update description format

samples/best_practices/deny_runasrootuser.yaml

@@ -4,8 +4,10 @@ metadata:
   name: validate-deny-runasrootuser
   annotations:
     policies.kyverno.io/category: Security Context
-    policies.kyverno.io/description: |
-      By default, processes in a container run as a root user (uid 0). To prevent potential compromise of container hosts, specify a least privileged user ID when building the container image and require that application containers run as non root users.
+    policies.kyverno.io/description: By default, processes in a container run as a 
+      root user (uid 0). To prevent potential compromise of container hosts, specify a 
+      least privileged user ID when building the container image and require that 
+      application containers run as non root users.
 spec:
   validationFailureAction: "audit"
   rules:

samples/best_practices/disallow_automountingapicred.yaml

@@ -4,8 +4,8 @@ metadata:
   name: validate-disallow-automoutingapicred
   annotations:
     policies.kyverno.io/category: API Server Access Control
-    policies.kyverno.io/description: |
-      Kubernetes automounts default service account credentials in each pod. To restrict access, opt out of automounting credentials by setting 'automountServiceAccountToken' to 'false'.
+    policies.kyverno.io/description: Kubernetes automounts default service account credentials in each pod. 
+      To restrict access, opt out of automounting credentials by setting 'automountServiceAccountToken' to 'false'.
 spec:
   rules:
   - name: disallow-automoutingapicred

samples/best_practices/disallow_default_namespace.yaml

@@ -4,8 +4,8 @@ metadata:
   name: validate-namespace
   annotations:
     policies.kyverno.io/category: Workload Isolation
-    policies.kyverno.io/description: |
-      With many users spread across multiple teams, restricting use of the default namespace and subdividing the cluster by namesoace isolates workloads.
+    policies.kyverno.io/description: With many users spread across multiple teams, restricting 
+      use of the default namespace and subdividing the cluster by namesoace isolates workloads.
 spec:
   rules:
   - name: check-default-namespace

samples/best_practices/disallow_host_filesystem.yaml

@@ -4,8 +4,9 @@ metadata:
   name: "deny-use-of-host-fs"
   annotations:
     policies.kyverno.io/category: Data Protection
-    policies.kyverno.io/description: |
-      The volume of type 'hostpath' binds pods to a specific host, and data persisted in the volume is dependent on the life of the node. In a shared cluster, it is recommeded that applications are independent of hosts.
+    policies.kyverno.io/description: The volume of type 'hostpath' binds pods to a specific host, 
+      and data persisted in the volume is dependent on the life of the node. In a shared cluster, 
+      it is recommeded that applications are independent of hosts.
 spec: 
   rules: 
   - name: "deny-use-of-host-fs"

samples/best_practices/disallow_host_network_hostport.yaml

@@ -4,8 +4,8 @@ metadata:
   name: validate-host-network-hostport
   annotations:
     policies.kyverno.io/category: Security
-    policies.kyverno.io/description: |
-      Using 'hostPort' and 'hostNetwork' allows pods to share the host network stack, allowing potential snooping of network traffic from an application pod.
+    policies.kyverno.io/description: Using 'hostPort' and 'hostNetwork' allows pods to share 
+      the host network stack, allowing potential snooping of network traffic from an application pod.
 spec:
   rules:
   - name: validate-host-network-hostport

samples/best_practices/disallow_hostpid_hostipc.yaml

@@ -4,10 +4,10 @@ metadata:
   name: validate-hostpid-hostipc
   annotations:
     policies.kyverno.io/category: Security
-    policies.kyverno.io/description: |
-      Sharing the host's PID namespace allows visibility of process on the host, potentially exposing process information.
-      Sharing the host's IPC namespace allows the container process to communicate with processes on the host.
-      To avoid pod container from having visibility to host process space, validate that 'hostPID' and 'hostIPC' are set to 'false'.
+    policies.kyverno.io/description: Sharing the host's PID namespace allows visibility of process 
+      on the host, potentially exposing process information. Sharing the host's IPC namespace allows 
+      the container process to communicate with processes on the host. To avoid pod container from 
+      having visibility to host process space, validate that 'hostPID' and 'hostIPC' are set to 'false'.
 spec:
   rules:
   - name: validate-hostpid-hostipc

samples/best_practices/disallow_node_port.yaml

@@ -4,8 +4,10 @@ metadata:
   name: disallow-node-port
   annotations:
     policies.kyverno.io/category: Security
-    policies.kyverno.io/description: |
-      A Kubernetes service of type NodePort uses a host port to receive traffic from any source. A 'NetworkPolicy' resource cannot be used to control traffic to host ports. Although 'NodePort' services can be useful, their use must be limited to services with additional upstream security checks.
+    policies.kyverno.io/description: A Kubernetes service of type NodePort uses a 
+      host port to receive traffic from any source. A 'NetworkPolicy' resource cannot be used 
+      to control traffic to host ports. Although 'NodePort' services can be useful, their use 
+      must be limited to services with additional upstream security checks.
 spec:
   rules:
   - name: disallow-node-port

samples/best_practices/disallow_priviledged_priviligedescalation.yaml

@@ -4,9 +4,12 @@ metadata:
   name: validate-deny-privileged-priviligedescalation
   annotations:
     policies.kyverno.io/category: Security Context
-    policies.kyverno.io/description: |
-      Privileged containers are defined as any container where the container uid 0 is mapped to the host’s uid 0. A process within privileged containers can get unrestricted host access. With 'securityContext.allowPrivilegeEscalation' enabled a process can gain privileges from its parent.
-      To disallow privileged containers and the escalation of privileges it is recommended to run pod containers with 'securityContext.priveleged' as 'false' and 'allowPrivilegeEscalation' as 'false'.
+    policies.kyverno.io/description: Privileged containers are defined as any container 
+      where the container uid 0 is mapped to the host’s uid 0. A process within privileged 
+      containers can get unrestricted host access. With 'securityContext.allowPrivilegeEscalation' 
+      enabled a process can gain privileges from its parent. To disallow privileged containers 
+      and the escalation of privileges it is recommended to run pod containers with 
+      'securityContext.priveleged' as 'false' and 'allowPrivilegeEscalation' as 'false'.
 spec:
   rules:
   - name: deny-privileged-priviligedescalation

samples/best_practices/require_default_network_policy.yaml

@@ -4,8 +4,10 @@ metadata:
   name: default-deny-ingress-networkpolicy
   annotations:
     policies.kyverno.io/category: NetworkPolicy
-    policies.kyverno.io/description: |
-      By default, Kubernetes allows all ingress and egress traffic to and from pods within a cluster. A "default" NetworkPolicy resource for a namespace should be used to deny all ingress traffic to the pods in that namespace. Additional NetworkPolicy resources can then be configured to allow desired traffic to application pods.
+    policies.kyverno.io/description: By default, Kubernetes allows all ingress and egress traffic 
+      to and from pods within a cluster. A "default" NetworkPolicy resource for a namespace should 
+      be used to deny all ingress traffic to the pods in that namespace. Additional NetworkPolicy 
+      resources can then be configured to allow desired traffic to application pods.
 spec:
   rules:
   - name: "default-deny-ingress"

samples/best_practices/require_image_tag_not_latest.yaml

@@ -4,8 +4,9 @@ metadata:
   name: validate-image-tag
   annotations:
     policies.kyverno.io/category: Image
-    policies.kyverno.io/description: |
-      The ':latest' tag is mutable and can lead to unexpected errors if the image changes. A best practice is to use an immutable tag that maps to a specific version of an application pod.
+    policies.kyverno.io/description: The ':latest' tag is mutable and can lead to 
+      unexpected errors if the image changes. A best practice is to use an immutable 
+      tag that maps to a specific version of an application pod.
 spec:
   rules:
   - name: image-tag-notspecified

samples/best_practices/require_namespace_quota.yaml

@@ -4,8 +4,9 @@ metadata:
   name: validate-namespace-quota
   annotations:
     policies.kyverno.io/category: Resource Quota
-    policies.kyverno.io/description: |
-      To limit the number of objects, as well as the total amount of compute that may be consumed by an application, it is important to create resource limits and quotas for each namespace.
+    policies.kyverno.io/description: To limit the number of objects, as well as the 
+      total amount of compute that may be consumed by an application, it is important 
+      to create resource limits and quotas for each namespace.
 spec:
   rules:
   - name: validate-namespace-quota

samples/best_practices/require_pod_requests_limits.yaml

@@ -4,8 +4,10 @@ metadata:
   name: check-resource
   annotations:
     policies.kyverno.io/category: Resource Quota
-    policies.kyverno.io/description: |
-      As application workloads share cluster resources, it is important to limit resources requested and consumed by each pod. It is recommended to require 'resources.requests' and 'resources.limits' per pod. If a namespace level request or limit is specified, defaults will automatically be applied to each pod based on the 'LimitRange' configuration.
+    policies.kyverno.io/description: As application workloads share cluster resources, it is important 
+      to limit resources requested and consumed by each pod. It is recommended to require 
+      'resources.requests' and 'resources.limits' per pod. If a namespace level request or limit is 
+      specified, defaults will automatically be applied to each pod based on the 'LimitRange' configuration.
 spec:
   validationFailureAction: "audit"
   rules:

samples/best_practices/require_probes.yaml

@@ -4,9 +4,10 @@ metadata:
   name: validate-probes
   annotations:
     policies.kyverno.io/category: Health Check
-    policies.kyverno.io/description: |
-      For each pod, a 'livenessProbe' is carried out by the kubelet to determine when to restart a container. A 'readinessProbe' is used by services and deployments to determine if the pod is ready to recieve network traffic.
-      Both liveness and readiness probes need to be configured to manage the pod lifecycle during restarts and upgrades.
+    policies.kyverno.io/description: For each pod, a 'livenessProbe' is carried out by the kubelet to 
+      determine when to restart a container. A 'readinessProbe' is used by services and deployments to 
+      determine if the pod is ready to recieve network traffic. Both liveness and readiness probes 
+      need to be configured to manage the pod lifecycle during restarts and upgrades.
 spec:
   rules:
   - name: check-probes

samples/best_practices/require_readonly_rootfilesystem.yaml

@@ -4,8 +4,10 @@ metadata:
   name: validate-readonly-rootfilesystem
   annotations:
     policies.kyverno.io/category: Security Context
-    policies.kyverno.io/description: |
-      A read-only root file system helps to enforce an immutable infrastructure strategy; the container only needs to write on the mounted volume that persists the state. An immutable root filesystem can also prevent malicious binaries from writing to the host system.
+    policies.kyverno.io/description: A read-only root file system helps to enforce an immutable 
+      infrastructure strategy; the container only needs to write on the mounted volume that p
+      ersists the state. An immutable root filesystem can also prevent malicious binaries from 
+      writing to the host system.
 spec:
   rules:
   - name: validate-readonly-rootfilesystem

samples/best_practices/trusted_image_registries.yaml

@@ -4,8 +4,9 @@ metadata:
   name: trusted-registries
   annotations:
     policies.kyverno.io/category: Image
-    policies.kyverno.io/description: |
-      Images from unknown registries may not be scanned and secured. Requiring use of known registries helps reduce threat exposure. You can customize this policy to allow image registries that you trust.
+    policies.kyverno.io/description: Images from unknown registries may not be scanned and secured. 
+      Requiring use of known registries helps reduce threat exposure. You can customize this policy 
+      to allow image registries that you trust.
 spec:
   rules:
   - name: trusted-registries

samples/more/policy_validate_container_capabilities.yaml

@@ -4,8 +4,9 @@ metadata:
   name: validate-container-capablities
   annotations:
     policies.kyverno.io/category: Security Context
-    policies.kyverno.io/description: |
-      Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled or disabled by listing them in 'securityContext.capabilites'.
+    policies.kyverno.io/description: Linux divides the privileges traditionally associated with 
+      superuser into distinct units, known as capabilities, which can be independently enabled 
+      or disabled by listing them in 'securityContext.capabilites'.
 spec:
   validationFailureAction: "audit"
   rules:

samples/more/policy_validate_sysctl_configs.yaml

@@ -4,8 +4,11 @@ metadata:
   name: validate-allow-portrange-with-sysctl
   annotations:
     policies.kyverno.io/category: Security Context
-    policies.kyverno.io/description: |
-      The Sysctl interface allows to modify kernel parameters at runtime and in the pod can be specified under 'securityContext.sysctls'. If kernel parameters in the pod are to be modified, should be handled cautiously, and policy with rules restricting these options will be helpful. We can control minimum and maximum port that a network connection can use as its source(local) port by checking 'net.ipv4.ip_local_port_range'.
+    policies.kyverno.io/description: The Sysctl interface allows to modify kernel parameters at 
+      runtime and in the pod can be specified under 'securityContext.sysctls'. If kernel parameters  
+      in the pod are to be modified, should be handled cautiously, and policy with rules restricting 
+      these options will be helpful. We can control minimum and maximum port that a network connection 
+      can use as its source(local) port by checking 'net.ipv4.ip_local_port_range'.
 spec:
   validationFailureAction: "audit"
   rules:

samples/more/policy_validate_user_group_fsgroup_id.yaml

@@ -4,8 +4,10 @@ metadata:
   name: validate-userid-groupid-fsgroup
   annotations:
     policies.kyverno.io/category: Security Context
-    policies.kyverno.io/description: |
-      All processes inside the pod can be made to run with specific user and groupID by setting 'runAsUser' and 'runAsGroup' respectively. 'fsGroup' can be specified to make sure any file created in the volume with have the specified groupID. These options can be used to validate the IDs used for user and group.
+    policies.kyverno.io/description: All processes inside the pod can be made to run with specific user 
+      and groupID by setting 'runAsUser' and 'runAsGroup' respectively. 'fsGroup' can be specified 
+      to make sure any file created in the volume with have the specified groupID. These options can be 
+      used to validate the IDs used for user and group.
 spec:
   rules:
   - name: validate-userid