artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.2.0
name: trusted-repos
displayName: Trusted Repos
createdAt: 2024-09-30T07:10:07.419432459Z
description: Kubewarden policy that restricts what registries, tags and images can pods on your cluster refer to
license: Apache-2.0
homeURL: https://github.com/kubewarden/trusted-repos-policy
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/trusted-repos:v0.2.0
keywords:
- image
- registry
- tag
links:
- name: policy
  url: https://github.com/kubewarden/trusted-repos-policy/releases/download/v0.2.0/policy.wasm
- name: source
  url: https://github.com/kubewarden/trusted-repos-policy
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/trusted-repos:v0.2.0
  ```
  Then, generate the policy manifest and tune it to your liking. For example:
  ```console
  kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/trusted-repos:v0.2.0
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'false'
  kubewarden/questions-ui: |
    questions:
    - default: null
      description: >-
        This policy allows you to restrict what repositories, tags, and images pods
        in your cluster can refer to. The configuration allows you to mix and match
        several filters: registries, tags, and images. When both an allow list and a
        reject list is supported, only one can be provided at the same time for that
        specific filter.
      group: Settings
      label: Description
      required: false
      hide_input: true
      type: string
      variable: description
    - default: {}
      description: Allow or reject images coming from a specified registry.
      group: Settings
      label: Registries
      hide_input: true
      type: map[
      variable: registries
      subquestions:
        - default: []
          group: Settings
          label: Allow
          type: array[
          variable: registries.allow
        - default: []
          group: Settings
          label: Reject
          type: array[
          variable: registries.reject
    - default: {}
      description: Reject a specified tag for all images
      group: Settings
      label: Tags
      hide_input: true
      type: map[
      variable: tags
      subquestions:
        - default: []
          group: Settings
          label: Reject
          type: array[
          variable: tags.reject
    - default: {}
      description: Accept or reject a specified image
      group: Settings
      label: Images
      hide_input: true
      type: map[
      variable: images
      subquestions:
        - default: []
          group: Settings
          label: Allow
          type: array[
          variable: images.allow
        - default: []
          group: Settings
          label: Reject
          type: array[
          variable: images.reject
  kubewarden/resources: Pod
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - CREATE
      - UPDATE
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - replicationcontrollers
      operations:
      - CREATE
      - UPDATE
    - apiGroups:
      - apps
      apiVersions:
      - v1
      resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
      operations:
      - CREATE
      - UPDATE
    - apiGroups:
      - batch
      apiVersions:
      - v1
      resources:
      - jobs
      - cronjobs
      operations:
      - CREATE
      - UPDATE