Istio

[x] Must define any external interfaces under the expose key.
[x] Must deploy and operate successfully with Istio injection enabled in the namespace.
[x] Should avoid workarounds such as disabling strict mTLS peer authentication.

Network Policies

[x] Must use and create a Keycloak client through the sso key if the application provides a user login.
[ ] #18
[x] #19
[x] #20
[ ] #33
[ ] #21

UDS Packages may make use of the UDS Exemption custom resource for exempting any Pepr policies, but in doing so they:

[x] Must minimize the scope and number of the exemptions to only what is absolutely required by the application
[x] Must have documented rationale for any exemptions present

Packages also follow structural guidelines to ensure consistency and flexibility for configuration, they:

[x] Should expose all configuration (uds.dev CRs, additional Secrets/ConfigMaps, etc) through a Helm chart (ideally in a chart or charts directory).

This allows UDS bundles to override configuration with Helm overrides and enables downstream teams to fully control their bundle configurations.
[x] #23

This ensures that the package is configured the same way that the bundle would be and avoids any side effect issues of Zarf's ### templating
[ ] #24

This allows for different images or configurations to be delivered consistently to customers.

A UDS Package will also have testing and quality checks to ensure that updates / changes to them result in minimal churn. Packages:

[x] #25

This can by something like Playwright / Cypress tests for services with a Web UI or something like Jest tests for headless services.
[ ] #26
[x] #27

To help maintain a UDS Package, it:

[x] Must have a dependency management bot (such as renovate) configured to open PRs to update core package and support dependencies.
[x] Must release its package to the ghcr.io/defenseunicorns/packages/<group> namespace as the application's name (i.e. ghcr.io/defenseunicorns/packages/uds/mattermost)

And in addition to the above, packages generally:

[x] Must be capable of operating within an internet-disconnected (air-gapped) environment
[x] #28