artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.1.6
name: host-namespaces-psp
displayName: Host Namespaces PSP
createdAt: 2023-10-16T07:47:25.848418557Z
description: A Kubewarden policy that controls the usage of host namespaces
license: Apache-2.0
homeURL: https://github.com/kubewarden/host-namespaces-psp-policy
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6
keywords:
- psp
- container
- network
links:
- name: policy
  url: https://github.com/kubewarden/host-namespaces-psp-policy/releases/download/v0.1.6/policy.wasm
- name: source
  url: https://github.com/kubewarden/host-namespaces-psp-policy
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6
  ```
  Then, generate the policy manifest and tune it to your liking. For example:
  ```console
  kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/host-namespaces-psp:v0.1.6
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'false'
  kubewarden/questions-ui: |
    questions:
    - default: null
      description: >-
        This policy works by defining what host namespaces can be used by a Pod.
        `allow_host_ipc`, `allow_host_network` and `allow_host_pid` are `false` by
        default. `allow_host_ports` is an empty list by default. This means that by
        default host IPC, network, pid and all host ports are disabled when this
        policy is loaded with no configuration.
      group: Settings
      label: Description
      required: false
      hide_input: true
      type: string
      variable: description
    - default: false
      tooltip: Allows the pod to set .spec.HostIPC to true.
      group: Settings
      label: Allow host IPC
      required: false
      type: boolean
      variable: allow_host_ipc
    - default: false
      tooltip: Allows the pod to set .spec.HostNetwork to true.
      group: Settings
      label: Allow host network
      required: false
      type: boolean
      variable: allow_host_network
    - default: false
      tooltip: Allows the pod to set .spec.HostPID to true.
      group: Settings
      label: Allow host PID
      required: false
      type: boolean
      variable: allow_host_pid
    - default: []
      description: >-
        A range of ports to allow, an example would allow host ports `80`, `443` and
        the range `8000-9000`.
      group: Settings
      label: Allow host ports
      hide_input: true
      type: sequence[
      variable: allow_host_ports
      sequence_questions:
        - default: 0
          tooltip: ''
          group: Settings
          label: min
          type: int
          variable: min
        - default: 0
          tooltip: ''
          group: Settings
          label: max
          type: int
          variable: max
  kubewarden/resources: Pod
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - CREATE