Add job to workloads library

[jpreese]

Noticed this when doing some rework on our kubernetes manifests. Policy was not failing on a Kubernetes Job that had an invalid image registry host specified.

[jpreese]

Aside: What are your thoughts on all of the is_daemonset , is_deployment , etc rules? We don't use any of them, and I'm not sure how much value breaking all of those kinds really provides.

We could just remove all of them, and then change the pods[pod] rule to:

pods[pod] {
  pod = core.resource
}

pods[pod] {
  pod = core.resource.spec.template
}

Which drastically cuts down on the size.

I do kind of like is_workload, we use it in a couple policies as just containers[_] isn't as friendly. Though I think I would prefer workloads.has_container or another name that says container. Seems odd to create an abstraction around the word container.

workloads.has_container
workloads.containers[_].resources.requests.cpu

[jalseth]

Makes sense, LGTM!

Regarding the is_something rules, I agree they should be removed. I'll have a PR up soon which adds quite a few security related policies and also includes a bit of a refactor on the libraries to make them more concise while maintaining readability.