generated from kubewarden/go-policy-template
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #14 from viccuad/artifacthub-v2
feat: Update `artifacthub-pkg.yml` automatically from now
- Loading branch information
Showing
5 changed files
with
61 additions
and
71 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,43 +1,42 @@ | ||
| --- | ||
| version: 0.1.7 | ||
| # Kubewarden Artifacthub Package config | ||
| # | ||
| # Use this config to submit the policy to https://artifacthub.io. | ||
| # | ||
| # This config can be saved to its default location with: | ||
| # kwctl scaffold artifacthub > artifacthub-pkg.yml | ||
| version: 0.1.8 | ||
| name: hostpaths-psp | ||
| displayName: Hostpaths PSP | ||
| createdAt: '2023-02-17T16:26:40+00:00' | ||
| createdAt: 2023-03-24T15:15:54.209442298Z | ||
| description: A Pod Security Policy that controls usage of hostPath volumes | ||
| license: Apache-2.0 | ||
| homeURL: https://github.com/kubewarden/hostpaths-psp-policy | ||
| containersImages: | ||
| - name: policy | ||
| image: ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.7 | ||
| install: | | ||
| The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl/): | ||
| ```console | ||
| kwctl pull ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.7 | ||
| ``` | ||
| image: ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.8 | ||
| keywords: | ||
| - psp | ||
| - hostpaths | ||
| - pod | ||
| links: | ||
| - name: policy | ||
| url: https://github.com/kubewarden/hostpaths-psp-policy/releases/download/v0.1.7/policy.wasm | ||
| url: https://github.com/kubewarden/hostpaths-psp-policy/releases/download/v0.1.8/policy.wasm | ||
| - name: source | ||
| url: https://github.com/kubewarden/hostpaths-psp-policy | ||
| install: | | ||
| The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl): | ||
| ```console | ||
| kwctl pull ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.8 | ||
| ``` | ||
| maintainers: | ||
| - name: Kubewarden developers | ||
| email: [email protected] | ||
| provider: | ||
| name: kubewarden | ||
| recommendations: | ||
| - url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller | ||
| annotations: | ||
| kubewarden/resources: Pod | ||
| kubewarden/mutation: false | ||
| kubewarden/contextAware: false | ||
| kubewarden/rules: | | ||
| rules: | ||
| - apiGroups: [""] | ||
| apiVersions: ["v1"] | ||
| resources: ["pods"] | ||
| operations: ["CREATE"] | ||
| kubewarden/mutation: 'false' | ||
| kubewarden/questions-ui: | | ||
| questions: | ||
| - default: [] | ||
|
|
@@ -72,3 +71,13 @@ annotations: | |
| label: Read only | ||
| type: boolean | ||
| variable: readOnly | ||
| kubewarden/resources: Pod | ||
| kubewarden/rules: | | ||
| - apiGroups: | ||
| - '' | ||
| apiVersions: | ||
| - v1 | ||
| resources: | ||
| - pods | ||
| operations: | ||
| - CREATE | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,51 +6,15 @@ rules: | |
| mutating: false | ||
| contextAware: false | ||
| annotations: | ||
| io.kubewarden.policy.title: psp-hostpaths | ||
| # artifacthub specific: | ||
| io.artifacthub.displayName: Hostpaths PSP | ||
| io.artifacthub.resources: Pod | ||
| io.artifacthub.keywords: psp, hostpaths, pod | ||
| io.kubewarden.policy.ociUrl: ghcr.io/kubewarden/policies/hostpaths-psp | ||
| # kubewarden specific: | ||
| io.kubewarden.policy.title: hostpaths-psp | ||
| io.kubewarden.policy.description: A Pod Security Policy that controls usage of hostPath volumes | ||
| io.kubewarden.policy.author: Kubewarden devs | ||
| io.kubewarden.policy.author: Kubewarden developers <[email protected]> | ||
| io.kubewarden.policy.url: https://github.com/kubewarden/hostpaths-psp-policy | ||
| io.kubewarden.policy.source: https://github.com/kubewarden/hostpaths-psp-policy | ||
| io.kubewarden.policy.license: Apache-2.0 | ||
| io.kubewarden.policy.usage: | | ||
| Replacement for the Kubernetes Pod Security Policy that controls the usage of | ||
| `hostPath` volumes. The policy inspects both the containers and the init | ||
| containers that are using `hostPath` volumes. | ||
| ## Settings | ||
| ```yaml | ||
| allowedHostPaths: | ||
| - pathPrefix: "/foo" | ||
| readOnly: true | ||
| - pathPrefix: "/bar" | ||
| readOnly: false | ||
| ``` | ||
| `allowedHostPaths` is a list of host paths that are allowed to be used by | ||
| hostPath volumes. | ||
| An empty `allowedHostPaths` list means there is no restriction on host paths | ||
| used. | ||
| Each entry of `allowedHostPaths` must have: | ||
| - A `pathPrefix` field, which allows hostPath volumes to mount a path that | ||
| begins with an allowed prefix. | ||
| - a `readOnly` field indicating it must be mounted read-only. | ||
| ### Special behaviour | ||
| It's possible to have host paths sharing part of the prefix. In that case, the | ||
| `readOnly` attribute of the most specific path takes precedence. | ||
| For example, given the following configuration: | ||
| ```yaml | ||
| allowedHostPaths: | ||
| - pathPrefix: "/foo" | ||
| readOnly: false | ||
| - pathPrefix: "/foo/bar" | ||
| readOnly: true | ||
| ``` | ||
| Paths such as `/foo/bar/dir1`, `/foo/bar` must be read only. | ||