-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathartifacthub-pkg.yml
119 lines (119 loc) · 3.36 KB
/
artifacthub-pkg.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
# kwctl scaffold artifacthub > artifacthub-pkg.yml
version: 0.1.7
name: volumemounts
displayName: volumeMounts
createdAt: 2023-10-16T07:21:56.999641643Z
description: Policy that inspects containers, init containers, and ephemeral containers, and restricts their usage of volumes by checking the `volume` name being used in `volumeMounts[*].name`
license: Apache-2.0
homeURL: https://github.com/kubewarden/volumemounts-policy
containersImages:
- name: policy
image: ghcr.io/kubewarden/policies/volumemounts:v0.1.7
keywords:
- container
- volumeMounts
- volume
- pod
- workload resources
links:
- name: policy
url: https://github.com/kubewarden/volumemounts-policy/releases/download/v0.1.7/policy.wasm
- name: source
url: https://github.com/kubewarden/volumemounts-policy
install: |
The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
```console
kwctl pull ghcr.io/kubewarden/policies/volumemounts:v0.1.7
```
Then, generate the policy manifest and tune it to your liking. For example:
```console
kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/volumemounts:v0.1.7
```
maintainers:
- name: Kubewarden developers
email: [email protected]
provider:
name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
kubewarden/mutation: 'false'
kubewarden/questions-ui: |
questions:
- default: null
description: >-
This policy inspects containers, init containers, or ephemeral containers,
and will restrict their usage of volumes by checking the volume name being
used in volumeMounts[*].name. The policy can target either Pods or workload
resources (Deployments, ReplicaSets, DaemonSets, ReplicationControllers,
Jobs, CronJobs) by setting the policy's spec.rules accordingly.
group: Settings
label: Description
required: false
hide_input: true
type: string
variable: description
- default: anyIn
group: Settings
label: Reject
options:
- anyIn
- anyNotIn
- allAreUsed
- notAllAreUsed
required: false
type: enum
variable: reject
- default: []
description: A list of Volume Mount names to match using the defined reject operator.
group: Settings
label: Volume Mount Names
required: false
type: array[
variable: volumeMountsNames
kubewarden/resources: Pod,Deployment,Replicaset,Statefulset,Daemonset,Replicationcontroller,Job,Cronjob
kubewarden/rules: |
- apiGroups:
- ''
apiVersions:
- v1
resources:
- pods
operations:
- CREATE
- apiGroups:
- ''
apiVersions:
- v1
resources:
- replicationcontrollers
operations:
- CREATE
- UPDATE
- apiGroups:
- apps
apiVersions:
- v1
resources:
- deployments
- replicasets
- statefulsets
- daemonsets
operations:
- CREATE
- UPDATE
- apiGroups:
- batch
apiVersions:
- v1
resources:
- jobs
- cronjobs
operations:
- CREATE
- UPDATE