{ "apiVersion": "v1", "items": [ { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-14T00:25:13Z", "generation": 6, "name": "ec-policy", "namespace": "build-e2e-sulp", "resourceVersion": "114246", "uid": "2fb71484-7cdc-41f7-83f7-13b05e583e8b" }, "spec": { "description": "Includes rules for levels 1, 2 \u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml", "name": "Default", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [ "slsa_source_correlated.source_code_reference_provided" ], "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-14T00:17:08Z", "generation": 12, "name": "ec-policy", "namespace": "chains-e2e-qgqn", "resourceVersion": "93843", "uid": "472c5258-3664-44d7-890b-2e1c57cb03e4" }, "spec": { "description": "Includes rules for levels 1, 2 \u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml", "name": "Default", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "include": [ "trusted_task.pinned" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-14T01:12:14Z", "generation": 1, "name": "dr-ec-policy", "namespace": "dr-test-kokohazamar-backwards-compat-dr-managed", "resourceVersion": "158029", "uid": "3683fe5c-9a14-4bfa-8e69-5d24f228cfdc" }, "spec": { "configuration": { "collections": [ "@slsa3" ], "exclude": [ "step_image_registries", "tasks.required_tasks_found:prefetch-dependencies" ] }, "description": "DR test Enterprise Contract policy", "publicKey": "k8s://dr-test-kokohazamar-backwards-compat-dr-managed/cosign-public-key", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-14T01:12:14Z", "generation": 1, "name": "dr-ec-policy", "namespace": "dr-test-moshekipod-backwards-compat-dr-managed", "resourceVersion": "158031", "uid": "cab3264d-1791-4db8-8684-6dbd95df8ea0" }, "spec": { "configuration": { "collections": [ "@slsa3" ], "exclude": [ "step_image_registries", "tasks.required_tasks_found:prefetch-dependencies" ] }, "description": "DR test Enterprise Contract policy", "publicKey": "k8s://dr-test-moshekipod-backwards-compat-dr-managed/cosign-public-key", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/default", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/default\"},\"name\":\"default\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes rules for levels 1, 2 \\u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml\",\"name\":\"Default\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@slsa3\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-13T23:57:01Z", "generation": 1, "name": "default", "namespace": "enterprise-contract-service", "resourceVersion": "24091", "uid": "996bb407-2444-44b4-83e3-2e8470793117" }, "spec": { "description": "Includes rules for levels 1, 2 \u0026 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml", "name": "Default", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat\"},\"name\":\"redhat\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml\",\"name\":\"Red Hat\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@redhat\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-13T23:57:02Z", "generation": 1, "name": "redhat", "namespace": "enterprise-contract-service", "resourceVersion": "24126", "uid": "205e12e1-d6d1-4802-ae45-cdd0e85d2b12" }, "spec": { "description": "Includes the full set of rules and policies required internally by Red Hat when building Red Hat products. Source: https://github.com/conforma/config/blob/main/redhat/policy.yaml", "name": "Red Hat", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-no-hermetic", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-no-hermetic\"},\"name\":\"redhat-no-hermetic\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Source: https://github.com/conforma/config/blob/main/redhat-no-hermetic/policy.yaml\",\"name\":\"Red Hat (non hermetic)\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[\"hermetic_build_task\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"include\":[\"@redhat\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-13T23:57:02Z", "generation": 1, "name": "redhat-no-hermetic", "namespace": "enterprise-contract-service", "resourceVersion": "24154", "uid": "14a62daf-403b-4ba0-8429-1be2181b413a" }, "spec": { "description": "Includes most of the rules and policies required internally by Red Hat when building Red Hat products. It excludes the requirement of hermetic builds. Source: https://github.com/conforma/config/blob/main/redhat-no-hermetic/policy.yaml", "name": "Red Hat (non hermetic)", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [ "hermetic_build_task", "tasks.required_tasks_found:prefetch-dependencies" ], "include": [ "@redhat" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-rpms", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-rpms\"},\"name\":\"redhat-rpms\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"For Red Hat RPM builds in Red Hat Konflux. Source: https://github.com/conforma/config/blob/main/redhat-rpms/policy.yaml\",\"name\":\"Red Hat RPMs\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@redhat_rpms\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/enterprise-contract/rpmbuild-data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-13T23:57:02Z", "generation": 1, "name": "redhat-rpms", "namespace": "enterprise-contract-service", "resourceVersion": "24149", "uid": "e8c8673b-80c5-4cc8-824f-41c986473127" }, "spec": { "description": "For Red Hat RPM builds in Red Hat Konflux. Source: https://github.com/conforma/config/blob/main/redhat-rpms/policy.yaml", "name": "Red Hat RPMs", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@redhat_rpms" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest", "oci::quay.io/enterprise-contract/rpmbuild-data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-trusted-tasks", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/redhat-trusted-tasks\"},\"name\":\"redhat-trusted-tasks\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Rules used to verify Tekton Task definitions comply to Red Hat's standards.\",\"name\":\"Red Hat Trusted Tasks\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"kind\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-task-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-13T23:57:02Z", "generation": 1, "name": "redhat-trusted-tasks", "namespace": "enterprise-contract-service", "resourceVersion": "24169", "uid": "5c7c16d4-5c1c-4683-94c9-befc7a4dd641" }, "spec": { "description": "Rules used to verify Tekton Task definitions comply to Red Hat's standards.", "name": "Red Hat Trusted Tasks", "sources": [ { "config": { "exclude": [], "include": [ "kind" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-task-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "annotations": { "argocd.argoproj.io/tracking-id": "enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/slsa3", "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"appstudio.redhat.com/v1alpha1\",\"kind\":\"EnterpriseContractPolicy\",\"metadata\":{\"annotations\":{\"argocd.argoproj.io/tracking-id\":\"enterprise-contract-in-cluster-local:appstudio.redhat.com/EnterpriseContractPolicy:enterprise-contract-service/slsa3\"},\"name\":\"slsa3\",\"namespace\":\"enterprise-contract-service\"},\"spec\":{\"description\":\"Rules specifically related to levels 1, 2 \\u0026 3 of SLSA v0.1, plus a set of basic checks that are expected to pass for all Konflux builds. Source: https://github.com/conforma/config/blob/main/slsa3/policy.yaml\",\"name\":\"SLSA3\",\"publicKey\":\"k8s://openshift-pipelines/public-key\",\"sources\":[{\"config\":{\"exclude\":[],\"include\":[\"@minimal\",\"@slsa3\"]},\"data\":[\"github.com/release-engineering/rhtap-ec-policy//data\",\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest\",\"oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest\"],\"name\":\"Default\",\"policy\":[\"oci::quay.io/enterprise-contract/ec-release-policy:konflux\"]}]}}\n" }, "creationTimestamp": "2026-05-13T23:57:02Z", "generation": 1, "name": "slsa3", "namespace": "enterprise-contract-service", "resourceVersion": "24135", "uid": "751930d9-9521-48e7-aeb1-f4d86dfc14da" }, "spec": { "description": "Rules specifically related to levels 1, 2 \u0026 3 of SLSA v0.1, plus a set of basic checks that are expected to pass for all Konflux builds. Source: https://github.com/conforma/config/blob/main/slsa3/policy.yaml", "name": "SLSA3", "publicKey": "k8s://openshift-pipelines/public-key", "sources": [ { "config": { "exclude": [], "include": [ "@minimal", "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } }, { "apiVersion": "appstudio.redhat.com/v1alpha1", "kind": "EnterpriseContractPolicy", "metadata": { "creationTimestamp": "2026-05-14T00:12:47Z", "generation": 1, "name": "konflux-demo-component-policy", "namespace": "konflux-kxpr-managed", "resourceVersion": "58383", "uid": "32f482fb-cac1-47df-a4f5-949bd8d1c869" }, "spec": { "configuration": { "collections": [ "minimal" ], "exclude": [ "cve" ] }, "description": "Red Hat's enterprise requirements", "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEL6J+m16pu+K4C8FY8NYV+/W99gWZ\nMhmD020nT3EAMF4GcZSTTOqK/sxmTICQS0+Pedct91cDC62ulKYYTvedsw==\n-----END PUBLIC KEY-----", "sources": [ { "config": { "include": [ "@slsa3" ] }, "data": [ "github.com/release-engineering/rhtap-ec-policy//data", "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest", "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest" ], "name": "Default", "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:konflux" ] } ] } } ], "kind": "List", "metadata": { "resourceVersion": "" } }