https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/Recent content in Enforce on CapsuleHugo -- gohugo.ioenhttps://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/workloads/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/workloads/Workload enforcement is configured under spec.rules[].enforce.workloads. Use targets to select native workload kinds or locations inside their Pod specs. A targets-only rule matches the selected kinds themselves. When workload policies are present, targets scope those policies: resource management, OCI registries, scheduler names, QoS, placement, security profiles, and PodDisruptionBudgets. Rules use the shared namespace selection, audiences, conditions, and actions and order. See Reference for a complete Tenant example. Rule Composition Actions and order Rules are evaluated in declaration order after namespace selection, audience, and condition filtering.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/metadata/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/metadata/Metadata enforcement is configured under spec.rules[].enforce.metadata. Use Metadata Targets to select resource kinds, then configure labels and annotations, including defaults, managed values, required keys, and value validation. Migration covers the legacy Namespace, Pod, and Service metadata options. Rules use the shared namespace selection, audiences, conditions, and actions and order. See Reference for a complete Tenant example. Rule Composition Actions and order Metadata rules are evaluated in declaration order after namespace selection, audience, and condition filtering.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/network/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/network/Network enforcement covers three policy groups under spec.rules[].enforce: Policy Configuration path Network Policies network.policies.ingress.cidrs, network.policies.egress.cidrs Services services Ingress ingress Use these policies to control ingress and egress CIDR grants, Service types and addresses, and hostnames on ingress resources. Reference provides a complete Tenant example for each policy group. Rules use the shared namespace selection, audiences, conditions, and actions and order. Rule Composition Actions and order Rules are evaluated in declaration order after namespace selection, audience, and condition filtering.https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/storage/Mon, 01 Jan 0001 00:00:00 +0000https://deploy-preview-164--docs-projectcapsule.netlify.app/docs/rules/enforcement/storage/Storage enforcement is configured under spec.rules[].enforce.storage. Persistent Volumes covers default Tenant isolation and additional volume access for PVs without a Tenant label. Rules use the shared namespace selection, audiences, conditions, and actions and order. See Reference for a complete Tenant example. Rule Composition Actions and order Storage rules use the existing ordered action evaluation, but affect only additional access to PVs without a Tenant label: Action Effect on additional access allow Grants access when the selector, audience, namespace selection, and all conditions match.