The Enterprise Contract Policy defines the configuration for the enforcement of the Enterprise Contract by specifying the rules needed for a container image to be compliant with an organization’s software release policy requirements.
The Enterprise Contract Policy is passed in the form of a configuration to the EC CLI to parameterize its execution in the enforcement of the set policy.
When creating Enterprise Contract Policy first make note of what rule sources to include, any authorization approval requirements and the public key needed to validate the image and attestation image signatures.
The resulting data is placed in a JSON document with the following structure:
link:example$spec-example.json[role=include]Consult the the EnterpriseContractPolicySpec reference documentation for details on the structure of this document.
The policy in JSON format can be passed in directly to the ec command line
using the -p/--policy option, for example in the
validate image command.
It is more common to create the Enterprise Contract Policy as a Kubernetes
Custom Resource and pass the reference to the namespace and the name of the
Custom Resource to the -p/--policy option. This has the advantage that the
policy is centraly defined and served from the Kubernetes API server with the
additional benefit of applying role based access control.
link:example$k8s-example.yaml[role=include]kubectlkubectl apply -f policy.yaml