policy-machineconfig-chrony.yaml

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: add-chrony
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: add-chrony-worker
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: machineconfiguration.openshift.io/v1
                kind: MachineConfig
                metadata:
                  name: 50-worker-chrony
                  labels:
                    machineconfiguration.openshift.io/role: worker
                spec:
                  config:
                    ignition:
                      version: 2.2.0
                    storage:
                      files:
                        - contents:
                            filesystem: root
                            mode: 420
                            path: /etc/chrony.conf
                            source: >-
                              data:,server%200.fedora.pool.ntp.org%0A%0Aserver%201.fedora.pool.ntp.org%0A%0Aserver%202.fedora.pool.ntp.org%0A%0Adriftfile%20/var/lib/chrony/drift%0A%0Amakestep%201.0%203%0A%0Artcsync%0A%0Akeyfile%20/etc/chrony.keys%0A%0Aleapsectz%20right/UTC%0A%0Alogdir%20/var/log/chrony%0A
          remediationAction: enforce
          severity: low
  remediationAction: inform