github/polaris
1
0
Fork 0
mirror of https://github.com/FairwindsOps/polaris.git synced 2026-08-19 04:06:29 +00:00
Code Issues Packages Projects Releases Wiki Activity
991 Commits 31 Branches 119 Tags
b0d86cdcd2f0cbaff5ad207c42f8fc0fe07bdd45
Commit Graph
102 Commits
Author SHA1 Message Date
John SlivkaandGitHub b0d86cdcd2 Add option to filter audit results by severity level (#969) 2023-06-28 08:38:47 -05:00
Vitor Rodrigo VezaniandGitHub 0a26f3f578 FWI-4307 - fix checks category (#964) 
* fix checks category

* add changelog
 2023-06-21 12:08:49 -04:00
Vitor Rodrigo VezaniGitHubRobert BrennanAndrew Suderman
 		8e3cf1ddd9 FWI-4190 - Upload polaris results to Fairwinds Insights support (#948) 
* add login flow

* add logout functionality

* improve code

* implement token and status print

* implement status command

* add user to login

* improve server port management

* improve login flow

* fix login flow

* make insights URL for login configurable

* remove comments

* fix logrus directive usage

* add upload-insights command

* remove unnecessary usage of pointer

* error when using upload-insights and audit-path simultaneously

* upload-insights support

* set priority to reports

* adds report verification

* fix logging to meet expected results

* renaming variable name

* improve results printing

* improve variable naming

* remove TODO

* Update checks severities (#950)

* change all ignore checks to warning

* promoting checks initially warning that should be danger.

* fixing docs and examples

* adds changelog

* fix changelog version

* improve general error message

* update workloads to be able grab its version

* print URL on stdout on browser error

* use os.WriteFile instead of low-level API

* renaming fn params

* add insights client

* validating token on auth status

* minor fix

* only query for re-auth if token is still valid

* update some dependencies in go and CI (#951)

* update some dependencies

* update testing requirements

* Fix cert-manager

* lots of deprecated versions

* attempts

* review suggestions

* avoid nil pointer

* fix fixtures

* fix test

---------

Co-authored-by: Robert Brennan <contact@rbren.io>

* update changelog

---------

Co-authored-by: Andrew Suderman <andy@fairwinds.com>
Co-authored-by: Robert Brennan <contact@rbren.io>
 2023-06-06 13:51:42 -03:00
Andrew SudermanGitHubRobert Brennan
 		f1bbe9236b update some dependencies in go and CI (#951) 
* update some dependencies

* update testing requirements

* Fix cert-manager

* lots of deprecated versions

* attempts

* review suggestions

* avoid nil pointer

* fix fixtures

* fix test

---------

Co-authored-by: Robert Brennan <contact@rbren.io>
 2023-06-06 12:01:20 -04:00
Vitor Rodrigo VezaniandGitHub 65c5ff59ca Update checks severities (#950) 
* change all ignore checks to warning

* promoting checks initially warning that should be danger.

* fixing docs and examples

* adds changelog

* fix changelog version
 2023-05-31 17:41:18 -03:00
StevieGitHubRobert Brennan
 		ef4ea66d49 Update checks documentation (#936) 
* Update docs with new checks; make sure both config-full has all config.yml checks

* Update doc on mutating webhooks

---------

Co-authored-by: Robert Brennan <accounts@rbren.io>
 2023-05-16 16:31:43 -04:00
Robert BrennanandGitHub f531103fa0 Update documentation from template (#926) 2023-03-14 11:25:31 -06:00
fslandGitHub 6abfbb3570 Update package-lock.json (#923) 
Signed-off-by: fengshunli <1171313930@qq.com>
 2023-02-21 09:24:09 -05:00
Robert BrennanGitHubAndrew Suderman
 		71b0e00288 Update documentation from template (#899) 
Co-authored-by: Andrew Suderman <andy@suderman.dev>
 2023-01-04 14:17:54 -07:00
Andrew SudermanandGitHub a1b63ac417 Fix #547 - add a check for topologySpreadConstraint (#879) 2023-01-04 14:05:23 -07:00
ivanfetch-fwandGitHub 467d06f4db FWI-2719: Enable new RBAC / sensitive content / Pod exec checks, add hasPrefix and hasSuffix functions to the GO template, exempt system: name prefixes for RBAC checks, sensitive content checks ignore valueFrom, (#832) 
* Enable these checks in the default configuration file, which may produce many new results:
  * automountServiceAccountToken
  * linuxHardening
  * sensitiveConfigmapContent and sensitiveContainerEnvVar
  * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole
  * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and  rolebindingRolePodExecAttach
* Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default
* `hasPrefix` and `hasSuffix` functions are now available in the go template
* Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment
variable names when those variables use `valueFrom` to reference an
external resource.
* Add the `*ClusterAdmin` checks to `examples/config-full.yaml`.
* Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)
 2022-11-14 15:05:02 -07:00
Robert BrennanandGitHub b6c6bbe893 update docs (#846) 2022-09-22 11:18:44 -04:00
Robert BrennanandGitHub 6b64369698 Update changelog.md (#825) 
* Update changelog.md

* Update changelog.md
 2022-08-24 12:38:15 -04:00
ivanfetch-fwandGitHub c3b57bf6c7 target: container also populates .Polaris.PodSpec|PodTemplate + a new .Polaris.Container representing the currently checked container, GetPodTemplate serializes data to work around a DeepCopy bug with type int (#812) 2022-07-29 07:45:56 -06:00
ivanfetch-fwGitHubRobert Brennan
 		25ab600eef Update docs to reflect target: PodTemplate RE: PR #801 (#804) 
* Update docs to reflect `target: PodTemplate` and the template being available via the `Polaris.PodTemplate` variable RE: PR #801

* Fix typo

Co-authored-by: Robert Brennan <accounts@rbren.io>

Co-authored-by: Robert Brennan <accounts@rbren.io>
 2022-07-14 13:50:41 -06:00
ivanfetch-fwandGitHub ccaa384cd0 expose Polaris.PodSpec for PodSpec targeted checks (#793) 
* Add a template `Polaris` variable, expose `Polaris.PodSpec` for checks of `target: PodSpec`.

Polaris checks that are `target: PodSpec` have reflected the original
resource (such as a pod-controller) in the Go template, instead of
reflecting the pod `spec` field. This update makes the PodSpec available
in a new template variable `Polaris.PodSpec`.
 2022-07-12 08:04:17 -06:00
Robert BrennanandGitHub 1c09ce9e09 update changelog and docs (#800) 
* update changelog and docs

* add 7.0.1

* fix version
 2022-07-11 14:12:50 -04:00
Robert BrennanandGitHub acadebe9fd add docs for mutation (#792) 
* add docs for mutation

* Update infrastructure-as-code.md
 2022-07-11 13:25:15 -04:00
Robert BrennanGitHubMAKOSCAFEE
 		f71ca999c9 Change target: Pod to target: PodSpec (#726) 
* change target pod to target pod spec

* add checks

* update docs

* fix tests

Co-authored-by: MAKOSCAFEE <barnabasmakonda@gmail.com>
 2022-06-07 07:37:25 -06:00
Robert BrennanGitHubBarnabas Makonda
 		6c33168378 update release process (#744) 
* update release process

* fix lint

* remove kubectl docs

* update webhook install

* fix webhook_test

* fix dashboard test

* Update kube_dashboard_test.sh

* Update webhook_test.sh

Co-authored-by: Barnabas Makonda <6409210+makoscafee@users.noreply.github.com>
 2022-04-28 17:16:17 -04:00
Andrew SudermanandGitHub 78838a606d Add a --namespace flag to the in-cluster audit (#742) 2022-04-08 07:54:03 -06:00
Ken KaizuGitHubRobert Brennan
 		1841b7441d audit check specific checks when passing checks args (#737) 
Signed-off-by: krrrr38 <k.kaizu38@gmail.com>

Co-authored-by: Robert Brennan <accounts@rbren.io>
 2022-04-07 09:11:51 -04:00
Robert BrennanGitHubTravis CI
 		ef50fbbff6 Release 5.1 (#720) 
* bump to 5.1.0

* regenerate deploy files

Co-authored-by: Travis CI <jess.portnoy@kaltura.com>
 2022-03-15 10:02:20 -04:00
nobletroutandGitHub f429f1922a Nobletrout/add kubectx support (#719) 
* See #699 add support for kubecontext selection

* Update cli.md
 2022-03-15 09:24:24 -04:00
Andrew SudermanandGitHub 539fa088d1 Update documentation from template (#702) 2022-02-15 14:43:07 -07:00
Barnabas MakondaGitHubRobert Brennan
 		e91b9b8824 Update serverity for polaris check (#690) 
* update serverity for polaris check

* update test checks

* update changelog and fix test failure

* update tests/checks

* update replicas for webhook

* update config-full.yaml

* update tags

Co-authored-by: Robert Brennan <accounts@rbren.io>
 2022-01-20 17:08:39 +03:00
Janki ChhatbarandGitHub 268f0e6811 Correct URL to download polaris tar (#660) 2021-11-03 06:32:29 -06:00
Luke ReedandGitHub c398f1043c prep for 4.2.0 release and helm chart update (#643) 2021-09-28 11:31:34 -07:00
Maxime VISONNEAUGitHubRobert Brennan
 		32c1150b28 config: new flags '--disallow-(config|annotation)-exemptions' (#636) 
This change follows up #635 and lets end-users decide to disallow exemption rules defined as part of the config file or the controller annotations (whether none, any or both). The main use case here is to be able to prevent users with edit privileges over a controller to add a new exemption rule through an annotation which may obfuscate the actual policies we want to enforce.

Signed-off-by: Maxime VISONNEAU <maxime.visonneau@gmail.com>

Co-authored-by: Robert Brennan <accounts@rbren.io>
 2021-09-27 12:56:59 -04:00
Luke ReedandGitHub a62389b85f Update documentation from template (#634) 2021-09-21 07:50:08 -07:00
Robert BrennanandGitHub 310015ff53 bump to 4.1.0 (#623) 
* bump to 4.1.0

* fix deploy files
 2021-09-07 09:53:12 -04:00
Robert BrennanandGitHub 9ae4f774e9 bump version, add docs, fix up dashboard (#595) 
* bump version\, add docs\, fix up dashboard

* fix pretty output

* Update config.yaml

* fix extra kinds appearing
 2021-08-18 17:55:48 -04:00
dependabot[bot]GitHublnx01
 		3e655d846b Bump url-parse from 1.5.1 to 1.5.3 in /docs (#611) 
Bumps [url-parse](https://github.com/unshiftio/url-parse) from 1.5.1 to 1.5.3.
- [Release notes](https://github.com/unshiftio/url-parse/releases)
- [Commits](https://github.com/unshiftio/url-parse/compare/1.5.1...1.5.3)

---
updated-dependencies:
- dependency-name: url-parse
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-08-18 14:59:17 -04:00
dependabot[bot]GitHublnx01
 		0232e31a50 Bump path-parse from 1.0.6 to 1.0.7 in /docs (#607) 
Bumps [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7.
- [Release notes](https://github.com/jbgutierrez/path-parse/releases)
- [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7)

---
updated-dependencies:
- dependency-name: path-parse
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-08-18 14:59:09 -04:00
Robert BrennanandGitHub ca3e46ebbd Update documentation from template (#609) 2021-08-17 11:26:25 -04:00
dependabot[bot]GitHublnx01
 		d172d8e18b Bump color-string from 1.5.4 to 1.5.5 in /docs (#588) 
Bumps [color-string](https://github.com/Qix-/color-string) from 1.5.4 to 1.5.5.
- [Release notes](https://github.com/Qix-/color-string/releases)
- [Changelog](https://github.com/Qix-/color-string/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Qix-/color-string/compare/1.5.4...1.5.5)

---
updated-dependencies:
- dependency-name: color-string
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-07-22 14:35:46 -04:00
Robert Brennan 6c995eb04c fix goreleaser format 2021-07-22 15:26:29 +00:00
Robert Brennan e52f1e76e9 bump version 2021-07-22 15:20:38 +00:00
dependabot[bot]GitHublnx01
 		f602687c90 Bump prismjs from 1.23.0 to 1.24.0 in /docs (#580) 
Bumps [prismjs](https://github.com/PrismJS/prism) from 1.23.0 to 1.24.0.
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PrismJS/prism/compare/v1.23.0...v1.24.0)

---
updated-dependencies:
- dependency-name: prismjs
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-07-14 14:06:19 -04:00
Robert BrennanandGitHub ff8e66af07 bump version (#587) 2021-07-14 10:26:27 -03:00
Robert BrennanandGitHub cd47487b0b bump version (#578) 2021-06-25 18:06:06 -04:00
Robert BrennanandGitHub ccc795d58e bump version, update changelog (#575) 
* bump version\, update changelog

* add docs
 2021-06-21 14:00:36 -04:00
dependabot[bot]GitHublnx01
 		0007b12080 Bump ini from 1.3.5 to 1.3.8 in /docs (#574) 
Bumps [ini](https://github.com/isaacs/ini) from 1.3.5 to 1.3.8.
- [Release notes](https://github.com/isaacs/ini/releases)
- [Commits](https://github.com/isaacs/ini/compare/v1.3.5...v1.3.8)

---
updated-dependencies:
- dependency-name: ini
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 12:27:30 -04:00
dependabot[bot]GitHublnx01
 		2958b5cc07 Bump prismjs from 1.22.0 to 1.23.0 in /docs (#573) 
Bumps [prismjs](https://github.com/PrismJS/prism) from 1.22.0 to 1.23.0.
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PrismJS/prism/compare/v1.22.0...v1.23.0)

---
updated-dependencies:
- dependency-name: prismjs
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 12:27:19 -04:00
dependabot[bot]GitHublnx01
 		0c5014489e Bump elliptic from 6.5.3 to 6.5.4 in /docs (#572) 
Bumps [elliptic](https://github.com/indutny/elliptic) from 6.5.3 to 6.5.4.
- [Release notes](https://github.com/indutny/elliptic/releases)
- [Commits](https://github.com/indutny/elliptic/compare/v6.5.3...v6.5.4)

---
updated-dependencies:
- dependency-name: elliptic
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 12:27:09 -04:00
dependabot[bot]GitHublnx01
 		ebf99869ff Bump lodash from 4.17.20 to 4.17.21 in /docs (#571) 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.20 to 4.17.21.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.20...4.17.21)

---
updated-dependencies:
- dependency-name: lodash
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 12:26:56 -04:00
dependabot[bot]GitHublnx01
 		88b57f9f32 Bump y18n from 4.0.0 to 4.0.3 in /docs (#570) 
Bumps [y18n](https://github.com/yargs/y18n) from 4.0.0 to 4.0.3.
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/y18n-v4.0.3/CHANGELOG.md)
- [Commits](https://github.com/yargs/y18n/compare/v4.0.0...y18n-v4.0.3)

---
updated-dependencies:
- dependency-name: y18n
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 11:55:38 -04:00
dependabot[bot]GitHublnx01
 		e028c34448 Bump url-parse from 1.4.7 to 1.5.1 in /docs (#569) 
Bumps [url-parse](https://github.com/unshiftio/url-parse) from 1.4.7 to 1.5.1.
- [Release notes](https://github.com/unshiftio/url-parse/releases)
- [Commits](https://github.com/unshiftio/url-parse/compare/1.4.7...1.5.1)

---
updated-dependencies:
- dependency-name: url-parse
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 11:55:28 -04:00
dependabot[bot]GitHublnx01
 		7c1ec6a762 Bump browserslist from 4.14.7 to 4.16.6 in /docs (#568) 
Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.14.7 to 4.16.6.
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.14.7...4.16.6)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 11:55:19 -04:00
dependabot[bot]GitHublnx01
 		fa6843ae61 Bump dns-packet from 1.3.1 to 1.3.4 in /docs (#567) 
Bumps [dns-packet](https://github.com/mafintosh/dns-packet) from 1.3.1 to 1.3.4.
- [Release notes](https://github.com/mafintosh/dns-packet/releases)
- [Changelog](https://github.com/mafintosh/dns-packet/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mafintosh/dns-packet/compare/v1.3.1...v1.3.4)

---
updated-dependencies:
- dependency-name: dns-packet
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2021-06-21 11:55:08 -04:00