Skip to content

Commit f005e27

Browse files
ShantingLiuJenny Liu
ShantingLiu
and
Jenny Liu
authored
[Safeguards][v20250502preview] Add PodSecurityStandardsLevel to DeploymentSafeguardsProperties (#35252)
Add PodSecurityStandardsLevel to DeploymetnSafeguardProperties for the Safeguards PodSecurityStandards feature offering. --------- Co-authored-by: Jenny Liu <[email protected]>
1 parent 6a16ff7 commit f005e27

File tree

15 files changed

+917
-3
lines changed

15 files changed

+917
-3
lines changed

‎specification/containerservice/DeploymentSafeguards.Management/deploymentsafeguards.tsp‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,20 @@ union DeploymentSafeguardsLevel {
4242
string,
4343
}
4444

45+
@doc("Specifies the Pod Security Standards level")
46+
union PodSecurityStandardsLevel {
47+
@doc("Privileged level is an unrestricted policy, providing the widest possible level of permissions. This policy allows for known privilege escalations.")
48+
PodSecurityStandardsPrivileged: "Privileged",
49+
50+
@doc("Baseline level is a minimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration.")
51+
PodSecurityStandardsBaseline: "Baseline",
52+
53+
@doc("Restricted level is a heavily restricted policy, following current Pod hardening best practices.")
54+
PodSecurityStandardsRestricted: "Restricted",
55+
56+
string,
57+
}
58+
4559
@doc("DeploymentSafeguards Properties")
4660
model DeploymentSafeguardsProperties {
4761
@doc("Provisioning State")
@@ -57,6 +71,10 @@ model DeploymentSafeguardsProperties {
5771
@doc("System defined list of namespaces excluded from Deployment Safeguards. These are determined by the underlying provider (such as AKS), and cannot be changed. Deployments in these namespaces will not be checked")
5872
@visibility(Lifecycle.Read)
5973
systemExcludedNamespaces: Array<string>;
74+
75+
@doc("The pod security standards level")
76+
@added(Versions.v2025_05_02_preview)
77+
podSecurityStandardsLevel?: PodSecurityStandardsLevel;
6078
}
6179

6280
@lroStatus

‎specification/containerservice/DeploymentSafeguards.Management/examples/2025-05-02-preview/DeploymentSafeguards_Create.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"operationId": "DeploymentSafeguards_Create",
3+
"title": "Creates a DeploymentSafeguards resource with a long running operation.",
4+
"parameters": {
5+
"api-version": "2025-05-02-preview",
6+
"resourceUri": "subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1",
7+
"resource": {
8+
"properties": {
9+
"level": "Warn",
10+
"podSecurityStandardsLevel": "Baseline"
11+
}
12+
}
13+
},
14+
"responses": {
15+
"201": {
16+
"headers": {
17+
"ETag": "23ujdflewrj3=",
18+
"Location": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operations/00000000-0000-0000-0000-000000000000?api-version=2022-02-01",
19+
"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operationResults/00000000-0000-0000-0000-000000000000?api-version=2022-02-01"
20+
},
21+
"body": {
22+
"id": "/subscriptions/subid1/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1/providers/Microsoft.ContainerService/deploymentSafeguards/default",
23+
"name": "default",
24+
"type": "Microsoft.ContainerService/deploymentSafeguards",
25+
"systemData": {
26+
"createdBy": "someUser",
27+
"createdByType": "User",
28+
"createdAt": "2022-03-23T05:40:40.657Z",
29+
"lastModifiedBy": "someOtherUser",
30+
"lastModifiedByType": "User",
31+
"lastModifiedAt": "2022-03-23T05:40:40.657Z"
32+
},
33+
"eTag": "23ujdflewrj3=",
34+
"properties": {
35+
"level": "Warn",
36+
"systemExcludedNamespaces": [
37+
"kube-system",
38+
"gatekeeper-system"
39+
],
40+
"podSecurityStandardsLevel": "Baseline",
41+
"provisioningState": "Succeeded"
42+
}
43+
}
44+
},
45+
"200": {
46+
"headers": {
47+
"ETag": "23ujdflewrj3=",
48+
"Location": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operations/00000000-0000-0000-0000-000000000000?api-version=2022-02-01",
49+
"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operationResults/00000000-0000-0000-0000-000000000000?api-version=2022-02-01"
50+
},
51+
"body": {
52+
"id": "/subscriptions/subid1/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1/providers/Microsoft.ContainerService/deploymentSafeguards/default",
53+
"name": "default",
54+
"type": "Microsoft.ContainerService/deploymentSafeguards",
55+
"systemData": {
56+
"createdBy": "someUser",
57+
"createdByType": "User",
58+
"createdAt": "2022-03-23T05:40:40.657Z",
59+
"lastModifiedBy": "someOtherUser",
60+
"lastModifiedByType": "User",
61+
"lastModifiedAt": "2022-03-23T05:40:40.657Z"
62+
},
63+
"eTag": "23ujdflewrj3=",
64+
"properties": {
65+
"level": "Warn",
66+
"systemExcludedNamespaces": [
67+
"kube-system",
68+
"gatekeeper-system"
69+
],
70+
"podSecurityStandardsLevel": "Baseline",
71+
"provisioningState": "Succeeded"
72+
}
73+
}
74+
}
75+
}
76+
}

‎specification/containerservice/DeploymentSafeguards.Management/examples/2025-05-02-preview/DeploymentSafeguards_Delete.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"operationId": "DeploymentSafeguards_Delete",
3+
"title": "Deletes a DeploymentSafeguard resource asynchronously with a long running operation.",
4+
"parameters": {
5+
"api-version": "2025-05-02-preview",
6+
"resourceUri": "subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1"
7+
},
8+
"responses": {
9+
"202": {
10+
"headers": {
11+
"Location": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operations/00000000-0000-0000-0000-000000000000?api-version=2022-02-01",
12+
"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operationResults/00000000-0000-0000-0000-000000000000?api-version=2022-02-01"
13+
}
14+
},
15+
"204": {}
16+
}
17+
}

‎specification/containerservice/DeploymentSafeguards.Management/examples/2025-05-02-preview/DeploymentSafeguards_Get.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"operationId": "DeploymentSafeguards_Get",
3+
"title": "Gets a DeploymentSafeguard resource.",
4+
"parameters": {
5+
"api-version": "2025-05-02-preview",
6+
"resourceUri": "subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1"
7+
},
8+
"responses": {
9+
"200": {
10+
"headers": {
11+
"ETag": "kd30rkdfo49="
12+
},
13+
"body": {
14+
"id": "/subscriptions/subid1/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1/providers/Microsoft.ContainerService/deploymentSafeguards/default",
15+
"name": "default",
16+
"type": "Microsoft.ContainerService/deploymentSafeguards",
17+
"systemData": {
18+
"createdBy": "someUser",
19+
"createdByType": "User",
20+
"createdAt": "2022-03-23T05:40:40.657Z",
21+
"lastModifiedBy": "someOtherUser",
22+
"lastModifiedByType": "User",
23+
"lastModifiedAt": "2022-03-23T05:40:40.657Z"
24+
},
25+
"eTag": "23ujdflewrj3=",
26+
"properties": {
27+
"level": "Warn",
28+
"systemExcludedNamespaces": [
29+
"kube-system",
30+
"gatekeeper-system"
31+
],
32+
"podSecurityStandardsLevel": "Baseline",
33+
"provisioningState": "Succeeded"
34+
}
35+
}
36+
}
37+
}
38+
}

‎specification/containerservice/DeploymentSafeguards.Management/examples/2025-05-02-preview/DeploymentSafeguards_List.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"operationId": "DeploymentSafeguards_List",
3+
"title": "Lists DeploymentSafeguards by parent resource.",
4+
"parameters": {
5+
"api-version": "2025-05-02-preview",
6+
"resourceUri": "subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1"
7+
},
8+
"responses": {
9+
"200": {
10+
"headers": {
11+
"ETag": "kd30rkdfo49="
12+
},
13+
"body": {
14+
"value": [
15+
{
16+
"id": "/subscriptions/subid1/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1/providers/Microsoft.ContainerService/deploymentSafeguards/default",
17+
"name": "default",
18+
"type": "Microsoft.ContainerService/deploymentSafeguards",
19+
"systemData": {
20+
"createdBy": "someUser",
21+
"createdByType": "User",
22+
"createdAt": "2022-03-23T05:40:40.657Z",
23+
"lastModifiedBy": "someOtherUser",
24+
"lastModifiedByType": "User",
25+
"lastModifiedAt": "2022-03-23T05:40:40.657Z"
26+
},
27+
"eTag": "23ujdflewrj3=",
28+
"properties": {
29+
"level": "Warn",
30+
"systemExcludedNamespaces": [
31+
"kube-system",
32+
"gatekeeper-system"
33+
],
34+
"podSecurityStandardsLevel": "Baseline",
35+
"provisioningState": "Succeeded"
36+
}
37+
}
38+
]
39+
}
40+
}
41+
}
42+
}

‎specification/containerservice/DeploymentSafeguards.Management/examples/2025-05-02-preview/Operations_List.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"operationId": "Operations_List",
3+
"title": "List the operations for the provider.",
4+
"parameters": {
5+
"api-version": "2025-05-02-preview"
6+
},
7+
"responses": {
8+
"200": {
9+
"body": {
10+
"value": [
11+
{
12+
"display": {
13+
"description": "Gets the status of an asynchronous operation",
14+
"operation": "Get Operation",
15+
"provider": "Microsoft Container Service",
16+
"resource": "Operation"
17+
},
18+
"name": "Microsoft.ContainerService/locations/operations/read",
19+
"origin": "user,system"
20+
}
21+
]
22+
}
23+
}
24+
}
25+
}

‎specification/containerservice/DeploymentSafeguards.Management/main.tsp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,11 @@ enum Versions {
3131
@useDependency(Azure.Core.Versions.v1_0_Preview_2)
3232
@armCommonTypesVersion(Azure.ResourceManager.CommonTypes.Versions.v6)
3333
v2025_04_01: "2025-04-01",
34+
35+
/** 2025-05-02-preview version */
36+
@doc("Deployment Safeguards api version 2025-05-02-preview")
37+
@useDependency(Azure.ResourceManager.Versions.v1_0_Preview_1)
38+
@useDependency(Azure.Core.Versions.v1_0_Preview_2)
39+
@armCommonTypesVersion(Azure.ResourceManager.CommonTypes.Versions.v6)
40+
v2025_05_02_preview: "2025-05-02-preview",
3441
}

0 commit comments

Comments
 (0)