# yaml-language-server: $schema=../../../../api/jsonschema/harp.bundle.v1/RuleSet.json
apiVersion: harp.elastic.co/v1
kind: RuleSet
meta:
  name: harp-server
  description: Package and secret constraints for harp-server
  owner: security@elastic.co
spec:
  rules:
    - name: HARP-SRV-0001
      description: The target package must have all secrets declared
      path: "app/qa/security/harp/v1.0.0/server/database/credentials"
      rego: |
        package harp
        default compliant = false

        compliant {
            input.annotations["infosec.elastic.co/v1/SecretPolicy#severity"] == "moderate"
            secrets := ["DB_HOST","DB_NAME","DB_USER","DB_PASSWORD"]
            # Has all secrets
            input.secrets.data[_].key == secrets[_]
        }
