Enforce Multiple Replicas 1.0.4

Enforces that ReplicaSets, ReplicationControllers, Deployments and StatefulSets create more than one replica.


Note that this policy is part of the following security standards:

  • bsi/containerization: BSI IT-Grundschutz "Containerisierung": Section: SYS.1.6.A25
  • Operational
  • bsi/containerization

Applies to

  • ReplicaSet
  • ReplicationController
  • Deployment
  • StatefulSet

Example

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
- replicas: 1
+ replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - containerPort: 80

Risk acceptance

Use the annotation securitytower.io/policy.exclusion.enforcemultiplereplicas as on the example below.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: your-deployment
  annotations:
    securitytower.io/policy.exclusion.enforcemultiplereplicas: |-
      The image vendor is stateful and cannot be replicated.
...