@pulumi/kubernetes-compliance-policies
Version:
This repository contains a growing set of Compliance Policies to validate your infrastructure using Pulumi's Crossguard Policy-as-Code framework.
396 lines (395 loc) • 19.8 kB
JavaScript
"use strict";
// Copyright 2016-2024, Pulumi Corporation.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// ------------------------------- WARNING -------------------------------------
// This file was programmatically generated. Do not edit unless you know what
// you're doing.
// ------------------------------- WARNING -------------------------------------
Object.defineProperty(exports, "__esModule", { value: true });
exports.RolePatch = exports.RoleList = exports.RoleBindingPatch = exports.RoleBindingList = exports.RoleBinding = exports.Role = exports.ClusterRolePatch = exports.ClusterRoleList = exports.ClusterRoleBindingPatch = exports.ClusterRoleBindingList = exports.ClusterRoleBinding = exports.ClusterRole = void 0;
const policy_1 = require("@pulumi/policy");
const compliance_policy_manager_1 = require("@pulumi/compliance-policy-manager");
const v1alpha1_1 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_2 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_3 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_4 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_5 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_6 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_7 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_8 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_9 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_10 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_11 = require("@pulumi/kubernetes/rbac/v1alpha1");
const v1alpha1_12 = require("@pulumi/kubernetes/rbac/v1alpha1");
var ClusterRole;
(function (ClusterRole) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRole).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ClusterRole.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-clusterrole-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRole).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_1.ClusterRole, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ClusterRole shouldn't use an unstable API (rbac.v1alpha1.ClusterRole).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(ClusterRole || (ClusterRole = {}));
exports.ClusterRole = ClusterRole;
var ClusterRoleBinding;
(function (ClusterRoleBinding) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleBinding).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ClusterRoleBinding.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-clusterrolebinding-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleBinding).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_2.ClusterRoleBinding, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ClusterRoleBinding shouldn't use an unstable API (rbac.v1alpha1.ClusterRoleBinding).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(ClusterRoleBinding || (ClusterRoleBinding = {}));
exports.ClusterRoleBinding = ClusterRoleBinding;
var ClusterRoleBindingList;
(function (ClusterRoleBindingList) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleBindingList).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ClusterRoleBindingList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-clusterrolebindinglist-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleBindingList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_3.ClusterRoleBindingList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ClusterRoleBindingList shouldn't use an unstable API (rbac.v1alpha1.ClusterRoleBindingList).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(ClusterRoleBindingList || (ClusterRoleBindingList = {}));
exports.ClusterRoleBindingList = ClusterRoleBindingList;
var ClusterRoleBindingPatch;
(function (ClusterRoleBindingPatch) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleBindingPatch).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ClusterRoleBindingPatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-clusterrolebindingpatch-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleBindingPatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_4.ClusterRoleBindingPatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ClusterRoleBindingPatch shouldn't use an unstable API (rbac.v1alpha1.ClusterRoleBindingPatch).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(ClusterRoleBindingPatch || (ClusterRoleBindingPatch = {}));
exports.ClusterRoleBindingPatch = ClusterRoleBindingPatch;
var ClusterRoleList;
(function (ClusterRoleList) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleList).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ClusterRoleList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-clusterrolelist-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRoleList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_5.ClusterRoleList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ClusterRoleList shouldn't use an unstable API (rbac.v1alpha1.ClusterRoleList).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(ClusterRoleList || (ClusterRoleList = {}));
exports.ClusterRoleList = ClusterRoleList;
var ClusterRolePatch;
(function (ClusterRolePatch) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRolePatch).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
ClusterRolePatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-clusterrolepatch-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.ClusterRolePatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_6.ClusterRolePatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes ClusterRolePatch shouldn't use an unstable API (rbac.v1alpha1.ClusterRolePatch).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(ClusterRolePatch || (ClusterRolePatch = {}));
exports.ClusterRolePatch = ClusterRolePatch;
var Role;
(function (Role) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.Role).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
Role.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-role-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.Role).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_7.Role, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes Role shouldn't use an unstable API (rbac.v1alpha1.Role).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(Role || (Role = {}));
exports.Role = Role;
var RoleBinding;
(function (RoleBinding) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleBinding).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
RoleBinding.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-rolebinding-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleBinding).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_8.RoleBinding, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes RoleBinding shouldn't use an unstable API (rbac.v1alpha1.RoleBinding).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(RoleBinding || (RoleBinding = {}));
exports.RoleBinding = RoleBinding;
var RoleBindingList;
(function (RoleBindingList) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleBindingList).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
RoleBindingList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-rolebindinglist-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleBindingList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_9.RoleBindingList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes RoleBindingList shouldn't use an unstable API (rbac.v1alpha1.RoleBindingList).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(RoleBindingList || (RoleBindingList = {}));
exports.RoleBindingList = RoleBindingList;
var RoleBindingPatch;
(function (RoleBindingPatch) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleBindingPatch).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
RoleBindingPatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-rolebindingpatch-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleBindingPatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_10.RoleBindingPatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes RoleBindingPatch shouldn't use an unstable API (rbac.v1alpha1.RoleBindingPatch).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(RoleBindingPatch || (RoleBindingPatch = {}));
exports.RoleBindingPatch = RoleBindingPatch;
var RoleList;
(function (RoleList) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleList).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
RoleList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-rolelist-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RoleList).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_11.RoleList, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes RoleList shouldn't use an unstable API (rbac.v1alpha1.RoleList).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(RoleList || (RoleList = {}));
exports.RoleList = RoleList;
var RolePatch;
(function (RolePatch) {
/**
* Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RolePatch).
*
* @severity medium
* @frameworks none
* @topics alpha, api, unstable
* @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning
*/
RolePatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({
resourceValidationPolicy: {
name: "kubernetes-rbac-v1alpha1-rolepatch-disallow-alpha-resource",
description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (rbac.v1alpha1.RolePatch).",
configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema,
enforcementLevel: "advisory",
validateResource: (0, policy_1.validateResourceOfType)(v1alpha1_12.RolePatch, (_, args, reportViolation) => {
if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) {
return;
}
reportViolation("Kubernetes RolePatch shouldn't use an unstable API (rbac.v1alpha1.RolePatch).");
}),
},
vendors: ["kubernetes"],
services: ["rbac"],
severity: "medium",
topics: ["api", "unstable", "alpha"],
});
})(RolePatch || (RolePatch = {}));
exports.RolePatch = RolePatch;