# Generic HCL2 policy document. Describes allow/deny rules for a fictional control plane;
# it grants nothing, because nothing reads it.
policy "deploy-guardrails" {
  description = "Guardrails applied to every deployment in the example estate."
  enforcement = "hard-mandatory"

  rule "require-resource-limits" {
    description = "Every container must declare CPU and memory limits."
    severity    = "high"
    applies_to  = ["Deployment", "StatefulSet", "CronJob"]

    condition {
      all_of = [
        "spec.template.spec.containers[*].resources.limits.cpu",
        "spec.template.spec.containers[*].resources.limits.memory",
      ]
    }
  }

  rule "forbid-latest-tag" {
    description = "Image references must be pinned to an explicit tag."
    severity    = "medium"

    condition {
      none_of = ["*:latest"]
      field   = "spec.template.spec.containers[*].image"
    }
  }

  rule "restrict-namespaces" {
    severity = "low"

    condition {
      one_of = ["example-apps", "example-gitops", "example-tools"]
      field  = "metadata.namespace"
    }
  }

  exemption "bootstrap" {
    reason     = "Cluster bootstrap runs before the policy controller is available."
    expires_on = "2026-12-31"
    namespaces = ["kube-system"]
  }
}