wip - Added validation policies for Deployment and DeploymentConfig

[garethahealy]

What is this PR About?

Adds validation policies suggested by @noelo (https://github.com/noelo/omydb)

This is "an early preview" to get some feedback / allow people to ask questions etc.

Question for the mergers (@tylerauerbeck or @pabrahamsson)

• Since the PR is quite large. Do you want it split up into several? or happy to merge as a whole?

cc: @redhat-cop/rego-policies

[garethahealy]

DONT MERGE

[garethahealy]

CC @springdo @ckavili for review/input/thoughts

[springdo]

@garethahealy - now that some of the other PRs are merged in, do you want to split this puppy up into smaller chunks and smash em in?

[garethahealy]

@springdo ; whats best/easiest way for you to review? PR per group?

• https://github.com/redhat-cop/rego-policies/pull/19/files#diff-04c6e90faac2675aa89e2176d2eec7d8R19-R42

i.e.: split this into 8 PRs?

[garethahealy]

CI was failing due to required conftest 0.19.0 feature:

# Error: get test result: running warn rules: run multiple queries: run query: evaluating policy: policy/warn-k8s_ocp-deployment_deploymentconfig-bestpractices.rego:176: eval_builtin_error: units.parse_bytes: units.parse_bytes error: byte unit mi not recognized

[springdo]

@garethahealy - few things at a quick glance on this monster pr .....

• Perhaps for each policy's readability, some docs would be good. Im thinking, where you pulled the policy idea from. So, for example, for the Readiness Probe you could point to something like this https://learnk8s.io/production-best-practices#application-development.
• The helper functions is getting big, would be good to split them out into some kinda module or dep that could be pulled in by other library. Im thinking, in containers-quickstarts or something similar. I think I'll raise that as a separate issue though as not directly linked by this PR
• Naming of some of the files could be easier, ie the policy that checks labels bp could say that instead of warn-k8s_ocp-all-bestpractices ie {policy-type}-{platform}-{kind}-{other...} = warn-k8s_ocp-label-bestpractices. I think the policies will be easier to maintain as smaller specific chunks in this way

[redhat-cop-ci-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: garethahealy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment