# an available choice for the specs control
name:
  ImageManifestVulnPolicy
description:
  detect image vulnerabilities
multiselect:
  specs
replacements: # if user select this choice, the template variable names and values to use
  standards: |
    NIST-CSF
  categories: |
    DE.CM Security Continuous Monitoring
  controls: |
    DE.CM-8 Vulnerability Scans
  namespaceSelector: |
    namespaces:
      exclude: ["kube-*"]
      include: ["*"]
  policyTemplates: |
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: {{name}}-example-csv
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: high
          namespaceSelector:
            exclude: ["kube-*"]
            include: ["*"]
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: operators.coreos.com/v1alpha1
                kind: ClusterServiceVersion
                metadata:
                  annotations:
                    tectonic-visibility: ocs
                    olm.targetNamespaces: ''
                    repository: 'https://github.com/quay/container-security-operator'
                    capabilities: Full Lifecycle
                    olm.operatorNamespace: openshift-operators
                    containerImage: >-
                      registry.redhat.io/quay/quay-container-security-rhel8-operator@sha256:ecf1e5ad2616ace76253403b66858af7485810ad5972a08b0aecbd0cfd77caaa
                    createdAt: '2020-05-20 17:15:55'
                    categories: 'OpenShift Optional, Security'
                    description: Identify image vulnerabilities in Kubernetes pods
                    olm.operatorGroup: global-operators
                  name: container-security-operator.v3.3.1
                  namespace: openshift-operators
                spec:
                  customresourcedefinitions:
                    owned:
                      - description: Represents a set of vulnerabilities in an image manifest.
                        displayName: Image Manifest Vulnerability
                        kind: ImageManifestVuln
                        name: imagemanifestvulns.secscan.quay.redhat.com
                        version: v1alpha1
                  apiservicedefinitions: {}
                  keywords:
                    - open source
                    - containers
                    - security
                  displayName: Quay Container Security
                  provider:
                    name: Red Hat
                  maturity: alpha
                  installModes:
                    - supported: true
                      type: OwnNamespace
                    - supported: true
                      type: SingleNamespace
                    - supported: true
                      type: MultiNamespace
                    - supported: true
                      type: AllNamespaces
                  version: 3.3.1
                  icon:
                    - base64data: >-
                        [encoded data, 4744 characters]
                      mediatype: image/png
                  links:
                    - name: Source Code
                      url: 'https://github.com/quay/container-security-operator'
                  install:
                    spec:
                      deployments:
                        - name: container-security-operator
                          spec:
                            replicas: 1
                            selector:
                              matchLabels:
                                name: container-security-operator-alm-owned
                            strategy: {}
                            template:
                              metadata:
                                creationTimestamp: null
                                labels:
                                  name: container-security-operator-alm-owned
                                name: container-security-operator-alm-owned
                              spec:
                                containers:
                                  - command:
                                      - /bin/security-labeller
                                      - '--namespaces=$(WATCH_NAMESPACE)'
                                      - '--extraCerts=/extra-certs'
                                    env:
                                      - name: MY_POD_NAMESPACE
                                        valueFrom:
                                          fieldRef:
                                            fieldPath: metadata.namespace
                                      - name: MY_POD_NAME
                                        valueFrom:
                                          fieldRef:
                                            fieldPath: metadata.name
                                      - name: WATCH_NAMESPACE
                                        valueFrom:
                                          fieldRef:
                                            fieldPath: 'metadata.annotations[''olm.targetNamespaces'']'
                                    image: >-
                                      registry.redhat.io/quay/quay-container-security-rhel8-operator@sha256:ecf1e5ad2616ace76253403b66858af7485810ad5972a08b0aecbd0cfd77caaa
                                    name: container-security-operator
                                    resources: {}
                                    volumeMounts:
                                      - mountPath: /extra-certs
                                        name: extra-certs
                                        readOnly: true
                                serviceAccountName: container-security-operator
                                volumes:
                                  - name: extra-certs
                                    secret:
                                      optional: true
                                      secretName: container-security-operator-extra-certs
                      permissions:
                        - rules:
                            - apiGroups:
                                - secscan.quay.redhat.com
                              resources:
                                - imagemanifestvulns
                                - imagemanifestvulns/status
                              verbs:
                                - '*'
                            - apiGroups:
                                - ''
                              resources:
                                - pods
                                - events
                              verbs:
                                - '*'
                            - apiGroups:
                                - ''
                              resources:
                                - secrets
                              verbs:
                                - get
                          serviceAccountName: container-security-operator
                    strategy: deployment
                  maintainers:
                    - email: quay-devel@redhat.com
                      name: Quay Engineering Team
                  description: >-
                    The Quay Container Security Operator (CSO) brings Quay and Clair metadata to
                    Kubernetes / OpenShift. Starting with vulnerability information the scope
                    will get expanded over time. If it runs on OpenShift, the corresponding
                    vulnerability information is shown inside the OCP Console. The Quay
                    Container Security Operator enables cluster administrators to monitor known
                    container image vulnerabilities in pods running on their Kubernetes cluster.
                    The controller sets up a watch on pods in the specified namespace(s) and
                    queries the container registry for vulnerability information. If the
                    container registry supports image scanning, such as
                    [Quay](https://github.com/quay/quay) with
                    [Clair](https://github.com/quay/clair), then the Operator will expose any
                    vulnerabilities found via the Kubernetes API in an `ImageManifestVuln`
                    object.  This Operator requires no additional configuration after
                    deployment, and will begin watching pods and populating `ImageManifestVulns`
                    immediately once installed.
                  selector:
                    matchLabels:
                      alm-owner-container-security-operator: container-security-operator
                      operated-by: container-security-operator
                  labels:
                    alm-owner-container-security-operator: container-security-operator
                    operated-by: container-security-operator
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: {{name}}-example-sub
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: high
          namespaceSelector:
            exclude: ["kube-*"]
            include: ["*"]
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: operators.coreos.com/v1alpha1
                kind: Subscription
                metadata:
                  name: container-security-operator
                  namespace: openshift-operators
                spec:
                  channel: quay-v3.3
                  installPlanApproval: Automatic
                  name: container-security-operator
                  source: redhat-operators
                  sourceNamespace: openshift-marketplace
                  startingCSV: container-security-operator.v3.3.1
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: {{name}}-example-imv
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: high
          namespaceSelector:
            exclude: ["kube-*"]
            include: ["*"]
          object-templates:
            - complianceType: mustnothave # mustnothave any ImageManifestVuln object
              objectDefinition:
                apiVersion: secscan.quay.redhat.com/v1alpha1
                kind: ImageManifestVuln # checking for a kind