apiVersion: v1
policies:
  - name: CHECKING_DEPRECATED_API_VERSIONS
    isDefault: true
    rules:
      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
      #   messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
      # - identifier: CONTAINERS_MISSING_MEMORY_REQUEST_KEY
      #   messageOnFailure: Missing property object `requests.memory` - value should be within the accepted boundaries recommended by the organization
      # - identifier: CONTAINERS_MISSING_CPU_REQUEST_KEY
      #   messageOnFailure: Missing property object `requests.cpu` - value should be within the accepted boundaries recommended by the organization
      # - identifier: CONTAINERS_MISSING_MEMORY_LIMIT_KEY
      #   messageOnFailure: Missing property object `limits.memory` - value should be within the accepted boundaries recommended by the organization
      # - identifier: CONTAINERS_MISSING_CPU_LIMIT_KEY
      #   messageOnFailure: Missing property object `limits.cpu` - value should be within the accepted boundaries recommended by the organization
      # - identifier: INGRESS_INCORRECT_HOST_VALUE_PERMISSIVE
      #   messageOnFailure: Incorrect value for key `host` - specify host instead of using a wildcard character ("*")
      # - identifier: SERVICE_INCORRECT_TYPE_VALUE_NODEPORT
      #   messageOnFailure: Incorrect value for key `type` - `NodePort` will open a port on all nodes where it can be reached by the network external to the cluster
      # - identifier: CRONJOB_INVALID_SCHEDULE_VALUE
      #   messageOnFailure: 'Incorrect value for key `schedule` - the (cron) schedule expressions is not valid and, therefore, will not work as expected'
      # - identifier: WORKLOAD_INVALID_LABELS_VALUE
      #   messageOnFailure: Incorrect value for key(s) under `labels` - the vales syntax is not valid so the Kubernetes engine will not accept it
      # - identifier: WORKLOAD_INCORRECT_RESTARTPOLICY_VALUE_ALWAYS
      #   messageOnFailure: Incorrect value for key `restartPolicy` - any other value than `Always` is not supported by this resource
      # - identifier: CONTAINERS_MISSING_LIVENESSPROBE_KEY
      #   messageOnFailure: Missing property object `livenessProbe` - add a properly configured livenessProbe to catch possible deadlocks
      # - identifier: CONTAINERS_MISSING_READINESSPROBE_KEY
      #   messageOnFailure: Missing property object `readinessProbe` - add a properly configured readinessProbe to notify kubelet your Pods are ready for traffic
      # - identifier: HPA_MISSING_MINREPLICAS_KEY
      #   messageOnFailure: Missing property object `minReplicas` - the value should be within the accepted boundaries recommended by the organization
      # - identifier: HPA_MISSING_MAXREPLICAS_KEY
      #   messageOnFailure: Missing property object `maxReplicas` - the value should be within the accepted boundaries recommended by the organization
      # - identifier: WORKLOAD_INCORRECT_NAMESPACE_VALUE_DEFAULT
      #   messageOnFailure: Incorrect value for key `namespace` - use an explicit namespace instead of the default one (`default`)
      # - identifier: DEPLOYMENT_INCORRECT_REPLICAS_VALUE
      #   messageOnFailure: Incorrect value for key `replicas` - running 2 or more replicas will increase the availability of the service
      # - identifier: CRONJOB_MISSING_STARTINGDEADLINESECOND_KEY
      #   messageOnFailure: Missing property object `startingDeadlineSeconds` - set a time limit to the cron execution to allow killing it if exceeded
      - identifier: K8S_DEPRECATED_APIVERSION_1.16
        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.16)
      - identifier: K8S_DEPRECATED_APIVERSION_1.17
        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.17)
      - identifier: K8S_DEPRECATED_APIVERSIONS_1_22
        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.22)
      - identifier: K8S_DEPRECATED_APIVERSIONS_1_25
        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use are expected to be deprecated in Kubernetes cluster version (>=1.25)
      - identifier: K8S_DEPRECATED_APIVERSIONS_1_26
        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use are expected to be deprecated in Kubernetes cluster version (>=1.26)
      # - identifier: CONTAINERS_INCORRECT_PRIVILEGED_VALUE_TRUE
      #   messageOnFailure: Incorrect value for key `privileged` - this mode will allow the container the same access as processes running on the host
      # - identifier: WORKLOAD_MISSING_LABEL_OWNER_VALUE
      #   messageOnFailure: Missing label object `owner` - add a proper owner label to know which person/team to ping when needed
      # - identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
      #   messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST
      #   messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
      # - identifier: CRONJOB_MISSING_CONCURRENCYPOLICY_KEY
      #   messageOnFailure: Missing property object `concurrencyPolicy` - the behavior will be more deterministic if jobs won't run concurrently
      # - identifier: K8S_INCORRECT_KIND_VALUE_POD
      #   messageOnFailure: Incorrect value for key `kind` - raw pod won't be rescheduled in the event of a node failure
      # - identifier: CONTAINERS_INCORRECT_HOSTPID_VALUE_TRUE
      #   messageOnFailure: Incorrect value for key `hostPID` - running on the host’s PID namespace enables access to sensitive information from processes running outside the container
      # - identifier: CONTAINERS_INCORRECT_HOSTIPC_VALUE_TRUE
      #   messageOnFailure: Incorrect value for key `hostIPC` - running on the host’s IPC namespace can be (maliciously) used to interact with other processes running outside the container
      # - identifier: CONTAINERS_INCORRECT_HOSTNETWORK_VALUE_TRUE
      #   messageOnFailure: Incorrect value for key `hostNetwork` - running on the host’s network namespace can allow a compromised container to sniff network traffic
      # - identifier: CONTAINERS_INCORRECT_RUNASUSER_VALUE_LOWUID
      #   messageOnFailure: Incorrect value for key `runAsUser` - value should be above 9999 to reduce the likelihood that the UID is already taken
      # - identifier: CONTAINERS_INCORRECT_PATH_VALUE_DOCKERSOCKET
      #   messageOnFailure: Incorrect value for key `path` - avoid mounting the docker.socket becasue it can allow container breakout

customRules:
  - identifier: K8S_DEPRECATED_APIVERSIONS_1_22
    name: Prevent Deprecated APIs in kubernetes v1.22
    defaultMessageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.22)
    schema:
      if:
        properties:
          kind:
            enum:
              - MutatingWebhookConfiguration
              - ValidatingWebhookConfiguration
              - CustomResourceDefinition
              - APIService
              - TokenReview
              - LocalSubjectAccessReview
              - SelfSubjectAccessReview
              - SubjectAccessReview
              - CertificateSigningRequest
              - Lease
              - Ingress
              - IngressClass
              - ClusterRole
              - ClusterRoleBinding
              - Role
              - RoleBinding
              - PriorityClass
              - CSIDriver
              - CSINode
              - StorageClass
              - VolumeAttachment
        required:
          - kind
      then:
        properties:
          apiVersion:
            not:
              enum:
                - admissionregistration.k8s.io/v1beta1
                - apiextensions.k8s.io/v1beta1
                - apiregistration.k8s.io/v1beta1
                - authentication.k8s.io/v1beta1
                - authorization.k8s.io/v1beta1
                - certificates.k8s.io/v1beta1
                - coordination.k8s.io/v1beta1
                - extensions/v1beta1
                - networking.k8s.io/v1beta1
                - rbac.authorization.k8s.io/v1beta1
                - scheduling.k8s.io/v1beta1
                - storage.k8s.io/v1beta1
        required:
          - apiVersion
  # For future use (Kubernates v1.25 is expected to deprecate the following APIs)
  - identifier: K8S_DEPRECATED_APIVERSIONS_1_25
    name: "[Warning -> Not yet deprecated] Prevent Deprecated APIs in kubernetes v1.25"
    defaultMessageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use are expected to be deprecated in Kubernetes cluster version (>=1.25)
    schema:
      if:
        properties:
          kind:
            enum:
              - CronJob
              - EndpointSlice
              - Event
              - HorizontalPodAutoscaler
              - PodDisruptionBudget
              - PodSecurityPolicy
              - RuntimeClass
        required:
          - kind
      then:
        properties:
          apiVersion:
            not:
              enum:
                - batch/v1beta1
                - discovery.k8s.io/v1beta1
                - events.k8s.io/v1beta1
                - autoscaling/v2beta1
                - policy/v1beta1
                - node.k8s.io/v1beta1
        required:
          - apiVersion

  # For future use (Kubernates v1.26 is expected to deprecate the following APIs)
  - identifier: K8S_DEPRECATED_APIVERSIONS_1_26
    name: "[Warning -> Not yet deprecated] Prevent Deprecated APIs in kubernetes v1.26"
    defaultMessageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use are expected to be deprecated in Kubernetes cluster version (>=1.26)
    schema:
      if:
        properties:
          kind:
            enum:
              - HorizontalPodAutoscaler
        required:
          - kind
      then:
        properties:
          apiVersion:
            not:
              enum:
                - autoscaling/v2beta2
        required:
          - apiVersion
