Skip to content

Commit

Permalink
Fix indent in README
Browse files Browse the repository at this point in the history
Signed-off-by: Takumi Yanagawa <yana@jp.ibm.com>
  • Loading branch information
yana1205 committed Oct 16, 2023
1 parent fba0dd8 commit 50db9a6
Showing 1 changed file with 45 additions and 44 deletions.
89 changes: 45 additions & 44 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,74 +1,75 @@
# compliance-to-policy
Compliance-to-Policy (C2P) provides the framework to bridge the gap between compliance and policy administration.

## setup pipeline
## C2P as pipeline task
### Setup pipeline
1. Create two repositories (one is configuration repository that's used for pipeline from OSCAL to Policy and another is evidence repository that's used for pipeline from OCM statuses to Compliance result)
- For example, c2p-for-ocm-pipeline01-config and c2p-for-ocm-pipeline01-evidence
- For example, c2p-for-ocm-pipeline01-config and c2p-for-ocm-pipeline01-evidence
1. Create Github Personal Access Token having following permissions
- Repository permission of `Contents`, `Pull Requests`, and `Workflows` with read-and-write against both the configuration repository and the evidence repository.
- Repository permission of `Contents`, `Pull Requests`, and `Workflows` with read-and-write against both the configuration repository and the evidence repository.
1. Fork C2P repository (yana1205/compliance-to-policy.git) and checkout `template`
1. Set required parameters for github action to initialize your configuration and evidence repo
1. Go to Settings tab
1. Go to `Actions` under `Secrets and variables`
1. Create `New repository secret`
- Name: PAT
- Secret: Created Github Personal Access Token
1. Go to `Variables` tab to create `New repository variable`
1. Create `CONFIGURATION_REPOSITORY` variable
- Name: CONFIGURATION_REPOSITORY
- Value: `<configuration repository org>/<configuration repository name> (e.g. yana1205/c2p-for-ocm-pipeline01-config)`
1. Create `EVIDENCE_REPOSITORY` variable
- Name: EVIDENCE_REPOSITORY
- Value: `<evidence repository org>/<evidence repository name> (e.g. yana1205/c2p-for-ocm-pipeline01-evidence)`
1. Go to Settings tab
1. Go to `Actions` under `Secrets and variables`
1. Create `New repository secret`
- Name: PAT
- Secret: Created Github Personal Access Token
1. Go to `Variables` tab to create `New repository variable`
1. Create `CONFIGURATION_REPOSITORY` variable
- Name: CONFIGURATION_REPOSITORY
- Value: `<configuration repository org>/<configuration repository name> (e.g. yana1205/c2p-for-ocm-pipeline01-config)`
1. Create `EVIDENCE_REPOSITORY` variable
- Name: EVIDENCE_REPOSITORY
- Value: `<evidence repository org>/<evidence repository name> (e.g. yana1205/c2p-for-ocm-pipeline01-evidence)`
1. Run Action `Initialize repositories` with branch `template`
1. Go to the configuration repository and create `New repository secret`
- Name: PAT
- Secret: Created Github Personal Access Token
- Name: PAT
- Secret: Created Github Personal Access Token
1. Go to the evidence repository and create `New repository secret`
- Name: PAT
- Secret: Created Github Personal Access Token
- Name: PAT
- Secret: Created Github Personal Access Token

## run oscal-to-pocliy
### Run oscal-to-pocliy
1. Go to the configuration repository
1. Go to `Actions` tab
1. Run `OSCAL to Policy`
1. This action generates manifests from OSCAL and then generate a PR of changes for a directory `ocm-policy-manifests` containing the generated manifests.
1. This action generates manifests from OSCAL and then generate a PR of changes for a directory `ocm-policy-manifests` containing the generated manifests.
1. Merge the PR

## integrate with GitOps
### Integrate with GitOps
1. Sync `ocm-policy-manifests` directory with your OCM Hub by OCM GitOps (OCM Channel and Subscription addon)

## deploy collector to your OCM Hub
### Deploy collector to your OCM Hub
1. Apply RBAC for collector
```
kubectl apply -f https://raw.githubusercontent.com/yana1205/compliance-to-policy/redesign.0622/scripts/collect/rbac.yaml
```
```
kubectl apply -f https://raw.githubusercontent.com/yana1205/compliance-to-policy/redesign.0622/scripts/collect/rbac.yaml
```
1. Create Secret for Github access
```
kubectl -n c2p create secret generic --save-config collect-ocm-status-secret --from-literal=user=<github user> --from-literal=token=<github PAT> --from-literal=org=<evidence org name> --from-literal=repo=<evidence repo name>
```
e.g.
```
kubectl -n c2p create secret generic --save-config collect-ocm-status-secret --from-literal=user=yana1205 --from-literal=token=github_pat_xxx --from-literal=org=yana1205 --from-literal=repo=c2p-for-ocm-pipeline01-evidence
```
```
kubectl -n c2p create secret generic --save-config collect-ocm-status-secret --from-literal=user=<github user> --from-literal=token=<github PAT> --from-literal=org=<evidence org name> --from-literal=repo=<evidence repo name>
```
e.g.
```
kubectl -n c2p create secret generic --save-config collect-ocm-status-secret --from-literal=user=yana1205 --from-literal=token=github_pat_xxx --from-literal=org=yana1205 --from-literal=repo=c2p-for-ocm-pipeline01-evidence
```
1. Deploy collector cronjob
```
kubectl apply -f https://raw.githubusercontent.com/yana1205/compliance-to-policy/redesign.0622/scripts/collect/cronjob.yaml
```
```
kubectl apply -f https://raw.githubusercontent.com/IBM/compliance-to-policy/main/scripts/collect/cronjob.yaml
```

## cleanup
### Cleanup
```
kubectl delete -f https://raw.githubusercontent.com/yana1205/compliance-to-policy/redesign.0622/scripts/collect/cronjob.yaml
kubectl delete -f https://raw.githubusercontent.com/IBM/compliance-to-policy/main/scripts/collect/cronjob.yaml
kubectl -n c2p delete secret collect-ocm-status-secret
kubectl delete -f https://raw.githubusercontent.com/yana1205/compliance-to-policy/redesign.0622/scripts/collect/rbac.yaml
kubectl delete -f https://raw.githubusercontent.com/IBM/compliance-to-policy/main/scripts/collect/rbac.yaml
```

---
# Controller pattern
## Prerequisites
## Utilities
### Prerequisites
1. Install [Policy Generator Plugin](https://github.com/open-cluster-management-io/policy-generator-plugin#as-a-kustomize-plugin)

## C2P Decomposer
### C2P Decomposer
Decompose OCM poicy collection to kubernetes resources composing each OCM policy (we call it policy resource).

1. Clone [Policy Collection](https://github.com/open-cluster-management-io/policy-collection)
Expand Down Expand Up @@ -100,7 +101,7 @@ Decompose OCM poicy collection to kubernetes resources composing each OCM policy
│   │   └── License.triliovault-license.0.yaml
│   ├── kustomization.yaml
```
## C2P Composer
### C2P Composer
Compose OCM Policy from policy resources from compliance information (for example, [compliance.yaml](cmd/compose/compliance.yaml))

1. Run C2P Composer
Expand Down Expand Up @@ -130,7 +131,7 @@ Compose OCM Policy from policy resources from compliance information (for exampl
└── policy-sets.yaml
```

## C2P Controller
## C2P as controller (deprecated)
1. Build image
```
make docker-build docker-push IMG=<controller image>
Expand Down

0 comments on commit 50db9a6

Please sign in to comment.