UNPKG

@pulumi/kubernetes-compliance-policies

Version:

This repository contains a growing set of Compliance Policies to validate your infrastructure using Pulumi's Crossguard Policy-as-Code framework.

489 lines (488 loc) 25.8 kB
"use strict"; // Copyright 2016-2024, Pulumi Corporation. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // // ------------------------------- WARNING ------------------------------------- // This file was programmatically generated. Do not edit unless you know what // you're doing. // ------------------------------- WARNING ------------------------------------- Object.defineProperty(exports, "__esModule", { value: true }); exports.ResourceSlicePatch = exports.ResourceSliceList = exports.ResourceSlice = exports.ResourceClaimTemplatePatch = exports.ResourceClaimTemplateList = exports.ResourceClaimTemplate = exports.ResourceClaimPatch = exports.ResourceClaimList = exports.ResourceClaim = exports.PodSchedulingContextPatch = exports.PodSchedulingContextList = exports.PodSchedulingContext = exports.DeviceClassPatch = exports.DeviceClassList = exports.DeviceClass = void 0; const policy_1 = require("@pulumi/policy"); const compliance_policy_manager_1 = require("@pulumi/compliance-policy-manager"); const v1alpha3_1 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_2 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_3 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_4 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_5 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_6 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_7 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_8 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_9 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_10 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_11 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_12 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_13 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_14 = require("@pulumi/kubernetes/resource/v1alpha3"); const v1alpha3_15 = require("@pulumi/kubernetes/resource/v1alpha3"); var DeviceClass; (function (DeviceClass) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.DeviceClass). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ DeviceClass.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-deviceclass-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.DeviceClass).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_1.DeviceClass, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes DeviceClass shouldn't use an unstable API (resource.v1alpha3.DeviceClass)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(DeviceClass || (DeviceClass = {})); exports.DeviceClass = DeviceClass; var DeviceClassList; (function (DeviceClassList) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.DeviceClassList). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ DeviceClassList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-deviceclasslist-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.DeviceClassList).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_2.DeviceClassList, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes DeviceClassList shouldn't use an unstable API (resource.v1alpha3.DeviceClassList)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(DeviceClassList || (DeviceClassList = {})); exports.DeviceClassList = DeviceClassList; var DeviceClassPatch; (function (DeviceClassPatch) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.DeviceClassPatch). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ DeviceClassPatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-deviceclasspatch-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.DeviceClassPatch).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_3.DeviceClassPatch, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes DeviceClassPatch shouldn't use an unstable API (resource.v1alpha3.DeviceClassPatch)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(DeviceClassPatch || (DeviceClassPatch = {})); exports.DeviceClassPatch = DeviceClassPatch; var PodSchedulingContext; (function (PodSchedulingContext) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.PodSchedulingContext). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ PodSchedulingContext.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-podschedulingcontext-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.PodSchedulingContext).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_4.PodSchedulingContext, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes PodSchedulingContext shouldn't use an unstable API (resource.v1alpha3.PodSchedulingContext)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(PodSchedulingContext || (PodSchedulingContext = {})); exports.PodSchedulingContext = PodSchedulingContext; var PodSchedulingContextList; (function (PodSchedulingContextList) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.PodSchedulingContextList). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ PodSchedulingContextList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-podschedulingcontextlist-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.PodSchedulingContextList).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_5.PodSchedulingContextList, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes PodSchedulingContextList shouldn't use an unstable API (resource.v1alpha3.PodSchedulingContextList)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(PodSchedulingContextList || (PodSchedulingContextList = {})); exports.PodSchedulingContextList = PodSchedulingContextList; var PodSchedulingContextPatch; (function (PodSchedulingContextPatch) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.PodSchedulingContextPatch). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ PodSchedulingContextPatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-podschedulingcontextpatch-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.PodSchedulingContextPatch).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_6.PodSchedulingContextPatch, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes PodSchedulingContextPatch shouldn't use an unstable API (resource.v1alpha3.PodSchedulingContextPatch)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(PodSchedulingContextPatch || (PodSchedulingContextPatch = {})); exports.PodSchedulingContextPatch = PodSchedulingContextPatch; var ResourceClaim; (function (ResourceClaim) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaim). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceClaim.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceclaim-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaim).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_7.ResourceClaim, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceClaim shouldn't use an unstable API (resource.v1alpha3.ResourceClaim)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceClaim || (ResourceClaim = {})); exports.ResourceClaim = ResourceClaim; var ResourceClaimList; (function (ResourceClaimList) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimList). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceClaimList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceclaimlist-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimList).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_8.ResourceClaimList, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceClaimList shouldn't use an unstable API (resource.v1alpha3.ResourceClaimList)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceClaimList || (ResourceClaimList = {})); exports.ResourceClaimList = ResourceClaimList; var ResourceClaimPatch; (function (ResourceClaimPatch) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimPatch). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceClaimPatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceclaimpatch-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimPatch).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_9.ResourceClaimPatch, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceClaimPatch shouldn't use an unstable API (resource.v1alpha3.ResourceClaimPatch)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceClaimPatch || (ResourceClaimPatch = {})); exports.ResourceClaimPatch = ResourceClaimPatch; var ResourceClaimTemplate; (function (ResourceClaimTemplate) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimTemplate). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceClaimTemplate.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceclaimtemplate-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimTemplate).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_10.ResourceClaimTemplate, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceClaimTemplate shouldn't use an unstable API (resource.v1alpha3.ResourceClaimTemplate)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceClaimTemplate || (ResourceClaimTemplate = {})); exports.ResourceClaimTemplate = ResourceClaimTemplate; var ResourceClaimTemplateList; (function (ResourceClaimTemplateList) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimTemplateList). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceClaimTemplateList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceclaimtemplatelist-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimTemplateList).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_11.ResourceClaimTemplateList, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceClaimTemplateList shouldn't use an unstable API (resource.v1alpha3.ResourceClaimTemplateList)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceClaimTemplateList || (ResourceClaimTemplateList = {})); exports.ResourceClaimTemplateList = ResourceClaimTemplateList; var ResourceClaimTemplatePatch; (function (ResourceClaimTemplatePatch) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimTemplatePatch). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceClaimTemplatePatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceclaimtemplatepatch-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceClaimTemplatePatch).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_12.ResourceClaimTemplatePatch, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceClaimTemplatePatch shouldn't use an unstable API (resource.v1alpha3.ResourceClaimTemplatePatch)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceClaimTemplatePatch || (ResourceClaimTemplatePatch = {})); exports.ResourceClaimTemplatePatch = ResourceClaimTemplatePatch; var ResourceSlice; (function (ResourceSlice) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceSlice). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceSlice.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceslice-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceSlice).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_13.ResourceSlice, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceSlice shouldn't use an unstable API (resource.v1alpha3.ResourceSlice)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceSlice || (ResourceSlice = {})); exports.ResourceSlice = ResourceSlice; var ResourceSliceList; (function (ResourceSliceList) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceSliceList). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceSliceList.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceslicelist-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceSliceList).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_14.ResourceSliceList, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceSliceList shouldn't use an unstable API (resource.v1alpha3.ResourceSliceList)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceSliceList || (ResourceSliceList = {})); exports.ResourceSliceList = ResourceSliceList; var ResourceSlicePatch; (function (ResourceSlicePatch) { /** * Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceSlicePatch). * * @severity medium * @frameworks none * @topics alpha, api, unstable * @link https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning */ ResourceSlicePatch.disallowAlphaResource = compliance_policy_manager_1.policyManager.registerPolicy({ resourceValidationPolicy: { name: "kubernetes-resource-v1alpha3-resourceslicepatch-disallow-alpha-resource", description: "Disallow the use of non-stable (Alpha) Kubernetes resouces (resource.v1alpha3.ResourceSlicePatch).", configSchema: compliance_policy_manager_1.policyManager.policyConfigSchema, enforcementLevel: "advisory", validateResource: (0, policy_1.validateResourceOfType)(v1alpha3_15.ResourceSlicePatch, (_, args, reportViolation) => { if (!compliance_policy_manager_1.policyManager.shouldEvalPolicy(args)) { return; } reportViolation("Kubernetes ResourceSlicePatch shouldn't use an unstable API (resource.v1alpha3.ResourceSlicePatch)."); }), }, vendors: ["kubernetes"], services: ["resource"], severity: "medium", topics: ["api", "unstable", "alpha"], }); })(ResourceSlicePatch || (ResourceSlicePatch = {})); exports.ResourceSlicePatch = ResourceSlicePatch;