pkg/safeguards/lib/manifests/v2.0.0/container-resource-limits/template.yaml [1:59]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sazurev3containerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sAzureV3ContainerLimits
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          properties:
            cpuLimit:
              type: string
            memoryLimit:
              type: string
            excludedContainers:
              type: array
              items:
                type: string
            excludedImages:
              description: >-
                Any container that uses an image that matches an entry in this list will be excluded
                from enforcement. Prefix-matching can be signified with `*`. For example: `my-image-*`.
                It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name)
                in order to avoid unexpectedly excluding images from an untrusted repository.
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sazurev3containerlimits

        import data.lib.exclude_container_image.is_excluded

        missing(obj, field) = true {
          not obj[field]
        }

        missing(obj, field) = true {
          obj[field] == ""
        }

        canonify_cpu(orig) = new {
          is_number(orig)
          new := orig * 1000
        }

        canonify_cpu(orig) = new {
          not is_number(orig)
          endswith(orig, "m")
          new := to_number(replace(orig, "m", ""))
        }

        canonify_cpu(orig) = new {
          not is_number(orig)
          not endswith(orig, "m")
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



pkg/safeguards/lib/v1.0.0/container-resource-limits/template.yaml [1:59]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sazurev3containerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sAzureV3ContainerLimits
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          properties:
            cpuLimit:
              type: string
            memoryLimit:
              type: string
            excludedContainers:
              type: array
              items:
                type: string
            excludedImages:
              description: >-
                Any container that uses an image that matches an entry in this list will be excluded
                from enforcement. Prefix-matching can be signified with `*`. For example: `my-image-*`.
                It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name)
                in order to avoid unexpectedly excluding images from an untrusted repository.
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sazurev3containerlimits

        import data.lib.exclude_container_image.is_excluded

        missing(obj, field) = true {
          not obj[field]
        }

        missing(obj, field) = true {
          obj[field] == ""
        }

        canonify_cpu(orig) = new {
          is_number(orig)
          new := orig * 1000
        }

        canonify_cpu(orig) = new {
          not is_number(orig)
          endswith(orig, "m")
          new := to_number(replace(orig, "m", ""))
        }

        canonify_cpu(orig) = new {
          not is_number(orig)
          not endswith(orig, "m")
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



