artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.1.10
name: hostpaths-psp
displayName: Hostpaths PSP
createdAt: 2023-10-16T08:36:54.8789282Z
description: A Pod Security Policy that controls usage of hostPath volumes
license: Apache-2.0
homeURL: https://github.com/kubewarden/hostpaths-psp-policy
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.10
keywords:
- psp
- hostpaths
- pod
links:
- name: policy
  url: https://github.com/kubewarden/hostpaths-psp-policy/releases/download/v0.1.10/policy.wasm
- name: source
  url: https://github.com/kubewarden/hostpaths-psp-policy
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.10
  ```
  Then, generate the policy manifest and tune it to your liking. For example:
  ```console
  kwctl scaffold manifest -t ClusterAdmissionPolicy registry://ghcr.io/kubewarden/policies/hostpaths-psp:v0.1.10
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'false'
  kubewarden/questions-ui: |
    questions:
    - default: []
      description: >-
        This policy is a replacement for the Kubernetes Pod Security Policy that
        controls the usage of `hostPath` volumes. The policy inspects both the
        containers and the init containers that are using `hostPath` volumes.
        `allowedHostPaths` is a list of host paths that are allowed to be used by
        hostPath volumes. An empty `allowedHostPaths` list means there is no
        restriction on host paths used. Each entry of `allowedHostPaths` must have:
        a `pathPrefix` field, which allows hostPath volumes to mount a path that
        begins with an allowed prefix, and a `readOnly` field indicating it must be
        mounted read-only.
      tooltip: A list of host paths that are allowed to be used by hostPath volumes.
      group: Settings
      label: Allow host path
      hide_input: true
      type: sequence[
      variable: allowedHostPaths
      sequence_questions:
        - default: ''
          description: >-
            Allows hostPath volumes to mount a path that begins with an allowed
            prefix.
          group: Settings
          label: Path prefix
          type: string
          variable: pathPrefix
        - default: false
          tooltip: Indicates if the volume must be mounted read-only.
          group: Settings
          label: Read only
          type: boolean
          variable: readOnly
  kubewarden/resources: Pod
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - CREATE