feat: add codegen

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

catalog/ecs/ecs-cluster-enable-logging.yaml

@@ -2,6 +2,11 @@ apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: ecs-cluster-enable-logging
+  labels:
+    ecs.aws.tags.kyverno.io: 'ecs-cluster'
+  annotations:
+    title.policy.kyverno.io: ECS cluster enable logging
+    description.policy.kyverno.io: This Policy ensures that ECS clusters have logging enabled.
 spec:
   rules:
     - name: ecs-cluster-enable-logging

catalog/ecs/ecs-cluster-required-container-insights.yaml

@@ -2,6 +2,11 @@ apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: required-container-insights
+  labels:
+    ecs.aws.tags.kyverno.io: 'ecs-cluster'
+  annotations:
+    title.policy.kyverno.io: ECS requires container insights
+    description.policy.kyverno.io: This Policy ensures that ECS clusters have container insights enabled.
 spec:
   rules:
     - name: required-container-insights

catalog/ecs/ecs-service-public-ip.yaml

@@ -2,6 +2,11 @@ apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: ecs-public-ip
+  labels:
+    ecs.aws.tags.kyverno.io: 'ecs-service'
+  annotations:
+    title.policy.kyverno.io: ECS public IP
+    description.policy.kyverno.io: This Policy ensures that ECS services do not have public IP addresses assigned to them automatically.
 spec:
   rules:
     - name: ecs-public-ip

catalog/ecs/ecs-service-required-latest-platform-fargate.yaml

@@ -2,6 +2,11 @@ apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: required-latest-platform-fargate
+  labels:
+    ecs.aws.tags.kyverno.io: 'ecs-service'
+  annotations:
+    title.policy.kyverno.io: ECS require latest platform fargate
+    description.policy.kyverno.io: This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
 spec:
   rules:
     - name: required-latest-platform

catalog/ecs/ecs-task-definition-fs-read-only.yaml

@@ -2,6 +2,11 @@ apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: fs-read-only
+  labels:
+    ecs.aws.tags.kyverno.io: 'ecs-task-definition'
+  annotations:
+    title.policy.kyverno.io: ECS require filesystem read only
+    description.policy.kyverno.io: This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
 spec:
   rules:
     - name: require-fs-read-only
@@ -10,7 +15,7 @@ spec:
         - type: aws_ecs_task_definition
       assert:
         any:
-        - message: ECS containers only have read-only access to root filesystems
+        - message: ECS containers should only have read-only access to root filesystems
           check:
             values:
               ~.(json_parse(container_definitions)):

website/docs/catalog/policies/ecs/ecs-cluster-enable-logging.md

@@ -0,0 +1,61 @@
+---
+tags:
+- aws
+- aws/ecs
+---
+# ECS cluster enable logging
+
+## Description
+
+This Policy ensures that ECS clusters have logging enabled.
+
+## Install
+
+### In cluster
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-enable-logging.yaml
+```
+
+### Download locally
+
+```bash
+curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-enable-logging.yaml
+```
+
+## Manifest
+
+[Original policy](https://github.com/kyverno/kyverno-json/blob/main/catalog/ecs/ecs-cluster-enable-logging.yaml)
+[Raw](https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-enable-logging.yaml)
+
+```yaml
+apiVersion: json.kyverno.io/v1alpha1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    description.policy.kyverno.io: This Policy ensures that ECS clusters have logging
+      enabled.
+    title.policy.kyverno.io: ECS cluster enable logging
+  creationTimestamp: null
+  labels:
+    ecs.aws.tags.kyverno.io: ecs-cluster
+  name: ecs-cluster-enable-logging
+spec:
+  rules:
+  - assert:
+      all:
+      - check:
+          values:
+            ~.configuration:
+              ~.execute_command_configuration:
+                (contains($forbidden_values, @.logging)): false
+        message: ECS Cluster should enable logging of ECS Exec
+    context:
+    - name: forbidden_values
+      variable:
+      - NONE
+    match:
+      any:
+      - type: aws_ecs_cluster
+    name: ecs-cluster-enable-logging
+```

website/docs/catalog/policies/ecs/ecs-cluster-required-container-insights.md

@@ -0,0 +1,57 @@
+---
+tags:
+- aws
+- aws/ecs
+---
+# ECS requires container insights
+
+## Description
+
+This Policy ensures that ECS clusters have container insights enabled.
+
+## Install
+
+### In cluster
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-required-container-insights.yaml
+```
+
+### Download locally
+
+```bash
+curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-required-container-insights.yaml
+```
+
+## Manifest
+
+[Original policy](https://github.com/kyverno/kyverno-json/blob/main/catalog/ecs/ecs-cluster-required-container-insights.yaml)
+[Raw](https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-required-container-insights.yaml)
+
+```yaml
+apiVersion: json.kyverno.io/v1alpha1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    description.policy.kyverno.io: This Policy ensures that ECS clusters have container
+      insights enabled.
+    title.policy.kyverno.io: ECS requires container insights
+  creationTimestamp: null
+  labels:
+    ecs.aws.tags.kyverno.io: ecs-cluster
+  name: required-container-insights
+spec:
+  rules:
+  - assert:
+      all:
+      - check:
+          values:
+            ~.setting:
+              name: containerInsights
+              value: enabled
+        message: Container insights should be enabled on ECS cluster
+    match:
+      any:
+      - type: aws_ecs_cluster
+    name: required-container-insights
+```

website/docs/catalog/policies/ecs/ecs-service-public-ip.md

@@ -0,0 +1,61 @@
+---
+tags:
+- aws
+- aws/ecs
+---
+# ECS public IP
+
+## Description
+
+This Policy ensures that ECS services do not have public IP addresses assigned to them automatically.
+
+## Install
+
+### In cluster
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-public-ip.yaml
+```
+
+### Download locally
+
+```bash
+curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-public-ip.yaml
+```
+
+## Manifest
+
+[Original policy](https://github.com/kyverno/kyverno-json/blob/main/catalog/ecs/ecs-service-public-ip.yaml)
+[Raw](https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-public-ip.yaml)
+
+```yaml
+apiVersion: json.kyverno.io/v1alpha1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    description.policy.kyverno.io: This Policy ensures that ECS services do not have
+      public IP addresses assigned to them automatically.
+    title.policy.kyverno.io: ECS public IP
+  creationTimestamp: null
+  labels:
+    ecs.aws.tags.kyverno.io: ecs-service
+  name: ecs-public-ip
+spec:
+  rules:
+  - assert:
+      all:
+      - check:
+          values:
+            ~.network_configuration:
+              (contains('$allowed-values', @.assign_public_ip)): false
+        message: ECS services should not have public IP addresses assigned to them
+          automatically
+    context:
+    - name: allowed-values
+      variable:
+      - false
+    match:
+      any:
+      - type: aws_ecs_service
+    name: ecs-public-ip
+```

website/docs/catalog/policies/ecs/ecs-service-required-latest-platform-fargate.md

@@ -0,0 +1,60 @@
+---
+tags:
+- aws
+- aws/ecs
+---
+# ECS require latest platform fargate
+
+## Description
+
+This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
+
+## Install
+
+### In cluster
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml
+```
+
+### Download locally
+
+```bash
+curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml
+```
+
+## Manifest
+
+[Original policy](https://github.com/kyverno/kyverno-json/blob/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml)
+[Raw](https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml)
+
+```yaml
+apiVersion: json.kyverno.io/v1alpha1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    description.policy.kyverno.io: This Policy ensures that ECS Fargate services runs
+      on the latest Fargate platform version.
+    title.policy.kyverno.io: ECS require latest platform fargate
+  creationTimestamp: null
+  labels:
+    ecs.aws.tags.kyverno.io: ecs-service
+  name: required-latest-platform-fargate
+spec:
+  rules:
+  - assert:
+      all:
+      - check:
+          values:
+            platform_version: LATEST
+        message: ECS Fargate services should run on the latest Fargate platform version
+    context:
+    - name: pv
+      variable: platform_version
+    match:
+      any:
+      - type: aws_ecs_service
+        values:
+          launch_type: FARGATE
+    name: required-latest-platform
+```

website/docs/catalog/policies/ecs/ecs-task-definition-fs-read-only.md

@@ -0,0 +1,56 @@
+---
+tags:
+- aws
+- aws/ecs
+---
+# ECS require filesystem read only
+
+## Description
+
+This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
+
+## Install
+
+### In cluster
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml
+```
+
+### Download locally
+
+```bash
+curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml
+```
+
+## Manifest
+
+[Original policy](https://github.com/kyverno/kyverno-json/blob/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml)
+[Raw](https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml)
+
+```yaml
+apiVersion: json.kyverno.io/v1alpha1
+kind: ValidatingPolicy
+metadata:
+  annotations:
+    description.policy.kyverno.io: This Policy ensures that ECS Fargate services runs
+      on the latest Fargate platform version.
+    title.policy.kyverno.io: ECS require filesystem read only
+  creationTimestamp: null
+  labels:
+    ecs.aws.tags.kyverno.io: ecs-task-definition
+  name: fs-read-only
+spec:
+  rules:
+  - assert:
+      any:
+      - check:
+          values:
+            ~.(json_parse(container_definitions)):
+              readonlyRootFilesystem: true
+        message: ECS containers should only have read-only access to root filesystems
+    match:
+      any:
+      - type: aws_ecs_task_definition
+    name: require-fs-read-only
+```

website/mkdocs.yaml

@@ -40,6 +40,11 @@ nav:
   - catalog/index.md
   - All:
     - catalog/policies/aws/policy-1.md
+    - catalog/policies/ecs/ecs-cluster-enable-logging.md
+    - catalog/policies/ecs/ecs-cluster-required-container-insights.md
+    - catalog/policies/ecs/ecs-service-public-ip.md
+    - catalog/policies/ecs/ecs-service-required-latest-platform-fargate.md
+    - catalog/policies/ecs/ecs-task-definition-fs-read-only.md
     - catalog/policies/ecs/policy-1.md
 - Playground:
   - playground.md