Note: important to add selectors here at the bottom of the policy: https://github.com/openshift/trustee-operator/blob/v1.2.0/config/templates/ear_default_attestation_policy_cpu.rego
Objective: to show selected access to resources behind the KBS.
A couple of examples:
- Debug initdata cannot access production resources
- Gate based on namespace
- Gate based on an image that we know must be signed based on the initdata policy
- Other recommendations.
The objective here is to show trustee can safely hide multi-tenanted resources.
Note: important to add selectors here at the bottom of the policy: https://github.com/openshift/trustee-operator/blob/v1.2.0/config/templates/ear_default_attestation_policy_cpu.rego
Objective: to show selected access to resources behind the KBS.
A couple of examples:
The objective here is to show trustee can safely hide multi-tenanted resources.