policy-limit-rolebinding.yaml

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-max-clusteradmin-iampolicy
  namespace: openshift-acm-policies
  annotations:
    policy.open-cluster-management.io/categories: AC Access Control
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/controls: AC-3 Access Enforcement
spec:
  disabled: false
  remediationAction: inform
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: IamPolicy
        metadata:
          name: policy-limitclusteradmin
        spec:
          # Include are the namespaces for which you want to watch cluster administrator role and IAM rolebinings, while exclude are the namespaces you explicitly do not want to watch
          namespaceSelector:
            include: ["*"]
            exclude: ["kube-system"]
          #labelSelector:
            #env: "production"
          # Can be enforce or inform, however enforce doesn't do anything with regards to this controller
          remediationAction: inform # enforce or inform
          severity: medium # low, medium, or high
          # Maximum number of cluster role binding still valid before it is considered as non-compliant
          maxClusterRoleBindingUsers: 5
          # ClusterRole: <Optional: Cluster role referenced in the cluster role bindings, default to cluster-admin.>