Aplicar vários pacotes do Controlador de Políticas
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, explicamos como ativar os pacotes do Policy Controller.
Para informações mais detalhadas sobre como aplicar e usar pacotes de políticas, leia as
instruções do pacote que você quer aplicar usando o menu de navegação
à esquerda. Para mais informações sobre pacotes de políticas, consulte a
visão geral dos pacotes do Controlador de Políticas.
Se você instalou o Controlador de Políticas usando o console do Google Cloud, o
pacote de políticas essenciais
é instalado por padrão, mas é possível ativar mais pacotes.
Na guia Configurações, na tabela de clusters, selecione Editaredit na coluna Editar configuração.
No menu Adicionar/editar pacotes de políticas, confira se a biblioteca de modelos está ativada.
Para ativar todos os pacotes de políticas, alterne a opção Adicionar todos os pacotes de políticas em
check_circle.
Para ativar pacotes de políticas individuais, alterne para cada um deles que você quer ativar.
Opcional: para isentar um namespace da aplicação obrigatória, expanda o menu Exibir
configurações avançadas. No campo Namespaces isentos, forneça uma lista
de namespaces válidos.
Substitua BUNDLE_NAME pelo nome do pacote
que você quer instalar. O nome é o prefixo do pacote, por exemplo,
cis-k8s-v1.5.1. Confira uma lista de nomes na
Visão geral dos pacotes de políticas.
Opcional: para isentar um namespace da aplicação, execute o seguinte
comando:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2024-11-21 UTC."],[],[],null,["# Apply multiple Policy Controller bundles\n\nThis page explains how to enable Policy Controller bundles.\n\nFor more detailed information about applying and using policy bundles, read the\ninstructions for the bundle that you want to apply using the left\nnavigation menu. For more information about policy bundles, see the\n[Policy Controller bundles](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles) overview.\n\nIf you installed Policy Controller using the Google Cloud console, the\n[policy essentials bundle](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-policy-essentials-v2022)\nis installed by default, but you can enable more bundles.\n\nBefore you begin\n----------------\n\n- [Install Policy Controller](/kubernetes-engine/enterprise/policy-controller/docs/how-to/installing-policy-controller).\n\nApply policy bundles\n--------------------\n\n**Warning:** After you choose a method to apply policy bundles (manual, gcloud CLI, or Google Cloud console), using a different method to install policy bundles can cause errors in your environment. \n\n### Console\n\nTo apply one or more policy bundles on a cluster using the Google Cloud console,\ncomplete the following steps:\n\n1. In the Google Cloud console, go to the GKE Enterprise **Policy** page under the **Posture Management** section.\n\n \u003cbr /\u003e\n\n [Go to Policy](https://console.cloud.google.com/kubernetes/policy_controller)\n2. Under the **Settings** tab, in the cluster table, select **Edit**\n *edit* in the **Edit configuration** column.\n\n3. In the **Add/Edit policy bundles** menu, ensure the template library is\n toggled on.\n\n4. To enable all policy bundles, toggle **Add all policy bundles** on\n *check_circle*.\n\n5. To enable individual policy bundles, toggle on each policy bundle that you\n want to enable.\n\n6. Optional: To exempt a namespace from enforcement, expand the **Show\n advanced settings** menu. In the **Exempt namespaces** field, provide a list\n of valid namespaces.\n\n **Best practice** :\n\n Exempt system namespaces to avoid errors in your environment. You can find the instructions to exempt namespaces\n and a list of common namespaces created by Google Cloud services on the\n [Exclude namespaces page](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-exclude-namespaces).\n7. Select **Save changes**.\n\nYou can view additional information about your policy coverage and violations\nusing the [Policy Controller dashboard](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-status).\n\n### gcloud\n\nTo apply a policy bundle, complete the following steps:\n\n1. If any of the bundles that you're applying use referential constraints,\n you must enable support for referential constraints:\n\n gcloud container fleet policycontroller update --referential-rules\n\n You can check whether a bundle requires support for referential constraints\n on the\n [Policy bundles overview](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles).\n2. For each bundle that you want to install, run the following command:\n\n gcloud container fleet policycontroller content bundles set \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e with the name of the bundle\n that you want to install. The name is the bundle prefix, for example\n `cis-k8s-v1.5.1`. You can find a list of names on the\n [Policy bundles overview](/kubernetes-engine/enterprise/policy-controller/docs/concepts/policy-controller-bundles).\n3. Optional: To exempt a namespace from enforcement, run the following\n command:\n\n gcloud container fleet policycontroller content bundles set \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e \\\n --exempted-namespaces=\u003cvar translate=\"no\"\u003eNAMESPACES\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eNAMESPACES\u003c/var\u003e with a comma-separated list of\n namespaces that you don't want enforced, for example `kube-system,gatekeeper-system`.\n\n For more information about how to add exemptable namespaces, see\n [Exclude namespaces from Policy Controller](/kubernetes-engine/enterprise/policy-controller/docs/how-to/policy-controller-exclude-namespaces).\n4. To remove a bundle, run the following command:\n\n gcloud container fleet policycontroller content bundles remove \u003cvar translate=\"no\"\u003eBUNDLE_NAME\u003c/var\u003e\n\nTroubleshooting\n---------------\n\nYou can't modify policy bundles that are installed directly by using the instructions\non this page. If you're having issues with a policy bundle and need to make edits,\ninstall the bundle by using one of the methods on the individual policy bundle's page.\nThese methods pull the policy bundle from a Git repository, which lets you make changes.\nFor example, if you want to edit the\nCIS Kubernetes Benchmark 1.5, follow the instructions on\n[Use CIS Kubernetes Benchmark v1.5.1 policy constraints](/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-cis-k8s-benchmark)\ninstead of this page.\n| **Caution:** If you're switching from applying policy bundles directly to using a manual install method, ensure that you first remove the policy bundle with either the Google Cloud console or Google Cloud CLI steps on this page before you manually install the bundle.\n\nWhat's next\n-----------\n\n- Learn more about [applying individual constraints](/kubernetes-engine/enterprise/policy-controller/docs/how-to/creating-policy-controller-constraints).\n- Take a tutorial on [using policy bundles in your CI/CD pipeline to shift left](/kubernetes-engine/enterprise/policy-controller/docs/tutorials/app-policy-validation-ci-pipeline)."]]
