improve K8s examples plus some cleanup
MODIFY
policy-packs/README.md
policy-packs/README.md
# Example Policy Packs
-Status: Beta release.
+---
+**NOTE**
+
+These examples are part of Pulumi's Policy as Code offering. It is currently being previewed and is subject to breaking changes.
+
+---
For more on Policy as Code, visit the [Pulumi-Policy repo](https://github.com/pulumi/pulumi-policy).

MODIFY
policy-packs/kubernetes/index.ts
policy-packs/kubernetes/index.ts
// limitations under the License.
import * as k8s from "@pulumi/kubernetes";
-import { PolicyPack, validateTypedResource } from "@pulumi/policy";
+import { EnforcementLevel, PolicyPack, ResourceValidationPolicy, validateTypedResource } from "@pulumi/policy";
const policies = new PolicyPack("kubernetes", {
policies: [
- {
+ noPublicServices("mandatory"),
+ minimumReplicaCount("mandatory"),
+ podsAreProhibited("advisory"),
+ ],
+});
+
+function noPublicServices(enforcementLevel: EnforcementLevel): ResourceValidationPolicy {
+ return {
name: "no-public-services",
description: "Kubernetes Services should be cluster-private",
- enforcementLevel: "mandatory",
- validateResource: validateTypedResource(k8s.core.v1.Service, (svc, args, reportViolation) => {
+ enforcementLevel: enforcementLevel,
+ validateResource: validateTypedResource(k8s.core.v1.Service, (svc, _, reportViolation) => {
if (svc.spec && svc.spec.type === "LoadBalancer") {
reportViolation(`Kubernetes Services that have .type === "LoadBalancer" are exposed to ` +
`anything that can reach the Kubernetes cluster, likely including the ` +
@@ -29,6 +36,41 @@ const policies = new PolicyPack("kubernetes", {
`unauthorized access.`);
}
}),
- },
+ };
+}
+
+function minimumReplicaCount(enforcementLevel: EnforcementLevel): ResourceValidationPolicy {
+ return {
+ name: "minimum-replica-count",
+ description: "Checks that Kubernetes Deployments and ReplicaSets have at least three replicas.",
+ enforcementLevel: enforcementLevel,
+ validateResource: [
+ validateTypedResource(k8s.apps.v1.Deployment, (deployment, _, reportViolation) => {
+ if (deployment.spec === undefined
+ || deployment.spec.replicas === undefined
+ || deployment.spec.replicas < 3) {
+ reportViolation("Kubernetes Deployments should have at least three replicas.");
+ }
+ }),
+ validateTypedResource(k8s.apps.v1.ReplicaSet, (replicaSet, _, reportViolation) => {
+ if (replicaSet.spec === undefined
+ || replicaSet.spec.replicas === undefined
+ || replicaSet.spec.replicas < 3) {
+ reportViolation("Kubernetes ReplicaSet should have at least three replicas.");
+ }
+ }),
],
-});
+ };
+}
+
+function podsAreProhibited(enforcementLevel: EnforcementLevel): ResourceValidationPolicy {
+ return {
+ name: "pods-are-prohibited",
+ description: "Checks that Kubernetes Pods are not being used directly.",
+ enforcementLevel: enforcementLevel,
+ validateResource: validateTypedResource(k8s.core.v1.Pod, (_, __, reportViolation) => {
+ reportViolation("Kubernetes Pods should not be used directly. " +
+ "Instead, you may want to use a Deployment, ReplicaSet or Job.");
+ }),
+ };
+}

DELETE
policy-packs/policy-pack-typescript/PulumiPolicy.yaml
-name: policy-pack-typescript
-description: A minimal Policy Pack using TypeScript.
-runtime: nodejs

DELETE
policy-packs/policy-pack-typescript/index.ts
-// Copyright 2016-2019, Pulumi Corporation.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import * as aws from "@pulumi/aws";
-import { PolicyPack, validateTypedResource } from "@pulumi/policy";
-
-new PolicyPack("policy-pack-typescript", {
- policies: [{
- name: "s3-no-public-read",
- description: "Prohibits setting the publicRead or publicReadWrite permission on AWS S3 buckets.",
- enforcementLevel: "mandatory",
- validateResource: validateTypedResource(aws.s3.Bucket, (bucket, args, reportViolation) => {
- if (bucket.acl === "public-read" || bucket.acl === "public-read-write") {
- reportViolation(
- "You cannot set public-read or public-read-write on an S3 bucket. " +
- "Read more about ACLs here: https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html");
- }
- }),
- }],
-});

DELETE
policy-packs/policy-pack-typescript/package.json
-{
- "name": "policy-pack-typescript",
- "version": "0.0.1",
- "dependencies": {
- "@pulumi/aws": "^1.0.0",
- "@pulumi/policy": "^0.2.0",
- "@pulumi/pulumi": "^1.0.0"
- },
- "devDependencies": {
- "@types/node": "^8.0.0"
- }
-}

DELETE
policy-packs/policy-pack-typescript/tsconfig.json
-{
- "compilerOptions": {
- "outDir": "bin",
- "target": "es6",
- "module": "commonjs",
- "moduleResolution": "node",
- "declaration": true,
- "sourceMap": false,
- "stripInternal": true,
- "experimentalDecorators": true,
- "pretty": true,
- "noFallthroughCasesInSwitch": true,
- "noImplicitAny": true,
- "noImplicitReturns": true,
- "forceConsistentCasingInFileNames": true,
- "strictNullChecks": true,
- },
- "files": [
- "index.ts"
- ]
-}
\ No newline at end of file

improve K8s examples plus some cleanup (#485)