-
Notifications
You must be signed in to change notification settings - Fork 168
/
ps-rule.yaml
91 lines (71 loc) · 1.91 KB
/
ps-rule.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
#
# PSRule configuration
#
# Please see the documentation for all configuration options:
# https://microsoft.github.io/PSRule/
# https://azure.github.io/PSRule.Rules.Azure/setup/configuring-options/
# https://github.com/microsoft/PSRule.Rules.CAF
input:
pathIgnore:
- '.vscode/'
- '*.md'
- '*.Designer.cs'
- '*.resx'
- '*.sln'
- '*.txt'
- '*.html'
- '*.ico'
include:
path: []
module:
- 'PSRule.Rules.Azure'
- 'PSRule.Rules.CAF'
requires:
PSRule.Rules.CAF: '>=0.3.0'
output:
culture:
- en-US
configuration:
# Enable automatic expansion of Azure parameter files
AZURE_PARAMETER_FILE_EXPANSION: true
# Bicep is experimental and currently disabled as testing occurs against compiled template
# Enable automatic expansion of bicep source files
AZURE_BICEP_FILE_EXPANSION: true
AZURE_BICEP_FILE_EXPANSION_TIMEOUT: 30
#ProjectSpecifc rules
Azure_AKSNodeMinimumMaxPods: 30
rule:
exclude:
# Ignore the following rules for all resources
- Azure.Resource.UseTags
- Azure.VM.Standalone
- Azure.KeyVault.SoftDelete
- Azure.KeyVault.PurgeProtect
- Azure.AppGw.UseHTTPS #In this project AGIC is in charge of managing the AppGW.
- Azure.ACR.ContentTrust
# Ignore the following rules for specific deployments
# -aks-AksStan = Low spec'd AKS deployment that won't meet many WAF rules
# - aks-Byo = moderately spec'd AKS deplyoment that wont meet every rule
suppression:
Azure.AKS.AuthorizedIPs:
# Exclude the following AKS clusters
- aks-AksStan
- aks-Byo
Azure.AKS.MinNodeCount:
- aks-AksStan
Azure.AKS.NetworkPolicy:
- aks-AksStan
Azure.AKS.AzurePolicyAddOn:
- aks-AksStan
Azure.AKS.AutoScaling:
- aks-AksStan
Azure.AKS.AvailabilityZone:
- aks-AksStan
Azure.AppGw.UseWAF:
- agw-Byo
Azure.AppGw.Prevention:
- agw-Byo
Azure.AppGw.WAFEnabled:
- agw-Byo
Azure.AKS.AutoUpgrade: #Auto-upgrade can be a pain for short lived test clusters
- aks-Byo