Install Policy Controller

Stay organized with collections Save and categorize content based on your preferences.

Console

To install Policy Controller in the Google Cloud console, complete the following steps:

1. In the Google Cloud console, go to the GKE Enterprise Policy page under the Posture Management section.

   Go to Policy

2. Click add Configure Policy Controller.

3. Optional: To change the default fleet settings, click Customize fleet settings. In the dialog that appears, do the following:

   1. In the Add/Edit policy bundles section, include or exclude a policy bundle by clicking the relevant toggle.

   2. In the Edit Policy Controller configuration section, do the following:

      1. To enable the mutation webhook, select the Enable mutation webhook checkbox. This feature is not compatible with Autopilot clusters.
      2. In the Audit interval box, enter the period in seconds between two consecutive audits.

      3. In the Exemptible namespaces box, enter a list of namespaces. Policy Controller ignores objects in these namespaces.

         Best practice:

         Exempt system namespaces to avoid errors in your environment. You can find the instructions to exempt namespaces and a list of common namespaces created by Google Cloud services on the Exclude namespaces page.

      4. To enable referential constraints, select the Enable Constraint Templates that reference to objects other than the object currently being evaluated checkbox.

      5. In the Version list, select the Policy Controller version that you want to use.

   3. Click Save changes.

4. Click Configure.

5. In the confirmation dialog, click Confirm. If you haven't previously enabled Policy Controller, clicking Confirm enables the anthospolicycontroller.googleapis.com API and installs Policy Controller on your clusters.

6. Optional: Sync existing clusters to the default settings:

   1. In the Settings tab, click Sync to fleet settings.
   2. In the Clusters in the fleet list, select the clusters that you want to sync and then click Sync to fleet settings. This operation can take a few minutes to complete.

You are redirected to the Policy Controller Settings tab. When Policy Controller is installed and configured on your clusters, the status columns show Installed check_circle. This can take several minutes.

gcloud

Enable Policy Controller by running the following command:

gcloud container fleet policycontroller enable \
    --memberships=MEMBERSHIP_NAME

You can set additional fields to configure Policy Controller. For example, you might want to tell Policy Controller to exempt some namespaces from enforcement. For a full list of fields you can configure, see the Policy Controller Google Cloud CLI documentation or run gcloud container fleet policycontroller enable --help.

Set fleet-level settings for Policy Controller by completing the following steps:

1. Create a file named fleet-default.yaml that contains the default configurations for Policy Controller. The installSpec field is required to enable fleet-level defaults. This example shows the options you can configure:

   # cat fleet-default.yaml
   
    policyControllerHubConfig:
     installSpec: INSTALL_SPEC_ENABLED 
     # Uncomment to set default deployment-level configurations.
     # deploymentConfigs:
     #   admission:
     #     containerResources:
     #       limits:
     #        cpu: 1000m
     #         memory: 8Gi
     #       requests:
     #         cpu: 500m
     #         memory: 4Gi
     # Uncomment to set policy bundles that you want to install by default.
     # policyContent:
     #   bundles:
     #     cis-k8s-v1.5.1:
     #       exemptedNamespaces:
     #       - "namespace-name"
     # Uncomment to exempt namespaces from admission.
     # exemptableNamespaces:
     # - "namespace-name"
     # Uncomment to enable support for referential constraints
     # referentialRulesEnabled: true
     # Uncomment to disable audit, adjust value to set audit interval
     # auditIntervalSeconds: 0
     # Uncomment to log all denies and dryrun failures
     # logDeniesEnabled: true
     # Uncomment to enable mutation
     # mutationEnabled: true
     # Uncomment to adjust the value to set the constraint violation limit
     # constraintViolationLimit: 20
     # ... other fields ...
   

   Best practice:

   Exempt system namespaces to avoid errors in your environment. You can find the instructions to exempt namespaces and a list of common namespaces created by Google Cloud services on the Exclude namespaces page.

2. Apply the default configuration to your fleet:

   gcloud container fleet policycontroller enable \
     --fleet-default-member-config=fleet-default.yaml
   

3. To verify that the configuration was applied, run the following command:

   gcloud container fleet policycontroller describe
   

4. To remove the fleet-level default configuration, run the following command:

   gcloud container fleet policycontroller enable \
     --no-fleet-default-member-config
   

Terraform

To enable Policy Controller across your fleet with the default template library installed, refer to the following example:

resource "google_gke_hub_feature" "policycontroller" {
  name     = "policycontroller"
  location = "global"
  project  = data.google_project.default.project_id

  fleet_default_member_config {
    policycontroller {
      policy_controller_hub_config {
        install_spec = "INSTALL_SPEC_ENABLED"
        policy_content {
          bundles {
            bundle = "pss-baseline-v2022"
          }
          template_library {
            installation = "ALL"
          }
        }
      }
    }
  }
}

You can pass multiple bundle blocks to install any of the bundles listed in the Policy Controller bundles overview.

To learn more about using Terraform, see Terraform support for Policy Controller.

Console

Complete the following steps:

1. In the Google Cloud console, go to the GKE Enterprise Policy page under the Posture Management section.

   Go to Policy

2. Under the Settings tab, in the cluster table, check the Policy controller status column. A successful installation has a status of Installed check_circle.

gcloud

Run the following command:

gcloud container fleet policycontroller describe --memberships=MEMBERSHIP_NAME

A successful installation shows membershipStates: MEMBERSHIP_NAME: policycontroller: state: ACTIVE.

Console

Complete the following steps:

1. In the Google Cloud console, go to the GKE Enterprise Policy page under the Posture Management section.

   Go to Policy

2. Under the Settings tab, in the cluster table, select the number listed in the Bundles installed column. In the Policy content status pane, a successful installation of the template library has a status of Installed check_circle.

gcloud

Run the following command:

kubectl get constrainttemplates

You should see output similar to the following example:

NAME                                      AGE
k8sallowedrepos                           84s
k8scontainerlimits                        84s
k8spspallowprivilegeescalationcontainer   84s
...[OUTPUT TRUNCATED]...

When an individual constraint template is installed correctly, its status.created field is true.

Console

1. In the Google Cloud console, go to the GKE Enterprise Policy page under the Posture Management section.

   Go to Policy

2. Under the Settings tab, next to the cluster whose version you want to upgrade, select edit Edit configuration.
3. Expand the Edit Policy Controller configuration menu.
4. From the Version drop-down list, select the version that you want to upgrade to.
5. Click Save changes.

gcloud

Run the following command:

gcloud container fleet policycontroller update \
  --version=VERSION \
  --memberships=MEMBERSHIP_NAME

Replace the following:

• VERSION: the version that you want to upgrade to
• MEMBERSHIP_NAME: the membership name that you chose when you registered your cluster. You can find the membership name by running gcloud container fleet memberships list.

Console

To disable Policy Controller on your clusters, complete the following tasks:

1. In the Google Cloud console, go to the GKE Enterprise Policy page under the Posture Management section.

   Go to Policy

2. Under the Settings tab, in the cluster table, select Edit edit in the Edit configuration column.
3. In the cluster pane, expand the About Policy Controller menu.
4. Select Uninstall Policy Controller.
5. Confirm the uninstall by following the instructions in the confirmation dialog and selecting Confirm.

When Policy Controller is uninstalled, the status columns show Not installed do_not_disturb_on.

gcloud

To uninstall Policy Controller, run the following command:

gcloud container fleet policycontroller disable \
  --memberships=MEMBERSHIP_NAME

Replace MEMBERSHIP_NAME with the membership name of the registered cluster to disable Policy Controller on. You can specify multiple memberships separated by a comma.