diff --git a/examples/ControllerAffinityNode/policy.yaml b/examples/ControllerAffinityNode/policy.yaml index d7ee503a..2e0c75cc 100644 --- a/examples/ControllerAffinityNode/policy.yaml +++ b/examples/ControllerAffinityNode/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.affinity-node-simple diff --git a/examples/ControllerAffinityNodeSelector/policy.yaml b/examples/ControllerAffinityNodeSelector/policy.yaml index 87756a02..6110f286 100644 --- a/examples/ControllerAffinityNodeSelector/policy.yaml +++ b/examples/ControllerAffinityNodeSelector/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.affinity-node-selector diff --git a/examples/ControllerAffinityPods/policy.yaml b/examples/ControllerAffinityPods/policy.yaml index 95d82135..76e1122d 100644 --- a/examples/ControllerAffinityPods/policy.yaml +++ b/examples/ControllerAffinityPods/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.affinity-pod-simple diff --git a/examples/ControllerAntiAffinityPods/policy.yaml b/examples/ControllerAntiAffinityPods/policy.yaml index 3759e61b..092f89f8 100644 --- a/examples/ControllerAntiAffinityPods/policy.yaml +++ b/examples/ControllerAntiAffinityPods/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.antiaffinity-pod-simple diff --git a/examples/ControllerContainerEnforceEnvVar/policy.yaml b/examples/ControllerContainerEnforceEnvVar/policy.yaml index 223e1a21..1a430a49 100644 --- a/examples/ControllerContainerEnforceEnvVar/policy.yaml +++ b/examples/ControllerContainerEnforceEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-enforce-environment-variable diff --git a/examples/ControllerContainerProhibitEnvVar/policy.yaml b/examples/ControllerContainerProhibitEnvVar/policy.yaml index 1f00899e..3a94a16f 100644 --- a/examples/ControllerContainerProhibitEnvVar/policy.yaml +++ b/examples/ControllerContainerProhibitEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-prohibit-environment-variable diff --git a/examples/ControllerImageApprovedRegistry/policy.yaml b/examples/ControllerImageApprovedRegistry/policy.yaml index c51b2a22..a7d8c46a 100644 --- a/examples/ControllerImageApprovedRegistry/policy.yaml +++ b/examples/ControllerImageApprovedRegistry/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.approved-registry diff --git a/examples/ControllerImageName/policy.yaml b/examples/ControllerImageName/policy.yaml index f756e30c..a9991903 100644 --- a/examples/ControllerImageName/policy.yaml +++ b/examples/ControllerImageName/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.containers-block-specific-image-names diff --git a/examples/ControllerMissingLabelValue/policy.yaml b/examples/ControllerMissingLabelValue/policy.yaml index fd40d6cf..be0236df 100644 --- a/examples/ControllerMissingLabelValue/policy.yaml +++ b/examples/ControllerMissingLabelValue/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.metadata-missing-label-and-value diff --git a/examples/ControllerMissingMatchLabelKey/policy.yaml b/examples/ControllerMissingMatchLabelKey/policy.yaml index e3d37a41..d1849b2b 100644 --- a/examples/ControllerMissingMatchLabelKey/policy.yaml +++ b/examples/ControllerMissingMatchLabelKey/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.missing-matchlabels-key diff --git a/examples/ControllerProbesCustom/policy.yaml b/examples/ControllerProbesCustom/policy.yaml index fafc3c7d..68603cf5 100644 --- a/examples/ControllerProbesCustom/policy.yaml +++ b/examples/ControllerProbesCustom/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-custom-probe diff --git a/examples/ControllerProbesNamedPort/policy.yaml b/examples/ControllerProbesNamedPort/policy.yaml index 6eb691a5..d21e82fc 100644 --- a/examples/ControllerProbesNamedPort/policy.yaml +++ b/examples/ControllerProbesNamedPort/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-named-port diff --git a/examples/ControllerResourcesMaxCPULimits/policy.yaml b/examples/ControllerResourcesMaxCPULimits/policy.yaml index e92c56eb..06a4cd3d 100644 --- a/examples/ControllerResourcesMaxCPULimits/policy.yaml +++ b/examples/ControllerResourcesMaxCPULimits/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-maximum-cpu-limits diff --git a/examples/ControllerResourcesMaxCPURequests/policy.yaml b/examples/ControllerResourcesMaxCPURequests/policy.yaml index 42a24882..b28aa46d 100644 --- a/examples/ControllerResourcesMaxCPURequests/policy.yaml +++ b/examples/ControllerResourcesMaxCPURequests/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-maximum-cpu-requests diff --git a/examples/ControllerResourcesMaxMemoryLimits/policy.yaml b/examples/ControllerResourcesMaxMemoryLimits/policy.yaml index 3b704893..41674ee7 100644 --- a/examples/ControllerResourcesMaxMemoryLimits/policy.yaml +++ b/examples/ControllerResourcesMaxMemoryLimits/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-maximum-memory-limits diff --git a/examples/ControllerResourcesMaxMemoryRequests/policy.yaml b/examples/ControllerResourcesMaxMemoryRequests/policy.yaml index 05a37dc6..16bc7735 100644 --- a/examples/ControllerResourcesMaxMemoryRequests/policy.yaml +++ b/examples/ControllerResourcesMaxMemoryRequests/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-maximum-memory-requests diff --git a/examples/ControllerResourcesMinCPULimits/policy.yaml b/examples/ControllerResourcesMinCPULimits/policy.yaml index d5189952..a9225654 100644 --- a/examples/ControllerResourcesMinCPULimits/policy.yaml +++ b/examples/ControllerResourcesMinCPULimits/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-minimum-cpu-limits diff --git a/examples/ControllerResourcesMinCPURequests/policy.yaml b/examples/ControllerResourcesMinCPURequests/policy.yaml index a276de50..896c3431 100644 --- a/examples/ControllerResourcesMinCPURequests/policy.yaml +++ b/examples/ControllerResourcesMinCPURequests/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-minimum-cpu-requests diff --git a/examples/ControllerResourcesMinMemoryLimits/policy.yaml b/examples/ControllerResourcesMinMemoryLimits/policy.yaml index 93f83968..650e8802 100644 --- a/examples/ControllerResourcesMinMemoryLimits/policy.yaml +++ b/examples/ControllerResourcesMinMemoryLimits/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-minimum-memory-limits diff --git a/examples/ControllerResourcesMinMemoryRequests/policy.yaml b/examples/ControllerResourcesMinMemoryRequests/policy.yaml index 210d7a58..9dfe94e7 100644 --- a/examples/ControllerResourcesMinMemoryRequests/policy.yaml +++ b/examples/ControllerResourcesMinMemoryRequests/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.container-minimum-memory-requests diff --git a/examples/ControllerSpecGeneric/policy.yaml b/examples/ControllerSpecGeneric/policy.yaml index ff31be14..c32ebc09 100644 --- a/examples/ControllerSpecGeneric/policy.yaml +++ b/examples/ControllerSpecGeneric/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.containers-are-missing-a-controller-spec-key diff --git a/examples/ControllerSpecTemplateLabels/policy.yaml b/examples/ControllerSpecTemplateLabels/policy.yaml index 756bd49c..0ea834ab 100644 --- a/examples/ControllerSpecTemplateLabels/policy.yaml +++ b/examples/ControllerSpecTemplateLabels/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.containers-are-missing-a-spec-template-label diff --git a/examples/IngressClass/policy.yaml b/examples/IngressClass/policy.yaml index fd16ece4..6e56e9e7 100644 --- a/examples/IngressClass/policy.yaml +++ b/examples/IngressClass/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.enforce-specific-ingress-class diff --git a/examples/IngressHostname/policy.yaml b/examples/IngressHostname/policy.yaml index de7d970e..82821631 100644 --- a/examples/IngressHostname/policy.yaml +++ b/examples/IngressHostname/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.ingress-approved-hostnames diff --git a/examples/IstioGatewayHosts/policy.yaml b/examples/IstioGatewayHosts/policy.yaml index 04907edb..b274c526 100644 --- a/examples/IstioGatewayHosts/policy.yaml +++ b/examples/IstioGatewayHosts/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.istio-gateway-approved-hosts diff --git a/examples/IstioNamespaceLabelInjection/policy.yaml b/examples/IstioNamespaceLabelInjection/policy.yaml index f9703489..ecd5b9b7 100644 --- a/examples/IstioNamespaceLabelInjection/policy.yaml +++ b/examples/IstioNamespaceLabelInjection/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.istio-injected-namespaces diff --git a/examples/KubernetesKubeletVersion/policy.yaml b/examples/KubernetesKubeletVersion/policy.yaml index 2cb2c290..474d0b86 100644 --- a/examples/KubernetesKubeletVersion/policy.yaml +++ b/examples/KubernetesKubeletVersion/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.kubernetes-minimum-kubelet-version diff --git a/examples/KubernetesProhibitKind/policy.yaml b/examples/KubernetesProhibitKind/policy.yaml index f0aebf1b..00cdf2a5 100644 --- a/examples/KubernetesProhibitKind/policy.yaml +++ b/examples/KubernetesProhibitKind/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.prohibit-specific-kind-from-being-scheduled diff --git a/examples/NamespaceLimitRangeMinMax/policy.yaml b/examples/NamespaceLimitRangeMinMax/policy.yaml index ff2e2d75..71186907 100644 --- a/examples/NamespaceLimitRangeMinMax/policy.yaml +++ b/examples/NamespaceLimitRangeMinMax/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.namespace-resources-limitrange diff --git a/examples/NamespacePodQuota/policy.yaml b/examples/NamespacePodQuota/policy.yaml index 5106d636..183bd0b2 100644 --- a/examples/NamespacePodQuota/policy.yaml +++ b/examples/NamespacePodQuota/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.namespace-pod-quota diff --git a/examples/NamespaceResourceQuotas/policy.yaml b/examples/NamespaceResourceQuotas/policy.yaml index 16df6a05..87340949 100644 --- a/examples/NamespaceResourceQuotas/policy.yaml +++ b/examples/NamespaceResourceQuotas/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.resource-quota-setting-is-missing diff --git a/examples/NetworkPolicyAllowEgressAllFromNamespace/policy.yaml b/examples/NetworkPolicyAllowEgressAllFromNamespace/policy.yaml index 98778251..b8a5060d 100644 --- a/examples/NetworkPolicyAllowEgressAllFromNamespace/policy.yaml +++ b/examples/NetworkPolicyAllowEgressAllFromNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-all-egress-traffic-from-namespace diff --git a/examples/NetworkPolicyAllowEgressAllFromNamespaceToCIDR/policy.yaml b/examples/NetworkPolicyAllowEgressAllFromNamespaceToCIDR/policy.yaml index afaf17b6..97da77b1 100644 --- a/examples/NetworkPolicyAllowEgressAllFromNamespaceToCIDR/policy.yaml +++ b/examples/NetworkPolicyAllowEgressAllFromNamespaceToCIDR/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-all-egress-traffic-from-namespace-to-cidr-block diff --git a/examples/NetworkPolicyAllowEgressDNSFromNamespace/policy.yaml b/examples/NetworkPolicyAllowEgressDNSFromNamespace/policy.yaml index 3420551e..9f458ed0 100644 --- a/examples/NetworkPolicyAllowEgressDNSFromNamespace/policy.yaml +++ b/examples/NetworkPolicyAllowEgressDNSFromNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-egress-dns-to-coredns diff --git a/examples/NetworkPolicyAllowEgressFromNamespaceToNamespace/policy.yaml b/examples/NetworkPolicyAllowEgressFromNamespaceToNamespace/policy.yaml index 315f2b3a..d0ff123f 100644 --- a/examples/NetworkPolicyAllowEgressFromNamespaceToNamespace/policy.yaml +++ b/examples/NetworkPolicyAllowEgressFromNamespaceToNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-egress-traffic-from-namespace-to-another diff --git a/examples/NetworkPolicyAllowIngressAllToNamespace/policy.yaml b/examples/NetworkPolicyAllowIngressAllToNamespace/policy.yaml index 1ba94a8b..446ae03a 100644 --- a/examples/NetworkPolicyAllowIngressAllToNamespace/policy.yaml +++ b/examples/NetworkPolicyAllowIngressAllToNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-all-ingress-traffic-to-namespace diff --git a/examples/NetworkPolicyAllowIngressAllToNamespaceFromCIDR/policy.yaml b/examples/NetworkPolicyAllowIngressAllToNamespaceFromCIDR/policy.yaml index 57463997..d920f32c 100644 --- a/examples/NetworkPolicyAllowIngressAllToNamespaceFromCIDR/policy.yaml +++ b/examples/NetworkPolicyAllowIngressAllToNamespaceFromCIDR/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-all-ingress-traffic-to-namespace-from-cidr-block diff --git a/examples/NetworkPolicyAllowIngressFromNamespaceToNamespace/policy.yaml b/examples/NetworkPolicyAllowIngressFromNamespaceToNamespace/policy.yaml index 55fdcbf5..4c9240fc 100644 --- a/examples/NetworkPolicyAllowIngressFromNamespaceToNamespace/policy.yaml +++ b/examples/NetworkPolicyAllowIngressFromNamespaceToNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-allow-ingress-traffic-from-namespace-to-another diff --git a/examples/NetworkPolicyBlockEgressAllFromNamespace/policy.yaml b/examples/NetworkPolicyBlockEgressAllFromNamespace/policy.yaml index d90edb68..cd097158 100644 --- a/examples/NetworkPolicyBlockEgressAllFromNamespace/policy.yaml +++ b/examples/NetworkPolicyBlockEgressAllFromNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-block-all-egress-traffic-from-namespace diff --git a/examples/NetworkPolicyBlockEgressAllFromNamespaceToCIDR/policy.yaml b/examples/NetworkPolicyBlockEgressAllFromNamespaceToCIDR/policy.yaml index 6fa55d25..959ac251 100644 --- a/examples/NetworkPolicyBlockEgressAllFromNamespaceToCIDR/policy.yaml +++ b/examples/NetworkPolicyBlockEgressAllFromNamespaceToCIDR/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-block-all-egress-traffic-for-namespace-to-cidr-block diff --git a/examples/NetworkPolicyBlockIngressAllToNamespace/policy.yaml b/examples/NetworkPolicyBlockIngressAllToNamespace/policy.yaml index 74e6c06d..b9a2b78f 100644 --- a/examples/NetworkPolicyBlockIngressAllToNamespace/policy.yaml +++ b/examples/NetworkPolicyBlockIngressAllToNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-block-all-ingress-traffic-to-namespace diff --git a/examples/NetworkPolicyBlockIngressAllToNamespaceFromCIDR/policy.yaml b/examples/NetworkPolicyBlockIngressAllToNamespaceFromCIDR/policy.yaml index 67f10253..08646d9c 100644 --- a/examples/NetworkPolicyBlockIngressAllToNamespaceFromCIDR/policy.yaml +++ b/examples/NetworkPolicyBlockIngressAllToNamespaceFromCIDR/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.network-block-all-ingress-traffic-to-namespace-from-cidr-block diff --git a/examples/NodeCustomLabel/policy.yaml b/examples/NodeCustomLabel/policy.yaml index 780110c7..f7fd96b3 100644 --- a/examples/NodeCustomLabel/policy.yaml +++ b/examples/NodeCustomLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.node-custom-label diff --git a/examples/NodeKernelVersion/policy.yaml b/examples/NodeKernelVersion/policy.yaml index 4b68043e..2684b955 100644 --- a/examples/NodeKernelVersion/policy.yaml +++ b/examples/NodeKernelVersion/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.node-kernel-versions diff --git a/examples/NodeMissingLabel/policy.yaml b/examples/NodeMissingLabel/policy.yaml index ace183ca..d811feef 100644 --- a/examples/NodeMissingLabel/policy.yaml +++ b/examples/NodeMissingLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.node-missing-label diff --git a/examples/NodeOSVersion/policy.yaml b/examples/NodeOSVersion/policy.yaml index de66a5cc..9cdc8d1e 100644 --- a/examples/NodeOSVersion/policy.yaml +++ b/examples/NodeOSVersion/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.node-os-version diff --git a/examples/PersistentVolumeAccessModes/policy.yaml b/examples/PersistentVolumeAccessModes/policy.yaml index dd9dc0d6..5125c5f2 100644 --- a/examples/PersistentVolumeAccessModes/policy.yaml +++ b/examples/PersistentVolumeAccessModes/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.persistent-volume-access-modes diff --git a/examples/PersistentVolumeClaimMaxSize/policy.yaml b/examples/PersistentVolumeClaimMaxSize/policy.yaml index 35007586..464db3a3 100644 --- a/examples/PersistentVolumeClaimMaxSize/policy.yaml +++ b/examples/PersistentVolumeClaimMaxSize/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.persistent-volume-claim-max-size diff --git a/examples/PersistentVolumeClaimSnapshot/policy.yaml b/examples/PersistentVolumeClaimSnapshot/policy.yaml index 7c48abeb..4e1679d9 100644 --- a/examples/PersistentVolumeClaimSnapshot/policy.yaml +++ b/examples/PersistentVolumeClaimSnapshot/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.persistent-volume-claim-snapshot diff --git a/examples/PersistentVolumeMaxSize/policy.yaml b/examples/PersistentVolumeMaxSize/policy.yaml index 10a4c21b..4411ee66 100644 --- a/examples/PersistentVolumeMaxSize/policy.yaml +++ b/examples/PersistentVolumeMaxSize/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.persistent-volume-max-size diff --git a/examples/PrometheusAnnotationKey/policy.yaml b/examples/PrometheusAnnotationKey/policy.yaml index ae5cd369..a20d47ce 100644 --- a/examples/PrometheusAnnotationKey/policy.yaml +++ b/examples/PrometheusAnnotationKey/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.enforce-prometheus-annotation-key diff --git a/examples/PrometheusAnnotationValue/policy.yaml b/examples/PrometheusAnnotationValue/policy.yaml index 90c47430..f88758a9 100644 --- a/examples/PrometheusAnnotationValue/policy.yaml +++ b/examples/PrometheusAnnotationValue/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.enforce-prometheus-annotation-value diff --git a/examples/PrometheusServiceAnnontationKey/policy.yaml b/examples/PrometheusServiceAnnontationKey/policy.yaml index baffb064..60a05a03 100644 --- a/examples/PrometheusServiceAnnontationKey/policy.yaml +++ b/examples/PrometheusServiceAnnontationKey/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.enforce-prometheus-service-annotation-key diff --git a/examples/RBACProhibitEditingConfigMaps/policy.yaml b/examples/RBACProhibitEditingConfigMaps/policy.yaml index 94584dd6..44eff0ab 100644 --- a/examples/RBACProhibitEditingConfigMaps/policy.yaml +++ b/examples/RBACProhibitEditingConfigMaps/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.rbac-prohibit-updating-configmaps diff --git a/examples/RBACProhibitVerbsOnResources/policy.yaml b/examples/RBACProhibitVerbsOnResources/policy.yaml index b812a924..58b557de 100644 --- a/examples/RBACProhibitVerbsOnResources/policy.yaml +++ b/examples/RBACProhibitVerbsOnResources/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.rbac-prohibit-verbs-on-resources diff --git a/examples/RBACProhibitWildcards/policy.yaml b/examples/RBACProhibitWildcards/policy.yaml index f6fe2b9e..9f618aee 100644 --- a/examples/RBACProhibitWildcards/policy.yaml +++ b/examples/RBACProhibitWildcards/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.templates.rbac-prohibit-resources-wildcards diff --git a/policies/ControllerContainerAllowingPrivilegeEscalation/policy.yaml b/policies/ControllerContainerAllowingPrivilegeEscalation/policy.yaml index 3bf7b4bc..fdec7f7a 100644 --- a/policies/ControllerContainerAllowingPrivilegeEscalation/policy.yaml +++ b/policies/ControllerContainerAllowingPrivilegeEscalation/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-running-with-privilege-escalation diff --git a/policies/ControllerContainerBlockHostPath/policy.yaml b/policies/ControllerContainerBlockHostPath/policy.yaml index ee7ee270..46ff6817 100644 --- a/policies/ControllerContainerBlockHostPath/policy.yaml +++ b/policies/ControllerContainerBlockHostPath/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-using-hostpath diff --git a/policies/ControllerContainerBlockPortsRange/policy.yaml b/policies/ControllerContainerBlockPortsRange/policy.yaml index e92247b5..3f2dccda 100644 --- a/policies/ControllerContainerBlockPortsRange/policy.yaml +++ b/policies/ControllerContainerBlockPortsRange/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-block-ports-range diff --git a/policies/ControllerContainerBlockSSHPort/policy.yaml b/policies/ControllerContainerBlockSSHPort/policy.yaml index 55375667..0ca28bd3 100644 --- a/policies/ControllerContainerBlockSSHPort/policy.yaml +++ b/policies/ControllerContainerBlockSSHPort/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-block-ssh-port diff --git a/policies/ControllerContainerBlockSysctls/policy.yaml b/policies/ControllerContainerBlockSysctls/policy.yaml index fc1bb5d1..c0e7e374 100644 --- a/policies/ControllerContainerBlockSysctls/policy.yaml +++ b/policies/ControllerContainerBlockSysctls/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.container-block-sysctl diff --git a/policies/ControllerContainerBlockSysctls_CVE-2022-0811/policy.yaml b/policies/ControllerContainerBlockSysctls_CVE-2022-0811/policy.yaml index c2fef506..1cc76c7e 100644 --- a/policies/ControllerContainerBlockSysctls_CVE-2022-0811/policy.yaml +++ b/policies/ControllerContainerBlockSysctls_CVE-2022-0811/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.container-block-sysctl.cve-2022-0811 diff --git a/policies/ControllerContainerLinuxCapabilities/policy.yaml b/policies/ControllerContainerLinuxCapabilities/policy.yaml index 31e380cd..f3ad5746 100644 --- a/policies/ControllerContainerLinuxCapabilities/policy.yaml +++ b/policies/ControllerContainerLinuxCapabilities/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-running-with-unapproved-linux-capabilities diff --git a/policies/ControllerContainerRunningAsRoot/policy.yaml b/policies/ControllerContainerRunningAsRoot/policy.yaml index 76f3105e..a786eb4e 100644 --- a/policies/ControllerContainerRunningAsRoot/policy.yaml +++ b/policies/ControllerContainerRunningAsRoot/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.container-running-as-root diff --git a/policies/ControllerContainerRunningAsUser/policy.yaml b/policies/ControllerContainerRunningAsUser/policy.yaml index 7cefbb6d..2290cccd 100644 --- a/policies/ControllerContainerRunningAsUser/policy.yaml +++ b/policies/ControllerContainerRunningAsUser/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.container-running-as-user diff --git a/policies/ControllerContainerRunningPrivilegedMode/policy.yaml b/policies/ControllerContainerRunningPrivilegedMode/policy.yaml index fec231a2..93ad331e 100644 --- a/policies/ControllerContainerRunningPrivilegedMode/policy.yaml +++ b/policies/ControllerContainerRunningPrivilegedMode/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-running-in-privileged-mode diff --git a/policies/ControllerContainerServiceAccountTokenAutomount/policy.yaml b/policies/ControllerContainerServiceAccountTokenAutomount/policy.yaml index f4d8fa1e..fda7a8cd 100644 --- a/policies/ControllerContainerServiceAccountTokenAutomount/policy.yaml +++ b/policies/ControllerContainerServiceAccountTokenAutomount/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.controller-serviceaccount-tokens-automount diff --git a/policies/ControllerContainerUsingHostPort/policy.yaml b/policies/ControllerContainerUsingHostPort/policy.yaml index cc9a2635..8a82248a 100644 --- a/policies/ControllerContainerUsingHostPort/policy.yaml +++ b/policies/ControllerContainerUsingHostPort/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-using-hostport diff --git a/policies/ControllerDockerSocketMount/policy.yaml b/policies/ControllerDockerSocketMount/policy.yaml index 8246edb0..7fcd6ff0 100644 --- a/policies/ControllerDockerSocketMount/policy.yaml +++ b/policies/ControllerDockerSocketMount/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-mounting-docker-socket diff --git a/policies/ControllerImagePullPolicy/policy.yaml b/policies/ControllerImagePullPolicy/policy.yaml index 490dd5e6..4314006f 100644 --- a/policies/ControllerImagePullPolicy/policy.yaml +++ b/policies/ControllerImagePullPolicy/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.container-image-pull-policy diff --git a/policies/ControllerImageTag/policy.yaml b/policies/ControllerImageTag/policy.yaml index 1b5f2e28..e80c413e 100644 --- a/policies/ControllerImageTag/policy.yaml +++ b/policies/ControllerImageTag/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.container-prohibit-image-tag diff --git a/policies/ControllerMinimumReplicaCount/policy.yaml b/policies/ControllerMinimumReplicaCount/policy.yaml index 642ae4e3..f1f172d0 100644 --- a/policies/ControllerMinimumReplicaCount/policy.yaml +++ b/policies/ControllerMinimumReplicaCount/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-minimum-replica-count diff --git a/policies/ControllerMissingKubernetesAppComponentLabel/policy.yaml b/policies/ControllerMissingKubernetesAppComponentLabel/policy.yaml index 1db8332a..9cd9bec1 100644 --- a/policies/ControllerMissingKubernetesAppComponentLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppComponentLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-component-label diff --git a/policies/ControllerMissingKubernetesAppCreatedByLabel/policy.yaml b/policies/ControllerMissingKubernetesAppCreatedByLabel/policy.yaml index c515fd19..b1dcba43 100644 --- a/policies/ControllerMissingKubernetesAppCreatedByLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppCreatedByLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-created-by-label diff --git a/policies/ControllerMissingKubernetesAppInstanceLabel/policy.yaml b/policies/ControllerMissingKubernetesAppInstanceLabel/policy.yaml index e911e249..68e3554a 100644 --- a/policies/ControllerMissingKubernetesAppInstanceLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppInstanceLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-instance-label diff --git a/policies/ControllerMissingKubernetesAppLabel/policy.yaml b/policies/ControllerMissingKubernetesAppLabel/policy.yaml index 483a9d09..93f04254 100644 --- a/policies/ControllerMissingKubernetesAppLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-label diff --git a/policies/ControllerMissingKubernetesAppManagedByLabel/policy.yaml b/policies/ControllerMissingKubernetesAppManagedByLabel/policy.yaml index 00288cb3..480be935 100644 --- a/policies/ControllerMissingKubernetesAppManagedByLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppManagedByLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-managed-by-label diff --git a/policies/ControllerMissingKubernetesAppPartOfLabel/policy.yaml b/policies/ControllerMissingKubernetesAppPartOfLabel/policy.yaml index 014880da..667091d2 100644 --- a/policies/ControllerMissingKubernetesAppPartOfLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppPartOfLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-part-of-label diff --git a/policies/ControllerMissingKubernetesAppVersionLabel/policy.yaml b/policies/ControllerMissingKubernetesAppVersionLabel/policy.yaml index b08fa050..04736f8c 100644 --- a/policies/ControllerMissingKubernetesAppVersionLabel/policy.yaml +++ b/policies/ControllerMissingKubernetesAppVersionLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-kubernetes-app-version-label diff --git a/policies/ControllerMissingLivenessProbe/policy.yaml b/policies/ControllerMissingLivenessProbe/policy.yaml index a625b078..c984b11d 100644 --- a/policies/ControllerMissingLivenessProbe/policy.yaml +++ b/policies/ControllerMissingLivenessProbe/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-missing-liveness-probe diff --git a/policies/ControllerMissingNamespace/policy.yaml b/policies/ControllerMissingNamespace/policy.yaml index b10a10e3..cc5569cd 100644 --- a/policies/ControllerMissingNamespace/policy.yaml +++ b/policies/ControllerMissingNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.block-workloads-created-without-specifying-namespace diff --git a/policies/ControllerMissingOwnerLabel/policy.yaml b/policies/ControllerMissingOwnerLabel/policy.yaml index d4bbe902..4674acb1 100644 --- a/policies/ControllerMissingOwnerLabel/policy.yaml +++ b/policies/ControllerMissingOwnerLabel/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.missing-owner-label diff --git a/policies/ControllerMissingReadinessProbe/policy.yaml b/policies/ControllerMissingReadinessProbe/policy.yaml index 3d17eb7b..0490ee62 100644 --- a/policies/ControllerMissingReadinessProbe/policy.yaml +++ b/policies/ControllerMissingReadinessProbe/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-missing-readiness-probe diff --git a/policies/ControllerMissingSecurityContext/policy.yaml b/policies/ControllerMissingSecurityContext/policy.yaml index 96678911..9613d2b5 100644 --- a/policies/ControllerMissingSecurityContext/policy.yaml +++ b/policies/ControllerMissingSecurityContext/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-missing-security-context diff --git a/policies/ControllerMissingStartupProbe/policy.yaml b/policies/ControllerMissingStartupProbe/policy.yaml index b8697829..19be05b7 100644 --- a/policies/ControllerMissingStartupProbe/policy.yaml +++ b/policies/ControllerMissingStartupProbe/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-missing-startup-probe diff --git a/policies/ControllerProhibitNamespace/policy.yaml b/policies/ControllerProhibitNamespace/policy.yaml index c85cd9d7..5a5860eb 100644 --- a/policies/ControllerProhibitNamespace/policy.yaml +++ b/policies/ControllerProhibitNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-should-not-run-in-namespace diff --git a/policies/ControllerReadOnlyFileSystem/policy.yaml b/policies/ControllerReadOnlyFileSystem/policy.yaml index 84b4c26d..e3d01cf4 100644 --- a/policies/ControllerReadOnlyFileSystem/policy.yaml +++ b/policies/ControllerReadOnlyFileSystem/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-read-only-root-filesystem diff --git a/policies/ControllerRestartPolicy/policy.yaml b/policies/ControllerRestartPolicy/policy.yaml index 9ef9db28..2e36fb30 100644 --- a/policies/ControllerRestartPolicy/policy.yaml +++ b/policies/ControllerRestartPolicy/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-enforce-restart-policy diff --git a/policies/ControllerSeccompRuntimeDefault/policy.yaml b/policies/ControllerSeccompRuntimeDefault/policy.yaml index 2d43d3ab..9cf74718 100644 --- a/policies/ControllerSeccompRuntimeDefault/policy.yaml +++ b/policies/ControllerSeccompRuntimeDefault/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-not-using-runtime-default-seccomp-profile diff --git a/policies/ControllerShareHostIPC/policy.yaml b/policies/ControllerShareHostIPC/policy.yaml index 5df8ae57..bcb4b39f 100644 --- a/policies/ControllerShareHostIPC/policy.yaml +++ b/policies/ControllerShareHostIPC/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-sharing-host-ipc diff --git a/policies/ControllerShareHostNetwork/policy.yaml b/policies/ControllerShareHostNetwork/policy.yaml index 09393577..99d72784 100644 --- a/policies/ControllerShareHostNetwork/policy.yaml +++ b/policies/ControllerShareHostNetwork/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-sharing-host-network diff --git a/policies/ControllerShareHostPID/policy.yaml b/policies/ControllerShareHostPID/policy.yaml index c9111948..f3629ed6 100644 --- a/policies/ControllerShareHostPID/policy.yaml +++ b/policies/ControllerShareHostPID/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-sharing-host-pid diff --git a/policies/ControllerShareProcessNamespace/policy.yaml b/policies/ControllerShareProcessNamespace/policy.yaml index 50f2370b..e37ff624 100644 --- a/policies/ControllerShareProcessNamespace/policy.yaml +++ b/policies/ControllerShareProcessNamespace/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-sharing-process-namespace diff --git a/policies/ControllerTolerations/policy.yaml b/policies/ControllerTolerations/policy.yaml index f4f5d7cf..5b6102f8 100644 --- a/policies/ControllerTolerations/policy.yaml +++ b/policies/ControllerTolerations/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.containers-should-not-run-on-kubernetes-control-plane-nodes diff --git a/policies/InfluxDBEnforceAdminTokenEnvVar/policy.yaml b/policies/InfluxDBEnforceAdminTokenEnvVar/policy.yaml index 825067f9..3de7c39c 100644 --- a/policies/InfluxDBEnforceAdminTokenEnvVar/policy.yaml +++ b/policies/InfluxDBEnforceAdminTokenEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.influxdb-enforce-admin-token-env-var diff --git a/policies/InfluxDBEnforceBucketEnvVar/policy.yaml b/policies/InfluxDBEnforceBucketEnvVar/policy.yaml index a518012b..c2b3033f 100644 --- a/policies/InfluxDBEnforceBucketEnvVar/policy.yaml +++ b/policies/InfluxDBEnforceBucketEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.influxdb-enforce-bucket-env-var diff --git a/policies/InfluxDBEnforceOrgEnvVar/policy.yaml b/policies/InfluxDBEnforceOrgEnvVar/policy.yaml index d9abd765..9c6c62c4 100644 --- a/policies/InfluxDBEnforceOrgEnvVar/policy.yaml +++ b/policies/InfluxDBEnforceOrgEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.influxdb-enforce-org-env-var diff --git a/policies/InfluxDBEnforcePasswordEnvVar/policy.yaml b/policies/InfluxDBEnforcePasswordEnvVar/policy.yaml index 61596f7a..5d2059ac 100644 --- a/policies/InfluxDBEnforcePasswordEnvVar/policy.yaml +++ b/policies/InfluxDBEnforcePasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.influxdb-enforce-password-env-var diff --git a/policies/InfluxDBEnforceRetentionEnvVar/policy.yaml b/policies/InfluxDBEnforceRetentionEnvVar/policy.yaml index a379a377..c0dd9df8 100644 --- a/policies/InfluxDBEnforceRetentionEnvVar/policy.yaml +++ b/policies/InfluxDBEnforceRetentionEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.influxdb-enforce-retention-env-var diff --git a/policies/InfluxDBEnforceUsernameEnvVar/policy.yaml b/policies/InfluxDBEnforceUsernameEnvVar/policy.yaml index d9d09009..90a967d3 100644 --- a/policies/InfluxDBEnforceUsernameEnvVar/policy.yaml +++ b/policies/InfluxDBEnforceUsernameEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.influxdb-enforce-username-env-var diff --git a/policies/KubernetesProhibitNakedPods/policy.yaml b/policies/KubernetesProhibitNakedPods/policy.yaml index f512e0ee..f6abd97e 100644 --- a/policies/KubernetesProhibitNakedPods/policy.yaml +++ b/policies/KubernetesProhibitNakedPods/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.prohibit-naked-pods-from-being-scheduled diff --git a/policies/MYSQLEnforceDatabaseEnvVar/policy.yaml b/policies/MYSQLEnforceDatabaseEnvVar/policy.yaml index c91360f7..5cecca76 100644 --- a/policies/MYSQLEnforceDatabaseEnvVar/policy.yaml +++ b/policies/MYSQLEnforceDatabaseEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-database-env-var diff --git a/policies/MYSQLEnforceOnetimePasswordEnvVar/policy.yaml b/policies/MYSQLEnforceOnetimePasswordEnvVar/policy.yaml index e2c6a870..e454cff0 100644 --- a/policies/MYSQLEnforceOnetimePasswordEnvVar/policy.yaml +++ b/policies/MYSQLEnforceOnetimePasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-onetime-password-env-var diff --git a/policies/MYSQLEnforcePasswordEnvVar/policy.yaml b/policies/MYSQLEnforcePasswordEnvVar/policy.yaml index dc63f6bf..d7bd2759 100644 --- a/policies/MYSQLEnforcePasswordEnvVar/policy.yaml +++ b/policies/MYSQLEnforcePasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-password-env-var diff --git a/policies/MYSQLEnforceRandomRootPasswordEnvVar/policy.yaml b/policies/MYSQLEnforceRandomRootPasswordEnvVar/policy.yaml index ec33c78c..64c9ce11 100644 --- a/policies/MYSQLEnforceRandomRootPasswordEnvVar/policy.yaml +++ b/policies/MYSQLEnforceRandomRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-random-root-password-env-var diff --git a/policies/MYSQLEnforceRootPasswordEnvVar/policy.yaml b/policies/MYSQLEnforceRootPasswordEnvVar/policy.yaml index 468d93c5..6a2a1a55 100644 --- a/policies/MYSQLEnforceRootPasswordEnvVar/policy.yaml +++ b/policies/MYSQLEnforceRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-root-password-env-var diff --git a/policies/MYSQLEnforceSkipTzinfoEnvVar/policy.yaml b/policies/MYSQLEnforceSkipTzinfoEnvVar/policy.yaml index a27ed409..f70d7c45 100644 --- a/policies/MYSQLEnforceSkipTzinfoEnvVar/policy.yaml +++ b/policies/MYSQLEnforceSkipTzinfoEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-skip-tzinfo-env-var diff --git a/policies/MYSQLEnforceUserEnvVar/policy.yaml b/policies/MYSQLEnforceUserEnvVar/policy.yaml index 9ca06102..7d353c85 100644 --- a/policies/MYSQLEnforceUserEnvVar/policy.yaml +++ b/policies/MYSQLEnforceUserEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-enforce-user-env-var diff --git a/policies/MYSQLProhibitEmptyPasswordEnvVar/policy.yaml b/policies/MYSQLProhibitEmptyPasswordEnvVar/policy.yaml index dee72518..b93de86f 100644 --- a/policies/MYSQLProhibitEmptyPasswordEnvVar/policy.yaml +++ b/policies/MYSQLProhibitEmptyPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mysql-prohibit-empty-password-env-var diff --git a/policies/MariaDBEnforceDatabaseEnvVar/policy.yaml b/policies/MariaDBEnforceDatabaseEnvVar/policy.yaml index ceac324c..2f44da3c 100644 --- a/policies/MariaDBEnforceDatabaseEnvVar/policy.yaml +++ b/policies/MariaDBEnforceDatabaseEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-database-env-var diff --git a/policies/MariaDBEnforceMysqlDatabaseEnvVar/policy.yaml b/policies/MariaDBEnforceMysqlDatabaseEnvVar/policy.yaml index d13a878d..0e9543eb 100644 --- a/policies/MariaDBEnforceMysqlDatabaseEnvVar/policy.yaml +++ b/policies/MariaDBEnforceMysqlDatabaseEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-mysql-database-env-var diff --git a/policies/MariaDBEnforceMysqlPasswordEnvVar/policy.yaml b/policies/MariaDBEnforceMysqlPasswordEnvVar/policy.yaml index 815078b8..706f3d1a 100644 --- a/policies/MariaDBEnforceMysqlPasswordEnvVar/policy.yaml +++ b/policies/MariaDBEnforceMysqlPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-mysql-password-env-var diff --git a/policies/MariaDBEnforceMysqlRandomRootPasswordEnvVar/policy.yaml b/policies/MariaDBEnforceMysqlRandomRootPasswordEnvVar/policy.yaml index 5e80b2a2..e47dd7c6 100644 --- a/policies/MariaDBEnforceMysqlRandomRootPasswordEnvVar/policy.yaml +++ b/policies/MariaDBEnforceMysqlRandomRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-mysql-random-root-password-env-var diff --git a/policies/MariaDBEnforceMysqlRootPasswordEnvVar/policy.yaml b/policies/MariaDBEnforceMysqlRootPasswordEnvVar/policy.yaml index 184cedd8..6db4d842 100644 --- a/policies/MariaDBEnforceMysqlRootPasswordEnvVar/policy.yaml +++ b/policies/MariaDBEnforceMysqlRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-mysql-root-password-env-var diff --git a/policies/MariaDBEnforceMysqlSkipTzinfoEnvVar/policy.yaml b/policies/MariaDBEnforceMysqlSkipTzinfoEnvVar/policy.yaml index fb8194cd..64f7804a 100644 --- a/policies/MariaDBEnforceMysqlSkipTzinfoEnvVar/policy.yaml +++ b/policies/MariaDBEnforceMysqlSkipTzinfoEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-mysql-initdb-skip-tzinfo-env-var diff --git a/policies/MariaDBEnforceMysqlUserEnvVar/policy.yaml b/policies/MariaDBEnforceMysqlUserEnvVar/policy.yaml index 83083361..1811a24d 100644 --- a/policies/MariaDBEnforceMysqlUserEnvVar/policy.yaml +++ b/policies/MariaDBEnforceMysqlUserEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-mysql-user-env-var diff --git a/policies/MariaDBEnforcePasswordEnvVar/policy.yaml b/policies/MariaDBEnforcePasswordEnvVar/policy.yaml index 8a536c2b..05178f9f 100644 --- a/policies/MariaDBEnforcePasswordEnvVar/policy.yaml +++ b/policies/MariaDBEnforcePasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-password-env-var diff --git a/policies/MariaDBEnforceRandomRootPasswordEnvVar/policy.yaml b/policies/MariaDBEnforceRandomRootPasswordEnvVar/policy.yaml index 55a7812b..6ca9ae38 100644 --- a/policies/MariaDBEnforceRandomRootPasswordEnvVar/policy.yaml +++ b/policies/MariaDBEnforceRandomRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-random-root-password-env-var diff --git a/policies/MariaDBEnforceRootPasswordEnvVar/policy.yaml b/policies/MariaDBEnforceRootPasswordEnvVar/policy.yaml index 4b74c45f..c35ddc9b 100644 --- a/policies/MariaDBEnforceRootPasswordEnvVar/policy.yaml +++ b/policies/MariaDBEnforceRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-root-password-env-var diff --git a/policies/MariaDBEnforceSkipTzinfoEnvVar/policy.yaml b/policies/MariaDBEnforceSkipTzinfoEnvVar/policy.yaml index 92f0b512..c1d242d0 100644 --- a/policies/MariaDBEnforceSkipTzinfoEnvVar/policy.yaml +++ b/policies/MariaDBEnforceSkipTzinfoEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-initdb-skip-tzinfo-env-var diff --git a/policies/MariaDBEnforceUserEnvVar/policy.yaml b/policies/MariaDBEnforceUserEnvVar/policy.yaml index 1eb6b450..a5490b38 100644 --- a/policies/MariaDBEnforceUserEnvVar/policy.yaml +++ b/policies/MariaDBEnforceUserEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-enforce-user-env-var diff --git a/policies/MariaDBProhibitEmptyPasswordEnvVar/policy.yaml b/policies/MariaDBProhibitEmptyPasswordEnvVar/policy.yaml index d32704dc..c0f2e291 100644 --- a/policies/MariaDBProhibitEmptyPasswordEnvVar/policy.yaml +++ b/policies/MariaDBProhibitEmptyPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-prohibit-empty-password-env-var diff --git a/policies/MariaDBProhibitMysqlEmptyPasswordEnvVar/policy.yaml b/policies/MariaDBProhibitMysqlEmptyPasswordEnvVar/policy.yaml index 4ad211ce..0f27461a 100644 --- a/policies/MariaDBProhibitMysqlEmptyPasswordEnvVar/policy.yaml +++ b/policies/MariaDBProhibitMysqlEmptyPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mariadb-prohibit-mysql-empty-password-env-var diff --git a/policies/MongoDBEnforceDatabaseEnvVar/policy.yaml b/policies/MongoDBEnforceDatabaseEnvVar/policy.yaml index 216cf561..00852817 100644 --- a/policies/MongoDBEnforceDatabaseEnvVar/policy.yaml +++ b/policies/MongoDBEnforceDatabaseEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongodb-enforce-database-env-var diff --git a/policies/MongoDBEnforceRootPasswordEnvVar/policy.yaml b/policies/MongoDBEnforceRootPasswordEnvVar/policy.yaml index 5bb87e47..d77eed95 100644 --- a/policies/MongoDBEnforceRootPasswordEnvVar/policy.yaml +++ b/policies/MongoDBEnforceRootPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongodb-enforce-root-password-env-var diff --git a/policies/MongoDBEnforceRootPasswordFileEnvVar/policy.yaml b/policies/MongoDBEnforceRootPasswordFileEnvVar/policy.yaml index 38aa0efc..9faee67d 100644 --- a/policies/MongoDBEnforceRootPasswordFileEnvVar/policy.yaml +++ b/policies/MongoDBEnforceRootPasswordFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongodb-enforce-root-password-file-env-var diff --git a/policies/MongoDBEnforceRootUsernameEnvVar/policy.yaml b/policies/MongoDBEnforceRootUsernameEnvVar/policy.yaml index fec7ad3c..5478675b 100644 --- a/policies/MongoDBEnforceRootUsernameEnvVar/policy.yaml +++ b/policies/MongoDBEnforceRootUsernameEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongodb-enforce-root-username-env-var diff --git a/policies/MongoDBEnforceRootUsernameFileEnvVar/policy.yaml b/policies/MongoDBEnforceRootUsernameFileEnvVar/policy.yaml index 1748d4d9..35a5c9ad 100644 --- a/policies/MongoDBEnforceRootUsernameFileEnvVar/policy.yaml +++ b/policies/MongoDBEnforceRootUsernameFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongodb-enforce-root-username-file-env-var diff --git a/policies/MongoExpressEnforceAdminPasswordEnvVar/policy.yaml b/policies/MongoExpressEnforceAdminPasswordEnvVar/policy.yaml index 8546cfd8..d707e363 100644 --- a/policies/MongoExpressEnforceAdminPasswordEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceAdminPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-admin-password-env-var diff --git a/policies/MongoExpressEnforceAdminUsernameEnvVar/policy.yaml b/policies/MongoExpressEnforceAdminUsernameEnvVar/policy.yaml index c557129f..ceed2536 100644 --- a/policies/MongoExpressEnforceAdminUsernameEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceAdminUsernameEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-admin-username-env-var diff --git a/policies/MongoExpressEnforceAuthPasswordEnvVar/policy.yaml b/policies/MongoExpressEnforceAuthPasswordEnvVar/policy.yaml index 44a88a18..eeb04c04 100644 --- a/policies/MongoExpressEnforceAuthPasswordEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceAuthPasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-auth-password-env-var diff --git a/policies/MongoExpressEnforceAuthUsernameEnvVar/policy.yaml b/policies/MongoExpressEnforceAuthUsernameEnvVar/policy.yaml index 4fb2c87f..88de0296 100644 --- a/policies/MongoExpressEnforceAuthUsernameEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceAuthUsernameEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-auth-username-env-var diff --git a/policies/MongoExpressEnforceBaseURLEnvVar/policy.yaml b/policies/MongoExpressEnforceBaseURLEnvVar/policy.yaml index 2b381f14..fe923093 100644 --- a/policies/MongoExpressEnforceBaseURLEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceBaseURLEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-base-url-env-var diff --git a/policies/MongoExpressEnforceCookieSecretEnvVar/policy.yaml b/policies/MongoExpressEnforceCookieSecretEnvVar/policy.yaml index 80d554e1..ab6f0ba7 100644 --- a/policies/MongoExpressEnforceCookieSecretEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceCookieSecretEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-cookie-secret-env-var diff --git a/policies/MongoExpressEnforceEditorThemeEnvVar/policy.yaml b/policies/MongoExpressEnforceEditorThemeEnvVar/policy.yaml index 2f649bcb..05561cb9 100644 --- a/policies/MongoExpressEnforceEditorThemeEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceEditorThemeEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-editor-theme-env-var diff --git a/policies/MongoExpressEnforceEnableAdminEnvVar/policy.yaml b/policies/MongoExpressEnforceEnableAdminEnvVar/policy.yaml index 6e719ddb..d9e38f55 100644 --- a/policies/MongoExpressEnforceEnableAdminEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceEnableAdminEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-enable-admin-env-var diff --git a/policies/MongoExpressEnforceMongoPortEnvVar/policy.yaml b/policies/MongoExpressEnforceMongoPortEnvVar/policy.yaml index 08b14e05..5fa8bff8 100644 --- a/policies/MongoExpressEnforceMongoPortEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceMongoPortEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-mongodb-port-env-var diff --git a/policies/MongoExpressEnforceMongoServerEnvVar/policy.yaml b/policies/MongoExpressEnforceMongoServerEnvVar/policy.yaml index ace7fd8e..7cae0230 100644 --- a/policies/MongoExpressEnforceMongoServerEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceMongoServerEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-mongodb-server-env-var diff --git a/policies/MongoExpressEnforceRequestSizeEnvVar/policy.yaml b/policies/MongoExpressEnforceRequestSizeEnvVar/policy.yaml index 256333ca..78c9be6a 100644 --- a/policies/MongoExpressEnforceRequestSizeEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceRequestSizeEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-request-size-env-var diff --git a/policies/MongoExpressEnforceSSLCrtPathEnvVar/policy.yaml b/policies/MongoExpressEnforceSSLCrtPathEnvVar/policy.yaml index f71d947c..8b6a0c6c 100644 --- a/policies/MongoExpressEnforceSSLCrtPathEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceSSLCrtPathEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-ssl-crt-path-env-var diff --git a/policies/MongoExpressEnforceSSLEnabledEnvVar/policy.yaml b/policies/MongoExpressEnforceSSLEnabledEnvVar/policy.yaml index ce6a6036..093f6c26 100644 --- a/policies/MongoExpressEnforceSSLEnabledEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceSSLEnabledEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-ssl-enabled-env-var diff --git a/policies/MongoExpressEnforceSSLKeyPathEnvVar/policy.yaml b/policies/MongoExpressEnforceSSLKeyPathEnvVar/policy.yaml index c3323929..77c9ebbc 100644 --- a/policies/MongoExpressEnforceSSLKeyPathEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceSSLKeyPathEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-ssl-key-path-env-var diff --git a/policies/MongoExpressEnforceSessionSecretEnvVar/policy.yaml b/policies/MongoExpressEnforceSessionSecretEnvVar/policy.yaml index 3ff4199c..b342847d 100644 --- a/policies/MongoExpressEnforceSessionSecretEnvVar/policy.yaml +++ b/policies/MongoExpressEnforceSessionSecretEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.mongo-express-enforce-session-secret-env-var diff --git a/policies/NamespaceProhibitName/policy.yaml b/policies/NamespaceProhibitName/policy.yaml index 73e751b4..8b4d9df2 100644 --- a/policies/NamespaceProhibitName/policy.yaml +++ b/policies/NamespaceProhibitName/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.prohibit-creating-namespace-starting-with-prefix diff --git a/policies/NetworkPolicyDefaultRulesBlockAllEgress/policy.yaml b/policies/NetworkPolicyDefaultRulesBlockAllEgress/policy.yaml index 385347eb..9bbdd656 100644 --- a/policies/NetworkPolicyDefaultRulesBlockAllEgress/policy.yaml +++ b/policies/NetworkPolicyDefaultRulesBlockAllEgress/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.block-all-egress-traffic diff --git a/policies/NetworkPolicyDefaultRulesBlockAllIngress/policy.yaml b/policies/NetworkPolicyDefaultRulesBlockAllIngress/policy.yaml index 72b0017a..20a7f2d8 100644 --- a/policies/NetworkPolicyDefaultRulesBlockAllIngress/policy.yaml +++ b/policies/NetworkPolicyDefaultRulesBlockAllIngress/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.block-all-ingress-traffic diff --git a/policies/PersistentVolumeReclaimPolicy/policy.yaml b/policies/PersistentVolumeReclaimPolicy/policy.yaml index 042f12b2..d87e987c 100644 --- a/policies/PersistentVolumeReclaimPolicy/policy.yaml +++ b/policies/PersistentVolumeReclaimPolicy/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.persistent-volume-reclaim-policy-should-be-set-to-retain diff --git a/policies/PostgresEnforceAuthMethodEnvVar/policy.yaml b/policies/PostgresEnforceAuthMethodEnvVar/policy.yaml index b3e02095..60dcff18 100644 --- a/policies/PostgresEnforceAuthMethodEnvVar/policy.yaml +++ b/policies/PostgresEnforceAuthMethodEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-auth-method-env-var diff --git a/policies/PostgresEnforceDBEnvVar/policy.yaml b/policies/PostgresEnforceDBEnvVar/policy.yaml index 71f1558f..3ed4b2c8 100644 --- a/policies/PostgresEnforceDBEnvVar/policy.yaml +++ b/policies/PostgresEnforceDBEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-db-env-var diff --git a/policies/PostgresEnforceInitDBArgsEnvVar/policy.yaml b/policies/PostgresEnforceInitDBArgsEnvVar/policy.yaml index 371f8910..84805768 100644 --- a/policies/PostgresEnforceInitDBArgsEnvVar/policy.yaml +++ b/policies/PostgresEnforceInitDBArgsEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-initdb-args-env-var diff --git a/policies/PostgresEnforceInitDBWaldirEnvVar/policy.yaml b/policies/PostgresEnforceInitDBWaldirEnvVar/policy.yaml index f5ca08ef..1f2b4de6 100644 --- a/policies/PostgresEnforceInitDBWaldirEnvVar/policy.yaml +++ b/policies/PostgresEnforceInitDBWaldirEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-initdb-waldir-env-var diff --git a/policies/PostgresEnforcePGDataEnvVar/policy.yaml b/policies/PostgresEnforcePGDataEnvVar/policy.yaml index c9e1477f..da72af75 100644 --- a/policies/PostgresEnforcePGDataEnvVar/policy.yaml +++ b/policies/PostgresEnforcePGDataEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-pgdata-env-var diff --git a/policies/PostgresEnforcePasswordEnvVar/policy.yaml b/policies/PostgresEnforcePasswordEnvVar/policy.yaml index 318f4ff5..8f865e20 100644 --- a/policies/PostgresEnforcePasswordEnvVar/policy.yaml +++ b/policies/PostgresEnforcePasswordEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-password-env-var diff --git a/policies/PostgresEnforceUserEnvVar/policy.yaml b/policies/PostgresEnforceUserEnvVar/policy.yaml index 7e72ec77..04b76ff1 100644 --- a/policies/PostgresEnforceUserEnvVar/policy.yaml +++ b/policies/PostgresEnforceUserEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.postgres-enforce-user-env-var diff --git a/policies/PrometheusRBACClusterRole/policy.yaml b/policies/PrometheusRBACClusterRole/policy.yaml index 9fc3c20d..be3b7f80 100644 --- a/policies/PrometheusRBACClusterRole/policy.yaml +++ b/policies/PrometheusRBACClusterRole/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.prometheus-rbac-prohibit-verbs diff --git a/policies/PrometheusRBACClusterRoleBinding/policy.yaml b/policies/PrometheusRBACClusterRoleBinding/policy.yaml index 7ed6db0d..4ead28e1 100644 --- a/policies/PrometheusRBACClusterRoleBinding/policy.yaml +++ b/policies/PrometheusRBACClusterRoleBinding/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.prometheus-clusterrolebinding-has-incorrect-bindings diff --git a/policies/RBACClusterRoleClusterAdmin/policy.yaml b/policies/RBACClusterRoleClusterAdmin/policy.yaml index 96354722..ab3fe506 100644 --- a/policies/RBACClusterRoleClusterAdmin/policy.yaml +++ b/policies/RBACClusterRoleClusterAdmin/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rbac-protect-cluster-admin-clusterrolebindings diff --git a/policies/RabbitMQEnforceConfigFileEnvVar/policy.yaml b/policies/RabbitMQEnforceConfigFileEnvVar/policy.yaml index 228c222c..7d89547b 100644 --- a/policies/RabbitMQEnforceConfigFileEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceConfigFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-config-file-env-var diff --git a/policies/RabbitMQEnforceDefaultPassEnvVar/policy.yaml b/policies/RabbitMQEnforceDefaultPassEnvVar/policy.yaml index 39b52b3a..78cbe78c 100644 --- a/policies/RabbitMQEnforceDefaultPassEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceDefaultPassEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-default-pass-env-var diff --git a/policies/RabbitMQEnforceDefaultUserEnvVar/policy.yaml b/policies/RabbitMQEnforceDefaultUserEnvVar/policy.yaml index bf69410f..ad882748 100644 --- a/policies/RabbitMQEnforceDefaultUserEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceDefaultUserEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-default-user-env-var diff --git a/policies/RabbitMQEnforceDefaultVHostEnvVar/policy.yaml b/policies/RabbitMQEnforceDefaultVHostEnvVar/policy.yaml index 2c81e880..19ec5cda 100644 --- a/policies/RabbitMQEnforceDefaultVHostEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceDefaultVHostEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-default-vhost-env-var diff --git a/policies/RabbitMQEnforceERLArgsEnvVar/policy.yaml b/policies/RabbitMQEnforceERLArgsEnvVar/policy.yaml index c0a385da..b2174dbf 100644 --- a/policies/RabbitMQEnforceERLArgsEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceERLArgsEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-additional-erl-args-env-var diff --git a/policies/RabbitMQEnforceEnabledPluginsEnvVar/policy.yaml b/policies/RabbitMQEnforceEnabledPluginsEnvVar/policy.yaml index 24ebb05c..5351ea1b 100644 --- a/policies/RabbitMQEnforceEnabledPluginsEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceEnabledPluginsEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-enabled-plugins-env-var diff --git a/policies/RabbitMQEnforceGeneratedConfigDirEnvVar/policy.yaml b/policies/RabbitMQEnforceGeneratedConfigDirEnvVar/policy.yaml index 37601882..1ac39c38 100644 --- a/policies/RabbitMQEnforceGeneratedConfigDirEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceGeneratedConfigDirEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-generated-config-dir-env-var diff --git a/policies/RabbitMQEnforceLogBaseEnvVar/policy.yaml b/policies/RabbitMQEnforceLogBaseEnvVar/policy.yaml index 10b77f0a..e9190a76 100644 --- a/policies/RabbitMQEnforceLogBaseEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceLogBaseEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-log-base-env-var diff --git a/policies/RabbitMQEnforceLogsEnvVar/policy.yaml b/policies/RabbitMQEnforceLogsEnvVar/policy.yaml index d83d2032..f4f5a443 100644 --- a/policies/RabbitMQEnforceLogsEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceLogsEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-logs-env-var diff --git a/policies/RabbitMQEnforceMnesiaBaseEnvVar/policy.yaml b/policies/RabbitMQEnforceMnesiaBaseEnvVar/policy.yaml index b997ebe4..f02dd73a 100644 --- a/policies/RabbitMQEnforceMnesiaBaseEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceMnesiaBaseEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-mnesia-base-env-var diff --git a/policies/RabbitMQEnforceMnesiaDirEnvVar/policy.yaml b/policies/RabbitMQEnforceMnesiaDirEnvVar/policy.yaml index 49c1161f..83f47a83 100644 --- a/policies/RabbitMQEnforceMnesiaDirEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceMnesiaDirEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-mnesia-dir-env-var diff --git a/policies/RabbitMQEnforcePidFileEnvVar/policy.yaml b/policies/RabbitMQEnforcePidFileEnvVar/policy.yaml index f7b0b8c0..80bfa06e 100644 --- a/policies/RabbitMQEnforcePidFileEnvVar/policy.yaml +++ b/policies/RabbitMQEnforcePidFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-pid-file-env-var diff --git a/policies/RabbitMQEnforcePluginsDirEnvVar/policy.yaml b/policies/RabbitMQEnforcePluginsDirEnvVar/policy.yaml index 2092021d..d6c47ed2 100644 --- a/policies/RabbitMQEnforcePluginsDirEnvVar/policy.yaml +++ b/policies/RabbitMQEnforcePluginsDirEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-plugins-dir-env-var diff --git a/policies/RabbitMQEnforcePluginsExpandDirEnvVar/policy.yaml b/policies/RabbitMQEnforcePluginsExpandDirEnvVar/policy.yaml index 28e128b5..7b180ea8 100644 --- a/policies/RabbitMQEnforcePluginsExpandDirEnvVar/policy.yaml +++ b/policies/RabbitMQEnforcePluginsExpandDirEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-plugins-expand-dir-env-var diff --git a/policies/RabbitMQEnforceSSLCACertFileEnvVar/policy.yaml b/policies/RabbitMQEnforceSSLCACertFileEnvVar/policy.yaml index 52cc49c7..66173e5a 100644 --- a/policies/RabbitMQEnforceSSLCACertFileEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSSLCACertFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-ssl-ca-cert-file-env-var diff --git a/policies/RabbitMQEnforceSSLCertFileEnvVar/policy.yaml b/policies/RabbitMQEnforceSSLCertFileEnvVar/policy.yaml index ce77a39d..4e125f0b 100644 --- a/policies/RabbitMQEnforceSSLCertFileEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSSLCertFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-ssl-cert-file-env-var diff --git a/policies/RabbitMQEnforceSSLDepthEnvVar/policy.yaml b/policies/RabbitMQEnforceSSLDepthEnvVar/policy.yaml index 6b92aae4..3590a68c 100644 --- a/policies/RabbitMQEnforceSSLDepthEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSSLDepthEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-ssl-depth-env-var diff --git a/policies/RabbitMQEnforceSSLFailNoPeerEnvVar/policy.yaml b/policies/RabbitMQEnforceSSLFailNoPeerEnvVar/policy.yaml index 9e404fe0..033a6e7b 100644 --- a/policies/RabbitMQEnforceSSLFailNoPeerEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSSLFailNoPeerEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-fail-if-no-peer-cert-env-var diff --git a/policies/RabbitMQEnforceSSLKeyFileEnvVar/policy.yaml b/policies/RabbitMQEnforceSSLKeyFileEnvVar/policy.yaml index ac8d972f..08675d3b 100644 --- a/policies/RabbitMQEnforceSSLKeyFileEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSSLKeyFileEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-ssl-keyfile-env-var diff --git a/policies/RabbitMQEnforceSSLVerifyEnvVar/policy.yaml b/policies/RabbitMQEnforceSSLVerifyEnvVar/policy.yaml index d7bd7dbb..85238c14 100644 --- a/policies/RabbitMQEnforceSSLVerifyEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSSLVerifyEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-ssl-verify-env-var diff --git a/policies/RabbitMQEnforceSchemaDirEnvVar/policy.yaml b/policies/RabbitMQEnforceSchemaDirEnvVar/policy.yaml index 0bb5f3ce..db2240c6 100644 --- a/policies/RabbitMQEnforceSchemaDirEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceSchemaDirEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-schema-dir-env-var diff --git a/policies/RabbitMQEnforceVMMemoryEnvVar/policy.yaml b/policies/RabbitMQEnforceVMMemoryEnvVar/policy.yaml index 1c9f0fea..bcfa5b55 100644 --- a/policies/RabbitMQEnforceVMMemoryEnvVar/policy.yaml +++ b/policies/RabbitMQEnforceVMMemoryEnvVar/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.rabbitmq-enforce-vm-memory-env-var diff --git a/policies/ServiceAccountDisableTokenAutomount/policy.yaml b/policies/ServiceAccountDisableTokenAutomount/policy.yaml index c230eec6..17d94bc1 100644 --- a/policies/ServiceAccountDisableTokenAutomount/policy.yaml +++ b/policies/ServiceAccountDisableTokenAutomount/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.disable-service-account-token-automount-in-specific-namespace diff --git a/policies/ServiceProhibitPortsRange/policy.yaml b/policies/ServiceProhibitPortsRange/policy.yaml index a62d5318..95c2a7c7 100644 --- a/policies/ServiceProhibitPortsRange/policy.yaml +++ b/policies/ServiceProhibitPortsRange/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.services-prohibit-ports-range diff --git a/policies/ServiceProhibitType/policy.yaml b/policies/ServiceProhibitType/policy.yaml index bff07830..15cfeb48 100644 --- a/policies/ServiceProhibitType/policy.yaml +++ b/policies/ServiceProhibitType/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.services-prohibit-type diff --git a/policies/ServiceRestrictProtocols/policy.yaml b/policies/ServiceRestrictProtocols/policy.yaml index 55b7cdb5..298b7e6d 100644 --- a/policies/ServiceRestrictProtocols/policy.yaml +++ b/policies/ServiceRestrictProtocols/policy.yaml @@ -1,4 +1,4 @@ -apiVersion: pac.weave.works/v2beta1 +apiVersion: pac.weave.works/v2beta2 kind: Policy metadata: name: weave.policies.services-restrict-protocols diff --git a/policies/datastudio.csv b/policies/datastudio.csv index b55d0489..8063c004 100644 --- a/policies/datastudio.csv +++ b/policies/datastudio.csv @@ -1,127 +1,127 @@ -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Running As Root','False','True','True''False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_DATABASE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_USER','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Prohibit Environment Variable - MYSQL_ALLOW_EMPTY_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Using Hostpath','False','True','True''False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SESSIONSECRET','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Read Only Root Filesystem','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_LOGS','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SSL_ENABLED','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_SERVER','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Service','Services Restrict Protocols','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Owner Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_BASICAUTH_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Pod','Prohibit Naked Pods From Being Scheduled','False','False','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Host IPC','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_PASSWORD_FILE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_BASEURL','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Part Of Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Process Namespace','False','True','True''False','False','False','False','False','False','False' 'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SCHEMA_DIR','False','True','False','False','False','False','False','False','False','False' -'weave.categories.reliability','Deployment,StatefulSet,ReplicaSet,ReplicationController,HorizontalPodAutoscaler','Containers Minimum Replica Count','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_VHOST','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Mounting Docker Socket','False','True','True''False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_DB','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' 'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_PLUGINS_EXPAND_DIR','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','ServiceAccount','Disable ServiceAccount Token Automount In Specific Namespace','False','True','True''False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_INITDB_SKIP_TZINFO','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Host PID','False','True','True''False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_ADMINUSERNAME','False','True','False','False','False','False','False','False','False','False' -'weave.categories.capacity-management','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Should Not Run On Kubernetes Control Plane Nodes','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_USER','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_PASS','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_INITDB_WALDIR','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - PGDATA','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Block Ssh Port','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Should Not Run In Namespace','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_USER','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_USERNAME','False','True','False','False','False','False','False','False','False','False' 'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Using Hostpath','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Prohibit Environment Variable - MARIADB_ALLOW_EMPTY_PASSWORD','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_BASICAUTH_USERNAME','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_PID_FILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_DATABASE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.reliability','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Liveness Probe','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_MNESIA_BASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Running As Root','False','True','True''False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Version Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Block Workloads Created Without Specifying Namespace','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_COOKIESECRET','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Running In Privileged Mode','False','True','True''False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_VERIFY','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_GENERATED_CONFIG_DIR','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Service','Services Prohibit Ports Range','False','True','False','False','False','False','False','False','False','False' 'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_RETENTION','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_MNESIA_DIR','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Namespace','Prohibit Creating Namespace Starting With Prefix','False','False','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_REQUEST_SIZE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Running With Unapproved Linux Capabilities','False','True','True''False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Host Network','False','True','True''False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Controller ServiceAccount Tokens Automount','False','True','True''False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_PLUGINS_DIR','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_USERNAME','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Block Ports Range','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_DATABASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_CONFIG_FILE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Read Only Root Filesystem','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','ServiceAccount','Disable ServiceAccount Token Automount In Specific Namespace','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_BUCKET','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Block Sysctls','False','True','True''False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_LOGS','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_USER','False','True','False','False','False','False','False','False','False','False' -'weave.categories.software-supply-chain','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Prohibit Image Tag','False','True','True''False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SSL_CRT_PATH','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_USER','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_USERNAME','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_ONETIME_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Enforce Restart Policy','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_FAIL_IF_NO_PEER_CERT','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SESSIONSECRET','False','True','False','False','False','False','False','False','False','False' +'weave.categories.reliability','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Startup Probe','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Host PID','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_OPTIONS_EDITORTHEME','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_ENABLED_PLUGINS_FILE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Component Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_KEYFILE','False','True','False','False','False','False','False','False','False','False' 'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_CACERTFILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Using Hostport','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_BASEURL','False','True','False','False','False','False','False','False','False','False' -'weave.categories.data-protection','PersistentVolume','Persistent Volume Reclaim Policy Should Be Set To Retain','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_COOKIESECRET','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Process Namespace','False','True','True''False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_DB','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_DATABASE','False','True','False','False','False','False','False','False','False','False' 'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Running With Privilege Escalation','False','True','True''False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_CONFIG_FILE','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Prohibit Environment Variable - MYSQL_ALLOW_EMPTY_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_VERIFY','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Not Using Runtime Default Seccomp Profile','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_ADMINPASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_DATABASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_INITDB_WALDIR','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_INITDB_SKIP_TZINFO','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - PGDATA','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_ADMINUSERNAME','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Block Ports Range','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Owner Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Prohibit Environment Variable - MYSQL_ALLOW_EMPTY_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Mounting Docker Socket','False','True','True''False','False','False','False','False','False','False' +'weave.categories.data-protection','PersistentVolume','Persistent Volume Reclaim Policy Should Be Set To Retain','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_DATABASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.reliability','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Readiness Probe','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Service','Services Prohibit Type','False','True','False','False','False','False','False','False','False','False' 'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Block Sysctls CVE-2022-0811','False','True','True''False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Version Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Service','Services Prohibit Ports Range','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_RANDOM_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Prohibit Environment Variable - MARIADB_ALLOW_EMPTY_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_ORG','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_CERTFILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_ENABLED_PLUGINS_FILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_OPTIONS_EDITORTHEME','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Should Not Run In Namespace','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_VM_MEMORY_HIGH_WATERMARK','False','True','False','False','False','False','False','False','False','False' +'weave.categories.reliability','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Liveness Probe','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_INITDB_SKIP_TZINFO','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SSL_ENABLED','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_BASICAUTH_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Managed By Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_ADMINPASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_PORT','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Not Using Runtime Default Seccomp Profile','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_INITDB_ARGS','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','ClusterRoleBinding','Rbac Protect Cluster Admin Clusterrolebindings','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Running As User','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_PASS','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_INITDB_SKIP_TZINFO','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Running With Unapproved Linux Capabilities','False','True','True''False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_USERNAME_FILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','NetworkPolicy','Block All Egress Traffic','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Security Context','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Controller ServiceAccount Tokens Automount','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_HOST_AUTH_METHOD','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','ClusterRoleBinding','Prometheus Clusterrolebinding Has Incorrect Bindings','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_MNESIA_BASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_USERNAME','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.capacity-management','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Should Not Run On Kubernetes Control Plane Nodes','False','True','False','False','False','False','False','False','False','False' 'weave.categories.software-supply-chain','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Image Pull Policy','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Enforce Restart Policy','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_INITDB_SKIP_TZINFO','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_INITDB_SKIP_TZINFO','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Security Context','False','True','True''False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_MNESIA_DIR','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_CERTFILE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_PID_FILE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_DATABASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_DATABASE','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SSL_KEY_PATH','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_RANDOM_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Part Of Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_GENERATED_CONFIG_DIR','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Pod','Prohibit Naked Pods From Being Scheduled','False','False','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_VHOST','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Service','Services Restrict Protocols','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_RANDOM_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Block Ssh Port','False','True','False','False','False','False','False','False','False','False' 'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Instance Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Running As User','False','True','True''False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Block Sysctls','False','True','True''False','False','False','False','False','False','False' -'weave.categories.reliability','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Startup Probe','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_USER','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Using Hostport','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_ORG','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_LOG_BASE','False','True','False','False','False','False','False','False','False','False' 'weave.categories.network-security','NetworkPolicy','Block All Ingress Traffic','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_DEPTH','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_USER','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','NetworkPolicy','Block All Egress Traffic','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_PLUGINS_DIR','False','True','False','False','False','False','False','False','False','False' 'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Created By Label','False','True','False','False','False','False','False','False','False','False' +'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Host Network','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','ClusterRole','Prometheus Rbac Prohibit Verbs','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_USER','False','True','False','False','False','False','False','False','False','False' +'weave.categories.reliability','Deployment,StatefulSet,ReplicaSet,ReplicationController,HorizontalPodAutoscaler','Containers Minimum Replica Count','False','True','False','False','False','False','False','False','False','False' +'weave.categories.organizational-standards','Namespace','Prohibit Creating Namespace Starting With Prefix','False','False','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_RANDOM_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Block Workloads Created Without Specifying Namespace','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Managed By Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SSL_KEY_PATH','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Sharing Host IPC','False','True','True''False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_VM_MEMORY_HIGH_WATERMARK','False','True','False','False','False','False','False','False','False','False' +'weave.categories.software-supply-chain','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Container Prohibit Image Tag','False','True','True''False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MYSQL Enforce Environment Variable - MYSQL_ONETIME_PASSWORD','False','True','False','False','False','False','False','False','False','False' +'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_SSL_CRT_PATH','False','True','False','False','False','False','False','False','False','False' +'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_SERVER','False','True','False','False','False','False','False','False','False','False' 'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_ENABLE_ADMIN','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MARIADB_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Mongo-Express Enforce Environment Variable - ME_CONFIG_MONGODB_PORT','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_KEYFILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_FAIL_IF_NO_PEER_CERT','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','InfluxDB Enforce Environment Variable - DOCKER_INFLUXDB_INIT_BUCKET','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SSL_DEPTH','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_PASSWORD_FILE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_INITDB_ARGS','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Missing Kubernetes App Component Label','False','True','False','False','False','False','False','False','False','False' -'weave.categories.network-security','Service','Services Prohibit Type','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','ClusterRoleBinding','Rbac Protect Cluster Admin Clusterrolebindings','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','MariaDB Enforce Environment Variable - MYSQL_ROOT_PASSWORD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.access-control','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Postgres Enforce Environment Variable - POSTGRES_HOST_AUTH_METHOD','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_LOG_BASE','False','True','False','False','False','False','False','False','False','False' -'weave.categories.reliability','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Missing Readiness Probe','False','True','False','False','False','False','False','False','False','False' -'weave.categories.pod-security','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','Containers Running In Privileged Mode','False','True','True''False','False','False','False','False','False','False' -'weave.categories.access-control','ClusterRole','Prometheus Rbac Prohibit Verbs','False','True','False','False','False','False','False','False','False','False' -'weave.categories.organizational-standards','Deployment,Job,ReplicationController,ReplicaSet,DaemonSet,StatefulSet,CronJob','RabbitMQ Enforce Environment Variable - RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS','False','True','False','False','False','False','False','False','False','False' diff --git a/policies/policies.md b/policies/policies.md index 297e8743..80254142 100644 --- a/policies/policies.md +++ b/policies/policies.md @@ -1,21 +1,64 @@ -## Container Running As Root +## Prohibit Naked Pods From Being Scheduled ### ID -weave.policies.container-running-as-root +weave.policies.prohibit-naked-pods-from-being-scheduled ### Description -Running as root gives the container full access to all resources in the VM it is running on. Containers should not run with such access rights unless required by design. This Policy enforces that the `securityContext.runAsNonRoot` attribute is set to `true`. +This Policy checks for a `kind` and can prohibit it from being schedule to your cluster. A common example is running "naked" pods. ### How to solve? -You should set `securityContext.runAsNonRoot` to `true`. Not setting it will default to giving the container root user rights on the VM that it is running on. +Ensure you are not using a kind that is specified within the Policy. +``` +kind: +``` + +https://kubernetes.io/docs/concepts/configuration/overview/#naked-pods-vs-replicasets-deployments-and-jobs + + +### Category +weave.categories.organizational-standards + +### Severity +medium + +### Targets +{'kinds': ['Pod']} + +### Tags +['cis-benchmark'] + +--- + +## Containers Sharing Host IPC + +### ID +weave.policies.containers-sharing-host-ipc + +### Description +This Policy allows check if sharing host IPC namespace with the container should be allowed or not. Resources that can be shared with the container include: + +### hostNetwork +Controls whether the pod may use the node network namespace. Doing so gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. + +### hostPID +Controls whether the pod containers can share the host process ID namespace. Note that when paired with ptrace this can be used to escalate privileges outside of the container (ptrace is forbidden by default). + +### shareProcessNamespace +When process namespace sharing is enabled, processes in a container are visible to all other containers in that pod. + +### hostIPC +Controls whether the pod containers can share the host IPC namespace. + + +### How to solve? +Match the shared resource with either true or false, as set in your constraint. ``` ... spec: - securityContext: - runAsNonRoot: true + : ``` -https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces ### Category @@ -28,25 +71,25 @@ high {'kinds': ['Deployment', 'Job', 'ReplicationController', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'CronJob']} ### Tags -['pci-dss', 'cis-benchmark', 'mitre-attack', 'nist800-190', 'gdpr', 'default'] +['nist800-190', 'gdpr', 'default'] ### Parameters -[{'name': 'exclude_namespaces', 'type': 'array', 'required': False, 'value': ['kube-system']}, {'name': 'exclude_label_key', 'type': 'string', 'required': False, 'value': None}, {'name': 'exclude_label_value', 'type': 'string', 'required': False, 'value': None}] +[{'name': 'resource_enabled', 'type': 'boolean', 'required': True, 'value': False}, {'name': 'exclude_namespaces', 'type': 'array', 'required': False, 'value': None}, {'name': 'exclude_label_key', 'type': 'string', 'required': False, 'value': None}, {'name': 'exclude_label_value', 'type': 'string', 'required': False, 'value': None}] --- -## MongoDB Enforce Environment Variable - MONGO_INITDB_DATABASE +## MongoDB Enforce Environment Variable - MONGO_INITDB_ROOT_PASSWORD_FILE ### ID -weave.policies.mongodb-enforce-database-env-var +weave.policies.mongodb-enforce-root-password-file-env-var ### Description -This Policy ensures MONGO_INITDB_DATABASE environment variable are in place when using the official container images from Docker Hub. -MONGO_INITDB_DATABASE: The MONGO_INITDB_DATABASE environment variable allows you to specify the name of a database to be used for creation scripts. +This Policy ensures MONGO_INITDB_ROOT_PASSWORD_FILE environment variable are in place when using the official container images from Docker Hub. +MONGO_INITDB_ROOT_PASSWORD_FILE: The MONGO_INITDB_ROOT_PASSWORD_FILE environment variable is an alternative to passing sensitive information via environment variables, _FILE may be appended to the previously listed environment variables, causing the initialization script to load the values for those variables from files present in the container. ### How to solve? -If you encounter a violation, ensure the MONGO_INITDB_DATABASE environment variables is set. +If you encounter a violation, ensure the MONGO_INITDB_ROOT_PASSWORD_FILE environment variables is set. For futher information about the MongoDB Docker container, check here: https://hub.docker.com/_/mariadb @@ -59,28 +102,31 @@ high ### Targets {'kinds': ['Deployment', 'Job', 'ReplicationController', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'CronJob']} +### Tags +['pci-dss', 'mitre-attack', 'hipaa'] + ### Parameters [{'name': 'exclude_namespaces', 'type': 'array', 'required': False, 'value': None}, {'name': 'exclude_label_key', 'type': 'string', 'required': False, 'value': None}, {'name': 'exclude_label_value', 'type': 'string', 'required': False, 'value': None}] --- -## RabbitMQ Enforce Environment Variable - RABBITMQ_DEFAULT_USER +## Mongo-Express Enforce Environment Variable - ME_CONFIG_SITE_BASEURL ### ID -weave.policies.rabbitmq-enforce-default-user-env-var +weave.policies.mongo-express-enforce-base-url-env-var ### Description -This Policy ensures RABBITMQ_DEFAULT_USER environment variable are in place when using the official container images from Docker Hub. -RABBITMQ_DEFAULT_USER: The RABBITMQ_DEFAULT_USER environment variable sets the User name to create when RabbitMQ creates a new database from scratch. +This Policy ensures ME_CONFIG_SITE_BASEURL environment variable are in place when using the official container images from Docker Hub. +ME_CONFIG_SITE_BASEURL: The ME_CONFIG_SITE_BASEURL environment variable sets the baseUrl to ease mounting at a subdirectory. Remember to include a leading and trailing slash. ### How to solve? -If you encounter a violation, ensure the RABBITMQ_DEFAULT_USER environment variables is set. -For futher information about the RabbitMQ Docker container, check here: https://hub.docker.com/_/rabbitmq +If you encounter a violation, ensure the ME_CONFIG_SITE_BASEURL environment variables is set. +For futher information about the Mongo-Express Docker container, check here: https://hub.docker.com/_/mongo-express ### Category -weave.categories.access-control +weave.categories.network-security ### Severity high @@ -89,66 +135,109 @@ high {'kinds': ['Deployment', 'Job', 'ReplicationController', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'CronJob']} ### Tags -['pci-dss', 'hipaa', 'gdpr'] +['pci-dss'] ### Parameters [{'name': 'exclude_namespaces', 'type': 'array', 'required': False, 'value': None}, {'name': 'exclude_label_key', 'type': 'string', 'required': False, 'value': None}, {'name': 'exclude_label_value', 'type': 'string', 'required': False, 'value': None}] --- -## MYSQL Prohibit Environment Variable - MYSQL_ALLOW_EMPTY_PASSWORD +## Missing Kubernetes App Part Of Label ### ID -weave.policies.mysql-prohibit-empty-password-env-var +weave.policies.missing-kubernetes-app-part-of-label ### Description -This Policy ensures MYSQL_ALLOW_EMPTY_PASSWORD environment variable are in place when using the official container images from Docker Hub. -MYSQL_ALLOW_EMPTY_PASSWORD: MYSQL_ALLOW_EMPTY_PASSWORD set to true will allow the container to be started with a blank password for the root user +Custom labels can help enforce organizational standards for each artifact deployed. This Policy ensure a custom label key is set in the entity's `metadata`. The Policy detects the presence of the following: + +### owner +A label key of `owner` will help identify who the owner of this entity is. + +### app.kubernetes.io/name +The name of the application + +### app.kubernetes.io/instance +A unique name identifying the instance of an application + +### app.kubernetes.io/version +The current version of the application (e.g., a semantic version, revision hash, etc.) + +### app.kubernetes.io/part-of +The name of a higher level application this one is part of + +### app.kubernetes.io/managed-by +The tool being used to manage the operation of an application + +### app.kubernetes.io/created-by +The controller/user who created this resource ### How to solve? -If you encounter a violation, ensure the MYSQL_ALLOW_EMPTY_PASSWORD environment variables is set. -For futher information about the MYSQL Docker container, check here: https://hub.docker.com/_/mysql +Add these custom labels to `metadata`. +* owner +* app.kubernetes.io/name +* app.kubernetes.io/instance +* app.kubernetes.io/version +* app.kubernetes.io/name +* app.kubernetes.io/part-of +* app.kubernetes.io/managed-by +* app.kubernetes.io/created-by + +``` +metadata: + labels: +