artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.1.12
name: selinux-psp
displayName: Selinux PSP
createdAt: 2023-10-16T07:24:37.086889634Z
description: Replacement for the Kubernetes Pod Security Policy that controls the usage of SELinux
license: Apache-2.0
homeURL: https://github.com/kubewarden/selinux-psp-policy
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/selinux-psp:v0.1.12
keywords:
- psp
- container
- runtime
- selinux
links:
- name: policy
  url: https://github.com/kubewarden/selinux-psp-policy/releases/download/v0.1.12/policy.wasm
- name: source
  url: https://github.com/kubewarden/selinux-psp-policy
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/selinux-psp:v0.1.12
  ```
  Then, generate the policy manifest and tune it to your liking. For example:
  ```console
  kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/selinux-psp:v0.1.12
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'true'
  kubewarden/questions-ui: |
    questions:
    - default: null
      description: >-
        This policy is a replacement for the Kubernetes Pod Security Policy that
        controls the usage of SELinux in the pod security context and on containers,
        init containers and ephemeral containers. This policy will inspect the
        `.spec.securityContext.seLinuxOptions` of the pod  if the container has no
        specific `.spec.securityContext.seLinuxOptions`. In other words, the
        `seLinuxOptions` of the container, init container and ephemeral containers
        take precendence over the pod `seLinuxOptions`, if any.
      group: Settings
      label: Description
      required: false
      hide_input: true
      type: string
      variable: description
    - default: MustRunAs
      tooltip: >-
        Defines what seLinuxOptions can be set at the pod level and at the container
        level.
      group: Settings
      label: SE Linux Options
      options:
        - MustRunAs
        - RunAsAny
      required: false
      type: enum
      variable: rule
    - default: ''
      group: Settings
      label: User
      show_if: rule=MustRunAs
      type: string
      variable: user
    - default: ''
      group: Settings
      label: Role
      show_if: rule=MustRunAs
      type: string
      variable: role
    - default: ''
      group: Settings
      label: Type
      show_if: rule=MustRunAs
      type: string
      variable: type
    - default: ''
      group: Settings
      label: Level
      show_if: rule=MustRunAs
      type: string
      variable: level
  kubewarden/resources: Pod
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - CREATE
      - UPDATE