https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/Recent content in Enforcement on CapsuleHugo -- gohugo.ioenhttps://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/metadata/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/metadata/Metadata enforcement allows administrators to allow, deny, or audit Kubernetes object labels and annotations for namespaced resources. Metadata rules are configured under spec.rules[].enforce.metadata. They are evaluated by a generic validating webhook and can target one or more Kubernetes kinds. This makes metadata enforcement useful for objects such as ConfigMap, Secret, Service, Deployment, custom resources, and other namespaced resources. rules: - enforce: action: allow metadata: - apiGroups: - "*" kinds: - ConfigMap - Service labels: corp.https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/workloads/Workload enforcement mainly targets Pod objects and the resources associated with them. It is configured under spec.rules[].enforce.workloads. Each rule can define an action, optional workload targets, and one or more workload policies such as resource requests and limits, registry match expressions, scheduler match expressions, or QoS classes. apiVersion: capsule.clastix.io/v1beta2 kind: Tenant metadata: name: solar spec: rules: - enforce: action: deny workloads: qosClasses: - BestEffort Resource requests and limits Resource policies let a Tenant administrator normalize and enforce the requests and limits of Pods created in Tenant namespaces.https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/services/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/services/Service enforcement allows administrators to allow, deny, or audit Kubernetes Service resources in Tenant namespaces. Service rules are configured under spec.rules[].enforce.services. Each rule can define an action, a list of allowed or denied Service types, constraints for spec.externalIPs, and optional type-specific constraints for LoadBalancer, ExternalName, and NodePort Services. rules: - enforce: action: allow services: types: - ClusterIP - NodePort - LoadBalancer - ExternalName loadBalancers: cidrs: - 10.0.0.2/32 externalIPs: cidrs: - 10.https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/ingress/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-131--docs-projectcapsule.netlify.app/docs/rules/enforcement/ingress/Ingress enforcement allows administrators to allow, deny, or audit hostnames on Kubernetes Ingresses, OpenShift Routes, and Gateway API resources in Tenant namespaces. Ingress rules are configured under spec.rules[].enforce.ingress. Each rule selects one or more resource types and defines hostname match expressions: rules: - enforce: action: allow ingress: types: - Ingress - HTTPRoute hostnames: - exact: - internal.example.com - exp: "^[a-z0-9-]+\\.example\\.com$" Field Description types Resource kinds to which the rule applies. At least one type is required.