artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.1.11
name: allowed-proc-mount-types-psp
displayName: Allowed Proc Mount Types PSP
createdAt: 2024-07-19T13:11:32.076318453Z
description: Replacement for the Kubernetes Pod Security Policy that controls the usage of /proc mount types
license: Apache-2.0
homeURL: https://github.com/kubewarden/allowed-proc-mount-types-psp-policy
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/allowed-proc-mount-types-psp:v0.1.11
keywords:
- psp
- container
- runtime
links:
- name: policy
  url: https://github.com/kubewarden/allowed-proc-mount-types-psp-policy/releases/download/v0.1.11/policy.wasm
- name: source
  url: https://github.com/kubewarden/allowed-proc-mount-types-psp-policy
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/allowed-proc-mount-types-psp:v0.1.11
  ```
  Then, generate the policy manifest and tune it to your liking. For example:
  ```console
  kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/allowed-proc-mount-types-psp:v0.1.11
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'false'
  kubewarden/questions-ui: |
    questions:
    - default: false
      description: >-
        This policy works by defining what proc mount types are allowed in
        containers. They can be empty (defaulted by Kubernetes), `Default` or
        `Unmasked`. This policy protects against pods that contain at least one
        container with the `Unmasked` proc mount type, that can potentially expose
        host information to the container.
      tooltip: >-
        Allows the containers, init containers, or ephemeral containers within a pod
        to set `.spec.securityContext.procMount` to Unmasked. Otherwise, the pod or
        the ephemeral request subresource request will be rejected.
      group: Settings
      label: Allow unmasked proc mount type
      required: false
      type: boolean
      variable: allow_unmasked_proc_mount_type
  kubewarden/resources: Pod
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - CREATE
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - UPDATE