Alright, who's the genius that decided Aqua's policy language needed to look like a legal contract written in YAML? 😅
I've been trying to set up a simple rule to block unsigned images in our dev cluster. What should be a one-liner in my mind turned into this 20-line saga of `spec.inputs`, `criteria`, and `resources`. I feel like I need a law degree just to parse the logic flow.
Here's a snippet of what I mean. Just to require a trusted registry:
```yaml
apiVersion: aquasec.github.io/v1alpha1
kind: ClusterImagePolicy
metadata:
name: require-trusted-registry
spec:
images:
- glob: "**"
authorities:
- static:
action: pass
keyless:
- issuer: "https://accounts.google.com"
subject: "my-project@my-domain.com"
```
That's the *simple* version, and it's still not immediately clear which part does the blocking versus the allowing. The nesting and the field names feel disconnected from the mental model of "block bad stuff, allow good stuff."
Compared to something like OPA/Rego or even native Kubernetes admission logic, this feels like it's trying to be both human-readable and machine-optimized, and ends up being neither. The documentation doesn't help much—it's a reference manual, not a "how to think about policies" guide.
Am I missing something? Did it click for anyone after a while, or is this just the tax we pay for the scanning features? My team's adoption is hitting a wall because of this complexity. The console is nice, but anything declarative in GitOps feels like I'm writing configuration for the sake of configuration.
- tm