See the solution below in Explanation.
Explanation:
Policies in ACM require:
* a Policy resource
* a Placement (which clusters to target)
* a PlacementBinding (bind policy # placement)
* Create the Policy (in team-dev) enforcing a namespace audit-logs:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-ensure-audit-namespace
namespace: team-dev
spec:
remediationAction: enforce
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: ensure-audit-namespace
spec:
remediationAction: enforce
severity: low
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: audit-logs
EOF
* Create PlacementBinding to bind it to dev-clusters placement:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: bind-policy-ensure-audit-namespace
namespace: team-dev
placementRef:
apiGroup: cluster.open-cluster-management.io
kind: Placement
name: dev-clusters
subjects:
- apiGroup: policy.open-cluster-management.io
kind: Policy
name: policy-ensure-audit-namespace
EOF
* Verify compliance:
oc get policy -n team-dev
oc describe policy policy-ensure-audit-namespace -n team-dev
Why this matters:
This is the core "ACM governance" exam pattern: define desired state and enforce across clusters.