Skip to content

Commit 49313ba

Browse files
CopilotCopilot
authored
Add March 2026 quarterly baselines (#3717)
1 parent 612ddbd commit 49313ba

8 files changed

Lines changed: 390 additions & 8 deletions

File tree

‎.github/prompts/quarterly-baseline-update.prompt.md‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
Quarterly Baseline Update Instructions
2+
3+
Purpose
4+
5+
A concise guide to add a new quarterly baseline (e.g. `Azure.GA_2026_03`, `Azure.Preview_2026_03`, `Azure.CAF_2026_03`) and mark the previous quarter's baselines as obsolete.
6+
7+
Quarterly baselines are released every three months (March, June, September, December) for each year.
8+
Baseline names follow the pattern `Azure.GA_yyyy_mm` and `Azure.Preview_yyyy_mm`.
9+
10+
Steps
11+
12+
1. Branch
13+
- Create a feature branch: `git checkout -b <your-user>/quarterly-baseline-yyyy-mm`
14+
15+
2. Determine the new baseline period
16+
- The new period follows the pattern `yyyy_mm` (e.g. `2026_03` for March 2026).
17+
- The previous baseline (to mark obsolete) is the one that was previously `Latest` (no `obsolete` annotation).
18+
19+
3. Determine the current module version
20+
- Look at recent changelog entries in `docs/changelog.md` for the current `v1.x.x` release version.
21+
- The new baselines use `moduleVersion: v1.x.x` set to the upcoming release version.
22+
- To find the next version: check the current version in the most recently released baseline and increment appropriately.
23+
24+
4. Check for the current AKS minimum version
25+
- Look at `src/PSRule.Rules.Azure/rules/Config.Rule.yaml` for `AZURE_AKS_CLUSTER_MINIMUM_VERSION`.
26+
- Use this value in the new baselines.
27+
28+
5. Update `src/PSRule.Rules.Azure/rules/Baseline.Rule.yaml`
29+
- Mark the previous latest GA and Preview baselines as obsolete by adding `obsolete: true` to their `annotations` block.
30+
Example — change:
31+
```yaml
32+
annotations:
33+
export: true
34+
moduleVersion: v1.47.0
35+
```
36+
to:
37+
```yaml
38+
annotations:
39+
export: true
40+
moduleVersion: v1.47.0
41+
obsolete: true
42+
```
43+
- Append two new baseline entries at the end of the file (GA and Preview) following the existing pattern.
44+
Each new baseline includes all prior ruleSets plus the new `yyyy_mm` entry.
45+
46+
Example for `Azure.GA_2026_03`:
47+
```yaml
48+
---
49+
# Synopsis: Include rules released March 2026 or prior for Azure GA features.
50+
apiVersion: github.com/microsoft/PSRule/v1
51+
kind: Baseline
52+
metadata:
53+
name: Azure.GA_2026_03
54+
annotations:
55+
export: true
56+
moduleVersion: v1.48.0
57+
spec:
58+
configuration:
59+
# Configure minimum AKS cluster version
60+
AZURE_AKS_CLUSTER_MINIMUM_VERSION: '1.33.7'
61+
rule:
62+
tag:
63+
release: GA
64+
ruleSet:
65+
- '2020_06'
66+
# ... all prior ruleSets ...
67+
- '2025_12'
68+
- '2026_03'
69+
```
70+
71+
Example for `Azure.Preview_2026_03` (same but `release: preview`):
72+
```yaml
73+
---
74+
# Synopsis: Include rules released March 2026 or prior for Azure preview only features.
75+
apiVersion: github.com/microsoft/PSRule/v1
76+
kind: Baseline
77+
metadata:
78+
name: Azure.Preview_2026_03
79+
annotations:
80+
export: true
81+
moduleVersion: v1.48.0
82+
spec:
83+
configuration:
84+
# Configure minimum AKS cluster version
85+
AZURE_AKS_CLUSTER_MINIMUM_VERSION: '1.33.7'
86+
rule:
87+
tag:
88+
release: preview
89+
ruleSet:
90+
- '2020_06'
91+
# ... all prior ruleSets ...
92+
- '2025_12'
93+
- '2026_03'
94+
```
95+
96+
6. Update `src/PSRule.Rules.Azure/rules/CAF.Rule.yaml`
97+
- Append a new `Azure.CAF_yyyy_mm` baseline at the end of the file.
98+
- Copy the configuration from the most recent `Azure.CAF_*` baseline and add the new `yyyy_mm` ruleSet.
99+
- Update `moduleVersion` to the new version.
100+
101+
Example for `Azure.CAF_2026_03`:
102+
```yaml
103+
---
104+
# Synopsis: Includes rules related to Azure CAF based on a March 2026 snapshot.
105+
apiVersion: github.com/microsoft/PSRule/v1
106+
kind: Baseline
107+
metadata:
108+
name: Azure.CAF_2026_03
109+
annotations:
110+
taxonomy: Azure.CAF
111+
export: true
112+
moduleVersion: v1.48.0
113+
experimental: true
114+
spec:
115+
rule:
116+
tag:
117+
release: GA
118+
ruleSet:
119+
- '2020_06'
120+
# ... all prior ruleSets ...
121+
- '2025_12'
122+
- '2026_03'
123+
labels:
124+
Azure.CAF: '*'
125+
configuration:
126+
# Same configuration as the previous CAF baseline
127+
AZURE_VNET_NAME_FORMAT: '^vnet-'
128+
# etc.
129+
```
130+
131+
7. Update unit tests
132+
- Edit `tests/PSRule.Rules.Azure.Tests/Azure.Baseline.Tests.ps1`.
133+
- Add two new `It` blocks at the end of the `Context 'Rule'` section for `Azure.GA_yyyy_mm` and `Azure.Preview_yyyy_mm`.
134+
- To determine the correct rule count, build the module and run:
135+
```powershell
136+
Import-Module ./out/modules/PSRule.Rules.Azure -Force
137+
$ga = @(Get-PSRule -Module PSRule.Rules.Azure -Baseline 'Azure.GA_2026_03' -WarningAction Ignore)
138+
($ga | Where-Object { $_.Tag.release -in 'GA' }).Length
139+
$preview = @(Get-PSRule -Module PSRule.Rules.Azure -Baseline 'Azure.Preview_2026_03' -WarningAction Ignore)
140+
($preview | Where-Object { $_.Tag.release -in 'preview' }).Length
141+
```
142+
- Use the output counts in the test assertions.
143+
144+
Example:
145+
```powershell
146+
It 'With Azure.GA_2026_03' {
147+
$result = @(Get-PSRule -Module PSRule.Rules.Azure -Baseline 'Azure.GA_2026_03' -WarningAction Ignore);
148+
$filteredResult = @($result | Where-Object { $_.Tag.release -in 'GA'});
149+
$filteredResult | Should -Not -BeNullOrEmpty;
150+
$filteredResult.Length | Should -Be 517;
151+
}
152+
153+
It 'With Azure.Preview_2026_03' {
154+
$result = @(Get-PSRule -Module PSRule.Rules.Azure -Baseline 'Azure.Preview_2026_03' -WarningAction Ignore);
155+
$filteredResult = @($result | Where-Object { $_.Tag.release -in 'preview'});
156+
$filteredResult | Should -Not -BeNullOrEmpty;
157+
$filteredResult.Length | Should -Be 8;
158+
}
159+
```
160+
161+
8. Build and verify
162+
- Build the module:
163+
```powershell
164+
Invoke-Build BuildModule -File pipeline.build.ps1 -Configuration Debug -Build '0.0.1'
165+
```
166+
- Run the baseline tests:
167+
```powershell
168+
Import-Module ./out/modules/PSRule.Rules.Azure -Force
169+
Invoke-Pester tests/PSRule.Rules.Azure.Tests/Azure.Baseline.Tests.ps1 -Tag Baseline
170+
```
171+
- All tests should pass.
172+
173+
9. Changelog & PR
174+
- Add a changelog entry in `docs/changelog.md` under the `## Unreleased` section.
175+
176+
Example:
177+
```
178+
- New features:
179+
- Added March 2026 baselines `Azure.GA_2026_03`, `Azure.Preview_2026_03`, and `Azure.CAF_2026_03` by @BernieWhite.
180+
[#nnnn](https://github.com/Azure/PSRule.Rules.Azure/issues/nnnn)
181+
- Includes rules released before or during March 2026.
182+
- Marked `Azure.GA_2025_12` and `Azure.Preview_2025_12` baselines as obsolete.
183+
```
184+
185+
Notes & Tips
186+
187+
- Do NOT update auto-generated baseline documentation files in `docs/en/baselines/` — these are regenerated automatically.
188+
- The `docs/en/baselines/index.md` and individual baseline `.md` files have `generated: true` in their front matter.
189+
- The rule count for a new quarterly baseline is the same as the previous one if no new rules with the new `ruleSet` tag have been added yet.
190+
- After adding new rules tagged with the new `ruleSet` (e.g. `2026_03`), the baseline test counts must be updated accordingly.

‎docs/changelog.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,18 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3232

3333
What's changed since v1.47.0:
3434

35+
- New features:
36+
- Added March 2026 baselines `Azure.GA_2026_03`, `Azure.Preview_2026_03`, and `Azure.CAF_2026_03` by @BernieWhite.
37+
[#3709](https://github.com/Azure/PSRule.Rules.Azure/issues/3709)
38+
- Includes rules released before or during March 2026.
39+
- Marked `Azure.GA_2025_12` and `Azure.Preview_2025_12` baselines as obsolete.
3540
- New rules:
3641
- Azure Container Registry:
37-
- Check that audit diagnostic logs are enabled for Container Registry by @copilot.
38-
[#3536](https://github.com/Azure/PSRule.Rules.Azure/issues/3536)
42+
- Check that audit diagnostic logs are enabled for Container Registry by @BernieWhite.
43+
[#3445](https://github.com/Azure/PSRule.Rules.Azure/issues/3445)
3944
- Container Apps:
40-
- Check that liveness and readiness health probes use HTTP checks for HTTP-based ingress.
41-
[#3714](https://github.com/Azure/PSRule.Rules.Azure/issues/3714)
45+
- Check that liveness and readiness health probes use HTTP checks for HTTP-based ingress by @BernieWhite.
46+
[#3111](https://github.com/Azure/PSRule.Rules.Azure/issues/3111)
4247
- Updated rules:
4348
- Azure Kubernetes Service:
4449
- Updated `Azure.AKS.Version` to use `1.33.7` as the minimum version by @BernieWhite.

docs/en/rules/Azure.ACR.Logs.md renamed to docs/en/rules/Azure.ACR.AuditLogs.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ pillar: Security
55
category: SE:10 Monitoring and threat detection
66
resource: Container Registry
77
resourceType: Microsoft.ContainerRegistry/registries,Microsoft.Insights/diagnosticSettings
8-
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ACR.Logs/
8+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ACR.AuditLogs/
99
---
1010

1111
# Audit Container Registry access

‎src/PSRule.Rules.Azure/rules/Azure.ACR.Rule.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ Rule 'Azure.ACR.Naming' -Ref 'AZR-000506' -Type 'Microsoft.ContainerRegistry/reg
8181
}
8282

8383
# Synopsis: Ensure container registry audit diagnostic logs are enabled.
84-
Rule 'Azure.ACR.Logs' -Ref 'AZR-000535' -Type 'Microsoft.ContainerRegistry/registries' -Tag @{ release = 'GA'; ruleSet = '2026_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'LT-4'; 'Azure.WAF/maturity' = 'L1'; } {
84+
Rule 'Azure.ACR.AuditLogs' -Ref 'AZR-000535' -Type 'Microsoft.ContainerRegistry/registries' -Tag @{ release = 'GA'; ruleSet = '2026_06'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'LT-4'; 'Azure.WAF/maturity' = 'L1'; } {
8585
$logCategoryGroups = 'audit', 'allLogs'
8686
$joinedLogCategoryGroups = $logCategoryGroups -join ', '
8787
$diagnostics = @(GetSubResources -ResourceType 'Microsoft.Insights/diagnosticSettings', 'Microsoft.ContainerRegistry/registries/providers/diagnosticSettings' |

‎src/PSRule.Rules.Azure/rules/Baseline.Rule.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1208,6 +1208,7 @@ metadata:
12081208
annotations:
12091209
export: true
12101210
moduleVersion: v1.47.0
1211+
obsolete: true
12111212
spec:
12121213
configuration:
12131214
# Configure minimum AKS cluster version
@@ -1249,6 +1250,7 @@ metadata:
12491250
annotations:
12501251
export: true
12511252
moduleVersion: v1.47.0
1253+
obsolete: true
12521254
spec:
12531255
configuration:
12541256
# Configure minimum AKS cluster version
@@ -1280,3 +1282,87 @@ spec:
12801282
- '2025_06'
12811283
- '2025_09'
12821284
- '2025_12'
1285+
1286+
---
1287+
# Synopsis: Include rules released March 2026 or prior for Azure GA features.
1288+
apiVersion: github.com/microsoft/PSRule/v1
1289+
kind: Baseline
1290+
metadata:
1291+
name: Azure.GA_2026_03
1292+
annotations:
1293+
export: true
1294+
moduleVersion: v1.48.0
1295+
spec:
1296+
configuration:
1297+
# Configure minimum AKS cluster version
1298+
AZURE_AKS_CLUSTER_MINIMUM_VERSION: '1.33.7'
1299+
rule:
1300+
tag:
1301+
release: GA
1302+
ruleSet:
1303+
- '2020_06'
1304+
- '2020_09'
1305+
- '2020_12'
1306+
- '2021_03'
1307+
- '2021_06'
1308+
- '2021_09'
1309+
- '2021_12'
1310+
- '2022_03'
1311+
- '2022_06'
1312+
- '2022_09'
1313+
- '2022_12'
1314+
- '2023_03'
1315+
- '2023_06'
1316+
- '2023_09'
1317+
- '2023_12'
1318+
- '2024_03'
1319+
- '2024_06'
1320+
- '2024_09'
1321+
- '2024_12'
1322+
- '2025_03'
1323+
- '2025_06'
1324+
- '2025_09'
1325+
- '2025_12'
1326+
- '2026_03'
1327+
1328+
---
1329+
# Synopsis: Include rules released March 2026 or prior for Azure preview only features.
1330+
apiVersion: github.com/microsoft/PSRule/v1
1331+
kind: Baseline
1332+
metadata:
1333+
name: Azure.Preview_2026_03
1334+
annotations:
1335+
export: true
1336+
moduleVersion: v1.48.0
1337+
spec:
1338+
configuration:
1339+
# Configure minimum AKS cluster version
1340+
AZURE_AKS_CLUSTER_MINIMUM_VERSION: '1.33.7'
1341+
rule:
1342+
tag:
1343+
release: preview
1344+
ruleSet:
1345+
- '2020_06'
1346+
- '2020_09'
1347+
- '2020_12'
1348+
- '2021_03'
1349+
- '2021_06'
1350+
- '2021_09'
1351+
- '2021_12'
1352+
- '2022_03'
1353+
- '2022_06'
1354+
- '2022_09'
1355+
- '2022_12'
1356+
- '2023_03'
1357+
- '2023_06'
1358+
- '2023_09'
1359+
- '2023_12'
1360+
- '2024_03'
1361+
- '2024_06'
1362+
- '2024_09'
1363+
- '2024_12'
1364+
- '2025_03'
1365+
- '2025_06'
1366+
- '2025_09'
1367+
- '2025_12'
1368+
- '2026_03'

0 commit comments

Comments
 (0)