Infrastructure as Code rules

For Ingress/Service of type LoadBalancer, require host/path allowlist and TLS; forbid 0.0.0.0/0 exposure without WAF or Auth.

Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.

In Pulumi TypeScript programs, load sensitive values with new Config().requireSecret and pass as Secret<T>, never plain strings.

If a PR introduces workloads in a namespace that lacks a default-deny NetworkPolicy, add one plus explicit allow rules.

Use immutable image digests (repo@sha256:...) instead of mutable tags for production workloads.

Use version constraints for required_providers and modules, and include .terraform.lock.hcl in PRs that change dependencies.

Write ePHI backups to storage with server-side encryption (SSE-KMS) and least-privilege access; disallow public ACLs and cross-account access without a BAA. Record the KMS key id in metadata.

For stateful/critical infra (state buckets, databases), create resources with pulumi.Protect(true) to block accidental destroy.

CI must run fmt/validate, produce and upload a plan artifact (e.g., terraform plan -out plan.bin), run policy-as-code (e.g., tfsec/checkov/conftest), and gate apply on manual approval for prod.

Every container must specify resources.requests and resources.limits for cpu and memory.

All Terraform/Kubernetes resources must include standard tags/labels: owner, env, cost-center (and application if available).

Configure a remote backend with state locking (e.g., S3 + DynamoDB table or AzureRM blob with leases). Do not use local backend for shared environments.

If a PR changes redirect/header configuration (e.g., middleware redirects, CDN headers, security headers), validate it against the active edge rules to avoid conflicts. - If a Cloudflare MCP is available: fetch active rules and detect potential redirect loops, duplicate rules, or header conflicts. - Otherwise: require the author to link the relevant Cloudflare rules/screenshots in the PR description.

For Deployments with replicas ≥ 2, include a PodDisruptionBudget with minAvailable or maxUnavailable set.

Use template helpers to set metadata.name and labels (app.kubernetes.io/) consistently across templates; prohibit hardcoded mismatches.

All variables must declare a type, default (when sensible), and validation blocks; mark sensitive inputs with sensitive=true.