Activating policy preset

Stackland allows you to activate policy presets and apply them to cluster resources. To activate a preset, create the ClusterPolicySet resource.

Using the CLIUsing the CLI

1. Create a file of the ClusterPolicySet resource, e.g., using the touch clusterpolicyset.yaml command.

2. Open the file and paste the configuration below into it:

   Baseline

   Restricted

   Restricted and Baseline

   apiVersion: policy.stackland.yandex.cloud/v1alpha1
   kind: ClusterPolicySet
   metadata:
     name: test-policyset
   spec:
     engines:
       kyverno:
         presets:
           - baseline # Platform preset
   

   apiVersion: policy.stackland.yandex.cloud/v1alpha1
   kind: ClusterPolicySet
   metadata:
     name: test-policyset
   spec:
     engines:
       kyverno:
         presets:
           - restricted  # Additional platform preset
   

   apiVersion: policy.stackland.yandex.cloud/v1alpha1
   kind: ClusterPolicySet
   metadata:
     name: test-policyset
   spec:
     engines:
       kyverno:
         presets:
           - baseline      # Platform preset
           - restricted    # Platform preset
   

3. Apply the manifest: kubectl apply -f clusterpolicyset.yaml.

Using the management consoleUsing the management console

1. In the left-hand menu, select Security policies.

2. Go to the Settings tab.

3. Toggle Policy check on.

4. Under Kyverno, select the policy presets:

   • Baseline: Basic protection against misconfiguration.
   • Restricted: Strict adherence to the principle of least privilege.

   You can select one or both presets at the same time.

Click Open YAML editor to view or edit the ClusterPolicySet resource configuration.

This is it. Now Policy Manager will start sending notifications about policy violations.