{ "apiVersion": "v1", "items": [ { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-19T02:54:51Z", "generation": 8, "name": "ec-policy", "namespace": "chains-e2e-uhfc", "resourceVersion": "70028", "uid": "0337a99a-774a-4360-b89c-0431e1b50be9" }, "spec": { "description": "Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml", "name": "Red Hat", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [ "slsa_source_correlated.source_code_reference_provided", "cve.cve_results_found" ], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-19T03:30:14Z", "generation": 1, "name": "dr-ec-policy", "namespace": "dr-test-kokohazamar-backwards-compat-dr-managed", "resourceVersion": "108293", "uid": "94da06ce-1129-412d-b4c2-45f1db662802" }, "spec": { "configuration": { "collections": [ "@slsa3" ], "exclude": [ "step_image_registries", "tasks.required_tasks_found:prefetch-dependencies" ] }, "description": "DR test Enterprise Contract policy", "publicKey": "k8s://dr-test-kokohazamar-backwards-compat-dr-managed/cosign-public-key", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-19T03:30:14Z", "generation": 1, "name": "dr-ec-policy", "namespace": "dr-test-moshekipod-backwards-compat-dr-managed", "resourceVersion": "108330", "uid": "2413ee10-8f31-4779-8160-066f768292c4" }, "spec": { "configuration": { "collections": [ "@slsa3" ], "exclude": [ "step_image_registries", "tasks.required_tasks_found:prefetch-dependencies" ] }, "description": "DR test Enterprise Contract policy", "publicKey": "k8s://dr-test-moshekipod-backwards-compat-dr-managed/cosign-public-key", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/default", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/default\"},\"name\":\"default\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes rules for levels 1, 2 \\u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml\",\"name\":\"Default\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@slsa3\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-19T02:34:32Z", "generation": 1, "name": "default", "namespace": "enterprise-contract-service", "resourceVersion": "23352", "uid": "936d00ed-2112-42fb-ab59-461ef332ed9a" }, "spec": { "description": "Includes rules for levels 1, 2 \u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml", "name": "Default", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat\"},\"name\":\"redhat\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml\",\"name\":\"Red Hat\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@redhat\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-19T02:34:32Z", "generation": 1, "name": "redhat", "namespace": "enterprise-contract-service", "resourceVersion": "23417", "uid": "5b0e055f-9e2c-4d43-8baf-068245731974" }, "spec": { "description": "Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml", "name": "Red Hat", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-no-hermetic", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-no-hermetic\"},\"name\":\"redhat-no-hermetic\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Source: https://github.com/conforma/config/blob/main/redhat-no-hermetic/policy.yaml\",\"name\":\"Red Hat (non hermetic)\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[\"hermetic_build_task\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"include\":[\"@redhat\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-19T02:34:32Z", "generation": 1, "name": "redhat-no-hermetic", "namespace": "enterprise-contract-service", "resourceVersion": "23419", "uid": "1250c333-d084-4ef0-92a8-e557f1618954" }, "spec": { "description": "Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Source: https://github.com/conforma/config/blob/main/redhat-no-hermetic/policy.yaml", "name": "Red Hat (non hermetic)", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [ "hermetic_build_task", "tasks.required_tasks_found:prefetch-dependencies" ], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-rpms", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-rpms\"},\"name\":\"redhat-rpms\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"For Red Hat RPM builds in Red Hat Konflux. Source: https://github.com/conforma/config/blob/main/redhat-rpms/policy.yaml\",\"name\":\"Red Hat RPMs\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@redhat_rpms\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/enterprise-contract/rpmbuild-data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-19T02:34:32Z", "generation": 1, "name": "redhat-rpms", "namespace": "enterprise-contract-service", "resourceVersion": "23420", "uid": "7682785e-f319-4949-8754-cca29b0c85ca" }, "spec": { "description": "For Red Hat RPM builds in Red Hat Konflux. Source: https://github.com/conforma/config/blob/main/redhat-rpms/policy.yaml", "name": "Red Hat RPMs", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@redhat_rpms" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest", "oci::quay.io/enterprise-contract/rpmbuild-data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-trusted-tasks", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-trusted-tasks\"},\"name\":\"redhat-trusted-tasks\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Rules used to verify Tekton Task definitions comply to Red Hat's standards.\",\"name\":\"Red Hat Trusted Tasks\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"kind\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-task-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-19T02:34:32Z", "generation": 1, "name": "redhat-trusted-tasks", "namespace": "enterprise-contract-service", "resourceVersion": "23421", "uid": "7316aee6-732a-41b5-98b8-396873a04cba" }, "spec": { "description": "Rules used to verify Tekton Task definitions comply to Red Hat's standards.", "name": "Red Hat Trusted Tasks", "sources": [ { "config": { "exclude": [], "include": [ "kind" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-task-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/slsa3", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/slsa3\"},\"name\":\"slsa3\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Rules specifically related to levels 1, 2 \\u0026 3 of SLSA v0.1, plus a set of basic checks that are expected to pass for all Konflux builds. Source: https://github.com/conforma/config/blob/main/slsa3/policy.yaml\",\"name\":\"SLSA3\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@minimal\",\"@slsa3\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-19T02:34:32Z", "generation": 1, "name": "slsa3", "namespace": "enterprise-contract-service", "resourceVersion": "23422", "uid": "5cfcea02-cd25-4318-8c3c-b3da3d6f8ec5" }, "spec": { "description": "Rules specifically related to levels 1, 2 \u0026 3 of SLSA v0.1, plus a set of basic checks that are expected to pass for all Konflux builds. Source: https://github.com/conforma/config/blob/main/slsa3/policy.yaml", "name": "SLSA3", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@minimal", "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-19T02:50:58Z", "generation": 1, "name": "konflux-demo-component-policy", "namespace": "konflux-sird-managed", "resourceVersion": "56903", "uid": "3ae18ff6-d3b5-42d7-8ff2-e881bf095674" }, "spec": { "configuration": { "collections": [ "minimal" ], "exclude": [ "cve" ] }, "description": "Red Hat's enterprise requirements", "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELITVwv9tO3blzuM9WnjpByV0gUH6\nPNLTJA99G9w6AWAR/MPzdCuim97bE323/1T9YhqxpMMbQF7NzAQ84CcrMw==\n-----END PUBLIC KEY-----", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } } ], "kind": "List", "metadata": { "resourceVersion": "" } }