@pulumi/kubernetes-compliance-policies
Version:
This repository contains a growing set of Compliance Policies to validate your infrastructure using Pulumi's Crossguard Policy-as-Code framework.
104 lines (103 loc) • 3.6 kB
TypeScript
import { ResourceValidationPolicy } from "@pulumi/policy";
declare namespace DaemonSet {
/**
* Checks that Kubernetes DaemonSets have the recommended labels.
*
* @severity low
* @frameworks none
* @topics usability
* @link https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/
*/
const configureRecommendedLabels: ResourceValidationPolicy;
/**
* Checks that Kubernetes DaemonSets run pods with a read-only filesystem.
*
* @severity high
* @frameworks iso27001, pcidss
* @topics runtime, security
* @link https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
*/
const enableReadOnlyRootFilesystem: ResourceValidationPolicy;
}
export { DaemonSet };
declare namespace Deployment {
/**
* Checks that Kubernetes Deployments have at least three replicas.
*
* @severity high
* @frameworks none
* @topics availability
* @link https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
*/
const configureMinimumReplicaCount: ResourceValidationPolicy;
/**
* Checks that Kubernetes Deployments have the recommended labels.
*
* @severity low
* @frameworks none
* @topics usability
* @link https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/
*/
const configureRecommendedLabels: ResourceValidationPolicy;
/**
* Checks that Kubernetes Deployments run pods with a read-only filesystem.
*
* @severity high
* @frameworks iso27001, pcidss
* @topics runtime, security
* @link https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
*/
const enableReadOnlyRootFilesystem: ResourceValidationPolicy;
}
export { Deployment };
declare namespace ReplicaSet {
/**
* Checks that Kubernetes ReplicaSets have at least three replicas.
*
* @severity high
* @frameworks none
* @topics availability
* @link https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
*/
const configureMinimumReplicaCount: ResourceValidationPolicy;
/**
* Checks that Kubernetes ReplicaSets use the recommended labels.
*
* @severity low
* @frameworks none
* @topics usability
* @link https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/
*/
const configureRecommendedLabels: ResourceValidationPolicy;
/**
* Checks that Kubernetes ReplicaSets run pods with a read-only filesystem.
*
* @severity high
* @frameworks iso27001, pcidss
* @topics runtime, security
* @link https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
*/
const enableReadOnlyRootFilesystem: ResourceValidationPolicy;
}
export { ReplicaSet };
declare namespace StatefulSet {
/**
* Checks that Kubernetes StatefulSets have the recommended labels.
*
* @severity low
* @frameworks none
* @topics usability
* @link https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/
*/
const configureRecommendedLabels: ResourceValidationPolicy;
/**
* Checks that Kubernetes StatefulSets run pods with a read-only filesystem.
*
* @severity high
* @frameworks iso27001, pcidss
* @topics runtime, security
* @link https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
*/
const enableReadOnlyRootFilesystem: ResourceValidationPolicy;
}
export { StatefulSet };