feat: enforce minimum replicas for compute.googleapis.com/Autoscaler

policies/templates/gcp_compute_autoscaler_replicas.yaml

@@ -0,0 +1,90 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# TODO: Update definition
+
+apiVersion: templates.gatekeeper.sh/v1alpha1
+kind: ConstraintTemplate
+metadata:
+  name: gcp-compute-autoscaler-replicas-v1
+spec:
+  crd:
+    spec:
+      names:
+        kind: GCPComputeAutoscalerReplicasConstraintV1
+      validation:
+        openAPIV3Schema:
+          properties:
+            exemptions:
+              type: array
+              items:
+                type: string
+              description: "Array of compute assets to exempt from the defined autoscaler replicas constraint.
+                String values in the array should correspond to the full name values
+                of exempted devices."
+  targets:
+    validation.gcp.forsetisecurity.org:
+      rego: |
+        #
+        # Copyright 2021 Google LLC
+        #
+        # Licensed under the Apache License, Version 2.0 (the "License");
+        # you may not use this file except in compliance with the License.
+        # You may obtain a copy of the License at
+        #
+        #     https://www.apache.org/licenses/LICENSE-2.0
+        #
+        # Unless required by applicable law or agreed to in writing, software
+        # distributed under the License is distributed on an "AS IS" BASIS,
+        # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+        # See the License for the specific language governing permissions and
+        # limitations under the License.
+        #
+
+        package templates.gcp.GCPComputeAutoscalerReplicasConstraintV1
+
+        import data.validator.gcp.lib as lib
+
+        ####################################################
+        # Find Compute Autoscaler Minimum Replicas Violation
+        ####################################################
+
+        deny[{
+          # A deny rule will raise a violation if the block below evaluates to true
+        	"msg": message,
+        	"details": metadata,
+        }] {
+          # Rego logic: This block evaluates to true if all lines evaluate to true
+        	constraint := input.constraint
+        	lib.get_constraint_params(constraint, params)
+
+        	# Verify that resource is an Autoscaler
+        	asset := input.asset
+        	{asset.asset_type} == {asset.asset_type} & {"compute.googleapis.com/Autoscaler"}
+
+        	# Check if resource is in exempt list
+        	exempt_list := params.exemptions
+        	matches := {asset.name} & cast_set(exempt_list)
+        	count(matches) == 0
+
+          # Check that autoscaling policy has the minimum replicas
+          minimum_replicas := lib.get_default(params, "minimum_replicas", "0")
+          resource_minimum_replicas := asset.resource.data.autoscalingPolicy.minNumReplicas
+          minimum_replicas_meets_policy := {resource_minimum_replicas >= minimum_replicas}
+
+        	message := sprintf("%v does not meet the minimum replicas.", [asset.name])
+        	metadata := {"minimum_replicas": resource_minimum_replicas}
+        }
+        #ENDINLINE