Merge pull request #100 from reactiveops/rb/bump

update version to 0.1.1

.circleci/config.yml

@@ -30,6 +30,13 @@ references:
         docker tag $REPO:dev-$CIRCLE_SHA1 $REPO:$CIRCLE_TAG
         docker push $REPO:$CIRCLE_TAG
 
+  update_coverage: &update_coverage
+    run:
+      name: Update Coverage
+      command: |
+        go test ./pkg/... -coverprofile=coverage.txt -covermode=count
+        bash <(curl -s https://codecov.io/bash)
+
 jobs:
   build:
     docker:
@@ -50,6 +57,7 @@ jobs:
       - run: go get -u golang.org/x/lint/golint
       - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
       - run: go list ./... | grep -v vendor | xargs go vet
+      - *update_coverage
 
   test-deploy:
     docker:
@@ -84,6 +92,8 @@ jobs:
       - *set_environment_variables
       - *docker_tag_release
       - *install_goreleaser
+      - run: go get -u github.com/gobuffalo/packr/v2/packr2
+      - run: packr2
       - run: goreleaser
 
 workflows:

.goreleaser.yml

@@ -1,6 +1,7 @@
 builds:
 - env:
   - CGO_ENABLED=0
+  binary: polaris
 archive:
   replacements:
     darwin: Darwin

CODEOWNERS

@@ -0,0 +1 @@
+* @bobby-brennan @robscott

Dockerfile

@@ -15,6 +15,4 @@ COPY --from=build-env /go/src/github.com/reactiveops/polaris/polaris .
 
 WORKDIR /opt/app
 
-COPY --from=build-env /go/src/github.com/reactiveops/polaris/config.yaml ./config.yaml
-
 CMD ["polaris"]

README.md

@@ -1,36 +1,34 @@
 <div align="center">
   <img src="/pkg/dashboard/assets/images/polaris-logo.png" alt="Polaris Logo" />
   <br>
-  
+
   [![Version][version-image]][version-link] [![CircleCI][circleci-image]][circleci-link] [![Go Report Card][goreport-image]][goreport-link]
 </div>
 
-[version-image]: https://img.shields.io/static/v1.svg?label=Version&message=0.1.0&color=239922
+[version-image]: https://img.shields.io/static/v1.svg?label=Version&message=0.1.1&color=239922
 [version-link]: https://github.com/reactiveops/polaris
 
-<!-- TODO: uncomment once project is public
-[circleci-image]: https://circleci.com/gh/reactiveops/polaris.svg?style=svg
 [goreport-image]: https://goreportcard.com/badge/github.com/reactiveops/polaris
--->
-[circleci-link]: https://circleci.com/gh/reactiveops/polaris.svg
 [goreport-link]: https://goreportcard.com/report/github.com/reactiveops/polaris
 
-[circleci-image]: https://img.shields.io/static/v1.svg?label=Build&message=Passing&color=239922
-[goreport-image]: https://img.shields.io/static/v1.svg?label=go+report&message=A&color=239922
+[circleci-image]: https://circleci.com/gh/reactiveops/polaris.svg?style=svg
+[circleci-link]: https://circleci.com/gh/reactiveops/polaris.svg
 
-Polaris keeps your cluster sailing smoothly. It runs a variety of checks to ensure that Kubernetes deployments are configured using best practices that will avoid potential problems in the future. The project includes two primary parts:
+Polaris helps keep your cluster healthy. It runs a variety of checks to ensure that Kubernetes deployments are configured using best practices that will avoid potential problems in the future. The project includes two primary components:
 
-- A dashboard to display the results of these validations on your existing deployments
-- A beta version of a webhook that can prevent poorly configured deployments from reaching your cluster
+- A dashboard that provides an overview of how well current deployments are configured within a cluster.
+- An experimental validating webhook that can prevent any future deployments that do not live up to a configured standard.
 
 ## Dashboard
 
-The Polaris Dashboard provides an overview of your current deployments in a cluster along with their validation scores. An overall score is provided for a cluster on a 0 - 100 scale. Results are then broken down by namespace and deployment.
+The Polaris dashboard is a way to get a simple visual overview of the current state of your Kubernetes deployments as well as a roadmap for what can be improved. The dashboard provides a cluster wide overview as well as breaking out results by category, namespace, and deployment.
 
 <p align="center">
   <img src="/dashboard-screenshot.png" alt="Polaris Dashboard" />
 </p>
 
+Our default standards in Polaris are rather high, so don’t be surprised if your score is lower than you might expect. A key goal for Polaris was to set a high standard and aim for great configuration by default. If the defaults we’ve included are too strict, it’s easy to adjust the configuration as part of the deployment configuration to better suit your workloads.
+
 ### Deploying
 
 To deploy Polaris with kubectl:
@@ -57,7 +55,14 @@ With the port forwarding in place, you can open http://localhost:8080 in your br
 
 ### Using a Binary Release
 
-If you'd prefer to run Polaris locally, binary releases are available on the [releases page](https://github.com/reactiveops/polaris/releases). When running as a binary, Polaris will use your local kubeconfig to connect to a cluster. There are a variety of options available, but the most common usage may be to view the dashboard:
+If you'd prefer to run Polaris locally, binary releases are available on the [releases page](https://github.com/reactiveops/polaris/releases) or can be installed with [Homebrew](https://brew.sh/):
+
+```
+brew tap reactiveops/tap
+brew install reactiveops/tap/polaris
+```
+
+When running as a binary, Polaris will use your local kubeconfig to connect to a cluster. There are a variety of options available, but the most common usage will likely be to view the dashboard:
 
 ```
 polaris --dashboard
@@ -67,7 +72,7 @@ polaris --dashboard
 
 Polaris includes experimental support for an optional validating webhook. This accepts the same configuration as the dashboard, and can run the same validations. This webhook will reject any deployments that trigger a validation error. This is indicative of the greater goal of Polaris, not just to encourage better configuration through dashboard visibility, but to actually enforce it with this webhook. *Although we are working towards greater stability and better test coverage, we do not currently consider this webhook component production ready.*
 
-Unfortunately we have not found a way to disply warnings as part of `kubectl` output unless we are rejecting a deployment altogether. That means that any checks with a severity of `warning` will still pass webhook validation, and the only evidence of that warning will either be in the Polaris dashboard or the Polaris webhook logs.
+Unfortunately we have not found a way to display warnings as part of `kubectl` output unless we are rejecting a deployment altogether. That means that any checks with a severity of `warning` will still pass webhook validation, and the only evidence of that warning will either be in the Polaris dashboard or the Polaris webhook logs.
 
 ### Deploying
 
@@ -83,10 +88,9 @@ Alternatively, the webhook can be enabled with Helm by setting `webhook.enable`
 helm upgrade --install polaris deploy/helm/polaris/ --namespace polaris --set webhook.enable=true
 ```
 
-
 ## Configuration
 
-Polaris supports a wide range of validations covering a number of Kubernetes best practices. Here's a sample configuration file that includes all currently supported checks. The [default configuration](https://github.com/reactiveops/polaris/blob/master/config.yaml) contains a number of those checks. This repository also includes a sample [full configuration file](https://github.com/reactiveops/polaris/blob/master/config-full.yaml) that enables all available checks.
+Polaris supports a wide range of validations covering a number of Kubernetes best practices. Here's a sample configuration file that includes all currently supported checks. The [default configuration](https://github.com/reactiveops/polaris/blob/master/examples/config.yaml) contains a number of those checks. This repository also includes a sample [full configuration file](https://github.com/reactiveops/polaris/blob/master/examples/config-full.yaml) that enables all available checks.
 
 Each check can be assigned a `severity`. Only checks with a severity of `error` or `warning` will be validated. The results of these validations are visible on the dashboard. In the case of the validating webhook, only failures with a severity of `error` will result in a change being rejected.
 
@@ -108,9 +112,6 @@ Polaris validation checks fall into several different categories:
 * `disable-webhook-config-installer`: disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping
 * `kubeconfig`: Paths to a kubeconfig. Only required if out-of-cluster.
 
-## License
-Apache License 2.0
-
 ## Contributing
 PRs welcome! Check out the [Contributing Guidlines](CONTRIBUTING.md),
 [Code of Conduct](CODE_OF_CONDUCT.md), and [Roadmap](ROADMAP.md) for more information.
@@ -120,3 +121,6 @@ A history of changes to this project can be viewed in the [Changelog](CHANGELOG.
 
 If you'd like to learn more about Polaris, or if you'd like to speak with
 a Kubernetes expert, you can contact `info@reactiveops.com` or [visit our website](https://reactiveops.com)
+
+## License
+Apache License 2.0

codecov.yml

@@ -0,0 +1,2 @@
+coverage:
+  range: 50...80

deploy/dashboard.yaml

@@ -158,7 +158,7 @@ spec:
       - command:
         - polaris
         - --dashboard
-        image: 'quay.io/reactiveops/polaris:0.1.0'
+        image: 'quay.io/reactiveops/polaris:0.1.1'
         imagePullPolicy: 'Always'
         name: dashboard
         ports:

deploy/helm/polaris/Chart.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 description: Validation of best practices in your Kubernetes clusters
 name: polaris
-version: 1.0.0
+version: 0.1.1

deploy/helm/polaris/templates/webhook.rbac.yaml

@@ -59,6 +59,7 @@ apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: {{ include "polaris.fullname" . }}-webhook
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "polaris.labels" . | nindent 4 }}
 rules:
@@ -75,6 +76,7 @@ apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
   name: {{ include "polaris.fullname" . }}-webhook
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "polaris.labels" . | nindent 4 }}
 roleRef:

deploy/helm/polaris/values.yaml

@@ -50,7 +50,7 @@ dashboard:
     type: ClusterIP
   image:
     repository: quay.io/reactiveops/polaris
-    tag: 0.1.0
+    tag: 0.1.1
     pullPolicy: Always
 
 webhook:
@@ -58,7 +58,7 @@ webhook:
   replicas: 1
   image:
     repository: quay.io/reactiveops/polaris
-    tag: 0.1.0
+    tag: 0.1.1
     pullPolicy: Always
 
 rbac:

deploy/webhook.yaml

@@ -132,6 +132,7 @@ apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   name: polaris-webhook
+  namespace: polaris
   labels:
     app: polaris
 rules:
@@ -148,6 +149,7 @@ apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
   name: polaris-webhook
+  namespace: polaris
   labels:
     app: polaris
 roleRef:
@@ -206,7 +208,7 @@ spec:
           command:
             - polaris
             - --webhook
-          image: 'quay.io/reactiveops/polaris:0.1.0'
+          image: 'quay.io/reactiveops/polaris:0.1.1'
           imagePullPolicy: 'Always'
           ports:
             - containerPort: 9876

main.go

@@ -44,7 +44,7 @@ import (
 
 const (
 	// Version represents the current release version of Polaris
-	Version = "0.1.0"
+	Version = "0.1.1"
 )
 
 func main() {
@@ -56,7 +56,7 @@ func main() {
 	webhookPort := flag.Int("webhook-port", 9876, "Port for the webhook webserver")
 	auditOutputURL := flag.String("output-url", "", "Destination URL to send audit results")
 	auditOutputFile := flag.String("output-file", "", "Destination file for audit results")
-	configPath := flag.String("config", "config.yaml", "Location of Polaris configuration file")
+	configPath := flag.String("config", "", "Location of Polaris configuration file")
 	logLevel := flag.String("log-level", logrus.InfoLevel.String(), "Logrus log level")
 	version := flag.Bool("version", false, "Prints the version of Polaris")
 	disableWebhookConfigInstaller := flag.Bool("disable-webhook-config-installer", false,
@@ -89,10 +89,18 @@ func main() {
 	if *webhook {
 		startWebhookServer(c, *disableWebhookConfigInstaller, *webhookPort)
 	} else if *dashboard {
-		k, _ := kube.CreateResourceProvider(*auditPath)
+		k, err := kube.CreateResourceProvider(*auditPath)
+		if err != nil {
+			logrus.Errorf("Error fetching Kubernetes resources %v", err)
+			os.Exit(1)
+		}
 		startDashboardServer(c, k, *dashboardPort)
 	} else if *audit {
-		k, _ := kube.CreateResourceProvider(*auditPath)
+		k, err := kube.CreateResourceProvider(*auditPath)
+		if err != nil {
+			logrus.Errorf("Error fetching Kubernetes resources %v", err)
+			os.Exit(1)
+		}
 		runAudit(c, k, *auditOutputFile, *auditOutputURL)
 	}
 }

pkg/config/config.go

@@ -20,6 +20,7 @@ import (
 	"io"
 	"io/ioutil"
 
+	packr "github.com/gobuffalo/packr/v2"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/util/yaml"
@@ -110,7 +111,14 @@ type SecurityCapabilityLists struct {
 
 // ParseFile parses config from a file.
 func ParseFile(path string) (Configuration, error) {
-	rawBytes, err := ioutil.ReadFile(path)
+	configBox := packr.New("Config", "../../examples")
+	var rawBytes []byte
+	var err error
+	if path == "" {
+		rawBytes, err = configBox.Find("config.yaml")
+	} else {
+		rawBytes, err = ioutil.ReadFile(path)
+	}
 	if err != nil {
 		return Configuration{}, err
 	}

pkg/kube/resources.go

@@ -64,6 +64,7 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 			dep := appsv1.Deployment{}
 			err = decoder.Decode(&dep)
 			if err != nil {
+				logrus.Errorf("Error parsing deployment %v", err)
 				return err
 			}
 			resources.Deployments = append(resources.Deployments, dep)
@@ -71,6 +72,7 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 			ns := corev1.Namespace{}
 			err = decoder.Decode(&ns)
 			if err != nil {
+				logrus.Errorf("Error parsing namespace %v", err)
 				return err
 			}
 			resources.Namespaces = append(resources.Namespaces, ns)
@@ -78,6 +80,7 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 			pod := corev1.Pod{}
 			err = decoder.Decode(&pod)
 			if err != nil {
+				logrus.Errorf("Error parsing pod %v", err)
 				return err
 			}
 			resources.Pods = append(resources.Pods, pod)
@@ -91,12 +94,14 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 		}
 		contents, err := ioutil.ReadFile(path)
 		if err != nil {
+			logrus.Errorf("Error reading file %v", path)
 			return err
 		}
 		specs := regexp.MustCompile("\n-+\n").Split(string(contents), -1)
 		for _, spec := range specs {
 			err = addYaml(spec)
 			if err != nil {
+				logrus.Errorf("Error parsing YAML %v", err)
 				return err
 			}
 		}
@@ -115,6 +120,7 @@ func CreateResourceProviderFromCluster() (*ResourceProvider, error) {
 	kubeConf := config.GetConfigOrDie()
 	api, err := kubernetes.NewForConfig(kubeConf)
 	if err != nil {
+		logrus.Errorf("Error creating Kubernetes client %v", err)
 		return nil, err
 	}
 	return CreateResourceProviderFromAPI(api)
@@ -125,34 +131,35 @@ func CreateResourceProviderFromAPI(kube kubernetes.Interface) (*ResourceProvider
 	listOpts := metav1.ListOptions{}
 	serverVersion, err := kube.Discovery().ServerVersion()
 	if err != nil {
+		logrus.Errorf("Error fetching Kubernetes API version %v", err)
 		return nil, err
 	}
 	deploys, err := kube.AppsV1().Deployments("").List(listOpts)
 	if err != nil {
+		logrus.Errorf("Error fetching Kubernetes Deployments %v", err)
 		return nil, err
 	}
 	nodes, err := kube.CoreV1().Nodes().List(listOpts)
 	if err != nil {
+		logrus.Errorf("Error fetching Kubernetes Nodes %v", err)
 		return nil, err
 	}
 	namespaces, err := kube.CoreV1().Namespaces().List(listOpts)
 	if err != nil {
+		logrus.Errorf("Error fetching Kubernetes Namespaces %v", err)
 		return nil, err
 	}
-	allPods := []corev1.Pod{}
-	for _, ns := range namespaces.Items {
-		pods, err := kube.CoreV1().Pods(ns.Name).List(listOpts)
-		if err != nil {
-			return nil, err
-		}
-		allPods = append(allPods, pods.Items...)
+	pods, err := kube.CoreV1().Pods("").List(listOpts)
+	if err != nil {
+		logrus.Errorf("Error fetching Kubernetes Pods %v", err)
+		return nil, err
 	}
 	api := ResourceProvider{
 		ServerVersion: serverVersion.Major + "." + serverVersion.Minor,
 		Deployments:   deploys.Items,
 		Nodes:         nodes.Items,
 		Namespaces:    namespaces.Items,
-		Pods:          allPods,
+		Pods:          pods.Items,
 	}
 	return &api, nil
 }

pkg/kube/resources_test.go

@@ -1,6 +1,7 @@
 package kube
 
 import (
+	"github.com/reactiveops/polaris/test"
 	"github.com/stretchr/testify/assert"
 	"testing"
 )
@@ -41,3 +42,16 @@ func TestGetMultipleResourceFromSingleFile(t *testing.T) {
 	assert.Equal(t, "polaris", resources.Namespaces[0].ObjectMeta.Name)
 	assert.Equal(t, "polaris-2", resources.Namespaces[1].ObjectMeta.Name)
 }
+
+func TestGetResourceFromAPI(t *testing.T) {
+	k8s := test.SetupTestAPI()
+	k8s = test.SetupAddDeploys(k8s, "test")
+	resources, err := CreateResourceProviderFromAPI(k8s)
+	assert.Equal(t, nil, err, "Error should be nil")
+
+	assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
+	assert.Equal(t, 1, len(resources.Deployments), "Should have a deployment")
+	assert.Equal(t, 0, len(resources.Pods), "Should have a pod")
+
+	assert.Equal(t, "", resources.Deployments[0].ObjectMeta.Name)
+}