4.14. 镜像漏洞策略

apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
  name: operatorpolicy-imagemanifestvuln
spec:
  remediationAction: enforce
  severity: high
  complianceType: musthave
  upgradeApproval: Automatic
  subscription:
    name: container-security-operator
    namespace: openshift-operators
    source: redhat-operators
    sourceNamespace: openshift-marketplace

apiVersion: policy.open-cluster-management.io/v1beta1
kind: OperatorPolicy
metadata:
  name: operatorpolicy-imagemanifestvuln
spec:
  remediationAction: enforce
  severity: high
  complianceType: musthave
  upgradeApproval: Automatic
  subscription:
    name: container-security-operator
    namespace: openshift-operators
    source: redhat-operators
    sourceNamespace: openshift-marketplace

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-imagemanifestvuln-example-imv
spec:
  remediationAction: inform  # will be overridden by remediationAction in parent policy
  severity: high
  namespaceSelector:
    exclude: ["kube-*"]
    include: ["*"]
  object-templates:
    - complianceType: mustnothave # mustnothave any ImageManifestVuln object
      objectDefinition:
        apiVersion: secscan.quay.redhat.com/v1alpha1
        kind: ImageManifestVuln # checking for a Kind

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-imagemanifestvuln-example-imv
spec:
  remediationAction: inform  # will be overridden by remediationAction in parent policy
  severity: high
  namespaceSelector:
    exclude: ["kube-*"]
    include: ["*"]
  object-templates:
    - complianceType: mustnothave # mustnothave any ImageManifestVuln object
      objectDefinition:
        apiVersion: secscan.quay.redhat.com/v1alpha1
        kind: ImageManifestVuln # checking for a Kind