Skip to content

Commit 09666ae

Browse files
pilorAzure Policy Bot
pilor
and
Azure Policy Bot
authored
Built-in Policy Release da9c6b7a (Azure#1238)
Co-authored-by: Azure Policy Bot <azgovpolicy@microsoft.com>
1 parent 61cf0ac commit 09666ae

19 files changed

+963
-29
lines changed

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/BlockAdminRolebindings.json‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
"properties": {
3+
"displayName": "Kubernetes clusters should ensure that the cluster-admin role is only used where required",
4+
"policyType": "BuiltIn",
5+
"mode": "Microsoft.Kubernetes.Data",
6+
"description": "The role 'cluster-admin' provides wide-ranging powers over the environment and should be used only where and when needed.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Kubernetes"
10+
},
11+
"version": "1.0.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Disabled' turns off the policy.",
18+
"portalReview": true
19+
},
20+
"allowedValues": [
21+
"Audit",
22+
"Disabled"
23+
],
24+
"defaultValue": "Audit"
25+
},
26+
"excludedNamespaces": {
27+
"type": "Array",
28+
"metadata": {
29+
"displayName": "Namespace exclusions",
30+
"description": "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces \"kube-system\", \"gatekeeper-system\" and \"azure-arc\" are always excluded by design. \"azure-extensions-usage-system\" is optional to remove."
31+
},
32+
"defaultValue": [
33+
"kube-system",
34+
"gatekeeper-system",
35+
"azure-arc",
36+
"azure-extensions-usage-system"
37+
]
38+
},
39+
"namespaces": {
40+
"type": "Array",
41+
"metadata": {
42+
"displayName": "Namespace inclusions",
43+
"description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
44+
},
45+
"defaultValue": []
46+
},
47+
"labelSelector": {
48+
"type": "object",
49+
"metadata": {
50+
"displayName": "Kubernetes label selector",
51+
"description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
52+
},
53+
"defaultValue": {},
54+
"schema": {
55+
"description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
56+
"type": "object",
57+
"properties": {
58+
"matchLabels": {
59+
"description": "matchLabels is a map of {key,value} pairs.",
60+
"type": "object",
61+
"additionalProperties": {
62+
"type": "string"
63+
},
64+
"minProperties": 1
65+
},
66+
"matchExpressions": {
67+
"description": "matchExpressions is a list of values, a key, and an operator.",
68+
"type": "array",
69+
"items": {
70+
"type": "object",
71+
"properties": {
72+
"key": {
73+
"description": "key is the label key that the selector applies to.",
74+
"type": "string"
75+
},
76+
"operator": {
77+
"description": "operator represents a key's relationship to a set of values.",
78+
"type": "string",
79+
"enum": [
80+
"In",
81+
"NotIn",
82+
"Exists",
83+
"DoesNotExist"
84+
]
85+
},
86+
"values": {
87+
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
88+
"type": "array",
89+
"items": {
90+
"type": "string"
91+
}
92+
}
93+
},
94+
"required": [
95+
"key",
96+
"operator"
97+
],
98+
"additionalProperties": false
99+
},
100+
"minItems": 1
101+
}
102+
},
103+
"additionalProperties": false
104+
}
105+
}
106+
},
107+
"policyRule": {
108+
"if": {
109+
"field": "type",
110+
"equals": "Microsoft.ContainerService/managedClusters"
111+
},
112+
"then": {
113+
"effect": "[parameters('effect')]",
114+
"details": {
115+
"templateInfo": {
116+
"sourceType": "PublicURL",
117+
"url": "https://store.policy.azure.us/kubernetes/block-admin-rolebindings/v1/template.yaml"
118+
},
119+
"apiGroups": [
120+
"rbac.authorization.k8s.io"
121+
],
122+
"kinds": [
123+
"ClusterRoleBinding",
124+
"RoleBinding"
125+
],
126+
"excludedNamespaces": "[parameters('excludedNamespaces')]",
127+
"namespaces": "[parameters('namespaces')]",
128+
"labelSelector": "[parameters('labelSelector')]"
129+
}
130+
}
131+
}
132+
},
133+
"id": "/providers/Microsoft.Authorization/policyDefinitions/a3dc4946-dba6-43e6-950d-f96532848c9f",
134+
"name": "a3dc4946-dba6-43e6-950d-f96532848c9f"
135+
}

‎built-in-policies/policyDefinitions/Azure Government/Monitoring/AzureMonitor_DCRA_VMSS_Windows_Deploy.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Deploy Association to link Windows virtual machine scale sets to the specified Data Collection Rule or the specified Data Collection Endpoint. The list of locations and OS images are updated over time as support is increased.",
77
"metadata": {
8-
"version": "2.2.0",
8+
"version": "2.3.0",
99
"category": "Monitoring"
1010
},
11-
"version": "2.2.0",
11+
"version": "2.3.0",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -120,7 +120,8 @@
120120
"2022-datacenter-core-smalldisk-g2",
121121
"2022-datacenter-g2",
122122
"2022-datacenter-smalldisk",
123-
"2022-datacenter-smalldisk-g2"
123+
"2022-datacenter-smalldisk-g2",
124+
"2022-datacenter-gensecond"
124125
]
125126
}
126127
]

‎built-in-policies/policyDefinitions/Azure Government/Monitoring/AzureMonitor_DCRA_VM_Windows_Deploy.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Deploy Association to link Windows virtual machines to the specified Data Collection Rule or the specified Data Collection Endpoint. The list of locations and OS images are updated over time as support is increased.",
77
"metadata": {
8-
"version": "2.2.0",
8+
"version": "2.3.0",
99
"category": "Monitoring"
1010
},
11-
"version": "2.2.0",
11+
"version": "2.3.0",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -120,7 +120,8 @@
120120
"2022-datacenter-core-smalldisk-g2",
121121
"2022-datacenter-g2",
122122
"2022-datacenter-smalldisk",
123-
"2022-datacenter-smalldisk-g2"
123+
"2022-datacenter-smalldisk-g2",
124+
"2022-datacenter-gensecond"
124125
]
125126
}
126127
]

‎built-in-policies/policyDefinitions/Kubernetes/AKS_Autoupgrade_Cluster_Audit.json‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"properties": {
3+
"policyType": "BuiltIn",
4+
"displayName": "Azure Kubernetes Service Clusters should enable cluster auto-upgrade",
5+
"description": "AKS cluster auto-upgrade can ensure your clusters are up to date and don't miss the latest features or patches from AKS and upstream Kubernetes. Learn more at: https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-cluster.",
6+
"metadata": {
7+
"version": "1.0.0",
8+
"category": "Kubernetes"
9+
},
10+
"version": "1.0.0",
11+
"mode": "Indexed",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"defaultValue": "Audit",
16+
"allowedValues": [
17+
"Audit",
18+
"Disabled"
19+
],
20+
"metadata": {
21+
"displayName": "Effect",
22+
"description": "Enable or disable the execution of the policy."
23+
}
24+
},
25+
"allowedClusterAutoUpgradeChannels": {
26+
"type": "Array",
27+
"metadata": {
28+
"displayName": "Allowed Cluster Auto-upgrade Channels",
29+
"description": "Cluster auto-upgrade channels viewed as complaint. Lean more at https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-cluster#use-cluster-auto-upgrade",
30+
"portalReview": true
31+
},
32+
"allowedValues": [
33+
"rapid",
34+
"stable",
35+
"patch",
36+
"node-image",
37+
"none"
38+
],
39+
"defaultValue": [
40+
"rapid",
41+
"stable",
42+
"patch"
43+
]
44+
}
45+
},
46+
"policyRule": {
47+
"if": {
48+
"allOf": [
49+
{
50+
"field": "type",
51+
"equals": "Microsoft.ContainerService/managedClusters"
52+
},
53+
{
54+
"anyOf": [
55+
{
56+
"field": "Microsoft.ContainerService/managedClusters/autoUpgradeProfile.upgradeChannel",
57+
"exists": false
58+
},
59+
{
60+
"field": "Microsoft.ContainerService/managedClusters/autoUpgradeProfile.upgradeChannel",
61+
"notin": "[parameters('allowedClusterAutoUpgradeChannels')]"
62+
}
63+
]
64+
}
65+
]
66+
},
67+
"then": {
68+
"effect": "[parameters('effect')]"
69+
}
70+
}
71+
},
72+
"id": "/providers/Microsoft.Authorization/policyDefinitions/5c345cdf-2049-47e0-b8fe-b0e96bc2df35",
73+
"name": "5c345cdf-2049-47e0-b8fe-b0e96bc2df35"
74+
}

‎built-in-policies/policyDefinitions/Kubernetes/BlockAdminRolebindings.json‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
"properties": {
3+
"displayName": "Kubernetes clusters should ensure that the cluster-admin role is only used where required",
4+
"policyType": "BuiltIn",
5+
"mode": "Microsoft.Kubernetes.Data",
6+
"description": "The role 'cluster-admin' provides wide-ranging powers over the environment and should be used only where and when needed.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Kubernetes"
10+
},
11+
"version": "1.0.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Disabled' turns off the policy.",
18+
"portalReview": true
19+
},
20+
"allowedValues": [
21+
"Audit",
22+
"Disabled"
23+
],
24+
"defaultValue": "Audit"
25+
},
26+
"excludedNamespaces": {
27+
"type": "Array",
28+
"metadata": {
29+
"displayName": "Namespace exclusions",
30+
"description": "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces \"kube-system\", \"gatekeeper-system\" and \"azure-arc\" are always excluded by design. \"azure-extensions-usage-system\" is optional to remove."
31+
},
32+
"defaultValue": [
33+
"kube-system",
34+
"gatekeeper-system",
35+
"azure-arc",
36+
"azure-extensions-usage-system"
37+
]
38+
},
39+
"namespaces": {
40+
"type": "Array",
41+
"metadata": {
42+
"displayName": "Namespace inclusions",
43+
"description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
44+
},
45+
"defaultValue": []
46+
},
47+
"labelSelector": {
48+
"type": "object",
49+
"metadata": {
50+
"displayName": "Kubernetes label selector",
51+
"description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
52+
},
53+
"defaultValue": {},
54+
"schema": {
55+
"description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
56+
"type": "object",
57+
"properties": {
58+
"matchLabels": {
59+
"description": "matchLabels is a map of {key,value} pairs.",
60+
"type": "object",
61+
"additionalProperties": {
62+
"type": "string"
63+
},
64+
"minProperties": 1
65+
},
66+
"matchExpressions": {
67+
"description": "matchExpressions is a list of values, a key, and an operator.",
68+
"type": "array",
69+
"items": {
70+
"type": "object",
71+
"properties": {
72+
"key": {
73+
"description": "key is the label key that the selector applies to.",
74+
"type": "string"
75+
},
76+
"operator": {
77+
"description": "operator represents a key's relationship to a set of values.",
78+
"type": "string",
79+
"enum": [
80+
"In",
81+
"NotIn",
82+
"Exists",
83+
"DoesNotExist"
84+
]
85+
},
86+
"values": {
87+
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
88+
"type": "array",
89+
"items": {
90+
"type": "string"
91+
}
92+
}
93+
},
94+
"required": [
95+
"key",
96+
"operator"
97+
],
98+
"additionalProperties": false
99+
},
100+
"minItems": 1
101+
}
102+
},
103+
"additionalProperties": false
104+
}
105+
}
106+
},
107+
"policyRule": {
108+
"if": {
109+
"field": "type",
110+
"equals": "Microsoft.ContainerService/managedClusters"
111+
},
112+
"then": {
113+
"effect": "[parameters('effect')]",
114+
"details": {
115+
"templateInfo": {
116+
"sourceType": "PublicURL",
117+
"url": "https://store.policy.core.windows.net/kubernetes/block-admin-rolebindings/v1/template.yaml"
118+
},
119+
"apiGroups": [
120+
"rbac.authorization.k8s.io"
121+
],
122+
"kinds": [
123+
"ClusterRoleBinding",
124+
"RoleBinding"
125+
],
126+
"excludedNamespaces": "[parameters('excludedNamespaces')]",
127+
"namespaces": "[parameters('namespaces')]",
128+
"labelSelector": "[parameters('labelSelector')]"
129+
}
130+
}
131+
}
132+
},
133+
"id": "/providers/Microsoft.Authorization/policyDefinitions/a3dc4946-dba6-43e6-950d-f96532848c9f",
134+
"name": "a3dc4946-dba6-43e6-950d-f96532848c9f"
135+
}

0 commit comments

Comments
 (0)