The general/replicalimits ConstraintTemplate in the library only has unit tests that validate updates to a Deployment resource. It does not check for Scale resources, which get generated when running kubectl scale commands.
There is also a bug in the Rego because in the event of kubectl scale deploy <name> --replicas=0, the Scale resource has an empty spec (so input.review.object.spec is empty) and a violation is generated, even if a range allows zero as a valid value.
The
general/replicalimitsConstraintTemplate in the library only has unit tests that validate updates to a Deployment resource. It does not check for Scale resources, which get generated when runningkubectl scalecommands.There is also a bug in the Rego because in the event of
kubectl scale deploy <name> --replicas=0, the Scale resource has an empty spec (soinput.review.object.specis empty) and a violation is generated, even if a range allows zero as a valid value.