@pulumi/kubernetes-compliance-policies
Version:
This repository contains a growing set of Compliance Policies to validate your infrastructure using Pulumi's Crossguard Policy-as-Code framework.
396 lines (395 loc) • 23.8 kB
JavaScript
"use strict";
// Copyright 2016-2024, Pulumi Corporation.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// ------------------------------- WARNING -------------------------------------
// This file was programmatically generated. Do not edit unless you know what
// you're doing.
// ------------------------------- WARNING -------------------------------------
Object.defineProperty(exports, "__esModule", { value: true });
exports.ValidatingWebhookConfigurationPatch = exports.ValidatingWebhookConfigurationList = exports.ValidatingWebhookConfiguration = exports.ValidatingAdmissionPolicyPatch = exports.ValidatingAdmissionPolicyList = exports.ValidatingAdmissionPolicyBindingPatch = exports.ValidatingAdmissionPolicyBindingList = exports.ValidatingAdmissionPolicyBinding = exports.ValidatingAdmissionPolicy = exports.MutatingWebhookConfigurationPatch = exports.MutatingWebhookConfigurationList = exports.MutatingWebhookConfiguration = void 0;
const policy_1 = require("@pulumi/policy");
const compliance_policy_manager_1 = require("@pulumi/compliance-policy-manager");
const v1beta1_1 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_2 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_3 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_4 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_5 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_6 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_7 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_8 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_9 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_10 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_11 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
const v1beta1_12 = require("@pulumi/kubernetes/admissionregistration/v1beta1");
var MutatingWebhookConfiguration;
(function (MutatingWebhookConfiguration) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.MutatingWebhookConfiguration).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
MutatingWebhookConfiguration.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-mutatingwebhookconfiguration-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.MutatingWebhookConfiguration).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_1.MutatingWebhookConfiguration, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes MutatingWebhookConfiguration shouldn't use an unstable API (admissionregistration.v1beta1.MutatingWebhookConfiguration).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(MutatingWebhookConfiguration || (MutatingWebhookConfiguration = {}));
exports.MutatingWebhookConfiguration = MutatingWebhookConfiguration;
var MutatingWebhookConfigurationList;
(function (MutatingWebhookConfigurationList) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.MutatingWebhookConfigurationList).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
MutatingWebhookConfigurationList.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-mutatingwebhookconfigurationlist-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.MutatingWebhookConfigurationList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_2.MutatingWebhookConfigurationList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes MutatingWebhookConfigurationList shouldn't use an unstable API (admissionregistration.v1beta1.MutatingWebhookConfigurationList).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(MutatingWebhookConfigurationList || (MutatingWebhookConfigurationList = {}));
exports.MutatingWebhookConfigurationList = MutatingWebhookConfigurationList;
var MutatingWebhookConfigurationPatch;
(function (MutatingWebhookConfigurationPatch) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.MutatingWebhookConfigurationPatch).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
MutatingWebhookConfigurationPatch.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-mutatingwebhookconfigurationpatch-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.MutatingWebhookConfigurationPatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_3.MutatingWebhookConfigurationPatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes MutatingWebhookConfigurationPatch shouldn't use an unstable API (admissionregistration.v1beta1.MutatingWebhookConfigurationPatch).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(MutatingWebhookConfigurationPatch || (MutatingWebhookConfigurationPatch = {}));
exports.MutatingWebhookConfigurationPatch = MutatingWebhookConfigurationPatch;
var ValidatingAdmissionPolicy;
(function (ValidatingAdmissionPolicy) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicy).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingAdmissionPolicy.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingadmissionpolicy-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicy).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_4.ValidatingAdmissionPolicy, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingAdmissionPolicy shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingAdmissionPolicy).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingAdmissionPolicy || (ValidatingAdmissionPolicy = {}));
exports.ValidatingAdmissionPolicy = ValidatingAdmissionPolicy;
var ValidatingAdmissionPolicyBinding;
(function (ValidatingAdmissionPolicyBinding) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyBinding).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingAdmissionPolicyBinding.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingadmissionpolicybinding-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyBinding).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_5.ValidatingAdmissionPolicyBinding, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingAdmissionPolicyBinding shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingAdmissionPolicyBinding).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingAdmissionPolicyBinding || (ValidatingAdmissionPolicyBinding = {}));
exports.ValidatingAdmissionPolicyBinding = ValidatingAdmissionPolicyBinding;
var ValidatingAdmissionPolicyBindingList;
(function (ValidatingAdmissionPolicyBindingList) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyBindingList).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingAdmissionPolicyBindingList.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingadmissionpolicybindinglist-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyBindingList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_6.ValidatingAdmissionPolicyBindingList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingAdmissionPolicyBindingList shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingAdmissionPolicyBindingList).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingAdmissionPolicyBindingList || (ValidatingAdmissionPolicyBindingList = {}));
exports.ValidatingAdmissionPolicyBindingList = ValidatingAdmissionPolicyBindingList;
var ValidatingAdmissionPolicyBindingPatch;
(function (ValidatingAdmissionPolicyBindingPatch) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyBindingPatch).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingAdmissionPolicyBindingPatch.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingadmissionpolicybindingpatch-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyBindingPatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_7.ValidatingAdmissionPolicyBindingPatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingAdmissionPolicyBindingPatch shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingAdmissionPolicyBindingPatch).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingAdmissionPolicyBindingPatch || (ValidatingAdmissionPolicyBindingPatch = {}));
exports.ValidatingAdmissionPolicyBindingPatch = ValidatingAdmissionPolicyBindingPatch;
var ValidatingAdmissionPolicyList;
(function (ValidatingAdmissionPolicyList) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyList).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingAdmissionPolicyList.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingadmissionpolicylist-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_8.ValidatingAdmissionPolicyList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingAdmissionPolicyList shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingAdmissionPolicyList).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingAdmissionPolicyList || (ValidatingAdmissionPolicyList = {}));
exports.ValidatingAdmissionPolicyList = ValidatingAdmissionPolicyList;
var ValidatingAdmissionPolicyPatch;
(function (ValidatingAdmissionPolicyPatch) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyPatch).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingAdmissionPolicyPatch.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingadmissionpolicypatch-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingAdmissionPolicyPatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_9.ValidatingAdmissionPolicyPatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingAdmissionPolicyPatch shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingAdmissionPolicyPatch).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingAdmissionPolicyPatch || (ValidatingAdmissionPolicyPatch = {}));
exports.ValidatingAdmissionPolicyPatch = ValidatingAdmissionPolicyPatch;
var ValidatingWebhookConfiguration;
(function (ValidatingWebhookConfiguration) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingWebhookConfiguration).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingWebhookConfiguration.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingwebhookconfiguration-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingWebhookConfiguration).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_10.ValidatingWebhookConfiguration, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingWebhookConfiguration shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingWebhookConfiguration).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingWebhookConfiguration || (ValidatingWebhookConfiguration = {}));
exports.ValidatingWebhookConfiguration = ValidatingWebhookConfiguration;
var ValidatingWebhookConfigurationList;
(function (ValidatingWebhookConfigurationList) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingWebhookConfigurationList).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingWebhookConfigurationList.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingwebhookconfigurationlist-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingWebhookConfigurationList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_11.ValidatingWebhookConfigurationList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingWebhookConfigurationList shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingWebhookConfigurationList).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingWebhookConfigurationList || (ValidatingWebhookConfigurationList = {}));
exports.ValidatingWebhookConfigurationList = ValidatingWebhookConfigurationList;
var ValidatingWebhookConfigurationPatch;
(function (ValidatingWebhookConfigurationPatch) {
/**
* Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingWebhookConfigurationPatch).
*
* @severity medium
* @frameworks none
* @topics api, beta, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ValidatingWebhookConfigurationPatch.disallowBetaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-admissionregistration-v1beta1-validatingwebhookconfigurationpatch-disallow-beta-resource",
description: "Disallow the use of non-stable (Beta) Kubernetes resouces (admissionregistration.v1beta1.ValidatingWebhookConfigurationPatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1beta1_12.ValidatingWebhookConfigurationPatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ValidatingWebhookConfigurationPatch shouldn't use an unstable API (admissionregistration.v1beta1.ValidatingWebhookConfigurationPatch).");
}),
},
vendors: ["kubernetes"],
services: ["admissionregistration"],
severity: "medium",
topics: ["api", "unstable", "beta"],
});
})(ValidatingWebhookConfigurationPatch || (ValidatingWebhookConfigurationPatch = {}));
exports.ValidatingWebhookConfigurationPatch = ValidatingWebhookConfigurationPatch;