Commit Graph
77 Commits
Author SHA1 Message Date
Robert Brennan 8af4363672 update dependencies (#898) 2023-01-04 10:10:09 -05:00
Eng Zer JunandAndrew Suderman 8bc1a4bcde refactor: move from io/ioutil to io and os packages (#858)
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit
replaces the existing io/ioutil functions with their new definitions in
io and os packages.

[1]: https://golang.org/doc/go1.16#ioutil
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>

Co-authored-by: Andrew Suderman <andrew@sudermanjr.com>
2022-11-16 16:28:09 -05:00
Robert Brennan 8e7100acaf Add debug info to kube resources, better caching strategy (#840)
* add debug info

* remove extra build step

* try and fix memory usage

* fix pointers

* add more debug logs

* fix up caching for replicasets

* fix import

* replace info with debug

* add logs

* dont cache jobs

* gofmt

* fix import
2022-09-16 10:07:20 -04:00
4d96993a18 [FWI-2357] Let Polaris modify YAML without losing comments/formatting (#821)
* added fix command implementation

* use node api

* fix tests

* added hostport mutate rule

* update mutating server

* fix array reference and add back leading slash

* added test and refactor findNodes

* more tests

* added more test and fix issue with arrays

* rename findNode function and ensure we capture exceptions

* rename findNode function

* append array value at the end and for single item remove brackets

* append array value at the end and for single item remove brackets

* create array if it does not exists

* fix tests

* handle some exceptions

* fix tests

* fix string format

* guard for PodResult

* fix flag name

* fix privilegeEscalation check

* fix up mutations for local files

* fix pod parsing

* fix object values

* remove logspam

* fix import

* update some comments for health probes

* add an option to not apply any mutations\, and just adjust yaml formatting

* add preliminary support for helm

* logspam

* change up comment strategy

* fix object comments

* format

* fix tests

* add comments

* fix key updates

* fix mutation tests

* tidy

* refactor test

* add test

* add test

* add test for object comments

Co-authored-by: Robert Brennan <accounts@rbren.io>
Co-authored-by: Robert Brennan <contact@rbren.io>
2022-09-15 12:38:22 -04:00
ivanfetch-fw c3b57bf6c7 target: container also populates .Polaris.PodSpec|PodTemplate + a new .Polaris.Container representing the currently checked container, GetPodTemplate serializes data to work around a DeepCopy bug with type int (#812) 2022-07-29 07:45:56 -06:00
ivanfetch-fw 50d789fd42 Fix resourceKindMap.addResource() to not assume every Kind has an APIGroup (#805)
This was causing the `ResourceProvider.Resources` map to essentially
loose resources with no APIGroup, such as ServiceAccounts.
2022-07-15 13:53:41 -06:00
ivanfetch-fw be45519a22 Add target PodTemplate which exposes the full Pod (not only the spec) (#801)
* Add `target PodTemplate` which exposes the full Pod (not only the spec)

* Fix PotTemplate in conjunction with how pod-schema-checks are handled

* Add test for GO template `Polaris` sub-keys, help `NewGenericResourceFromPod` to set `PodTemplate` in more cases

* Clarify PldTemplate logic for `IsActionable()`
2022-07-14 12:51:24 -06:00
ivanfetch-fw ccaa384cd0 expose Polaris.PodSpec for PodSpec targeted checks (#793)
* Add a template `Polaris` variable, expose `Polaris.PodSpec` for checks of `target: PodSpec`.

Polaris checks that are `target: PodSpec` have reflected the original
resource (such as a pod-controller) in the Go template, instead of
reflecting the pod `spec` field. This update makes the PodSpec available
in a new template variable `Polaris.PodSpec`.
2022-07-12 08:04:17 -06:00
3b865fcea8 skip incomplete or broken YAML - warn user (#678)
* skip broken yaml (eg, patch file)

* skip in visitFile, not in parser

* restore filepath.Walk() error handling

* restore test; correct assertion

* Update pkg/kube/resources_test.go

Co-authored-by: Robert Brennan <accounts@rbren.io>

* Fix tests

* update kind

Co-authored-by: Robert Brennan <accounts@rbren.io>
Co-authored-by: Luke Reed <luke@lreed.net>
Co-authored-by: Barnabas Makonda <6409210+makoscafee@users.noreply.github.com>
Co-authored-by: MAKOSCAFEE <barnabasmakonda@gmail.com>
2022-06-07 12:02:27 -04:00
Barnabas Makonda a59063bdb2 Add fix command to mutate and update IaC (#746)
* added fix command

* update fix command to walk through the folder to find all files

* added ability to add comment

* fix comment prefix

* trim whitespaces to the line

* refactor update mutated file

* remove filepath as is not needed anymore

* remove filepath as is not needed anymore

* remove timestamp and status if creation is null

* added comments and fix tests

* remove hardcoded mutation in config

* revert comment deletion

* separate mutated to success files

* read multiple resources in a file and update both

* Remove mutation in config.yaml
2022-04-28 18:28:33 +03:00
Robert Brennan c92819ca9d Save last podspec when walking owner hierarchy (#748)
* try saving last podspec when walking owner hierarchy

* remove namespace from config
2022-04-25 11:09:22 -04:00
Andrew Suderman 78838a606d Add a --namespace flag to the in-cluster audit (#742) 2022-04-08 07:54:03 -06:00
staerionandRobert Brennan fd16fb993d merge the list of resources from custom checks and the generated controller list before deduplicating them (#727)
Co-authored-by: Robert Brennan <accounts@rbren.io>
2022-04-07 10:18:04 -04:00
Andrew SudermanandBarnabas Makonda bd8b2962dc Fix license headers (#736)
* Update license headers

* Fmt

Co-authored-by: Barnabas Makonda <6409210+makoscafee@users.noreply.github.com>
2022-03-31 11:02:10 -04:00
nobletrout f429f1922a Nobletrout/add kubectx support (#719)
* See #699 add support for kubecontext selection

* Update cli.md
2022-03-15 09:24:24 -04:00
nobletrout 06322dc8a4 bounce out once we hit a type we know to avoid CRD problems (#718) 2022-03-14 16:41:43 -04:00
Robert Brennan 9ae4f774e9 bump version, add docs, fix up dashboard (#595)
* bump version\, add docs\, fix up dashboard

* fix pretty output

* Update config.yaml

* fix extra kinds appearing
2021-08-18 17:55:48 -04:00
Robert Brennan b923caf79e better support for namespaces in additional schemas (#593)
* better support for namespaces in additional schemas

* add alertmanager check

* Revert " revert file"

This reverts commit f55839b87aeec5af20ac28ecff664d17ac1159b3.

* remove alertmanager check
2021-07-27 10:31:34 -04:00
jdesouza 01cc5fa642 Fixed repeated names on dashboard (#586)
* Fixed repeated names on dashboard

* Fixed unit test
2021-07-14 09:17:40 -04:00
Robert Brennan f753fc91f2 Support multi-resource templates (#524)
* able to run multi-resource tests

* start passing resource provider through

* working end-to-end

* better support for go templating

* fix tests

* delint

* add test

* add json annotations

* remove panics

* fix annotation

* fix for groupkinds

* add comment

* add docs

* change jsonSchema field to schemaString

* rename check

* add pdb to tests

* add ingress to tests

* update deps

* fix up policy import

* update go

* fix check name

* funk it up

* better docs
2021-05-06 14:01:20 -04:00
Jordan DoigandRobert Brennan 63fd576d3e Add support for arbitrary Kinds (#505)
* Add basic flow

* Add arbitrary validator

* Pipe config through to resource provider

* Set arbitraries on resource provider

* Add arbitrary validation to fullaudit

* Add conf argument

* Fix resource setting from string

* PR updates

* Fix nil map error

* Delete lingering print, add pdb check, start implementing validator test

* move ingress to arbitrary

* fix compile

* refactor a bunch

* add tls tests

* tests passing

* resource provider helper

* refactor tests

* fix exemptions

* fix check test

* fix up resource creation from API

* fix init containers

* fix cronjob test

* fix pod tests

* combine controllers and-noncontrollers in resource provider

* delint

* add ingress backward compat

* fix tests

* reenable test

* rename a fn

* remove unused fn

* remove if

Co-authored-by: Robert Brennan <contact@rbren.io>
2021-03-26 08:29:59 -04:00
Jordan DoigandRobert Brennan 4c3d0e0603 Set full object ObjectMeta on new workload from Pod (#471)
* Unmarshal OriginalObjectJSON into ObjectMeta

* Unmarshal to unst before converting too v1 Object

* Add passing annotated deployment webhook test case

* fix meta accessor

* fix tests

* remove logs

* fix tests

Co-authored-by: Robert Brennan <contact@rbren.io>
2021-02-26 15:33:40 -05:00
Jordan Doig bc866a4d18 Merge branch 'master' into jd/out-of-control 2021-01-14 11:20:35 -07:00
Robert Brennan ec557f7ce8 Update dependencies (#470)
* update to v20

* fix tests
2021-01-08 14:01:01 -05:00
Jordan Doig ba53a2b8ab Add ingress nil check test 2021-01-04 20:57:51 -07:00
Jordan Doig 8f510a1b67 Add ingress to resource provider 2020-12-28 13:55:49 -07:00
Robert Brennan 7c98598858 Fix test fixtures, add a test for controllers (#455)
* first pass at fixing test fixtures

* tests mostly working

* add controller test

* remove debug stuff

* delint

* revert test file

* remove extra controllers from fixtures

* delint

* fix messages
2020-12-17 17:32:01 -05:00
Robert Brennan 4e044602f4 change how controller checks are handled (#454)
* change how controller checks are handled

* add changelog

* simpler fix
2020-12-17 16:29:49 -05:00
baderbuddy 7c9f01639b Update dependencies (#400)
* Start working on updating dependencies:

* Fix webhook

* Rollback jsonschema update

* Checkin new config

* Fix run as root

* Update versions of kind

* Fix typo in kind URL

* Fix kind config

* Add csr permissions

* Fix weird image thing

* Fixed certificates

* Add to logging

* Approve cert manually

* Fix approval

* Add cert script

* Fix deployment

* Add requests/limits

* Wait if certificate doesn't exist yet

* Add check for file size

* Add variable

* Try a different imagE

* Fix command

* Update certificate logic

* Add healthz

* Don't check cert size

* Remove stat

* Fix vet

* Put in change that makes no sense

* Fix cert names

* Roll back

* Try changing config

* Add logging for each request

* Cleanup code some

* Remove bad deployments

* Fix client injection

* Update timeout

* Add logging

* Fixed e2e webhook tests

* Add permissions for approval

* Fix permissions for CSR

* Remove logging code

* Remove refresh certs file

* Fix merge issues

* Update deployments

* Try beta of admission controller config

* Target 1.15 for testing

* Add beta versions of resourceS

* Lower webhook timeout

* Refactor out a method

* Fix up PR issues

* Fix more tabs

* Remove unnecessary messageS

* Fix go.sum

* Fix go.sum
2020-09-11 08:53:14 -04:00
Robert Brennan 8d562f2490 fix for parent tree climbing (#379) 2020-07-22 13:31:49 -04:00
Robert Brennan 47150155a0 add ability to audit a single workload (#368)
* add ability to audit a single workload

* delint

* fix help text

* update readme
2020-07-22 13:28:02 -04:00
Robert Brennan 997d4bfb2b Handle orphaned pods (#371)
* handle orphaned pods

* set originalResource when creating Pod resources
2020-07-10 09:43:33 -04:00
Robert Brennan b4e3d40f4b Add priority class check, some test infra (#342)
* add check for priority-class

* add test message

* lint
2020-06-22 16:34:48 -04:00
Robert Brennan 69bed16e4f don't error out when resolving parent resource (#358) 2020-06-22 16:05:23 -04:00
Huang Huang 5b173cf4a7 Support read yaml contents of workload from stdin (#353) 2020-06-22 14:19:51 -04:00
Huang Huang b26c4be8d6 Support audit files which use \r or \r\n as newline character (#343) 2020-06-16 10:46:28 -04:00
baderbuddy bf6e41566d Don't assume all objects have pods. (#329)
* Don't assume all objects have pods.

* Test service is ignored

* Fix test

* Fix comment on test
2020-06-10 10:22:59 -04:00
Robert Brennan af5b86e28c catch cache error (#324) 2020-06-03 15:55:13 -04:00
Robert Brennan 27faab919c handle case where RBAC is missing for a CRD (#305)
* handle case where RBAC is missing for a CRD

* handle error
2020-05-21 06:27:15 -04:00
baderbuddy d50d9c81f8 Add the capability for controller level checks (#285)
* Add controller level checks

* Add check for multipleReplicas

* Fixed spec

* Add controller level check

* Move controller schema checks to their own function.
2020-05-18 14:57:35 -04:00
69621f7034 Improve performance (#278)
* rename root fs check

* speed up docker build

* refactor webhook to be more generic

* delete controllers pkg

* revert deploy

* fix example config

* remove controllersToScan config

* fix lint error

* fix webhook name

* FileSystem -> Filesystem

* update deps

* skip node owners

* clean up meta tracking

* Cache results of dynamic queries

* Dynamically pick types to list.

* Fix unit tests

* Fix the other tests I missed

* Fix container test

* Fix issues from PR feedback

Co-authored-by: Robert Brennan <bobby.brennan@gmail.com>
Co-authored-by: Robert Brennan <accounts@rbren.io>
2020-05-01 13:29:29 -04:00
Robert BrennanandRobert Brennan 6792fba91f Delete controllers package (#270)
* rename root fs check

* speed up docker build

* refactor webhook to be more generic

* delete controllers pkg

* revert deploy

* fix example config

* remove controllersToScan config

* fix lint error

* fix webhook name

* FileSystem -> Filesystem

* update deps

* skip node owners

* clean up meta tracking

Co-authored-by: Robert Brennan <bobby.brennan@gmail.com>
2020-04-27 10:43:02 -04:00
Bader Boland 3c46f405a9 Cleanup SupportedControllers 2020-03-25 16:50:12 -04:00
Bader Boland a5828a2d3b Fix tests 2020-03-25 14:23:18 -04:00
Bader Boland 68fe23018a Feedback from PR 2020-03-23 09:27:36 -04:00
Bader Boland 8c769e445c Cut out duplicitive code. 2020-03-17 13:23:58 -04:00
Bader Boland 3c685279be Cut out logic specific to controller types 2020-03-17 12:41:44 -04:00
Bader Boland 7fdebfc4db Fix tests 2020-03-17 09:19:33 -04:00
Bader Boland 0d3fe6130a Remove unnecessary queries 2020-03-16 16:48:57 -04:00
Bader Boland bb34be7e02 Dynamically retrieve parents 2020-03-16 16:41:16 -04:00