LowPR-scope Plug & play

Add a PodDisruptionBudget for HA Deployments

For Deployments with replicas ≥ 2, include a PodDisruptionBudget with minAvailable or maxUnavailable set.

Why this matters

PDBs preserve availability during voluntary disruptions such as node drains.

Side-by-side examples engineers can pattern-match during review.

Avoid

apiVersion: apps/v1
kind: Deployment
metadata:
 name: auth
spec:
 replicas: 3
 template: { }
# (no PDB)

Prefer

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
 name: auth-pdb
spec:
 maxUnavailable: 1
 selector:
 matchLabels:
 app: auth

Good

kind: PodDisruptionBudget
spec:
 minAvailable: 2

Bad

kind: Deployment
spec:
 replicas: 3

From the same buckets as this rule.

Critical
Disallow public ingress without explicit allowlist
For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.
infra-as-codesecurity-hardening+1
Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
Critical
Pulumi TS: secrets must use Config.requireSecret
In Pulumi TypeScript programs, load sensitive values with new Config().requireSecret and pass as Secret<T>, never plain strings.
infra-as-codesecrets-credentials+1