38 Commits

Author SHA1 Message Date
ivanfetch-fw
01d7a8ac00 FWI-2547: Add checks for RBAC allowing execing or attaching to a Pod (#820)
* Add `rolePodExecAttach` and `clusterrolePodExecAttach` checks

* Add schema tests

* Add clusterrolebindingPodExecAttach, rolebindingRolePodExecAttach, and rolebindingClusterRolePodExecAttach checks + schema-tests

* Add the new checks to the full example config

* Update checks' success/failure messages and add some helpful comments

* Update binding-related check messaging RE: roleRef pointing to a nonexistent resource, and add tests for this case

* Update rolebindingClusterRolePodExecAttach and rolebindingRolePodExecAttach to pass if a binding roleRef is a different kind, and schema tests to include a namespace

* Add additional schema tests, remove "ignore default ClusterRole|Role bindings" code from checks that actually have no default bindings
2022-08-23 12:09:44 -06:00
ivanfetch-fw
206322271c FWI-2509: Add sensitiveContainerEnvVar and sensitiveConfigMapContent checks (#817)
* Add sensitiveContainerEnvVar and sensitiveConfigMapContent checks

* Update full example configfile
2022-08-05 11:58:57 -04:00
ivanfetch-fw
e5b9236268 FWI-2476: Add missingNetworkPolicy, automountServiceAccountToken, and linuxHardening checks (#816)
* Add missingNetworkPolicy, automountServiceAccountToken, and linuxHardening checks
2022-08-05 09:44:18 -06:00
Robert Brennan
08682075c6 Enable pullPolicyNotAlways (#795)
* add more mutations

* fix tests

* add more test cases

* Update insecureCapabilities.yaml

* Update dangerousCapabilities.yaml

* fix tests

* fix tests

* add pullPolicyNotAlways as default mutation
2022-07-11 13:20:17 -04:00
Barnabas Makonda
a59063bdb2 Add fix command to mutate and update IaC (#746)
* added fix command

* update fix command to walk through the folder to find all files

* added ability to add comment

* fix comment prefix

* trim whitespaces to the line

* refactor update mutated file

* remove filepath as is not needed anymore

* remove filepath as is not needed anymore

* remove timestamp and status if creation is null

* added comments and fix tests

* remove hardcoded mutation in config

* revert comment deletion

* separate mutated to success files

* read multiple resources in a file and update both

* Remove mutation in config.yaml
2022-04-28 18:28:33 +03:00
Robert Brennan
c92819ca9d Save last podspec when walking owner hierarchy (#748)
* try saving last podspec when walking owner hierarchy

* remove namespace from config
2022-04-25 11:09:22 -04:00
Andrew Suderman
78838a606d Add a --namespace flag to the in-cluster audit (#742) 2022-04-08 07:54:03 -06:00
Barnabas Makonda
a4c0b0f555 Add mutation field to imagePolicyNotAlways (#712)
* added mutation field in checks and config

* added test

* fix tests

* revert resolve export

* remove Patched resources as moving that to separate functionality apart from validation

* go mod tidy

* move mutation to the container level

* change prefix based on the resource kind

* collect all mutations from results and apply

* added test for cronjob and deployment apart from just pod

* test cronjob prefix

* return a copy of mutation

* fix tests and comments

* address feedback comments

* fix warning formating

* refactor getJSONSchemaPrefix function
2022-03-25 16:38:58 +03:00
Barnabas Makonda
e91b9b8824 Update serverity for polaris check (#690)
* update serverity for polaris check

* update test checks

* update changelog and fix test failure

* update tests/checks

* update replicas for webhook

* update config-full.yaml

* update tags

Co-authored-by: Robert Brennan <accounts@rbren.io>
2022-01-20 17:08:39 +03:00
Robert Brennan
f753fc91f2 Support multi-resource templates (#524)
* able to run multi-resource tests

* start passing resource provider through

* working end-to-end

* better support for go templating

* fix tests

* delint

* add test

* add json annotations

* remove panics

* fix annotation

* fix for groupkinds

* add comment

* add docs

* change jsonSchema field to schemaString

* rename check

* add pdb to tests

* add ingress to tests

* update deps

* fix up policy import

* update go

* fix check name

* funk it up

* better docs
2021-05-06 14:01:20 -04:00
Jordan Doig
5ab9f0b251 Add ingress tls check 2021-01-04 09:53:09 -07:00
baderbuddy
b3f1b3b478 Recategorize the results into standard categories. (#434)
* Initial checkin for recategorizing checks

* Fix tests

* Fix tests

* Update example output
2020-11-04 10:17:37 -05:00
Markus Blaschke
5bce1db05e Implement namespace support for exceptions (#421)
* Implement namespace support for exceptions

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

* remove debug

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

* Add documentation

Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>

Co-authored-by: baderbuddy <bader@fairwinds.com>
2020-10-19 08:45:45 -04:00
Robert Brennan
4e290e192d Update config.yaml (#378)
* Update config.yaml

* Update config-full.yaml

* update docs
2020-07-22 13:48:30 -04:00
Robert Brennan
b4e3d40f4b Add priority class check, some test infra (#342)
* add check for priority-class

* add test message

* lint
2020-06-22 16:34:48 -04:00
Robert Brennan
fa3504c350 add custom checks to config (#340) 2020-06-22 14:16:15 -04:00
Robert Brennan
2ac6a2b540 Change error to danger (#299)
* rename 'error' to 'danger'

* update dashboard

* fix docs

* update deploy configs
2020-05-19 08:41:07 -04:00
Robert Brennan
9d81c393de Pack config.yaml in Docker (#298)
* update examples

* pack config.yaml in Docker
2020-05-18 17:16:16 -04:00
baderbuddy
d50d9c81f8 Add the capability for controller level checks (#285)
* Add controller level checks

* Add check for multipleReplicas

* Fixed spec

* Add controller level check

* Move controller schema checks to their own function.
2020-05-18 14:57:35 -04:00
Robert Brennan
eac15d6258 more exemptions (#294) 2020-05-18 13:31:37 -04:00
Robert Brennan
cf10a9617f add some exemptions for kube-system (#292) 2020-05-18 12:46:32 -04:00
Robert Brennan
6792fba91f Delete controllers package (#270)
* rename root fs check

* speed up docker build

* refactor webhook to be more generic

* delete controllers pkg

* revert deploy

* fix example config

* remove controllersToScan config

* fix lint error

* fix webhook name

* FileSystem -> Filesystem

* update deps

* skip node owners

* clean up meta tracking

Co-authored-by: Robert Brennan <bobby.brennan@gmail.com>
2020-04-27 10:43:02 -04:00
Robert Brennan
ac501a20d2 add sample output 2020-01-14 14:50:34 +00:00
Robert Brennan
6b4227da4d fix config-full.yaml 2020-01-13 16:01:36 +00:00
Robert Brennan
4d82220212 fix up config-full 2020-01-02 19:26:03 +00:00
Robert Brennan
04da47d83e change input config to simplify things 2020-01-02 17:55:21 +00:00
Robert Brennan
5efa416ea9 implement custom checks, implement resource ranges as custom check 2020-01-02 17:55:21 +00:00
Robert Brennan
7b0fe81d01 implement capabilities checks in JSON schema 2020-01-02 17:55:21 +00:00
Robert Brennan
67ab987f7e Add support for annotation-based exemptions (#227)
* add controllers_to_scan to example config-full

* add support for annotation-based exemptions

* fix lint errors

* add docs
2019-12-06 08:29:30 -05:00
Andrew Suderman
1159a380ba Adding an exception for flannel being privileged to example config (#225) 2019-11-22 12:02:35 -07:00
Robert Brennan
ca6aa76729 Add default exemptions (#220)
* Update config.yaml

* Update config.yaml

* add a couple more exemptions
2019-11-15 14:45:58 -05:00
MAKOSCAFEE
fc7c913122 update exemption rules and check controller name prefix 2019-11-07 19:16:06 +02:00
MAKOSCAFEE
3e15586597 add kind exception configurations 2019-11-07 15:37:13 +02:00
Robert Brennan
2b15f11d57 Add exemptions to config (#204)
* first pass at adding exemptions

* Update config.yaml

* make config_test more reliable

* add flag to disallow exemptions in dashboard

* add disallow-exemptions flag to CLI

* add comments

* fix exemptions flag

* fix alert on dashboard

* minor style changes
2019-10-23 17:14:03 -04:00
Nick Huanca
75f70352ba Additional Pod Controller Scans (#166)
**Changes**

- Refactored the way controllers work to be an interface
- Added configurable controllers to include in scans
- Added daemonsets, jobs and cronjobs in scans
- Added `ReplicationController` type controllers to the supported list
- Adjusted logic for failed YAML parsing to bubble up errors
- Added better logic for calculating summaries on cluster wide results
- Relocated responsibilities for counting types into validators vs spreading it around more packages
- Fixed bug where cronjob parsing was using wrong KIND
- Added fixtures for mocking new controller types
- Added example yamls to test scanning files
- Added functions to NamespacedResult(s) to reduce code complexity deep set iterations
- Refactored how results get added to namespacedresults so adding more later is easier
- Minor signature changes for interface implementing structs for controllers
2019-07-31 15:56:27 -06:00
Bobby Brennan
79f3d2cb74 use packr for config.yaml 2019-05-17 14:34:53 +00:00
Rob Scott
0f81f5a93d Adding goreleaser support 2019-05-16 11:21:47 -04:00
Rob Scott
c019364958 much more granular rbac permissions, splitting up dashboard and webhook components to allow for that 2019-05-16 10:00:21 -04:00