{ "apiVersion": "v1", "items": [ { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-04-27T23:04:04Z", "generation": 1, "name": "ec-policy", "namespace": "chains-e2e-qewd", "resourceVersion": "66080", "uid": "6d89a77b-e76d-4510-a514-1303e5a7d382" }, "spec": { "description": "Includes rules for levels 1, 2 \u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml", "name": "Default", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "include": [ "slsa_provenance_available" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-04-28T00:12:22Z", "generation": 1, "name": "dr-ec-policy", "namespace": "dr-test-kokohazamar-backwards-compat-dr-managed", "resourceVersion": "178661", "uid": "db84c5da-be98-450e-ba8d-77383c0f9633" }, "spec": { "configuration": { "collections": [ "@slsa3" ], "exclude": [ "step_image_registries", "tasks.required_tasks_found:prefetch-dependencies" ] }, "description": "DR test Enterprise Contract policy", "publicKey": "k8s://dr-test-kokohazamar-backwards-compat-dr-managed/cosign-public-key", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-04-28T00:12:23Z", "generation": 1, "name": "dr-ec-policy", "namespace": "dr-test-moshekipod-backwards-compat-dr-managed", "resourceVersion": "178821", "uid": "9d15b18d-7052-4bdb-87e1-fbba94d95308" }, "spec": { "configuration": { "collections": [ "@slsa3" ], "exclude": [ "step_image_registries", "tasks.required_tasks_found:prefetch-dependencies" ] }, "description": "DR test Enterprise Contract policy", "publicKey": "k8s://dr-test-moshekipod-backwards-compat-dr-managed/cosign-public-key", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/default", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/default\"},\"name\":\"default\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes rules for levels 1, 2 \\u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml\",\"name\":\"Default\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@slsa3\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-04-27T22:46:57Z", "generation": 1, "name": "default", "namespace": "enterprise-contract-service", "resourceVersion": "25661", "uid": "7e7d25c5-e387-4064-87a6-52587d79166c" }, "spec": { "description": "Includes rules for levels 1, 2 \u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml", "name": "Default", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat\"},\"name\":\"redhat\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml\",\"name\":\"Red Hat\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@redhat\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-04-27T22:46:58Z", "generation": 1, "name": "redhat", "namespace": "enterprise-contract-service", "resourceVersion": "25666", "uid": "ee6c3622-d484-4094-a71d-88ad7622ff4f" }, "spec": { "description": "Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml", "name": "Red Hat", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-no-hermetic", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-no-hermetic\"},\"name\":\"redhat-no-hermetic\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Source: https://github.com/conforma/config/blob/main/redhat-no-hermetic/policy.yaml\",\"name\":\"Red Hat (non hermetic)\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[\"hermetic_build_task\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"include\":[\"@redhat\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-04-27T22:46:58Z", "generation": 1, "name": "redhat-no-hermetic", "namespace": "enterprise-contract-service", "resourceVersion": "25667", "uid": "fc9740de-353c-4492-8cc8-b77506c0be8b" }, "spec": { "description": "Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Source: https://github.com/conforma/config/blob/main/redhat-no-hermetic/policy.yaml", "name": "Red Hat (non hermetic)", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [ "hermetic_build_task", "tasks.required_tasks_found:prefetch-dependencies" ], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-rpms", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-rpms\"},\"name\":\"redhat-rpms\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"For Red Hat RPM builds in Red Hat Konflux. Source: https://github.com/conforma/config/blob/main/redhat-rpms/policy.yaml\",\"name\":\"Red Hat RPMs\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@redhat_rpms\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/enterprise-contract/rpmbuild-data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-04-27T22:46:58Z", "generation": 1, "name": "redhat-rpms", "namespace": "enterprise-contract-service", "resourceVersion": "25669", "uid": "c6b640e0-0012-4677-b268-892da7136e4b" }, "spec": { "description": "For Red Hat RPM builds in Red Hat Konflux. Source: https://github.com/conforma/config/blob/main/redhat-rpms/policy.yaml", "name": "Red Hat RPMs", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@redhat_rpms" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest", "oci::quay.io/enterprise-contract/rpmbuild-data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-trusted-tasks", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-trusted-tasks\"},\"name\":\"redhat-trusted-tasks\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Rules used to verify Tekton Task definitions comply to Red Hat's standards.\",\"name\":\"Red Hat Trusted Tasks\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"kind\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-task-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-04-27T22:46:58Z", "generation": 1, "name": "redhat-trusted-tasks", "namespace": "enterprise-contract-service", "resourceVersion": "25668", "uid": "fb6dfb44-7865-4123-9c3b-df1598e5719a" }, "spec": { "description": "Rules used to verify Tekton Task definitions comply to Red Hat's standards.", "name": "Red Hat Trusted Tasks", "sources": [ { "config": { "exclude": [], "include": [ "kind" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-task-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/slsa3", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/slsa3\"},\"name\":\"slsa3\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Rules specifically related to levels 1, 2 \\u0026 3 of SLSA v0.1, plus a set of basic checks that are expected to pass for all Konflux builds. Source: https://github.com/conforma/config/blob/main/slsa3/policy.yaml\",\"name\":\"SLSA3\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@minimal\",\"@slsa3\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-04-27T22:46:58Z", "generation": 1, "name": "slsa3", "namespace": "enterprise-contract-service", "resourceVersion": "25670", "uid": "3f3b2e70-5b11-4c26-bddd-cccb276db0d0" }, "spec": { "description": "Rules specifically related to levels 1, 2 \u0026 3 of SLSA v0.1, plus a set of basic checks that are expected to pass for all Konflux builds. Source: https://github.com/conforma/config/blob/main/slsa3/policy.yaml", "name": "SLSA3", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@minimal", "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-04-27T22:59:21Z", "generation": 1, "name": "konflux-demo-component-policy", "namespace": "konflux-snpo-managed", "resourceVersion": "51701", "uid": "dea5d7c3-976a-4b69-a848-2919ebead6c7" }, "spec": { "configuration": { "collections": [ "minimal" ], "exclude": [ "cve" ] }, "description": "Red Hat's enterprise requirements", "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHvgqbmewee6JqacmROVzkRti3GTk\n4tirgDWRwb+g/qXGy55BnDUeJsRU2V3Tn5mp2iEGm6ixPZfaOpx5Za3rcg==\n-----END PUBLIC KEY-----", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } } ], "kind": "List", "metadata": { "resourceVersion": "" } }