
              kind: K8sRequiredLabels
              metadata:
                name: ns-must-have-gk
              spec:
                match:
                  kinds:
                    - apiGroups:
                        - ''
                      kinds:
                        - Namespace
                  namespaces:
                    - e2etestsuccess
                    - e2etestfail
                parameters:
                  labels:
                    - gatekeeper
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: [TEST_POLICY_NAME]-audit
      spec:
        remediationAction: inform
        severity: low
        object-templates:
          - complianceType: musthave
            objectDefinition:
              apiVersion: constraints.gatekeeper.sh/v1beta1
              kind: K8sRequiredLabels
              metadata:
                name: ns-must-have-gk
              status:
                totalViolations: 0
  - objectDefinition:
      apiVersion: policy.open-cluster-management.io/v1
      kind: ConfigurationPolicy
      metadata:
        name: [TEST_POLICY_NAME]-admission
      spec:
        remediationAction: inform
        severity: low
        object-templates:
          - complianceType: mustnothave
            objectDefinition:
              apiVersion: v1
              kind: Event
              metadata:
                namespace: gatekeeper-system
                annotations:
                  constraint_action: deny
                  constraint_kind: K8sRequiredLabels
                  constraint_name: ns-must-have-gk
                  event_type: violation
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-[TEST_POLICY_NAME]
  namespace: default
placementRef:
  name: placement-[TEST_POLICY_NAME]
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: [TEST_POLICY_NAME]
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-[TEST_POLICY_NAME]
  namespace: default
spec:
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      []  # selects all clusters if not specified
