HighFile-scope Plug & play

Set CPU/memory requests and limits for all containers

Every container must specify resources.requests and resources.limits for cpu and memory.

Why this matters

Prevents noisy-neighbor issues and enables reliable scheduling.

Side-by-side examples engineers can pattern-match during review.

Avoid

containers:
- name: api
 image: api:1.2

Prefer

containers:
- name: api
 image: api:1.2
 resources:
 requests:
 cpu: "200m"
 memory: "256Mi"
 limits:
 cpu: "500m"
 memory: "512Mi"

Good

resources:
 requests:
 cpu: 200m
 memory: 256Mi
 limits:
 cpu: 500m
 memory: 512Mi

Bad

resources: {}

From the same buckets as this rule.

Critical
Disallow public ingress without explicit allowlist
For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.
infra-as-codesecurity-hardening+1
Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
Critical
Pulumi TS: secrets must use Config.requireSecret
In Pulumi TypeScript programs, load sensitive values with new Config().requireSecret and pass as Secret<T>, never plain strings.
infra-as-codesecrets-credentials+1