metadata.yml

rules:
  - apiGroups:
      - ""
    apiVersions:
      - v1
    resources:
      - pods
    operations:
      - CREATE
  - apiGroups:
      - ""
    apiVersions:
      - v1
    resources:
      - replicationcontrollers
    operations:
      - CREATE
      - UPDATE
  - apiGroups:
      - apps
    apiVersions:
      - v1
    resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
    operations:
      - CREATE
      - UPDATE
  - apiGroups:
      - batch
    apiVersions:
      - v1
    resources:
      - jobs
      - cronjobs
    operations:
      - CREATE
      - UPDATE
mutating: true
contextAware: false
executionMode: kubewarden-wapc
# Consider the policy for the background audit scans. Default is true. Note the
# intrinsic limitations of the background audit feature on docs.kubewarden.io;
# If your policy hits any limitations, set to false for the audit feature to
# skip this policy and not generate false positives.
backgroundAudit: true
annotations:
  # artifacthub specific:
  io.artifacthub.displayName: Container Resources
  io.artifacthub.resources: Pod, Replicationcontroller, Deployments, Replicaset, Statefulset, Daemonset, Job, Cronjob
  io.artifacthub.keywords: container, resources
  io.kubewarden.policy.ociUrl: ghcr.io/kubewarden/policies/container-resources # must match release workflow oci-target
  # kubewarden specific:
  io.kubewarden.policy.title: container-resources
  io.kubewarden.policy.description: Policy is designed to enforce constraints on the resource requirements of Kubernetes containers
  io.kubewarden.policy.author: "Kubewarden developers <cncf-kubewarden-maintainers@lists.cncf.io>"
  io.kubewarden.policy.url: https://github.com/kubewarden/container-resources-policy
  io.kubewarden.policy.source: https://github.com/kubewarden/container-resources-policy
  io.kubewarden.policy.license: Apache-2.0
  # The next two annotations are used in the policy report generated by the
  # Audit scanner. Severity indicates policy check result criticality and
  # Category indicates policy category. See more here at docs.kubewarden.io
  io.kubewarden.policy.severity: medium # one of info, low, medium, high, critical. See docs.
  io.kubewarden.policy.category: Resource validation