Apply multiple Policy Controller bundles

This page explains how to enable Policy Controller bundles.

For more detailed information about applying and using policy bundles, read the instructions for the bundle that you want to apply using the left navigation menu. For more information about policy bundles, see the Policy Controller bundles overview.

If you installed Policy Controller using the Google Cloud console, the policy essentials bundle is installed by default, but you can enable more bundles.

Before you begin

Apply policy bundles

Console

To apply one or more policy bundles on a cluster using the Google Cloud console, complete the following steps:

  1. In the Google Cloud console, go to the GKE Enterprise Policy page under the Posture Management section.

    Go to Policy

  2. Under the Settings tab, in the cluster table, select Edit in the Edit configuration column.

  3. In the Add/Edit policy bundles menu, ensure the template library is toggled on.

  4. To enable all policy bundles, toggle Add all policy bundles on .

  5. To enable individual policy bundles, toggle on each policy bundle that you want to enable.

  6. Optional: To exempt a namespace from enforcement, expand the Show advanced settings menu. In the Exempt namespaces field, provide a list of valid namespaces.

    Best practice:

    Exempt system namespaces to avoid errors in your environment. You can find the instructions to exempt namespaces and a list of common namespaces created by Google Cloud services on the Exclude namespaces page.

  7. Select Save changes.

You can view additional information about your policy coverage and violations using the Policy Controller dashboard.

gcloud

To apply a policy bundle, complete the following steps:

  1. If any of the bundles that you're applying use referential constraints, you must enable support for referential constraints:

    gcloud container fleet policycontroller update --referential-rules

    You can check whether a bundle requires support for referential constraints on the Policy bundles overview.

  2. For each bundle that you want to install, run the following command:

    gcloud container fleet policycontroller content bundles set BUNDLE_NAME

    Replace BUNDLE_NAME with the name of the bundle that you want to install. The name is the bundle prefix, for example cis-k8s-v1.5.1. You can find a list of names on the Policy bundles overview.

  3. Optional: To exempt a namespace from enforcement, run the following command:

    gcloud container fleet policycontroller content bundles set BUNDLE_NAME \
  --exempted-namespaces=NAMESPACES

    Replace NAMESPACES with a comma-separated list of namespaces that you don't want enforced, for example kube-system,gatekeeper-system.

    For more information about how to add exemptable namespaces, see Exclude namespaces from Policy Controller.

  4. To remove a bundle, run the following command:

    gcloud container fleet policycontroller content bundles remove BUNDLE_NAME

Troubleshooting

You can't modify policy bundles that are installed directly by using the instructions on this page. If you're having issues with a policy bundle and need to make edits, install the bundle by using one of the methods on the individual policy bundle's page. These methods pull the policy bundle from a Git repository, which lets you make changes. For example, if you want to edit the CIS Kubernetes Benchmark 1.5, follow the instructions on Use CIS Kubernetes Benchmark v1.5.1 policy constraints instead of this page.

What's next