AzPolicyAdvertizer

last sync: 2025-Jun-20 17:23:43 UTC

Ensure cluster containers have readiness or liveness probes configured

Azure BuiltIn Policy definition

Source Azure Portal
Display name Ensure cluster containers have readiness or liveness probes configured
Id b1a9997f-2883-4f12-bdff-2280f99b5915
Version 3.3.0
Details on versioning
Versioning Versions supported for Versioning: 3
3.3.0
3.2.0
3.1.0
Built-in Versioning [Preview]
Category Kubernetes
Microsoft Learn
Description This policy enforces that all pods have a readiness and/or liveness probes configured. Probe Types can be any of tcpSocket, httpGet and exec. This policy is generally available for Kubernetes Service (AKS), and preview for Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc.
Cloud environments AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
Available in AzUSGov The Policy is available in AzureUSGovernment cloud. Version: '4.2.0'
Repository: Azure-Policy b1a9997f-2883-4f12-bdff-2280f99b5915
Mode Microsoft.Kubernetes.Data
Type BuiltIn
Preview False
Deprecated False
Effect Default
Audit
Allowed
Audit, Deny, Disabled
RBAC role(s) none
Rule aliases none
Rule resource types IF (2)
Compliance Not a Compliance control
Initiatives usage
Rows: 1-2 / 2
Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Page of 1
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
[Preview]: Deployment safeguards should help guide developers towards AKS recommended best practices c047ea8e-9c78-49b2-958b-37e56d291a44 Kubernetes Preview BuiltIn true
Enforce recommended guardrails for Kubernetes Enforce-Guardrails-Kubernetes Kubernetes GA ALZ
History
Date/Time (UTC ymd) (i) Change type Change detail
2024-08-09 18:17:47 change Minor (3.2.0 > 3.3.0)
2024-02-20 22:44:08 change Minor (3.1.0 > 3.2.0)
2023-05-01 17:41:52 change Minor (3.0.1 > 3.1.0)
2022-10-21 16:42:13 change Patch (3.0.0 > 3.0.1)
2022-09-19 17:41:40 change Major (2.0.0 > 3.0.0)
2022-06-17 16:31:08 change Major (1.1.0 > 2.0.0)
2022-04-29 18:06:01 change Minor (1.0.0 > 1.1.0)
2022-02-04 18:25:37 add b1a9997f-2883-4f12-bdff-2280f99b5915
JSON compare
compare mode: version left: version right:
3.2.0 → 3.3.0 RENAMED
@@ -3,22 +3,31 @@
3
  "policyType": "BuiltIn",
4
  "mode": "Microsoft.Kubernetes.Data",
5
  "description": "This policy enforces that all pods have a readiness and/or liveness probes configured. Probe Types can be any of tcpSocket, httpGet and exec. This policy is generally available for Kubernetes Service (AKS), and preview for Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc.",
6
  "metadata": {
7
- "version": "3.2.0",
8
  "category": "Kubernetes"
9
  },
10
  "parameters": {
 
 
 
 
 
 
 
 
 
 
 
 
 
11
  "warn": {
12
  "type": "Boolean",
13
  "metadata": {
14
  "displayName": "Warn",
15
  "description": "Whether or not to return warnings back to the user in the kubectl cli"
16
  },
17
- "allowedValues": [
18
- true,
19
- false
20
- ],
21
  "defaultValue": false
22
  },
23
  "effect": {
24
  "type": "String",
@@ -154,8 +163,9 @@
154
  },
155
  "then": {
156
  "effect": "[parameters('effect')]",
157
  "details": {
 
158
  "warn": "[parameters('warn')]",
159
  "templateInfo": {
160
  "sourceType": "PublicURL",
161
  "url": "https://store.policy.core.windows.net/kubernetes/container-enforce-probes/v2/template.yaml"
 
3
  "policyType": "BuiltIn",
4
  "mode": "Microsoft.Kubernetes.Data",
5
  "description": "This policy enforces that all pods have a readiness and/or liveness probes configured. Probe Types can be any of tcpSocket, httpGet and exec. This policy is generally available for Kubernetes Service (AKS), and preview for Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc.",
6
  "metadata": {
7
+ "version": "3.3.0",
8
  "category": "Kubernetes"
9
  },
10
  "parameters": {
11
+ "source": {
12
+ "type": "String",
13
+ "metadata": {
14
+ "displayName": "Source",
15
+ "description": "The source k8s object for constraint evaluation. 'Original' means only evaluate against the specific GroupVersionKind specified in the policy definition. 'Generated' means only evaluate against k8s objects generated by Gatekeeper ExpansionTemplates. 'All' means evaluate against both the original object and any generated ones."
16
+ },
17
+ "allowedValues": [
18
+ "All",
19
+ "Generated",
20
+ "Original"
21
+ ],
22
+ "defaultValue": "Original"
23
+ },
24
  "warn": {
25
  "type": "Boolean",
26
  "metadata": {
27
  "displayName": "Warn",
28
  "description": "Whether or not to return warnings back to the user in the kubectl cli"
29
  },
 
 
 
 
30
  "defaultValue": false
31
  },
32
  "effect": {
33
  "type": "String",
 
163
  },
164
  "then": {
165
  "effect": "[parameters('effect')]",
166
  "details": {
167
+ "source": "[parameters('source')]",
168
  "warn": "[parameters('warn')]",
169
  "templateInfo": {
170
  "sourceType": "PublicURL",
171
  "url": "https://store.policy.core.windows.net/kubernetes/container-enforce-probes/v2/template.yaml"
JSON
api-version=2021-06-01
EPAC 
{7 items
  • displayName: "Ensure cluster containers have readiness or liveness probes configured",
  • policyType: "BuiltIn",
  • mode: "Microsoft.Kubernetes.Data",
  • description: "This policy enforces that all pods have a readiness and/or liveness probes configured. Probe Types can be any of tcpSocket, httpGet and exec. This policy is generally available for Kubernetes Service (AKS), and preview for Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc.",
  • metadata: {2 items
    • version: "3.3.0",
    • category: "Kubernetes"
    },
  • parameters: {9 items
    • source: {4 items
      • type: "String",
      • metadata: {2 items
        • displayName: "Source",
        • description: "The source k8s object for constraint evaluation. 'Original' means only evaluate against the specific GroupVersionKind specified in the policy definition. 'Generated' means only evaluate against k8s objects generated by Gatekeeper ExpansionTemplates. 'All' means evaluate against both the original object and any generated ones."
        },
      • allowedValues: [3 items
        • "All",
        • "Generated",
        • "Original"
        ],
      • defaultValue: "Original"
      },
    • warn: {3 items
      • type: "Boolean",
      • metadata: {2 items
        • displayName: "Warn",
        • description: "Whether or not to return warnings back to the user in the kubectl cli"
        },
      • defaultValue: false
      },
    • effect: {4 items
      • type: "String",
      • metadata: {3 items
        • displayName: "Effect",
        • description: "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy.",
        • portalReview: true
        },
      • allowedValues: [3 items
        • "Audit",
        • "Deny",
        • "Disabled"
        ],
      • defaultValue: "Audit"
      },
    • excludedNamespaces: {3 items
      • type: "Array",
      • metadata: {2 items
        • displayName: "Namespace exclusions",
        • description: "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces "kube-system", "gatekeeper-system" and "azure-arc" are always excluded by design. "azure-extensions-usage-system" is optional to remove."
        },
      • defaultValue: [4 items
        • "kube-system",
        • "gatekeeper-system",
        • "azure-arc",
        • "azure-extensions-usage-system"
        ]
      },
    • namespaces: {3 items
      • type: "Array",
      • metadata: {2 items
        • displayName: "Namespace inclusions",
        • description: "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
        },
      • defaultValue: []
      },
    • labelSelector: {4 items
      • type: "Object",
      • metadata: {2 items
        • displayName: "Kubernetes label selector",
        • description: "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
        },
      • defaultValue: {},
      • schema: {4 items
        • description: "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
        • type: "object",
        • properties: {2 items},
        • additionalProperties: false
        }
      },
    • requiredProbes: {3 items
      • type: "Array",
      • metadata: {3 items
        • displayName: "Required probes list",
        • description: "The list of probes that are required to be defined on a container. Kubernetes currently supports 'livenessProbe', 'readinessProbe', and 'startupProbe'.",
        • portalReview: true
        },
      • defaultValue: [2 items
        • "readinessProbe",
        • "livenessProbe"
        ]
      },
    • excludedContainers: {3 items
      • type: "Array",
      • metadata: {2 items
        • displayName: "Containers exclusions",
        • description: "The list of InitContainers and Containers to exclude from policy evaluation. The identify is the name of container. Use an empty list to apply this policy to all containers in all namespaces."
        },
      • defaultValue: []
      },
    • excludedImages: {3 items
      • type: "Array",
      • metadata: {3 items
        • displayName: "Image exclusions",
        • description: "The list of InitContainers and Containers to exclude from policy evaluation. The identifier is the image of container. Prefix-matching can be signified with `*`. For example: `myregistry.azurecr.io/istio:*`. It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
        • portalReview: true
        },
      • defaultValue: []
      }
    },
  • policyRule: {2 items
    • if: {2 items
      • field: "type",
      • in: [2 items
        • "Microsoft.Kubernetes/connectedClusters",
        • "Microsoft.ContainerService/managedClusters"
        ]
      },
    • then: {2 items
      • effect: "[parameters('effect')]",
      • details: {9 items
        • source: "[parameters('source')]",
        • warn: "[parameters('warn')]",
        • templateInfo: {2 items
          • sourceType: "PublicURL",
          • url: "https://store.policy.core.windows.net/kubernetes/container-enforce-probes/v2/template.yaml"
          },
        • apiGroups: [1 item
          • ""
          ],
        • kinds: [1 item
          • "Pod"
          ],
        • excludedNamespaces: "[parameters('excludedNamespaces')]",
        • namespaces: "[parameters('namespaces')]",
        • labelSelector: "[parameters('labelSelector')]",
        • values: {3 items
          • enforceProbes: "[parameters('requiredProbes')]",
          • excludedContainers: "[parameters('excludedContainers')]",
          • excludedImages: "[parameters('excludedImages')]"
          }
        }
      }
    }
}