artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.1.3
name: psa-label-enforcer
displayName: PSA Label Enforcer
createdAt: 2023-12-22T10:30:01.304148938Z
description: Policy to ensure that namespaces have the required PSA labels configuration for deployment in the cluster.
license: Apache-2.0
homeURL: https://github.com/kubewarden/psa-label-enforcer
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/psa-label-enforcer:v0.1.3
keywords:
- namespace
- psa
- kubewarden
links:
- name: policy
  url: https://github.com/kubwarden/psa-label-enforcer/releases/download/v0.1.3/policy.wasm
- name: source
  url: https://github.com/kubwarden/psa-label-enforcer
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/psa-label-enforcer:v0.1.3
  ```
  Then, generate the policy manifest and tune it to your liking. For example:
  ```console
  kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/psa-label-enforcer:v0.1.3
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'true'
  kubewarden/questions-ui: |
    questions:
      - default: null
        description: >-
          This policy ensures that namespaces have the required PSA labels configuration for deployment in the cluster. The policy validates whether the PSA labels defined in the namespace comply with the configuration specified in the policy settings. If the labels do not match the configuration, the policy will modify the required labels to meet the requirements.
        group: Settings
        label: Description
        required: false
        hide_input: true
        type: string
        variable: description
      - default: {}
        description: >-
          The policy settings consist of fields where the user can define the pod security levels and versions to be used in the deployed namespace. While it is not necessary to define all the modes in the policy settings, at least one mode must be defined, with or without the mode version. The mode level fields allow three values: baseline, restricted, and privileged. It is not permitted to define the mode version without specifying the mode level. The mode version must follow the v<major>.<minor> version pattern or use the latest value.
        label: Modes
        hide_input: true
        type: map[
        variable: modes
        subquestions:
          - default: ''
            group: Settings
            label: Enforce
            options:
            - baseline
            - restricted
            - privileged
            type: enum
            variable: modes.enforce
          - default: ''
            group: Settings
            label: Enforce Version
            type: string
            variable: modes.enforce-version
          - default: ''
            group: Settings
            label: Audit
            options:
            - baseline
            - restricted
            - privileged
            type: enum
            variable: modes.audit
          - default: ''
            group: Settings
            label: Audit Version
            type: string
            variable: modes.audit-version
          - default: ''
            group: Settings
            label: Warn
            options:
            - baseline
            - restricted
            - privileged
            type: enum
            variable: modes.warn
          - default: ''
            group: Settings
            label: Warn Version
            type: string
            variable: modes.warn-version
  kubewarden/resources: Namespace
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - namespaces
      operations:
      - CREATE
      - UPDATE