hull policy

Synopsis

hull policy evaluates the guardrail rules a package ships in its policies/ directory against a rendered Kubernetes manifest. Use it to catch disallowed images, missing resource limits, absent labels, and similar mistakes before the manifests reach a cluster.

The rules live in <package-path>/policies/*.yaml. Each rule has a name, a severity (deny fails the check, warn only prints), an optional match selector (kinds, namespaces, names, apiVersion), and require / forbid predicates such as imageRegistries, imageNotTagged, resourceLimits, minReplicas, labelKeys, and fields.

Subcommands

Command	What it does
check	Evaluate the package’s rules against a manifest and pass or fail.
list	Print the rules a package declares, with their severities.

Usage

hull policy [command]

Render a package and check it in one pipeline:

hull template ./mychart | hull policy check ./mychart

List the rules a package enforces:

hull policy list ./mychart

See also

• policy check — run the rules against a manifest
• policy list — show the declared rules
• template — render the manifest you pipe into check
• install — apply the package once it passes
• package verify — verify a package’s signature