https://projectcapsule.dev/docs/rules/enforcement/Recent content in Enforcement on CapsuleHugo -- gohugo.ioenhttps://projectcapsule.dev/docs/rules/enforcement/metadata/Mon, 01 Jan 0001 00:00:00 +0000https://projectcapsule.dev/docs/rules/enforcement/metadata/Metadata enforcement allows administrators to allow, deny, or audit Kubernetes object labels and annotations for namespaced resources. Metadata rules are configured under spec.rules[].enforce.metadata. They are evaluated by a generic validating webhook and can target one or more Kubernetes kinds. This makes metadata enforcement useful for objects such as ConfigMap, Secret, Service, Deployment, custom resources, and other namespaced resources. rules: - enforce: action: allow metadata: - apiGroups: - "*" kinds: - ConfigMap - Service labels: corp.https://projectcapsule.dev/docs/rules/enforcement/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://projectcapsule.dev/docs/rules/enforcement/workloads/Enforcement for workloads mainly targets Pods and their associated resources. Workload enforcement is configured under spec.rules[].enforce.workloads. Each rule can define an action, optional workload targets, and one or more workload matchers such as registry match expressions, scheduler match expressions, or QoS classes. apiVersion: capsule.clastix.io/v1beta2 kind: Tenant metadata: name: solar spec: … rules: - enforce: action: deny workloads: qosClasses: - BestEffort QoS Classes QoS class enforcement allows administrators to allow, deny, or audit Pods based on their computed Kubernetes QoS class.https://projectcapsule.dev/docs/rules/enforcement/services/Mon, 01 Jan 0001 00:00:00 +0000https://projectcapsule.dev/docs/rules/enforcement/services/Service enforcement allows administrators to allow, deny, or audit Kubernetes Service resources in Tenant namespaces. Service rules are configured under spec.rules[].enforce.services. Each rule can define an action, a list of allowed or denied Service types, and optional type-specific constraints for LoadBalancer, ExternalName, and NodePort Services. rules: - enforce: action: allow services: types: - ClusterIP - NodePort - LoadBalancer - ExternalName loadBalancers: cidrs: - 10.0.0.2/32 externalNames: hostnames: - exp: ".*\\.example\\.com" exact: - internal.https://projectcapsule.dev/docs/rules/enforcement/ingress/Mon, 01 Jan 0001 00:00:00 +0000https://projectcapsule.dev/docs/rules/enforcement/ingress/Ingress enforcement allows administrators to allow, deny, or audit hostnames on Kubernetes Ingresses, OpenShift Routes, and Gateway API resources in Tenant namespaces. Ingress rules are configured under spec.rules[].enforce.ingress. Each rule selects one or more resource types and defines hostname match expressions: rules: - enforce: action: allow ingress: types: - Ingress - HTTPRoute hostnames: - exact: - internal.example.com - exp: "^[a-z0-9-]+\\.example\\.com$" Field Description types Resource kinds to which the rule applies. At least one type is required.