github/polaris
1
0
Fork 0
mirror of https://github.com/FairwindsOps/polaris.git synced 2026-08-19 12:16:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,096 Commits 31 Branches 119 Tags
master
Commit Graph
2 Commits
Author SHA1 Message Date
ivanfetch-fwandGitHub 467d06f4db FWI-2719: Enable new RBAC / sensitive content / Pod exec checks, add hasPrefix and hasSuffix functions to the GO template, exempt system: name prefixes for RBAC checks, sensitive content checks ignore valueFrom, (#832) 
* Enable these checks in the default configuration file, which may produce many new results:
  * automountServiceAccountToken
  * linuxHardening
  * sensitiveConfigmapContent and sensitiveContainerEnvVar
  * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole
  * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and  rolebindingRolePodExecAttach
* Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default
* `hasPrefix` and `hasSuffix` functions are now available in the go template
* Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment
variable names when those variables use `valueFrom` to reference an
external resource.
* Add the `*ClusterAdmin` checks to `examples/config-full.yaml`.
* Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)
 2022-11-14 15:05:02 -07:00
ivanfetch-fwandGitHub 206322271c FWI-2509: Add sensitiveContainerEnvVar and sensitiveConfigMapContent checks (#817) 
* Add sensitiveContainerEnvVar and sensitiveConfigMapContent checks

* Update full example configfile
 2022-08-05 11:58:57 -04:00