-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathmetadata.yml
33 lines (33 loc) · 1.48 KB
/
metadata.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
rules:
- apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
operations: ["CREATE"]
mutating: false
contextAwareResources:
- apiVersion: "storage.sbombastic.rancher.io/v1alpha1"
kind: "VulnerabilityReport"
executionMode: kubewarden-wapc
# Consider the policy for the background audit scans. Default is true. Note the
# intrinsic limitations of the background audit feature on docs.kubewarden.io;
# If your policy hits any limitations, set to false for the audit feature to
# skip this policy and not generate false positives.
backgroundAudit: true
annotations:
# artifacthub specific:
io.artifacthub.displayName: Policy Name
io.artifacthub.resources: Pod
io.artifacthub.keywords: pod, cool policy, kubewarden
io.kubewarden.policy.ociUrl: ghcr.io/kubewarden/policies/image-cve-policy
# kubewarden specific:
io.kubewarden.policy.title: image-cve-policy
io.kubewarden.policy.description: Short description
io.kubewarden.policy.author: Flavio Castelli <[email protected]>
io.kubewarden.policy.url: https://github.com/yourorg/image-cve-policy
io.kubewarden.policy.source: https://github.com/yourorg/image-cve-policy
io.kubewarden.policy.license: Apache-2.0
# The next two annotations are used in the policy report generated by the
# Audit scanner. Severity indicates policy check result criticality and
# Category indicates policy category. See more here at docs.kubewarden.io
io.kubewarden.policy.severity: medium
io.kubewarden.policy.category: Resource validation