Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara mengaktifkan paket Pengontrol Kebijakan.
Untuk informasi yang lebih mendetail tentang cara menerapkan dan menggunakan paket kebijakan, baca petunjuk untuk paket yang ingin Anda terapkan menggunakan menu navigasi sebelah kiri. Untuk informasi selengkapnya tentang paket kebijakan, lihat ringkasan
Paket Pengontrol Kebijakan.
Jika Anda menginstal Pengontrol Kebijakan menggunakan konsol Google Cloud , paket dasar kebijakan
akan diinstal secara default, tetapi Anda dapat mengaktifkan lebih banyak paket.
Di tab Setelan, di tabel cluster, pilih Editedit di kolom Edit configuration.
Di menu Tambahkan/Edit paket kebijakan, pastikan library template
diaktifkan.
Untuk mengaktifkan semua paket kebijakan, aktifkan Tambahkan semua paket kebijakan di
check_circle.
Untuk mengaktifkan setiap paket kebijakan, aktifkan setiap paket kebijakan yang ingin Anda aktifkan.
Opsional: Untuk mengecualikan namespace dari penerapan, luaskan menu Tampilkan
setelan lanjutan. Di kolom Exempt namespaces, berikan daftar
namespace yang valid.
Praktik terbaik:
Mengecualikan namespace sistem untuk menghindari error di lingkungan Anda. Anda dapat menemukan petunjuk untuk mengecualikan namespace
dan daftar namespace umum yang dibuat oleh layanan Google Cloud di
halaman Exclude namespaces.
Pilih Simpan perubahan.
Anda dapat melihat informasi tambahan tentang cakupan dan pelanggaran kebijakan
menggunakan dasbor Pengontrol Kebijakan.
gcloud
Untuk menerapkan paket kebijakan, selesaikan langkah-langkah berikut:
Jika salah satu paket yang Anda terapkan menggunakan batasan referensi,
Anda harus mengaktifkan dukungan untuk batasan referensi:
Ganti BUNDLE_NAME dengan nama paket
yang ingin Anda instal. Namanya adalah awalan paket, misalnya
cis-k8s-v1.5.1. Anda dapat menemukan daftar nama di
Ringkasan paket kebijakan.
Opsional: Untuk mengecualikan namespace dari penerapan, jalankan perintah
berikut:
Anda tidak dapat mengubah paket kebijakan yang diinstal langsung menggunakan petunjuk
di halaman ini. Jika Anda mengalami masalah dengan paket kebijakan dan perlu melakukan pengeditan,
instal paket menggunakan salah satu metode di halaman paket kebijakan masing-masing.
Metode ini mengambil paket kebijakan dari repositori Git, yang memungkinkan Anda melakukan perubahan.
Misalnya, jika Anda ingin mengedit
CIS Kubernetes Benchmark 1.5, ikuti petunjuk di
Menggunakan batasan kebijakan CIS Kubernetes Benchmark v1.5.1,
bukan halaman ini.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-31 UTC."],[],[],null,["# Apply multiple Policy Controller bundles\n\nThis page explains how to enable Policy Controller bundles.\n\nFor more detailed information about applying and using policy bundles, read the\ninstructions for the bundle that you want to apply using the left\nnavigation menu. For more information about policy bundles, see the\n[Policy Controller bundles](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles) overview.\n\nIf you installed Policy Controller using the Google Cloud console, the\n[policy essentials bundle](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-policy-essentials-v2022)\nis installed by default, but you can enable more bundles.\n\nBefore you begin\n----------------\n\n- [Install Policy Controller](/kubernetes-engine/enterprise/policy-controller/docs/how-to/installing-policy-controller).\n\nApply policy bundles\n--------------------\n\n**Warning:** After you choose a method to apply policy bundles (manual, gcloud CLI, or Google Cloud console), using a different method to install policy bundles can cause errors in your environment. \n\n### Console\n\nTo apply one or more policy bundles on a cluster using the Google Cloud console,\ncomplete the following steps:\n\n1. In the Google Cloud console, go to the GKE Enterprise **Policy** page under the **Posture Management** section.\n\n \u003cbr /\u003e\n\n [Go to Policy](https://console.cloud.google.com/kubernetes/policy_controller)\n2. Under the **Settings** tab, in the cluster table, select **Edit**\n *edit* in the **Edit configuration** column.\n\n3. In the **Add/Edit policy bundles** menu, ensure the template library is\n toggled on.\n\n4. To enable all policy bundles, toggle **Add all policy bundles** on\n *check_circle*.\n\n5. To enable individual policy bundles, toggle on each policy bundle that you\n want to enable.\n\n6. Optional: To exempt a namespace from enforcement, expand the **Show\n advanced settings** menu. In the **Exempt namespaces** field, provide a list\n of valid namespaces.\n\n **Best practice** :\n\n Exempt system namespaces to avoid errors in your environment. You can find the instructions to exempt namespaces\n and a list of common namespaces created by Google Cloud services on the\n [Exclude namespaces page](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-exclude-namespaces).\n7. Select **Save changes**.\n\nYou can view additional information about your policy coverage and violations\nusing the [Policy Controller dashboard](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-status).\n\n### gcloud\n\nTo apply a policy bundle, complete the following steps:\n\n1. If any of the bundles that you're applying use referential constraints,\n you must enable support for referential constraints:\n\n gcloud container fleet policycontroller update --referential-rules\n\n You can check whether a bundle requires support for referential constraints\n on the\n [Policy bundles overview](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles).\n2. For each bundle that you want to install, run the following command:\n\n gcloud container fleet policycontroller content bundles set \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e with the name of the bundle\n that you want to install. The name is the bundle prefix, for example\n `cis-k8s-v1.5.1`. You can find a list of names on the\n [Policy bundles overview](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles).\n3. Optional: To exempt a namespace from enforcement, run the following\n command:\n\n gcloud container fleet policycontroller content bundles set \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e \\\n --exempted-namespaces=\u003cvar translate=\"no\"\u003eNAMESPACES\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eNAMESPACES\u003c/var\u003e with a comma-separated list of\n namespaces that you don't want enforced, for example `kube-system,gatekeeper-system`.\n\n For more information about how to add exemptable namespaces, see\n [Exclude namespaces from Policy Controller](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-exclude-namespaces).\n4. To remove a bundle, run the following command:\n\n gcloud container fleet policycontroller content bundles remove \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e\n\nTroubleshooting\n---------------\n\nYou can't modify policy bundles that are installed directly by using the instructions\non this page. If you're having issues with a policy bundle and need to make edits,\ninstall the bundle by using one of the methods on the individual policy bundle's page.\nThese methods pull the policy bundle from a Git repository, which lets you make changes.\nFor example, if you want to edit the\nCIS Kubernetes Benchmark 1.5, follow the instructions on\n[Use CIS Kubernetes Benchmark v1.5.1 policy constraints](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-cis-k8s-benchmark)\ninstead of this page.\n| **Caution:** If you're switching from applying policy bundles directly to using a manual install method, ensure that you first remove the policy bundle with either the Google Cloud console or Google Cloud CLI steps on this page before you manually install the bundle.\n\nWhat's next\n-----------\n\n- Learn more about [applying individual constraints](/kubernetes-engine/enterprise/policy-controller/docs/how-to/creating-policy-controller-constraints).\n- Take a tutorial on [using policy bundles in your CI/CD pipeline to shift left](/kubernetes-engine/enterprise/policy-controller/docs/tutorials/app-policy-validation-ci-pipeline)."]]
