artifacthub-pkg.yml

# Kubewarden Artifacthub Package config
#
# Use this config to submit the policy to https://artifacthub.io.
#
# This config can be saved to its default location with:
#   kwctl scaffold artifacthub > artifacthub-pkg.yml 
version: 0.1.10
name: allowed-fsgroups-psp
displayName: Allowed Fs Groups PSP
createdAt: 2023-07-07T17:42:12.88826776Z
description: Replacement for the Kubernetes Pod Security Policy that controls the usage of fsGroups in the pod security context
license: Apache-2.0
homeURL: https://github.com/kubewarden/allowed-fsgroups-psp-policy
containersImages:
- name: policy
  image: ghcr.io/kubewarden/policies/allowed-fsgroups-psp:v0.1.10
keywords:
- psp
- container
- runtime
links:
- name: policy
  url: https://github.com/kubewarden/allowed-fsgroups-psp-policy/releases/download/v0.1.10/policy.wasm
- name: source
  url: https://github.com/kubewarden/allowed-fsgroups-psp-policy
install: |
  The policy can be obtained using [`kwctl`](https://github.com/kubewarden/kwctl):
  ```console
  kwctl pull ghcr.io/kubewarden/policies/allowed-fsgroups-psp:v0.1.10
  ```
maintainers:
- name: Kubewarden developers
  email: cncf-kubewarden-maintainers@lists.cncf.io
provider:
  name: kubewarden
recommendations:
- url: https://artifacthub.io/packages/helm/kubewarden/kubewarden-controller
annotations:
  kubewarden/mutation: 'true'
  kubewarden/questions-ui: |
    questions:
    - default: RunAsAny
      tooltip: Set which fsGroup is allowed in the pod security context.
      description: >-
        This policy works by defining what `fsGroup` is allowed in the pod security
        context. `MustRunAs` and `MayRunAs` contain a list of ranges that define
        valid ranges for the `fsGroup` value. `RunAsAny` always accepts the request.
      group: Settings
      label: Service Type
      options:
        - MustRunAs
        - MayRunAs
        - RunAsAny
      required: false
      type: enum
      variable: rule
    - default: []
      tooltip: Valid user ID (UID) ranges for the fsGroup.
      group: Settings
      label: User ID Ranges
      show_if: rule=MustRunAs||rule=MayRunAs
      hide_input: true
      type: sequence[
      variable: ranges
      sequence_questions:
        - default: 1000
          tooltip: Minimum UID range for fsgroup.
          group: Settings
          label: min
          type: int
          variable: min
        - default: 2000
          tooltip: Maximum UID range for fsgroup.
          group: Settings
          label: max
          type: int
          variable: max
  kubewarden/resources: Pod
  kubewarden/rules: |
    - apiGroups:
      - ''
      apiVersions:
      - v1
      resources:
      - pods
      operations:
      - CREATE
      - UPDATE