Add KubeArmor policies

[caniszczyk]

https://github.com/kubearmor/KubeArmor

[nyrahul]

Thank you for hosting kubearmor policies on artifacthub. Here are few ones that KubeArmor has in the policy-templates library. Few interesting ones that I can quote:

• MySQL protection policy
• Untrusted Shell Execution
• Kernel Modules install/remove protection
• Disable RAW socket access

[daemon1024]

Referencing kubearmor/KubeArmor#1130 for tracking. We plan to work on this during the summer under GSoC.

[tegioz]

Hi! 👋

Support for KubeArmor policies has just been added! 🎉

To have some sample policies to test, we've created a fork of the policy-templates that includes the necessary AH metadata files. It'd be great if you could eventually publish this repository under the KubeArmor organization in AH. If you want us to create a PR from that fork to use it as a base, please let us know (or feel free to pick anything you need from it, whatever works best for you). You can see how the policies listed look in AH here.

For more information about how KubeArmor policies repositories work in Artifact Hub you can see the KubeArmor policies section in the repositories guide. Artifact Hub also allows you to embed a small view of a group of packages in your site, just in case you are interested (i.e. the Keptn project uses it to list their integrations).

You can also check how other projects are organizing the Artifact Hub metadata for inspiration:

• Keda: https://github.com/kedacore/external-scalers/tree/main/artifacthub
• Keptn: https://github.com/keptn-contrib/artifacthub
• Kubewarden: https://github.com/kubewarden/allowed-fsgroups-psp-policy
• Tinkerbell: https://github.com/tinkerbell/hub/tree/artifacthub-manifests/actions
• Gatekeeper: https://github.com/open-policy-agent/gatekeeper-library/tree/master/artifacthub

Regarding storing the policies in OCI registries: that's shouldn't be a problem, Kubewarden is doing it that way, for example. In that case, the AH metadata would still be located in a git repository, and you could provide the new installation instructions if needed. At that point you may also want to provide the corresponding container image in the metadata file, so that we can display it on the UI.