Remove flags from audit command and remove auth command (#1138)

* update libs

* Remove unused authentication code and dependencies from the Polaris project, streamlining the audit process by eliminating the upload insights feature and related flags.

* remove insights reporter

* remove lingering libs

* update docs

* INS-1251: Polaris: upgrade github.com/qri-io/jsonschema to v0.2.1 (#1135)

* Bump lins

* Code refactoring

* Fixign issues

* Fixing issues

* Fixing issues

* Fixing issues

* [WIP]

* [WIP]

* [WIP]

* Trying to fix tests

* Trying to fix tests

* Fixing issues

* Fixing issues

* Fixing issues

* Fixing issues

* Fixing issues

* Fixing issues

* Revert go mod

* Revert go mod

* Revert go mod

* Revert go mod

* Fixing issues

* Fixing issue

* Code refactoring

* Updating json schema version

* Updating json schema version

* fix go mod

* fix go sum

---------

Co-authored-by: jdesouza <james@fairwinds.com>

.circleci/build.config

@@ -0,0 +1,10 @@
+DOCKERFILE='Dockerfile'
+
+EXTERNAL_REGISTRY_BASE_DOMAIN=quay.io
+REPOSITORY_NAME=fairwinds/polaris
+DOCKERTAG=${EXTERNAL_REGISTRY_BASE_DOMAIN}/${REPOSITORY_NAME}
+if [[ -n $CI_TAG ]]; then
+  ADDITIONAL_DOCKER_TAG_VERSIONS=()
+  ADDITIONAL_DOCKER_TAG_VERSIONS+=(`echo $CI_TAG | sed -e 's/\(\w\+\)\..*$/\1/'`)
+  ADDITIONAL_DOCKER_TAG_VERSIONS+=(`echo $CI_TAG | sed -e 's/\(\w\+\.\w\+\)\..*$/\1/'`)
+fi

.circleci/config.yml

@@ -1,113 +1,183 @@
-version: 2
+version: 2.1
+
+orbs:
+  rok8s: fairwinds/rok8s-scripts@12
+  oss-docs: fairwinds/oss-docs@0
+
+executors:
+  vm:
+    machine:
+      enabled: true
+
+commands:
+  install_goreleaser_dependencies:
+    description: Installs dependencies for CI scripts
+    steps:
+    - run: apk update
+    # gettext provides envsubst
+    - run: apk add gettext
+    # Register other docker platforms, to build arm64.
+    # This shouldn't be needed, why TBD.
+    - run: docker run --privileged --rm tonistiigi/binfmt --install all
 
 references:
-  install_goreleaser: &install_goreleaser
-    run:
-      name: Install GoReleaser
-      command: |
-        curl -fsSLo goreleaser.deb https://github.com/goreleaser/goreleaser/releases/download/v0.94.0/goreleaser_amd64.deb
-        echo "8dbad6683d6fc9367e637e6eed8e01a0d63c9660  goreleaser.deb" | sha1sum -c
-        sudo dpkg -i goreleaser.deb
-        rm goreleaser.deb
   set_environment_variables: &set_environment_variables
     run:
       name: Set Environment Variables
       command: |
-        echo 'export REPO=quay.io/reactiveops/polaris' >> ${BASH_ENV}
-  docker_build_and_push: &docker_build_and_push
-    run:
-      name: Docker login, build, and push
-      command: |
-        docker login quay.io -u="reactiveops+circleci" -p="${quay_token}"
-        docker build -t $REPO:dev-$CIRCLE_SHA1 .
-        docker push $REPO:dev-$CIRCLE_SHA1
-  docker_tag_release: &docker_tag_release
-    run:
-      name: Docker tag release
-      command: |
-        docker login quay.io -u="reactiveops+circleci" -p="${quay_token}"
-        docker pull $REPO:dev-$CIRCLE_SHA1
-        docker tag $REPO:dev-$CIRCLE_SHA1 $REPO:$CIRCLE_TAG
-        docker push $REPO:$CIRCLE_TAG
+        echo 'export CI_SHA1=$CIRCLE_SHA1' >> ${BASH_ENV}
+        echo 'export CI_BRANCH=$CIRCLE_BRANCH' >> ${BASH_ENV}
+        echo 'export CI_BUILD_NUM=$CIRCLE_BUILD_NUM' >> ${BASH_ENV}
+        echo 'export CI_TAG=$CIRCLE_TAG' >> ${BASH_ENV}
+        echo 'export PUSH_ALL_VERSION_TAGS=true' >> ${BASH_ENV}
+        echo 'export GOPROXY=https://proxy.golang.org' >> ${BASH_ENV}
+        echo 'export GO111MODULE=on' >> ${BASH_ENV}
+        echo 'export GOFLAGS=-mod=mod' >> ${BASH_ENV}
+        echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
 
+  install_k8s: &install_k8s
+    run:
+      name: Install K8s
+      command: |
+        sudo apt-get update
+        echo "Installing git and jq"
+        sudo apt-get install -yqq jq git
+
+        echo "Installing KIND"
+        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.19.0/kind-linux-amd64
+        chmod 0755 kind-linux-amd64
+        sudo mv kind-linux-amd64 /usr/local/bin/kind
+        kind version
+
+        echo "Installing Kubectl"
+        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.25.10/bin/linux/amd64/kubectl
+        chmod 0755 kubectl
+        sudo mv kubectl /usr/local/bin/
+        kubectl version --client
+
+
+        echo "Creating Kubernetes Cluster with Kind"
+        kind create cluster --wait=90s --image kindest/node:v1.25.9@sha256:c08d6c52820aa42e533b70bce0c2901183326d86dcdcbedecc9343681db45161
+        docker ps -a
+
+        kubectl version
+
+        echo "Installing Helm"
+        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
+        chmod 700 get_helm.sh
+        ./get_helm.sh
+
+        echo "Installing cert-manager"
+        helm repo add jetstack https://charts.jetstack.io
+        helm repo update
+        echo "Helm install"
+        helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait --create-namespace
+        echo "Install cert-manager successful"
+
+  test_binary_dashboard: &test_binary_dashboard
+    run:
+      name: Test Dashboard
+      command: |
+        go run main.go dashboard --port 3000 --audit-path ./pkg/config/examples &
+        sleep 30
+        curl -f http://localhost:3000 > /dev/null
+        curl -f http://localhost:3000/health > /dev/null
+        curl -f http://localhost:3000/favicon.ico > /dev/null
+        curl -f http://localhost:3000/static/css/main.css > /dev/null
+        curl -f http://localhost:3000/results.json > /dev/null
+        curl -f http://localhost:3000/details/security > /dev/null
+  test_k8s: &test_k8s
+    run:
+      name: Test Kubernetes Deployments
+      command: |
+        if [[ -z $CIRCLE_PR_NUMBER ]]; then
+          ./test/webhook_test.sh
+          ./test/kube_dashboard_test.sh
+        else
+          echo "Skipping Kubernetes tests for forked PR"
+        fi
+
+  install_vault_alpine: &install_vault_alpine
+    run:
+      name: install hashicorp vault
+      command: |
+        apk --update add curl yq
+        cd /tmp
+        curl -LO https://releases.hashicorp.com/vault/1.13.2/vault_1.13.2_linux_amd64.zip
+        sha256sum vault_1.13.2_linux_amd64.zip | grep f7930279de8381de7c532164b4a4408895d9606c0d24e2e9d2f9acb5dfe99b3c
+        unzip vault_1.13.2_linux_amd64.zip
+        mv vault /usr/bin/vault
 jobs:
-  build:
-    docker:
-      - image: quay.io/reactiveops/ci-images:v8.0-stretch
+  test_k8s:
+    working_directory: ~/polaris
+    resource_class: medium
+    executor: vm
     steps:
       - checkout
-      - setup_remote_docker
       - *set_environment_variables
-      - *docker_build_and_push
+      - *install_k8s
+      - *test_k8s
 
   test:
-    working_directory: /go/src/github.com/reactiveops/polaris/
     docker:
-      - image: circleci/golang:1.12
-
+      - image: cimg/go:1.24.4
     steps:
       - checkout
-      - run: go get -u golang.org/x/lint/golint
-      - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
-      - run: go list ./... | grep -v vendor | xargs go vet
+      - *set_environment_variables
+      - run: go vet ./...
+      - run: go test ./... -coverprofile=coverage.txt -covermode=count
+      - *test_binary_dashboard
 
-  test-deploy:
+  build_and_push:
+    working_directory: /go/src/github.com/fairwindsops/polaris/
+    resource_class: large
+    shell: /bin/bash
     docker:
-      - image: quay.io/reactiveops/ci-images:v8.0-stretch
-    steps:
-      - checkout
-      - run:
-          name: Verify helm chart synced with dashboard.yaml
-          command: |
-            diff \
-              <(helm template deploy/helm/polaris/ --name polaris --namespace polaris --set templateOnly=true) \
-              deploy/dashboard.yaml || (echo "
-                Make sure to regenerate k8s deploy config with make helm-to-k8s" &&
-                exit 1)
-
-      - run:
-          name: Verify helm chart synced with webhook.yaml
-          command: |
-            diff \
-              <(helm template deploy/helm/polaris/ --name polaris --namespace polaris --set templateOnly=true --set webhook.enable=true --set dashboard.enable=false) \
-              deploy/webhook.yaml || (echo "
-                Make sure to regenerate k8s deploy config with make helm-to-k8s" &&
-                exit 1)
-
-  release:
-    working_directory: /go/src/github.com/reactiveops/polaris/
-    docker:
-      - image: circleci/golang:1.12
+      # The goreleaser image tag determins the version of Go.
+      # Manually check goreleaser images for their version of Go.
+      # Ref: https://hub.docker.com/r/goreleaser/goreleaser/tags
+      - image: goreleaser/goreleaser:v2.10.2
     steps:
       - checkout
       - setup_remote_docker
+      - *install_vault_alpine
+      - rok8s/get_vault_env:
+          vault_path: repo/global/env
+      - rok8s/get_vault_env:
+          vault_path: repo/polaris/env
       - *set_environment_variables
-      - *docker_tag_release
-      - *install_goreleaser
-      - run: goreleaser
+      - run: docker login quay.io -u="${FAIRWINDS_QUAY_USER}" -p="${FAIRWINDS_QUAY_TOKEN}"
+      - install_goreleaser_dependencies
+      - run: scripts/goreleaser.sh
 
 workflows:
   version: 2
-  build:
-    jobs:
-      - test
-      - test-deploy
-      - build:
-          requires:
-            - test
-            - test-deploy
-          context: org-global
-          # Allow using testing tags for testing circle test + build steps
-          filters:
-            tags:
-              only: /^testing-.*/
+
   release:
     jobs:
-      - release:
+      - test:
+          filters:
+            tags:
+              only: /.*/
+      - build_and_push:
           context: org-global
           filters:
             branches:
+              ignore: /pull\/[0-9]+/
+            tags:
+              ignore: /^testing-.*/
+      - test_k8s:
+          requires:
+            - build_and_push
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+            tags:
+              ignore: /^testing-.*/
+      - oss-docs/publish-docs:
+          repository: polaris
+          filters:
+            branches:
               ignore: /.*/
-            # Testing tags are reserved for testing circle test + build steps
             tags:
               ignore: /^testing-.*/

.envrc

@@ -0,0 +1,3 @@
+export GO111MODULE=on
+export GOPROXY=https://proxy.golang.org
+

.github/ISSUE_TEMPLATE/bug.yaml

@@ -0,0 +1,58 @@
+name: Bug Report
+description: File a bug report
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report! Please fill the form below.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+      description: What is the expected or desired behavior?
+    validations:
+      required: true
+  - type: textarea
+    id: reproducible
+    attributes:
+      label: How can we reproduce this?
+      description: Please share the steps that we can take to reproduce this. Also include any relevant configuration.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The version of the tool that you are using. If a helm chart, please share the name of the chart.
+    validations:
+      required: true
+  - type: checkboxes
+    id: search
+    attributes:
+      label: Search
+      options:
+        - label: I did search for other open and closed issues before opening this.
+          required: true
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow the CODE_OF_CONDUCT in this repository.
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true
+  - type: textarea
+    id: ctx
+    attributes:
+      label: Additional context
+      description: Anything else you would like to add
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,11 +1,14 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
+title: ''
+labels: [triage, enhancement]
+assignees: ''
 
 ---
 
 **Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is.
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
 
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen.

.github/ISSUE_TEMPLATE/other.md

@@ -0,0 +1,8 @@
+---
+name: Other
+about: For misc. tasks like research or continued conversation
+title: ''
+labels: [triage]
+assignees: ''
+
+---

.github/actions/setup-polaris/Dockerfile

@@ -0,0 +1,15 @@
+# The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action
+
+FROM alpine:3.22
+
+RUN	apk add --no-cache \
+  bash \
+  ca-certificates \
+  curl \
+  wget \
+  tar \
+  jq
+
+COPY get_polaris.sh /get_polaris.sh
+
+ENTRYPOINT ["/get_polaris.sh"]

.github/actions/setup-polaris/action.yaml

@@ -0,0 +1,22 @@
+name: 'Install polaris'
+description: 'Download a specific polaris version'
+
+inputs:
+  version:
+    description: 'version of polaris'
+    required: true
+    default: 'latest'
+
+runs:
+  using: 'docker'
+  image: './Dockerfile'
+  args:
+    - ${{ inputs.version }}
+
+outputs:
+  version:
+    description: 'Version of polaris installed'
+
+branding:
+  icon: 'download-cloud'
+  color: 'gray-dark'

.github/actions/setup-polaris/get_polaris.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+if [[ -z "$INPUT_VERSION" ]]; then
+  echo "Missing polaris version information"
+  exit 1
+fi
+POLARIS_URL=https://github.com/FairwindsOps/polaris/releases/download/$INPUT_VERSION/polaris_linux_amd64.tar.gz
+polaris version | grep "$INPUT_VERSION" &> /dev/null
+if [ $? == 0 ]; then
+   echo "Polaris $INPUT_VERSION is already installed! Exiting gracefully."
+   exit 0
+else
+  echo "Installing polaris to path from " $POLARIS_URL
+fi
+TARGET_FILE="polaris.tar.gz"
+curl -LJ -o $TARGET_FILE $POLARIS_URL
+mkdir polaris
+tar -xzf $TARGET_FILE -C polaris
+rm $TARGET_FILE
+echo "polaris" >> $GITHUB_PATH
+echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT

.github/dependabot.yml

@@ -0,0 +1,20 @@
+## DO NOT EDIT - Managed by Terraform
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,14 @@
+
+This PR fixes #
+
+## Checklist
+* [ ] I have signed the CLA
+* [ ] I have updated/added any relevant documentation
+
+## Description
+### What's the goal of this PR?
+
+### What changes did you make?
+
+### What alternative solution should we consider, if any?
+

.github/workflows/stale.yml

@@ -0,0 +1,18 @@
+name: 'Close stale issues and PRs'
+on:
+  schedule:
+    - cron: '32 1 * * *'
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v4
+        with:
+          exempt-issue-labels: pinned
+          stale-pr-label: stale
+          stale-issue-label: stale

.github/workflows/test_setup.yml

@@ -0,0 +1,27 @@
+name: Test setup-polaris
+on:
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  build-int:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup polaris
+        uses: ./.github/actions/setup-polaris
+        with:
+          version: 4.2.0
+      - name: Use command
+        run: polaris version
+
+  build-ext:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup polaris
+        uses: fairwindsops/polaris/.github/actions/setup-polaris@master
+        with:
+          version: 4.2.0
+      - name: Use command
+        run: polaris version

.gitignore

@@ -1,4 +1,8 @@
-# Binaries for programs and plugins
+# goreleaser is run via a wrapper that creates .goreleaser.yml from .goreleaser.yml.envsubst
+.goreleaser.yml
+# dist
+# # Binaries for programs and plugins
+.go-version
 *.exe
 *.exe~
 *.dll
@@ -6,6 +10,7 @@
 *.dylib
 polaris
 
+!cmd/polaris
 !deploy/helm/polaris
 
 # Test binary, build with `go test -c`
@@ -18,5 +23,11 @@ Tiltfile
 main
 .DS_Store
 
-*-packr.go
 dist
+.vscode
+
+*-test.yaml
+
+node_modules
+/dist
+docs/README.md

.goreleaser.yml

@@ -1,28 +0,0 @@
-builds:
-- env:
-  - CGO_ENABLED=0
-archive:
-  replacements:
-    darwin: Darwin
-    linux: Linux
-    windows: Windows
-    386: i386
-    amd64: x86_64
-checksum:
-  name_template: 'checksums.txt'
-snapshot:
-  name_template: "{{ .Tag }}-next"
-changelog:
-  sort: asc
-  filters:
-    exclude:
-    - '^docs:'
-    - '^test:'
-brew:
-  github:
-    owner: reactiveops
-    name: homebrew-tap
-  folder: Formula
-  description: Open Source Best Practices for Kubernetes
-  test: |
-    system "#{bin}/polaris --version"

.goreleaser.yml.envsubst

@@ -0,0 +1,114 @@
+version: 2
+checksum:
+  name_template: 'checksums.txt'
+changelog:
+  sort: asc
+  filters:
+    exclude:
+    - '^docs:'
+    - '^test:'
+env:
+  - GOBIN={{ .Env.TMPDIR }}/go-bin
+before:
+  hooks:
+    - go mod download
+builds:
+  - id: polaris
+    ldflags:
+      - -X main.Version={{.Version}} -X main.Commit={{.Commit}} -s -w
+    env:
+      - CGO_ENABLED=0
+      - GO111MODULE=on
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm
+      - arm64
+    goarm:
+      - 6
+      - 7
+archives:
+  - id: polaris
+    builds: ["polaris"]
+    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
+signs:
+- cmd: cosign
+  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
+  artifacts: checksum
+release:
+  # This is replaced using `envsubst`, depending on the git branch.
+  disable: ${skip_release}
+  prerelease: auto
+  footer: |
+    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
+
+    ```
+    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
+    ```
+brews:
+  - name: polaris
+    # This is replaced using `envsubst`, depending on the git branch.
+    skip_upload: ${skip_release}
+    repository:
+      owner: FairwindsOps
+      name: homebrew-tap
+    directory: Formula
+    description: Open Source Best Practices for Kubernetes
+    url_template: "https://github.com/FairwindsOps/polaris/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
+    test: |
+      system "#{bin}/polaris version"
+dockers:
+  # There are multiple images to match the `--platform` docker build flag with
+  # combinations of `GOOS`, `GOARCH`, and `GOARM`
+- image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  use: buildx
+  build_flag_templates:
+  - "--platform=linux/amd64"
+- image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+  use: buildx
+  goarch: arm64
+  goos: linux
+  build_flag_templates:
+  - "--platform=linux/arm64"
+docker_manifests:
+# Create DOcker manifests that make multiple architectures available within a tag,
+# and provide partial-version tags like 2, and 2.2.
+- name_template: quay.io/fairwinds/polaris:{{ .FullCommit }}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Env.feature_docker_tag }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_feature_docker_tags}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:latest
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Tag }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Major }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Major }}.{{ .Minor }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"

.licenserc.yaml

@@ -0,0 +1,24 @@
+header:
+  license:
+    spdx-id: Apache-2.0
+    copyright-owner: 'FairwindsOps, Inc.'
+  content: |
+    // Copyright 2019 FairwindsOps Inc
+    //
+    // Licensed under the Apache License, Version 2.0 (the "License");
+    // you may not use this file except in compliance with the License.
+    // You may obtain a copy of the License at
+    //
+    //     http://www.apache.org/licenses/LICENSE-2.0
+    //
+    // Unless required by applicable law or agreed to in writing, software
+    // distributed under the License is distributed on an "AS IS" BASIS,
+    // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    // See the License for the specific language governing permissions and
+    // limitations under the License.
+  paths:
+    - '**/*.go'
+  comment: on-failure
+dependency:
+  files:
+    - go.mod

CHANGELOG.md

@@ -1,25 +0,0 @@
-# 0.1.0
-* Dashboard fully functional
-* Validating webhook functional, but still considered beta
-* Checks:
-  * Health
-    * readiness probe missing
-    * liveness probe missing
-  * Images
-    * tag not specified
-    * pull policy not always
-  * Networking
-    * host network set
-    * host port set
-  * Resources
-    * cpu/memory requests missing
-    * cpu/memory limits missing
-    * cpu/memory ranges exceeded
-  * Security
-    * security capabilities
-    * host IPC set
-    * host PID set
-    * not read-only fs
-    * privilege escalation allowed
-    * run as root allowed
-    * run as privileged

CODEOWNERS

@@ -0,0 +1,2 @@
+## DO NOT EDIT - Managed by Terraform
+* @sudermanjr @jdesouza @vitorvezani

CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at [INSERT EMAIL ADDRESS]. All
+reported by contacting the project team at opensource@fairwinds.com. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.
@@ -71,4 +71,4 @@ This Code of Conduct is adapted from the [Contributor Covenant][homepage], versi
 available at [http://contributor-covenant.org/version/1/4][version]
 
 [homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/
+[version]: http://contributor-covenant.org/version/1/4/

CONTRIBUTING.md

@@ -1,44 +0,0 @@
-# Contributing
-
-Issues, whether bugs, tasks, or feature requests are essential for keeping Polaris great. We believe it should be as easy as possible to contribute changes that get things working in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
-
-## Code of Conduct
-
-This project adheres to a [code of conduct](CODE_OF_CONDUCT.md). Please review this document before contributing to this project.
-
-## Project Structure
-
-Polaris is built on top of [controller-runtime](https://github.com/kubernetes-sigs/controller-runtime). It can run in 3 different modes, a dashboard, a webhook, or a reporter that prints or exports validation results. All of these modes make use of the shared `validator` and `config` packages. Adding new validations is possible by only making additions to those packages.
-
-## Getting Started
-
-We label issues with the ["good first issue" tag](https://github.com/reactiveops/polaris/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) if we believe they'll be a good starting point for new contributors. If you're interested in working on an issue, please start a conversation on that issue, and we can help answer any questions as they come up.
-
-## Running Tests
-
-The following commands are all required to pass as part of Polaris testing:
-
-```
-go list ./... | grep -v vendor | xargs golint -set_exit_status
-go list ./... | grep -v vendor | xargs go vet
-go test ./pkg/... -v -coverprofile cover.out
-```
-
-## Creating a New Issue
-
-If you've encountered an issue that is not already reported, please create an issue that contains the following:
-
-- Clear description of the issue
-- Steps to reproduce it
-- Appropriate labels
-
-## Creating a Pull Request
-
-Each new pull request should:
-
-- Reference any related issues
-- Add tests that show the issues have been solved
-- Pass existing tests and linting
-- Contain a clear indication of if they're ready for review or a work in progress
-- Be up to date and/or rebased on the master branch
-

Dockerfile

@@ -1,20 +1,22 @@
-FROM golang:1.12.4 AS build-env
-WORKDIR /go/src/github.com/reactiveops/polaris/
+FROM alpine:3.22
 
-COPY . .
-RUN go get -u github.com/gobuffalo/packr/v2/packr2
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 packr2 build -a -o polaris *.go
+LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
+      org.opencontainers.image.vendor="FairwindsOps, Inc." \
+      org.opencontainers.image.title="polaris" \
+      org.opencontainers.image.description="Polaris is a cli tool to help discover deprecated apiVersions in Kubernetes" \
+      org.opencontainers.image.documentation="https://polaris.docs.fairwinds.com/" \
+      org.opencontainers.image.source="https://github.com/FairwindsOps/polaris" \
+      org.opencontainers.image.url="https://github.com/FairwindsOps/polaris" \
+      org.opencontainers.image.licenses="Apache License 2.0"
 
-FROM alpine:3.9
 WORKDIR /usr/local/bin
+RUN apk -U upgrade
 RUN apk --no-cache add ca-certificates
 
 RUN addgroup -S polaris && adduser -u 1200 -S polaris -G polaris
 USER 1200
-COPY --from=build-env /go/src/github.com/reactiveops/polaris/polaris .
+COPY polaris .
 
 WORKDIR /opt/app
 
-COPY --from=build-env /go/src/github.com/reactiveops/polaris/config.yaml ./config.yaml
-
 CMD ["polaris"]

Gopkg.lock

@@ -1,429 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  name = "cloud.google.com/go"
-  packages = ["compute/metadata"]
-  revision = "c9474f2f8deb81759839474b6bd1726bbfe1c1c4"
-  version = "v0.36.0"
-
-[[projects]]
-  name = "github.com/appscode/jsonpatch"
-  packages = ["."]
-  revision = "7c0e3b262f30165a8ec3d0b4c6059fd92703bfb2"
-  version = "1.0.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/beorn7/perks"
-  packages = ["quantile"]
-  revision = "3a771d992973f24aa725d07868b467d1ddfceafb"
-
-[[projects]]
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  revision = "8991bc29aa16c548c550c7ff78260e27b9ab7c73"
-  version = "v1.1.1"
-
-[[projects]]
-  name = "github.com/evanphx/json-patch"
-  packages = ["."]
-  revision = "72bf35d0ff611848c1dc9df0f976c81192392fa5"
-  version = "v4.1.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/go-logr/logr"
-  packages = ["."]
-  revision = "9fb12b3b21c5415d16ac18dc5cd42c1cfdd40c4e"
-
-[[projects]]
-  name = "github.com/go-logr/zapr"
-  packages = ["."]
-  revision = "7536572e8d55209135cd5e7ccf7fce43dca217ab"
-  version = "v0.1.0"
-
-[[projects]]
-  name = "github.com/gobuffalo/envy"
-  packages = ["."]
-  revision = "043cb4b8af871b49563291e32c66bb84378a60ac"
-  version = "v1.7.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/gobuffalo/genny"
-  packages = ["."]
-  revision = "3ca520ef0d9ea4981534aae98bf9a003d9b18678"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/gobuffalo/gogen"
-  packages = [".","goimports","gomods"]
-  revision = "8f38393713f59beb43221f903c07f58f0377a063"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/gobuffalo/logger"
-  packages = ["."]
-  revision = "86e12af44bc273e0063fad5b6ad588890b8cfe6b"
-
-[[projects]]
-  name = "github.com/gobuffalo/mapi"
-  packages = ["."]
-  revision = "0bb5e840be332d4280e40f2e6c50777c615bbac5"
-  version = "v1.0.2"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/gobuffalo/packd"
-  packages = ["."]
-  revision = "a385830c7fc0495b810318788a043c7655da337d"
-
-[[projects]]
-  name = "github.com/gobuffalo/packr"
-  packages = ["v2","v2/file","v2/file/resolver","v2/file/resolver/encoding/hex","v2/jam/parser","v2/plog"]
-  revision = "cda4ac25577350dac682c8715dc6659327232596"
-  version = "v2.2.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/gobuffalo/syncx"
-  packages = ["."]
-  revision = "33c29581e754bd354236e977dfe426e55331c45d"
-
-[[projects]]
-  name = "github.com/gogo/protobuf"
-  packages = ["proto","sortkeys"]
-  revision = "342cbe0a04158f6dcb03ca0079991a51a4248c02"
-  version = "v0.5"
-
-[[projects]]
-  name = "github.com/golang/groupcache"
-  packages = ["lru"]
-  revision = "02826c3e79038b59d737d3b1c0a1d937f71a4433"
-
-[[projects]]
-  name = "github.com/golang/protobuf"
-  packages = ["proto","ptypes","ptypes/any","ptypes/duration","ptypes/timestamp"]
-  revision = "aa810b61a9c79d51363740d207bb46cf8e620ed5"
-  version = "v1.2.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/google/btree"
-  packages = ["."]
-  revision = "4030bb1f1f0c35b30ca7009e9ebd06849dd45306"
-
-[[projects]]
-  name = "github.com/google/gofuzz"
-  packages = ["."]
-  revision = "44d81051d367757e1c7c6a5a86423ece9afcf63c"
-
-[[projects]]
-  name = "github.com/googleapis/gnostic"
-  packages = ["OpenAPIv2","compiler","extensions"]
-  revision = "0c5108395e2debce0d731cf0287ddf7242066aba"
-
-[[projects]]
-  name = "github.com/gorilla/mux"
-  packages = ["."]
-  revision = "c5c6c98bc25355028a63748a498942a6398ccd22"
-  version = "v1.7.1"
-
-[[projects]]
-  name = "github.com/gregjones/httpcache"
-  packages = [".","diskcache"]
-  revision = "787624de3eb7bd915c329cba748687a3b22666a6"
-
-[[projects]]
-  name = "github.com/hashicorp/golang-lru"
-  packages = [".","simplelru"]
-  revision = "a0d98a5f288019575c6d1f4bb1573fef2d1fcdc4"
-
-[[projects]]
-  name = "github.com/imdario/mergo"
-  packages = ["."]
-  revision = "9316a62528ac99aaecb4e47eadd6dc8aa6533d58"
-  version = "v0.3.5"
-
-[[projects]]
-  name = "github.com/joho/godotenv"
-  packages = ["."]
-  revision = "23d116af351c84513e1946b527c88823e476be13"
-  version = "v1.3.0"
-
-[[projects]]
-  name = "github.com/json-iterator/go"
-  packages = ["."]
-  revision = "ab8a2e0c74be9d3be70b3184d9acc634935ded82"
-  version = "1.1.4"
-
-[[projects]]
-  name = "github.com/karrick/godirwalk"
-  packages = ["."]
-  revision = "6d1c7760ec857d2984abe0a23fa263877f50d3f0"
-  version = "v1.8.0"
-
-[[projects]]
-  name = "github.com/konsorten/go-windows-terminal-sequences"
-  packages = ["."]
-  revision = "f55edac94c9bbba5d6182a4be46d86a2c9b5b50e"
-  version = "v1.0.2"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/markbates/oncer"
-  packages = ["."]
-  revision = "bf2de49a0be218916e69a11d22866e6cd0a560f2"
-
-[[projects]]
-  name = "github.com/markbates/safe"
-  packages = ["."]
-  revision = "6fea05a5732486546a4836b7a1d596c5ec687b98"
-  version = "v1.0.1"
-
-[[projects]]
-  name = "github.com/matttproud/golang_protobuf_extensions"
-  packages = ["pbutil"]
-  revision = "c12348ce28de40eed0136aa2b644d0ee0650e56c"
-  version = "v1.0.1"
-
-[[projects]]
-  name = "github.com/modern-go/concurrent"
-  packages = ["."]
-  revision = "bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94"
-  version = "1.0.3"
-
-[[projects]]
-  name = "github.com/modern-go/reflect2"
-  packages = ["."]
-  revision = "94122c33edd36123c84d5368cfb2b69df93a0ec8"
-  version = "v1.0.1"
-
-[[projects]]
-  name = "github.com/pborman/uuid"
-  packages = ["."]
-  revision = "ca53cad383cad2479bbba7f7a1a05797ec1386e4"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/petar/GoLLRB"
-  packages = ["llrb"]
-  revision = "53be0d36a84c2a886ca057d34b6aa4468df9ccb4"
-
-[[projects]]
-  name = "github.com/peterbourgon/diskv"
-  packages = ["."]
-  revision = "5f041e8faa004a95c88a202771f4cc3e991971e6"
-  version = "v2.0.1"
-
-[[projects]]
-  name = "github.com/pkg/errors"
-  packages = ["."]
-  revision = "ba968bfe8b2f7e042a574c888954fccecfa385b4"
-  version = "v0.8.1"
-
-[[projects]]
-  name = "github.com/pmezard/go-difflib"
-  packages = ["difflib"]
-  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
-  version = "v1.0.0"
-
-[[projects]]
-  name = "github.com/prometheus/client_golang"
-  packages = ["prometheus","prometheus/internal","prometheus/promhttp"]
-  revision = "505eaef017263e299324067d40ca2c48f6a2cf50"
-  version = "v0.9.2"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/prometheus/client_model"
-  packages = ["go"]
-  revision = "fd36f4220a901265f90734c3183c5f0c91daa0b8"
-
-[[projects]]
-  name = "github.com/prometheus/common"
-  packages = ["expfmt","internal/bitbucket.org/ww/goautoneg","model"]
-  revision = "cfeb6f9992ffa54aaa4f2170ade4067ee478b250"
-  version = "v0.2.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/prometheus/procfs"
-  packages = [".","internal/util","nfs","xfs"]
-  revision = "de1b801bf34b80cd00f14087dc5a994bfe0296bc"
-
-[[projects]]
-  name = "github.com/rogpeppe/go-internal"
-  packages = ["modfile","module","semver"]
-  revision = "438578804ca6f31be148c27683afc419ce47c06e"
-  version = "v1.3.0"
-
-[[projects]]
-  name = "github.com/sirupsen/logrus"
-  packages = ["."]
-  revision = "8bdbc7bcc01dcbb8ec23dc8a28e332258d25251f"
-  version = "v1.4.1"
-
-[[projects]]
-  name = "github.com/spf13/pflag"
-  packages = ["."]
-  revision = "583c0c0531f06d5278b7d917446061adc344b5cd"
-  version = "v1.0.1"
-
-[[projects]]
-  name = "github.com/stretchr/testify"
-  packages = ["assert"]
-  revision = "ffdc059bfe9ce6a4e144ba849dbedead332c6053"
-  version = "v1.3.0"
-
-[[projects]]
-  branch = "master"
-  name = "gitlab.com/golang-commonmark/html"
-  packages = ["."]
-  revision = "cfaf75183c4a5f0e44e3d51ece1065accafdd2b3"
-
-[[projects]]
-  branch = "master"
-  name = "gitlab.com/golang-commonmark/linkify"
-  packages = ["."]
-  revision = "c22b7bdb117955ff2cc0e3724083d35e3419d71e"
-
-[[projects]]
-  name = "gitlab.com/golang-commonmark/markdown"
-  packages = ["."]
-  revision = "772775880e1fbf39a7804149ed11c0f714ec89fe"
-
-[[projects]]
-  branch = "master"
-  name = "gitlab.com/golang-commonmark/mdurl"
-  packages = ["."]
-  revision = "e5bce34c34f29ecf232fec34f3982e55533ec14e"
-
-[[projects]]
-  branch = "master"
-  name = "gitlab.com/golang-commonmark/puny"
-  packages = ["."]
-  revision = "2cd490539afe7c6fc0eda6c59ef88fa93a00ea0d"
-
-[[projects]]
-  name = "go.uber.org/atomic"
-  packages = ["."]
-  revision = "4e336646b2ef9fc6e47be8e21594178f98e5ebcf"
-  version = "v1.2.0"
-
-[[projects]]
-  name = "go.uber.org/multierr"
-  packages = ["."]
-  revision = "3c4937480c32f4c13a875a1829af76c98ca3d40a"
-  version = "v1.1.0"
-
-[[projects]]
-  name = "go.uber.org/zap"
-  packages = [".","buffer","internal/bufferpool","internal/color","internal/exit","zapcore"]
-  revision = "ff33455a0e382e8a81d14dd7c922020b6b5e7982"
-  version = "v1.9.1"
-
-[[projects]]
-  name = "golang.org/x/crypto"
-  packages = ["ssh/terminal"]
-  revision = "de0752318171da717af4ce24d0a2e8626afaeb11"
-
-[[projects]]
-  branch = "release-branch.go1.10"
-  name = "golang.org/x/net"
-  packages = ["context","http2","http2/hpack","idna","lex/httplex"]
-  revision = "0ed95abb35c445290478a5348a7b38bb154135fd"
-
-[[projects]]
-  name = "golang.org/x/oauth2"
-  packages = [".","google","internal","jws","jwt"]
-  revision = "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
-
-[[projects]]
-  branch = "master"
-  name = "golang.org/x/sys"
-  packages = ["unix","windows"]
-  revision = "41f3e6584952bb034a481797859f6ab34b6803bd"
-
-[[projects]]
-  name = "golang.org/x/text"
-  packages = ["collate","collate/build","internal/colltab","internal/gen","internal/tag","internal/triegen","internal/ucd","language","secure/bidirule","transform","unicode/bidi","unicode/cldr","unicode/norm","unicode/rangetable"]
-  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
-  version = "v0.3.0"
-
-[[projects]]
-  name = "golang.org/x/time"
-  packages = ["rate"]
-  revision = "f51c12702a4d776e4c1fa9b0fabab841babae631"
-
-[[projects]]
-  branch = "master"
-  name = "golang.org/x/tools"
-  packages = ["go/ast/astutil","go/gcexportdata","go/internal/gcimporter","go/internal/packagesdriver","go/packages","go/types/typeutil","imports","internal/fastwalk","internal/gopathwalk","internal/module","internal/semver"]
-  revision = "4ca4b55e2050cfa75f1a1f72ae10825e80b052a0"
-
-[[projects]]
-  name = "google.golang.org/appengine"
-  packages = [".","internal","internal/app_identity","internal/base","internal/datastore","internal/log","internal/modules","internal/remote_api","internal/urlfetch","urlfetch"]
-  revision = "e9657d882bb81064595ca3b56cbe2546bbabf7b1"
-  version = "v1.4.0"
-
-[[projects]]
-  name = "gopkg.in/inf.v0"
-  packages = ["."]
-  revision = "3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4"
-  version = "v0.9.0"
-
-[[projects]]
-  name = "gopkg.in/yaml.v2"
-  packages = ["."]
-  revision = "51d6538a90f86fe93ac480b35f37b2be17fef232"
-  version = "v2.2.2"
-
-[[projects]]
-  name = "k8s.io/api"
-  packages = ["admission/v1beta1","admissionregistration/v1alpha1","admissionregistration/v1beta1","apps/v1","apps/v1beta1","apps/v1beta2","auditregistration/v1alpha1","authentication/v1","authentication/v1beta1","authorization/v1","authorization/v1beta1","autoscaling/v1","autoscaling/v2beta1","autoscaling/v2beta2","batch/v1","batch/v1beta1","batch/v2alpha1","certificates/v1beta1","coordination/v1beta1","core/v1","events/v1beta1","extensions/v1beta1","networking/v1","policy/v1beta1","rbac/v1","rbac/v1alpha1","rbac/v1beta1","scheduling/v1alpha1","scheduling/v1beta1","settings/v1alpha1","storage/v1","storage/v1alpha1","storage/v1beta1"]
-  revision = "05914d821849570fba9eacfb29466f2d8d3cd229"
-  version = "kubernetes-1.13.1"
-
-[[projects]]
-  name = "k8s.io/apimachinery"
-  packages = ["pkg/api/errors","pkg/api/meta","pkg/api/resource","pkg/apis/meta/internalversion","pkg/apis/meta/v1","pkg/apis/meta/v1/unstructured","pkg/apis/meta/v1beta1","pkg/conversion","pkg/conversion/queryparams","pkg/fields","pkg/labels","pkg/runtime","pkg/runtime/schema","pkg/runtime/serializer","pkg/runtime/serializer/json","pkg/runtime/serializer/protobuf","pkg/runtime/serializer/recognizer","pkg/runtime/serializer/streaming","pkg/runtime/serializer/versioning","pkg/selection","pkg/types","pkg/util/cache","pkg/util/clock","pkg/util/diff","pkg/util/errors","pkg/util/framer","pkg/util/intstr","pkg/util/json","pkg/util/mergepatch","pkg/util/naming","pkg/util/net","pkg/util/runtime","pkg/util/sets","pkg/util/strategicpatch","pkg/util/uuid","pkg/util/validation","pkg/util/validation/field","pkg/util/wait","pkg/util/yaml","pkg/version","pkg/watch","third_party/forked/golang/json","third_party/forked/golang/reflect"]
-  revision = "2b1284ed4c93a43499e781493253e2ac5959c4fd"
-  version = "kubernetes-1.13.1"
-
-[[projects]]
-  name = "k8s.io/client-go"
-  packages = ["discovery","discovery/fake","dynamic","kubernetes","kubernetes/fake","kubernetes/scheme","kubernetes/typed/admissionregistration/v1alpha1","kubernetes/typed/admissionregistration/v1alpha1/fake","kubernetes/typed/admissionregistration/v1beta1","kubernetes/typed/admissionregistration/v1beta1/fake","kubernetes/typed/apps/v1","kubernetes/typed/apps/v1/fake","kubernetes/typed/apps/v1beta1","kubernetes/typed/apps/v1beta1/fake","kubernetes/typed/apps/v1beta2","kubernetes/typed/apps/v1beta2/fake","kubernetes/typed/auditregistration/v1alpha1","kubernetes/typed/auditregistration/v1alpha1/fake","kubernetes/typed/authentication/v1","kubernetes/typed/authentication/v1/fake","kubernetes/typed/authentication/v1beta1","kubernetes/typed/authentication/v1beta1/fake","kubernetes/typed/authorization/v1","kubernetes/typed/authorization/v1/fake","kubernetes/typed/authorization/v1beta1","kubernetes/typed/authorization/v1beta1/fake","kubernetes/typed/autoscaling/v1","kubernetes/typed/autoscaling/v1/fake","kubernetes/typed/autoscaling/v2beta1","kubernetes/typed/autoscaling/v2beta1/fake","kubernetes/typed/autoscaling/v2beta2","kubernetes/typed/autoscaling/v2beta2/fake","kubernetes/typed/batch/v1","kubernetes/typed/batch/v1/fake","kubernetes/typed/batch/v1beta1","kubernetes/typed/batch/v1beta1/fake","kubernetes/typed/batch/v2alpha1","kubernetes/typed/batch/v2alpha1/fake","kubernetes/typed/certificates/v1beta1","kubernetes/typed/certificates/v1beta1/fake","kubernetes/typed/coordination/v1beta1","kubernetes/typed/coordination/v1beta1/fake","kubernetes/typed/core/v1","kubernetes/typed/core/v1/fake","kubernetes/typed/events/v1beta1","kubernetes/typed/events/v1beta1/fake","kubernetes/typed/extensions/v1beta1","kubernetes/typed/extensions/v1beta1/fake","kubernetes/typed/networking/v1","kubernetes/typed/networking/v1/fake","kubernetes/typed/policy/v1beta1","kubernetes/typed/policy/v1beta1/fake","kubernetes/typed/rbac/v1","kubernetes/typed/rbac/v1/fake","kubernetes/typed/rbac/v1alpha1","kubernetes/typed/rbac/v1alpha1/fake","kubernetes/typed/rbac/v1beta1","kubernetes/typed/rbac/v1beta1/fake","kubernetes/typed/scheduling/v1alpha1","kubernetes/typed/scheduling/v1alpha1/fake","kubernetes/typed/scheduling/v1beta1","kubernetes/typed/scheduling/v1beta1/fake","kubernetes/typed/settings/v1alpha1","kubernetes/typed/settings/v1alpha1/fake","kubernetes/typed/storage/v1","kubernetes/typed/storage/v1/fake","kubernetes/typed/storage/v1alpha1","kubernetes/typed/storage/v1alpha1/fake","kubernetes/typed/storage/v1beta1","kubernetes/typed/storage/v1beta1/fake","pkg/apis/clientauthentication","pkg/apis/clientauthentication/v1alpha1","pkg/apis/clientauthentication/v1beta1","pkg/version","plugin/pkg/client/auth/exec","plugin/pkg/client/auth/gcp","rest","rest/watch","restmapper","testing","third_party/forked/golang/template","tools/auth","tools/cache","tools/clientcmd","tools/clientcmd/api","tools/clientcmd/api/latest","tools/clientcmd/api/v1","tools/leaderelection","tools/leaderelection/resourcelock","tools/metrics","tools/pager","tools/record","tools/reference","transport","util/buffer","util/cert","util/connrotation","util/flowcontrol","util/homedir","util/integer","util/jsonpath","util/retry","util/workqueue"]
-  revision = "8d9ed539ba3134352c586810e749e58df4e94e4f"
-  version = "kubernetes-1.13.1"
-
-[[projects]]
-  name = "k8s.io/klog"
-  packages = ["."]
-  revision = "8139d8cb77af419532b33dfa7dd09fbc5f1d344f"
-
-[[projects]]
-  name = "k8s.io/kube-openapi"
-  packages = ["pkg/util/proto"]
-  revision = "c59034cc13d587f5ef4e85ca0ade0c1866ae8e1d"
-
-[[projects]]
-  name = "sigs.k8s.io/controller-runtime"
-  packages = ["pkg/cache","pkg/cache/internal","pkg/client","pkg/client/apiutil","pkg/client/config","pkg/internal/recorder","pkg/leaderelection","pkg/manager","pkg/metrics","pkg/patch","pkg/recorder","pkg/runtime/inject","pkg/runtime/log","pkg/runtime/signals","pkg/webhook","pkg/webhook/admission","pkg/webhook/admission/builder","pkg/webhook/admission/types","pkg/webhook/internal/cert","pkg/webhook/internal/cert/generator","pkg/webhook/internal/cert/writer","pkg/webhook/internal/cert/writer/atomic","pkg/webhook/internal/metrics","pkg/webhook/types"]
-  revision = "12d98582e72927b6cd0123e2b4e819f9341ce62c"
-  version = "v0.1.10"
-
-[[projects]]
-  name = "sigs.k8s.io/yaml"
-  packages = ["."]
-  revision = "fd68e9863619f6ec2fdd8625fe1f02e7c877e480"
-  version = "v1.1.0"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  inputs-digest = "0413cf32305d8e92a5f65d059d93e2bf151b8755f5a24088ef26ea12a148cd68"
-  solver-name = "gps-cdcl"
-  solver-version = 1

Gopkg.toml

@@ -1,58 +0,0 @@
-# Gopkg.toml example
-#
-# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#   name = "github.com/x/y"
-#   version = "2.4.0"
-#
-# [prune]
-#   non-go = false
-#   go-tests = true
-#   unused-packages = true
-
-
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.3.0"
-
-[[constraint]]
-  name = "k8s.io/api"
-  version = "kubernetes-1.13.1"
-
-[[constraint]]
-  name = "k8s.io/apimachinery"
-  version = "kubernetes-1.13.1"
-
-[[constraint]]
-  name = "k8s.io/client-go"
-  version = "kubernetes-1.13.1"
-
-[[constraint]]
-  name = "sigs.k8s.io/controller-runtime"
-  version = "0.1.10"
-
-[[constraint]]
-  name = "github.com/gobuffalo/packr"
-  version = "2.2.0"
-
-[[constraint]]
-  name = "github.com/gorilla/mux"
-  version = "1.7.1"
-
-[[constraint]]
-  revision = "772775880e1fbf39a7804149ed11c0f714ec89fe"
-  name = "gitlab.com/golang-commonmark/markdown"

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2019 ReactiveOps
+   Copyright 2019 FairwindsOps Inc
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

Makefile

@@ -1,3 +0,0 @@
-helm-to-k8s:
-	helm template deploy/helm/polaris/ --name polaris --namespace polaris --set templateOnly=true > deploy/dashboard.yaml
-	helm template deploy/helm/polaris/ --name polaris --namespace polaris --set templateOnly=true --set webhook.enable=true --set dashboard.enable=false > deploy/webhook.yaml

README.md

@@ -1,122 +1,64 @@
-<div align="center">
-  <img src="/pkg/dashboard/assets/images/polaris-logo.png" alt="Polaris Logo" />
+<div align="center" class="no-border">
+  <img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
   <br>
-  
-  [![Version][version-image]][version-link] [![CircleCI][circleci-image]][circleci-link] [![Go Report Card][goreport-image]][goreport-link]
+  <h3>Polaris is an open source policy engine for Kubernetes</h3>
+  <a href="https://github.com/FairwindsOps/polaris/releases">
+    <img src="https://img.shields.io/github/v/release/FairwindsOps/polaris">
+  </a>
+  <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
+    <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
+  </a>
+  <a href="https://circleci.com/gh/FairwindsOps/polaris">
+    <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
+  </a>
+  <a href="https://insights.fairwinds.com/gh/FairwindsOps/polaris">
+    <img src="https://insights.fairwinds.com/v0/gh/FairwindsOps/polaris/badge.svg">
+  </a>
 </div>
 
-[version-image]: https://img.shields.io/static/v1.svg?label=Version&message=0.1.0&color=239922
-[version-link]: https://github.com/reactiveops/polaris
-
-<!-- TODO: uncomment once project is public
-[circleci-image]: https://circleci.com/gh/reactiveops/polaris.svg?style=svg
-[goreport-image]: https://goreportcard.com/badge/github.com/reactiveops/polaris
--->
-[circleci-link]: https://circleci.com/gh/reactiveops/polaris.svg
-[goreport-link]: https://goreportcard.com/report/github.com/reactiveops/polaris
-
-[circleci-image]: https://img.shields.io/static/v1.svg?label=Build&message=Passing&color=239922
-[goreport-image]: https://img.shields.io/static/v1.svg?label=go+report&message=A&color=239922
-
-Polaris keeps your cluster sailing smoothly. It runs a variety of checks to ensure that Kubernetes deployments are configured using best practices that will avoid potential problems in the future. The project includes two primary parts:
-
-- A dashboard to display the results of these validations on your existing deployments
-- A beta version of a webhook that can prevent poorly configured deployments from reaching your cluster
-
-## Dashboard
-
-The Polaris Dashboard provides an overview of your current deployments in a cluster along with their validation scores. An overall score is provided for a cluster on a 0 - 100 scale. Results are then broken down by namespace and deployment.
+Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.
 
+Polaris can be run in three different modes:
+* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard) - Validate Kubernetes resources against policy-as-code.
+* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller) - Automatically reject or modify workloads that don't adhere to your organization's policies.
+* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code) - Incorporate policy-as-code into the CI/CD process to test local YAML files.
 <p align="center">
-  <img src="/dashboard-screenshot.png" alt="Polaris Dashboard" />
+  <img src="https://polaris.docs.fairwinds.com/img/architecture.svg" alt="Polaris Architecture" width="550"/>
 </p>
 
-### Deploying
+## Documentation
+Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)
 
-To deploy Polaris with kubectl:
+<!-- Begin boilerplate -->
+## Join the Fairwinds Open Source Community
 
-```
-kubectl apply -f https://raw.githubusercontent.com/reactiveops/polaris/master/deploy/dashboard.yaml
-```
+The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap,
+and network with fellow Kubernetes users.
+[Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-2na8gtwb4-DGQ4qgmQbczQyB2NlFlYQQ)
+or
+[join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
 
-Polaris can also be deployed with Helm:
+<a href="https://insights.fairwinds.com/auth/register/">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png"
+  alt="Love Fairwinds Open Source? Automate Fairwinds Open Source for free with Fairwinds Insights. Click to learn more" />
+</a>
 
-```
-helm upgrade --install polaris deploy/helm/polaris/ --namespace polaris
-```
+## Other Projects from Fairwinds
 
-### Viewing the Dashboard
+Enjoying Polaris? Check out some of our other projects:
+* [Goldilocks](https://github.com/FairwindsOps/Goldilocks) - Right-size your Kubernetes Deployments by compare your memory and CPU settings against actual usage
+* [Pluto](https://github.com/FairwindsOps/Pluto) - Detect Kubernetes resources that have been deprecated or removed in future versions
+* [Nova](https://github.com/FairwindsOps/Nova) - Check to see if any of your Helm charts have updates available
+* [rbac-manager](https://github.com/FairwindsOps/rbac-manager) - Simplify the management of RBAC in your Kubernetes clusters
 
-Once the dashboard is deployed, it can be viewed by using kubectl port-forward:
+Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris)
+## Fairwinds Insights
+If you're interested in running Polaris in multiple clusters,
+tracking the results over time, integrating with Slack, Datadog, and Jira,
+or unlocking other functionality, check out
+[Fairwinds Insights](https://fairwinds.com/pricing),
+a platform for auditing and enforcing policy in Kubernetes clusters.
 
-```
-kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
-```
-
-With the port forwarding in place, you can open http://localhost:8080 in your browser to view the dashboard.
-
-### Using a Binary Release
-
-If you'd prefer to run Polaris locally, binary releases are available on the [releases page](https://github.com/reactiveops/polaris/releases). When running as a binary, Polaris will use your local kubeconfig to connect to a cluster. There are a variety of options available, but the most common usage may be to view the dashboard:
-
-```
-polaris --dashboard
-```
-
-## Webhook
-
-Polaris includes experimental support for an optional validating webhook. This accepts the same configuration as the dashboard, and can run the same validations. This webhook will reject any deployments that trigger a validation error. This is indicative of the greater goal of Polaris, not just to encourage better configuration through dashboard visibility, but to actually enforce it with this webhook. *Although we are working towards greater stability and better test coverage, we do not currently consider this webhook component production ready.*
-
-Unfortunately we have not found a way to disply warnings as part of `kubectl` output unless we are rejecting a deployment altogether. That means that any checks with a severity of `warning` will still pass webhook validation, and the only evidence of that warning will either be in the Polaris dashboard or the Polaris webhook logs.
-
-### Deploying
-
-The Polaris webhook can be deployed with kubectl:
-
-```
-kubectl apply -f https://raw.githubusercontent.com/reactiveops/polaris/master/deploy/webhook.yaml
-```
-
-Alternatively, the webhook can be enabled with Helm by setting `webhook.enable` to true:
-
-```
-helm upgrade --install polaris deploy/helm/polaris/ --namespace polaris --set webhook.enable=true
-```
-
-
-## Configuration
-
-Polaris supports a wide range of validations covering a number of Kubernetes best practices. Here's a sample configuration file that includes all currently supported checks. The [default configuration](https://github.com/reactiveops/polaris/blob/master/config.yaml) contains a number of those checks. This repository also includes a sample [full configuration file](https://github.com/reactiveops/polaris/blob/master/config-full.yaml) that enables all available checks.
-
-Each check can be assigned a `severity`. Only checks with a severity of `error` or `warning` will be validated. The results of these validations are visible on the dashboard. In the case of the validating webhook, only failures with a severity of `error` will result in a change being rejected.
-
-Polaris validation checks fall into several different categories:
-
-- [Health Checks](docs/health-checks.md)
-- [Images](docs/images.md)
-- [Networking](docs/networking.md)
-- [Resources](docs/resources.md)
-- [Security](docs/security.md)
-
-## CLI Options
-
-* `config`: Specify a location for the Polaris config
-* `dashboard`: Runs the webserver for Polaris dashboard.
-* `dashboard-port`: Port for the dashboard webserver (default 8080)
-* `webhook`: Runs the webhook webserver.
-* `webhook-port`: Port for the webhook webserver (default 9876)
-* `disable-webhook-config-installer`: disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping
-* `kubeconfig`: Paths to a kubeconfig. Only required if out-of-cluster.
-
-## License
-Apache License 2.0
-
-## Contributing
-PRs welcome! Check out the [Contributing Guidlines](CONTRIBUTING.md),
-[Code of Conduct](CODE_OF_CONDUCT.md), and [Roadmap](ROADMAP.md) for more information.
-
-## Further Information
-A history of changes to this project can be viewed in the [Changelog](CHANGELOG.md)
-
-If you'd like to learn more about Polaris, or if you'd like to speak with
-a Kubernetes expert, you can contact `info@reactiveops.com` or [visit our website](https://reactiveops.com)
+<a href="https://fairwinds.com/pricing">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
+</a>

ROADMAP.md

@@ -1,53 +0,0 @@
-# Polaris Roadmap
-We plan to continue expanding the list of checks available to Polaris users,
-as well as the project's overall functionality.
-
-If you have ideas for a new check, or for new Polaris features,
-you can submit a pull request for this file, or open an issue in GitHub.
-
-## Features
-### Validating Webhook
-The validating webhook rejects incoming workloads if they cause `error`-level
-issues, as defined by the Polaris configuration.
-
-The webhook server is currently functional, but largely untested. Because
-the validating webhook has the potential to cause headaches for users,
-we have marked it as `beta` for now.
-
-We will continue to gather feedback here and will move the webhook out of `beta`
-when we feel it's ready.
-
-#### TODO
-* Pass `warning`-level messages back to `kubectl` if possible (may require changes
-to core k8s or `kubectl`)
-
-## Ability to override checks
-We plan to add the ability to override Polaris checks for particular namespaces
-and workloads. This may be something that is set in the Polaris configuration,
-or an annotation that can be added to the resource definition.
-
-This is important, as certain workloads have good reason to skip particular Polaris
-checks - for instance, the `dns-controller` deployment in `kube-system` needs to have
-the host network configured.
-
-## Checks
-These are checks that we plan to implement. If you have requests or ideas,
-let us know! You can submit a pull request for this file, or open an issue in GitHub.
-
-### Images
-* List of allowed/disallowed registries
-
-### New controller types
-Currently we only look at Deployments. We plan to also validate these types of controllers:
-* StatefulSet
-* DaemonSet
-* Job
-* CronJob
-* ReplicaSet
-
-### Check non-controllers
-We would like to implement checks for non-controller types, such as:
-* Ingress
-* Service
-* Secret
-

cmd/polaris/audit.go

@@ -0,0 +1,259 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+
+	cfg "github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"sigs.k8s.io/yaml"
+)
+
+var (
+	setExitCode         bool
+	onlyShowFailedTests bool
+	minScore            int
+	auditOutputURL      string
+	auditOutputFile     string
+	auditOutputFormat   string
+	resourceToAudit     string
+	useColor            bool
+	helmChart           string
+	helmValues          []string
+	helmSkipTests       bool
+	checks              []string
+	auditNamespace      string
+	severityLevel       string
+	skipSslValidation   bool
+)
+
+func init() {
+	rootCmd.AddCommand(auditCmd)
+	auditCmd.PersistentFlags().StringVar(&auditPath, "audit-path", "", "If specified, audits one or more YAML files instead of a cluster.")
+	auditCmd.PersistentFlags().BoolVar(&setExitCode, "set-exit-code-on-danger", false, "Set an exit code of 3 when the audit contains danger-level issues.")
+	auditCmd.PersistentFlags().BoolVar(&onlyShowFailedTests, "only-show-failed-tests", false, "If specified, audit output will only show failed tests.")
+	auditCmd.PersistentFlags().IntVar(&minScore, "set-exit-code-below-score", 0, "Set an exit code of 4 when the score is below this threshold (1-100).")
+	auditCmd.PersistentFlags().StringVar(&auditOutputURL, "output-url", "", "Destination URL to send audit results.")
+	auditCmd.PersistentFlags().StringVar(&auditOutputFile, "output-file", "", "Destination file for audit results.")
+	auditCmd.PersistentFlags().StringVarP(&auditOutputFormat, "format", "f", "json", "Output format for results - json, yaml, pretty, or score.")
+	auditCmd.PersistentFlags().BoolVar(&useColor, "color", true, "Whether to use color in pretty format.")
+	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
+	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
+	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
+	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
+	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
+	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
+	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
+	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
+	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
+}
+
+var auditCmd = &cobra.Command{
+	Use:   "audit",
+	Short: "Runs a one-time audit.",
+	Long:  `Runs a one-time audit.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		if displayName != "" {
+			config.DisplayName = displayName
+		}
+		if len(checks) > 0 {
+			targetChecks := make(map[string]bool)
+			for _, check := range checks {
+				targetChecks[check] = true
+			}
+			for key := range config.Checks {
+				if isTarget := targetChecks[key]; !isTarget {
+					config.Checks[key] = cfg.SeverityIgnore
+				}
+			}
+		}
+		if auditNamespace != "" {
+			if helmChart != "" {
+				logrus.Warn("--namespace and --helm-chart are mutually exclusive. --namespace will be ignored.")
+			}
+			if auditPath != "" {
+				logrus.Warn("--namespace and --audit-path are mutually exclusive. --namespace will be ignored.")
+			}
+			config.Namespace = auditNamespace
+		}
+		if helmChart != "" {
+			var err error
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
+			if err != nil {
+				logrus.Errorf("Couldn't process helm chart: %v", err)
+				os.Exit(1)
+			}
+		}
+
+		ctx := context.TODO()
+		k, err := kube.CreateResourceProvider(ctx, auditPath, resourceToAudit, config)
+		if err != nil {
+			logrus.Errorf("Error fetching Kubernetes resources %v", err)
+			os.Exit(1)
+		}
+
+		auditData, err := validator.RunAudit(context.Background(), config, k)
+		if err != nil {
+			logrus.Errorf("Error while running audit on resources: %v", err)
+			os.Exit(1)
+		}
+
+		outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests, severityLevel)
+
+		summary := auditData.GetSummary()
+		score := summary.GetScore()
+		if setExitCode && summary.Dangers > 0 {
+			logrus.Infof("%d danger items found in audit", summary.Dangers)
+			os.Exit(3)
+		} else if minScore != 0 && score < uint(minScore) {
+			logrus.Infof("Audit score of %d is less than the provided minimum of %d", score, minScore)
+			os.Exit(4)
+		}
+	},
+}
+
+// ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
+func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
+	cmd := exec.Command("helm", "dependency", "update", helmChart)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		logrus.Error(string(output))
+		return "", err
+	}
+
+	dir, err := os.MkdirTemp("", "*")
+	if err != nil {
+		return "", err
+	}
+	params := []string{
+		"template", helmChart,
+		"--generate-name",
+		"--output-dir",
+		dir,
+	}
+	for _, v := range helmValues {
+		params = append(params, "--values", v)
+	}
+
+	if helmSkipTests {
+		params = append(params, "--skip-tests")
+	}
+
+	cmd = exec.Command("helm", params...)
+	output, err = cmd.CombinedOutput()
+
+	if err != nil {
+		logrus.Error(string(output))
+		return "", err
+	}
+	return dir, nil
+}
+
+func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFormat string, useColor bool, onlyShowFailedTests bool, severityLevel string) {
+	if onlyShowFailedTests {
+		auditData = auditData.RemoveSuccessfulResults()
+	}
+
+	if severityLevel != "" {
+		switch severityLevel {
+		case "danger":
+			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityDanger)
+		case "warning":
+			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityWarning)
+		}
+	}
+
+	var outputBytes []byte
+	var err error
+	if outputFormat == "score" {
+		outputBytes = []byte(fmt.Sprintf("%d\n", auditData.GetSummary().GetScore()))
+	} else if outputFormat == "yaml" {
+		var jsonBytes []byte
+		jsonBytes, err = json.Marshal(auditData)
+		if err == nil {
+			outputBytes, err = yaml.JSONToYAML(jsonBytes)
+		}
+	} else if outputFormat == "pretty" {
+		outputBytes = []byte(auditData.GetPrettyOutput(useColor))
+	} else {
+		outputBytes, err = json.MarshalIndent(auditData, "", "  ")
+	}
+	if err != nil {
+		logrus.Errorf("Error marshalling audit: %v", err)
+		os.Exit(1)
+	}
+	if outputURL == "" && outputFile == "" {
+		os.Stdout.Write(outputBytes)
+	} else {
+		if outputURL != "" {
+			req, err := http.NewRequest("POST", outputURL, bytes.NewBuffer(outputBytes))
+
+			if err != nil {
+				logrus.Errorf("Error building request for output: %v", err)
+				os.Exit(1)
+			}
+
+			if outputFormat == "json" {
+				req.Header.Set("Content-Type", "application/json")
+			} else if outputFormat == "yaml" {
+				req.Header.Set("Content-Type", "application/x-yaml")
+			} else {
+				req.Header.Set("Content-Type", "text/plain")
+			}
+
+			client := &http.Client{}
+			if skipSslValidation {
+				transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
+				client = &http.Client{Transport: transport}
+			}
+			resp, err := client.Do(req)
+			if err != nil {
+				logrus.Errorf("Error making request for output: %v", err)
+				os.Exit(1)
+			}
+
+			defer resp.Body.Close()
+
+			body, err := io.ReadAll(resp.Body)
+
+			if err != nil {
+				logrus.Errorf("Error reading response: %v", err)
+				os.Exit(1)
+			}
+
+			logrus.Infof("Received response: %v", body)
+		}
+
+		if outputFile != "" {
+			err := os.WriteFile(outputFile, outputBytes, 0644)
+			if err != nil {
+				logrus.Errorf("Error writing output to file: %v", err)
+				os.Exit(1)
+			}
+		}
+	}
+}

cmd/polaris/dashboard.go

@@ -0,0 +1,71 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/fairwindsops/polaris/pkg/dashboard"
+	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+var serverPort int
+var basePath string
+var loadAuditFile string
+var listeningAddress string
+
+func init() {
+	rootCmd.AddCommand(dashboardCmd)
+	dashboardCmd.PersistentFlags().IntVarP(&serverPort, "port", "p", 8080, "Port for the dashboard webserver.")
+	dashboardCmd.PersistentFlags().StringVar(&listeningAddress, "listening-address", "", "Listening Address for the dashboard webserver.")
+	dashboardCmd.PersistentFlags().StringVar(&basePath, "base-path", "/", "Path on which the dashboard is served.")
+	dashboardCmd.PersistentFlags().StringVar(&loadAuditFile, "load-audit-file", "", "Runs the dashboard with data saved from a past audit.")
+	dashboardCmd.PersistentFlags().StringVar(&auditPath, "audit-path", "", "If specified, audits one or more YAML files instead of a cluster.")
+	dashboardCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
+
+}
+
+var dashboardCmd = &cobra.Command{
+	Use:   "dashboard",
+	Short: "Runs the webserver for Polaris dashboard.",
+	Long:  `Runs the webserver for Polaris dashboard.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		if displayName != "" {
+			config.DisplayName = displayName
+		}
+
+		var auditDataPtr *validator.AuditData
+		if loadAuditFile != "" {
+			auditData := validator.ReadAuditFromFile(loadAuditFile)
+			auditDataPtr = &auditData
+		}
+		router, err := dashboard.GetRouter(context.Background(), config, auditPath, serverPort, basePath, auditDataPtr)
+		if err != nil {
+			logrus.Fatalf("error creating router: %v", err)
+		}
+
+		router.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte("OK"))
+		})
+		http.Handle("/", router)
+
+		logrus.Infof("Starting Polaris dashboard server on port %d", serverPort)
+		logrus.Fatal(http.ListenAndServe(fmt.Sprintf("%s:%d", listeningAddress, serverPort), nil))
+	},
+}

cmd/polaris/fix.go

@@ -0,0 +1,57 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"os"
+
+	"github.com/fairwindsops/polaris/pkg/fix"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+var (
+	filesPath   string
+	checksToFix []string
+	isTemplate  bool
+)
+
+func init() {
+	rootCmd.AddCommand(fixCommand)
+	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
+	fixCommand.PersistentFlags().BoolVar(&isTemplate, "template", false, "set to true when modifyng a YAML template, like a Helm chart (experimental)")
+	fixCommand.PersistentFlags().StringSliceVar(&checksToFix, "checks", []string{}, "Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations")
+}
+
+var fixCommand = &cobra.Command{
+	Use:   "fix",
+	Short: "Fix Infrastructure as code files.",
+	Long:  `Fix Infrastructure as code files.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		logrus.Debug("Setting up controller manager")
+
+		err := fix.Execute(context.Background(), config, filesPath, isTemplate, checksToFix...)
+		if err != nil {
+			if errors.Is(err, fix.ErrFilesPathRequired) {
+				logrus.Error("Please specify a files-path flag")
+				cmd.Help()
+				os.Exit(1)
+			}
+			logrus.Fatal(err)
+		}
+	},
+}

cmd/polaris/root.go

@@ -0,0 +1,103 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"os"
+	"strings"
+
+	conf "github.com/fairwindsops/polaris/pkg/config"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+var (
+	mergeConfig                  bool
+	configPath                   string
+	disallowExemptions           bool
+	disallowConfigExemptions     bool
+	disallowAnnotationExemptions bool
+	fixChecks                    bool
+	logLevel                     string
+	auditPath                    string
+	displayName                  string
+	kubeContext                  string
+	insightsHost                 string
+)
+
+var (
+	version string
+)
+
+func init() {
+	// Flags
+	rootCmd.PersistentFlags().BoolVarP(&mergeConfig, "merge-config", "m", false, "If true, custom configuration will be merged with default configuration instead of replacing it.")
+	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "Location of Polaris configuration file.")
+	rootCmd.PersistentFlags().StringVarP(&kubeContext, "context", "x", "", "Set the kube context.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
+	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level to be output (trace, debug, info, warning, error, fatal, panic).")
+	rootCmd.PersistentFlags().StringVar(&insightsHost, "insights-host", "https://insights.fairwinds.com", "Fairwinds Insights host URL")
+}
+
+var config conf.Configuration
+
+var rootCmd = &cobra.Command{
+	Use:   "polaris",
+	Short: "polaris",
+	Long:  `Validation of best practices in your Kubernetes clusters.`,
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		parsedLevel, err := logrus.ParseLevel(logLevel)
+		if err != nil {
+			logrus.Errorf("log-level flag has invalid value %s", logLevel)
+		} else {
+			logrus.SetLevel(parsedLevel)
+		}
+
+		config, err = conf.MergeConfigAndParseFile(configPath, mergeConfig)
+		if err != nil {
+			logrus.Errorf("Error parsing config at %s: %v", configPath, err)
+			os.Exit(1)
+		}
+
+		config.DisallowExemptions = disallowExemptions
+		config.DisallowConfigExemptions = disallowConfigExemptions
+		config.DisallowAnnotationExemptions = disallowAnnotationExemptions
+		config.KubeContext = kubeContext
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		logrus.Error("You must specify a sub-command.")
+		err := cmd.Help()
+		if err != nil {
+			logrus.Error(err)
+		}
+		os.Exit(1)
+	},
+	PersistentPostRun: func(cmd *cobra.Command, args []string) {
+		if !strings.HasPrefix(cmd.Use, "audit") {
+			os.Stderr.WriteString("\n\nWant more? Automate Polaris for free with Fairwinds Insights!\n🚀 https://fairwinds.com/insights-signup/polaris 🚀 \n")
+		}
+	},
+}
+
+// Execute the stuff
+func Execute(VERSION string) {
+	version = VERSION
+	if err := rootCmd.Execute(); err != nil {
+		logrus.Error(err)
+		os.Exit(1)
+	}
+}

cmd/polaris/version.go

@@ -0,0 +1,37 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(versionCmd)
+}
+
+var versionCmd = &cobra.Command{
+	Use:   "version",
+	Short: "Prints the current version.",
+	Long:  `Prints the current version of the tool.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		fmt.Println("Polaris version:" + version)
+	},
+	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
+		return nil
+	},
+}

cmd/polaris/webhook.go

@@ -0,0 +1,88 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"context"
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	fwebhook "github.com/fairwindsops/polaris/pkg/webhook"
+	k8sConfig "sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+)
+
+var webhookPort int
+var disableWebhookConfigInstaller bool
+var enableMutations bool
+var enableValidations bool
+var certDir string
+
+func init() {
+	rootCmd.AddCommand(webhookCmd)
+	webhookCmd.PersistentFlags().IntVarP(&webhookPort, "port", "p", 9876, "Port for the dashboard webserver.")
+	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "Disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
+	webhookCmd.PersistentFlags().BoolVar(&enableValidations, "validate", true, "Enable the validating webhook to reject workloads with issues")
+	webhookCmd.PersistentFlags().BoolVar(&enableMutations, "mutate", false, "Enable the mutating webhook to modify workloads with issues")
+	webhookCmd.PersistentFlags().StringVar(&certDir, "cert-dir", "/opt/cert", "Directory in which tls certificate is located")
+}
+
+var webhookCmd = &cobra.Command{
+	Use:   "webhook",
+	Short: "Runs the webhook webserver.",
+	Long:  `Runs the webhook webserver.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		logrus.Debug("Setting up controller manager")
+
+		mgr, err := manager.New(k8sConfig.GetConfigOrDie(), manager.Options{
+			WebhookServer: webhook.NewServer(webhook.Options{
+				CertDir:  certDir,
+				Port:     webhookPort,
+				CertName: "tls.crt",
+				KeyName:  "tls.key",
+			}),
+		})
+		if err != nil {
+			logrus.Errorf("Unable to set up overall controller manager: %v", err)
+			os.Exit(1)
+		}
+
+		_, err = os.Stat(certDir + "/tls.crt")
+		if os.IsNotExist(err) {
+			panic("Cert does not exist")
+		}
+
+		if !enableMutations && !enableValidations {
+			logrus.Errorf("One of --mutate or --validate must be set to true")
+			os.Exit(1)
+		}
+
+		if enableValidations {
+			fwebhook.NewValidateWebhook(mgr, config)
+		}
+		if enableMutations {
+			fwebhook.NewMutateWebhook(context.Background(), mgr, config)
+		}
+		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
+		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
+			logrus.Errorf("Error starting manager: %v", err)
+			os.Exit(1)
+		}
+	},
+}

config-full.yaml

@@ -1,65 +0,0 @@
-resources:
-  cpuRequestsMissing: warning
-  cpuRequestRanges:
-    warning:
-      below: 50m
-      above: 1000m
-    error:
-      below: 500m
-      above: 2000m
-  cpuLimitsMissing: warning
-  cpuLimitRanges:
-    warning:
-      below: 50m
-      above: 1000m
-    error:
-      below: 500m
-      above: 2000m
-  memoryRequestsMissing: warning
-  memoryRequestRanges:
-    warning:
-      below: 50M
-      above: 2G
-    error:
-      below: 100M
-      above: 4G
-  memoryLimitsMissing: warning
-  memoryLimitRanges:
-    warning:
-      below: 50M
-      above: 2G
-    error:
-      below: 100M
-      above: 4G
-images:
-  tagNotSpecified: error
-  pullPolicyNotAlways: warning
-  whitelist:
-    error:
-      - gcr.io/*
-  blacklist:
-    warning:
-      - docker.io/*
-healthChecks:
-  readinessProbeMissing: warning
-  livenessProbeMissing: warning
-networking:
-  hostNetworkSet: error
-  hostPortSet: error
-security:
-  hostIPCSet: error
-  hostPIDSet: error
-  runAsRootAllowed: warning
-  runAsPrivileged: error
-  notReadOnlyRootFileSystem: warning
-  privilegeEscalationAllowed: error
-  capabilities:
-    error:
-      ifAnyAdded:
-        - SYS_ADMIN
-        - ALL
-      ifAnyNotDropped:
-        - ALL
-    warning:
-      ifAnyAddedBeyond:
-        - NONE

config.yaml

@@ -1,43 +0,0 @@
-resources:
-  cpuRequestsMissing: warning
-  cpuLimitsMissing: warning
-  memoryRequestsMissing: warning
-  memoryLimitsMissing: warning
-images:
-  tagNotSpecified: error
-  pullPolicyNotAlways: ignore
-healthChecks:
-  readinessProbeMissing: warning
-  livenessProbeMissing: warning
-networking:
-  hostNetworkSet: warning
-  hostPortSet: warning
-security:
-  hostIPCSet: error
-  hostPIDSet: error
-  notReadOnlyRootFileSystem: warning
-  privilegeEscalationAllowed: error
-  runAsRootAllowed: warning
-  runAsPrivileged: error
-  capabilities:
-    error:
-      ifAnyAdded:
-        - SYS_ADMIN
-        - NET_ADMIN
-        - ALL
-    warning:
-      ifAnyAddedBeyond:
-        - CHOWN
-        - DAC_OVERRIDE
-        - FSETID
-        - FOWNER
-        - MKNOD
-        - NET_RAW
-        - SETGID
-        - SETUID
-        - SETFCAP
-        - SETPCAP
-        - NET_BIND_SERVICE
-        - SYS_CHROOT
-        - KILL
-        - AUDIT_WRITE

deploy/dashboard.yaml

@@ -1,210 +0,0 @@
----
-# Source: polaris/templates/0-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: polaris
----
-# Source: polaris/templates/configmap.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: polaris
-  namespace: polaris
-  labels:
-    app: polaris
-data:
-  config.yaml:  |
-    resources:
-      cpuRequestsMissing: warning
-      cpuLimitsMissing: warning
-      memoryRequestsMissing: warning
-      memoryLimitsMissing: warning
-    images:
-      tagNotSpecified: error
-    healthChecks:
-      readinessProbeMissing: warning
-      livenessProbeMissing: warning
-    networking:
-      hostNetworkSet: warning
-      hostPortSet: warning
-    security:
-      hostIPCSet: error
-      hostPIDSet: error
-      notReadOnlyRootFileSystem: warning
-      privilegeEscalationAllowed: error
-      runAsRootAllowed: warning
-      runAsPrivileged: error
-      capabilities:
-        error:
-          ifAnyAdded:
-            - SYS_ADMIN
-            - NET_ADMIN
-            - ALL
-        warning:
-          ifAnyAddedBeyond:
-            - CHOWN
-            - DAC_OVERRIDE
-            - FSETID
-            - FOWNER
-            - MKNOD
-            - NET_RAW
-            - SETGID
-            - SETUID
-            - SETFCAP
-            - SETPCAP
-            - NET_BIND_SERVICE
-            - SYS_CHROOT
-            - KILL
-            - AUDIT_WRITE
-  
----
-# Source: polaris/templates/dashboard.rbac.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: polaris-dashboard
-  labels:
-    app: polaris
-rules:
-  - apiGroups:
-      - 'apps'
-      - 'extensions'
-    resources:
-      - 'deployments'
-    verbs:
-      - 'get'
-      - 'list'
-  - apiGroups:
-      - ''
-    resources:
-      - 'nodes'
-      - 'namespaces'
-      - 'pods'
-    verbs:
-      - 'get'
-      - 'list'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris-dashboard
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: polaris-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: polaris-dashboard
-    namespace: polaris
----
-# Source: polaris/templates/dashboard.service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
-spec:
-  ports:
-  - name: dashboard
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: polaris
-    component: dashboard
-  type: ClusterIP
----
-# Source: polaris/templates/dashboard.deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    checksum/config: '6ec4a4dc87403cae67c01438398a5f1d4ef836ffeaf26a33b685c066b940495a'
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
-    component: dashboard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: polaris
-      component: dashboard
-  template:
-    metadata:
-      labels:
-        app: polaris
-        component: dashboard
-    spec:
-      volumes:
-      - name: config
-        configMap:
-          name: polaris
-      containers:
-      - command:
-        - polaris
-        - --dashboard
-        image: 'quay.io/reactiveops/polaris:0.1.0'
-        imagePullPolicy: 'Always'
-        name: dashboard
-        ports:
-        - containerPort: 8080
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        resources:
-          limits:
-            cpu: 100m
-            memory: 128Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-              - ALL
-        volumeMounts:
-        - name: config
-          mountPath: /opt/app/config.yaml
-          subPath: config.yaml
-          readOnly: true
-      serviceAccountName: polaris-dashboard
----
-# Source: polaris/templates/webhook.deployment.yaml
-
----
-# Source: polaris/templates/webhook.rbac.yaml
-
----
-# Source: polaris/templates/webhook.secret.yaml
-
----
-# Source: polaris/templates/webhook.service.yaml
-

deploy/helm/polaris/Chart.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-description: Validation of best practices in your Kubernetes clusters
-name: polaris
-version: 1.0.0

deploy/helm/polaris/templates/0-namespace.yaml

@@ -1,6 +0,0 @@
-{{- if .Values.templateOnly -}}
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ .Release.Namespace }}
-{{- end -}}

deploy/helm/polaris/templates/NOTES.txt

@@ -1,12 +0,0 @@
-** Please be patient while the chart is being deployed **
-
-Enjoy Polaris and smooth sailing!
-
-{{- if contains "ClusterIP" .Values.dashboard.service.type }}
-
-## To view the dashboard execute these commands:
-
-kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "polaris.fullname" . }}-dashboard 8080:80 &
-open http://localhost:8080
-
-{{- end }}

deploy/helm/polaris/templates/_helpers.tpl

@@ -1,58 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "polaris.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "polaris.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "polaris.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Standard labels
-*/}}
-{{- define "polaris.labels" -}}
-{{- if .Values.templateOnly -}}
-app: {{ include "polaris.name" . }}
-{{- else -}}
-app.kubernetes.io/name: {{ include "polaris.name" . }}
-helm.sh/chart: {{ include "polaris.chart" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Standard selector
-*/}}
-{{- define "polaris.selectors" -}}
-{{- if .Values.templateOnly -}}
-app: {{ include "polaris.name" . }}
-{{- else -}}
-app.kubernetes.io/name: {{ include "polaris.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end -}}
-{{- end -}}

deploy/helm/polaris/templates/configmap.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "polaris.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-data:
-  config.yaml: {{- toYaml .Values.config | indent 2 -}}

deploy/helm/polaris/templates/dashboard.deployment.yaml

@@ -1,70 +0,0 @@
-{{- if .Values.dashboard.enable -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    checksum/config: '{{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}'
-  name: {{ include "polaris.fullname" . }}-dashboard
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-    component: dashboard
-spec:
-  replicas: {{.Values.dashboard.replicas}}
-  selector:
-    matchLabels:
-      {{- include "polaris.selectors" . | nindent 6 }}
-      component: dashboard
-  template:
-    metadata:
-      labels:
-        {{- include "polaris.selectors" . | nindent 8 }}
-        component: dashboard
-    spec:
-      volumes:
-      - name: config
-        configMap:
-          name: {{ include "polaris.fullname" . }}
-      containers:
-      - command:
-        - polaris
-        - --dashboard
-        image: '{{.Values.webhook.image.repository}}:{{.Values.webhook.image.tag}}'
-        imagePullPolicy: '{{.Values.webhook.image.pullPolicy}}'
-        name: dashboard
-        ports:
-        - containerPort: 8080
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        resources:
-          limits:
-            cpu: 100m
-            memory: 128Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-              - ALL
-        volumeMounts:
-        - name: config
-          mountPath: /opt/app/config.yaml
-          subPath: config.yaml
-          readOnly: true
-      serviceAccountName: {{ include "polaris.fullname" . }}-dashboard
-{{- end -}}

deploy/helm/polaris/templates/dashboard.rbac.yaml

@@ -1,49 +0,0 @@
-{{- if and .Values.dashboard.enable .Values.rbac.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "polaris.fullname" . }}-dashboard
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: {{ include "polaris.fullname" . }}-dashboard
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - 'apps'
-      - 'extensions'
-    resources:
-      - 'deployments'
-    verbs:
-      - 'get'
-      - 'list'
-  - apiGroups:
-      - ''
-    resources:
-      - 'nodes'
-      - 'namespaces'
-      - 'pods'
-    verbs:
-      - 'get'
-      - 'list'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "polaris.fullname" . }}-dashboard
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "polaris.fullname" . }}-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "polaris.fullname" . }}-dashboard
-    namespace: {{ .Release.Namespace }}
-{{- end -}}

deploy/helm/polaris/templates/dashboard.service.yaml

@@ -1,19 +0,0 @@
-{{- if and .Values.dashboard.enable .Values.dashboard.service -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "polaris.fullname" . }}-dashboard
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-spec:
-  ports:
-  - name: dashboard
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    {{- include "polaris.selectors" . | nindent 4 }}
-    component: dashboard
-  type: {{ .Values.dashboard.service.type }}
-{{- end -}}

deploy/helm/polaris/templates/webhook.deployment.yaml

@@ -1,88 +0,0 @@
-{{- if .Values.webhook.enable -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    checksum/config: '{{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}'
-  name: {{ include "polaris.fullname" . }}-webhook
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-    component: webhook
-spec:
-  replicas: {{ .Values.webhook.replicas }}
-  selector:
-    matchLabels:
-      {{- include "polaris.selectors" . | nindent 6 }}
-      component: webhook
-  template:
-    metadata:
-      labels:
-        {{- include "polaris.selectors" . | nindent 8 }}
-        component: webhook
-    spec:
-      containers:
-        - name: webhook
-          command:
-            - polaris
-            - --webhook
-          image: '{{.Values.webhook.image.repository}}:{{.Values.webhook.image.tag}}'
-          imagePullPolicy: '{{.Values.webhook.image.pullPolicy}}'
-          ports:
-            - containerPort: 9876
-          # These are fairly useless readiness/liveness probes for now
-          # Follow this issue for potential improvements:
-          # https://github.com/kubernetes-sigs/controller-runtime/issues/356
-          livenessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 100m
-              memory: 128Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: config
-              mountPath: /opt/app/config.yaml
-              subPath: config.yaml
-              readOnly: true
-            - name: secret
-              mountPath: /opt/cert/
-              readOnly: true
-            - name: cr-logs
-              mountPath: /tmp/
-              readOnly: false
-      serviceAccountName:  {{ include "polaris.fullname" . }}-webhook
-      volumes:
-        - name: config
-          configMap:
-            name: {{ include "polaris.fullname" . }}
-        - name: secret
-          secret:
-            secretName: polaris-webhook
-        - name: cr-logs
-          emptyDir: {}
-{{- end -}}

deploy/helm/polaris/templates/webhook.rbac.yaml

@@ -1,88 +0,0 @@
-{{- if and .Values.webhook.enable .Values.rbac.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "polaris.fullname" . }}-webhook
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: {{ include "polaris.fullname" . }}-webhook
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - 'apps'
-      - 'extensions'
-    resources:
-      - 'deployments'
-    verbs:
-      - 'get'
-      - 'list'
-  # required by controller-runtime code doing a cluster wide lookup
-  # when it seems namespace would suffice
-  - apiGroups:
-      - ''
-    resources:
-      - 'secrets'
-      - 'services'
-    verbs:
-      - 'get'
-      - 'list'
-      - 'watch'
-  - apiGroups:
-      - 'admissionregistration.k8s.io'
-    resources:
-      - 'validatingwebhookconfigurations'
-    verbs:
-      - '*'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "polaris.fullname" . }}-webhook
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "polaris.fullname" . }}-webhook
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "polaris.fullname" . }}-webhook
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: Role
-metadata:
-  name: {{ include "polaris.fullname" . }}-webhook
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-rules:
-  # required for current controller-runtime bootstrap method
-  - apiGroups:
-      - ''
-    resources:
-      - 'secrets'
-      - 'services'
-    verbs:
-      - '*'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: RoleBinding
-metadata:
-  name: {{ include "polaris.fullname" . }}-webhook
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "polaris.fullname" . }}-webhook
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "polaris.fullname" . }}-webhook
-    namespace: {{ .Release.Namespace }}
-{{- end -}}

deploy/helm/polaris/templates/webhook.secret.yaml

@@ -1,12 +0,0 @@
-{{- if .Values.webhook.enable -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: polaris-webhook
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-type: Opaque
-stringData:
-  cert.pem: ''
-{{- end -}}

deploy/helm/polaris/templates/webhook.service.yaml

@@ -1,19 +0,0 @@
-{{- if .Values.webhook.enable -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-webhook
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "polaris.labels" . | nindent 4 }}
-spec:
-  ports:
-  - name: webhook
-    port: 443
-    protocol: TCP
-    targetPort: 9876
-  selector:
-    {{- include "polaris.selectors" . | nindent 4 }}
-    component: webhook
-  type: ClusterIP
-{{- end -}}

deploy/helm/polaris/values.yaml

@@ -1,67 +0,0 @@
----
-config: |
-  resources:
-    cpuRequestsMissing: warning
-    cpuLimitsMissing: warning
-    memoryRequestsMissing: warning
-    memoryLimitsMissing: warning
-  images:
-    tagNotSpecified: error
-  healthChecks:
-    readinessProbeMissing: warning
-    livenessProbeMissing: warning
-  networking:
-    hostNetworkSet: warning
-    hostPortSet: warning
-  security:
-    hostIPCSet: error
-    hostPIDSet: error
-    notReadOnlyRootFileSystem: warning
-    privilegeEscalationAllowed: error
-    runAsRootAllowed: warning
-    runAsPrivileged: error
-    capabilities:
-      error:
-        ifAnyAdded:
-          - SYS_ADMIN
-          - NET_ADMIN
-          - ALL
-      warning:
-        ifAnyAddedBeyond:
-          - CHOWN
-          - DAC_OVERRIDE
-          - FSETID
-          - FOWNER
-          - MKNOD
-          - NET_RAW
-          - SETGID
-          - SETUID
-          - SETFCAP
-          - SETPCAP
-          - NET_BIND_SERVICE
-          - SYS_CHROOT
-          - KILL
-          - AUDIT_WRITE
-
-dashboard:
-  enable: true
-  replicas: 1
-  service:
-    type: ClusterIP
-  image:
-    repository: quay.io/reactiveops/polaris
-    tag: 0.1.0
-    pullPolicy: Always
-
-webhook:
-  enable: false
-  replicas: 1
-  image:
-    repository: quay.io/reactiveops/polaris
-    tag: 0.1.0
-    pullPolicy: Always
-
-rbac:
-  create: true
-
-templateOnly: false

deploy/webhook.yaml

@@ -1,276 +0,0 @@
----
-# Source: polaris/templates/0-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: polaris
----
-# Source: polaris/templates/webhook.secret.yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-type: Opaque
-stringData:
-  cert.pem: ''
----
-# Source: polaris/templates/configmap.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: polaris
-  namespace: polaris
-  labels:
-    app: polaris
-data:
-  config.yaml:  |
-    resources:
-      cpuRequestsMissing: warning
-      cpuLimitsMissing: warning
-      memoryRequestsMissing: warning
-      memoryLimitsMissing: warning
-    images:
-      tagNotSpecified: error
-    healthChecks:
-      readinessProbeMissing: warning
-      livenessProbeMissing: warning
-    networking:
-      hostNetworkSet: warning
-      hostPortSet: warning
-    security:
-      hostIPCSet: error
-      hostPIDSet: error
-      notReadOnlyRootFileSystem: warning
-      privilegeEscalationAllowed: error
-      runAsRootAllowed: warning
-      runAsPrivileged: error
-      capabilities:
-        error:
-          ifAnyAdded:
-            - SYS_ADMIN
-            - NET_ADMIN
-            - ALL
-        warning:
-          ifAnyAddedBeyond:
-            - CHOWN
-            - DAC_OVERRIDE
-            - FSETID
-            - FOWNER
-            - MKNOD
-            - NET_RAW
-            - SETGID
-            - SETUID
-            - SETFCAP
-            - SETPCAP
-            - NET_BIND_SERVICE
-            - SYS_CHROOT
-            - KILL
-            - AUDIT_WRITE
-  
----
-# Source: polaris/templates/webhook.rbac.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: polaris-webhook
-  labels:
-    app: polaris
-rules:
-  - apiGroups:
-      - 'apps'
-      - 'extensions'
-    resources:
-      - 'deployments'
-    verbs:
-      - 'get'
-      - 'list'
-  # required by controller-runtime code doing a cluster wide lookup
-  # when it seems namespace would suffice
-  - apiGroups:
-      - ''
-    resources:
-      - 'secrets'
-      - 'services'
-    verbs:
-      - 'get'
-      - 'list'
-      - 'watch'
-  - apiGroups:
-      - 'admissionregistration.k8s.io'
-    resources:
-      - 'validatingwebhookconfigurations'
-    verbs:
-      - '*'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris-webhook
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: polaris-webhook
-subjects:
-  - kind: ServiceAccount
-    name: polaris-webhook
-    namespace: polaris
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: Role
-metadata:
-  name: polaris-webhook
-  labels:
-    app: polaris
-rules:
-  # required for current controller-runtime bootstrap method
-  - apiGroups:
-      - ''
-    resources:
-      - 'secrets'
-      - 'services'
-    verbs:
-      - '*'
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: RoleBinding
-metadata:
-  name: polaris-webhook
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: polaris-webhook
-subjects:
-  - kind: ServiceAccount
-    name: polaris-webhook
-    namespace: polaris
----
-# Source: polaris/templates/webhook.service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-spec:
-  ports:
-  - name: webhook
-    port: 443
-    protocol: TCP
-    targetPort: 9876
-  selector:
-    app: polaris
-    component: webhook
-  type: ClusterIP
----
-# Source: polaris/templates/webhook.deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    checksum/config: '6ec4a4dc87403cae67c01438398a5f1d4ef836ffeaf26a33b685c066b940495a'
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-    component: webhook
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: polaris
-      component: webhook
-  template:
-    metadata:
-      labels:
-        app: polaris
-        component: webhook
-    spec:
-      containers:
-        - name: webhook
-          command:
-            - polaris
-            - --webhook
-          image: 'quay.io/reactiveops/polaris:0.1.0'
-          imagePullPolicy: 'Always'
-          ports:
-            - containerPort: 9876
-          # These are fairly useless readiness/liveness probes for now
-          # Follow this issue for potential improvements:
-          # https://github.com/kubernetes-sigs/controller-runtime/issues/356
-          livenessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 100m
-              memory: 128Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: config
-              mountPath: /opt/app/config.yaml
-              subPath: config.yaml
-              readOnly: true
-            - name: secret
-              mountPath: /opt/cert/
-              readOnly: true
-            - name: cr-logs
-              mountPath: /tmp/
-              readOnly: false
-      serviceAccountName:  polaris-webhook
-      volumes:
-        - name: config
-          configMap:
-            name: polaris
-        - name: secret
-          secret:
-            secretName: polaris-webhook
-        - name: cr-logs
-          emptyDir: {}
----
-# Source: polaris/templates/dashboard.deployment.yaml
-
----
-# Source: polaris/templates/dashboard.rbac.yaml
-
----
-# Source: polaris/templates/dashboard.service.yaml
-

docs/.vuepress/config-extras.js

@@ -0,0 +1,65 @@
+module.exports = {
+  title: "Fairwinds Polaris Documentation",
+  description: "Documentation for Fairwinds Polaris - audit and enforce Kubernetes best practices for your workloads",
+  themeConfig: {
+    docsRepo: "FairwindsOps/polaris",
+    sidebar: [
+      {
+        title: "Polaris",
+        path: "/",
+        sidebarDepth: 0,
+        collapsable: false,
+        children: [
+          {
+            title: "Changelog",
+            path: "/changelog",
+          },
+          {
+            title: "Code of Conduct",
+            path: "/code-of-conduct",
+          },
+          {
+            title: "Contributing",
+            path: "/contributing",
+          },
+        ],
+      },
+      {
+        title: "Ways to Run Polaris",
+        collapsable: false,
+        children: [
+          "/dashboard",
+          "/admission-controller",
+          "/infrastructure-as-code",
+        ],
+      },
+      {
+        title: "Usage",
+        collapsable: false,
+        children: [
+          "/cli",
+        ],
+      },
+      {
+        title: "Customization",
+        collapsable: false,
+        children: [
+          "/customization/configuration",
+          "/customization/checks",
+          "/customization/custom-checks",
+          "/customization/exemptions",
+        ]
+      },
+      {
+        title: "Checks",
+        collapsable: false,
+        sidebarDepth: 0,
+        children: [
+          "/checks/security",
+          "/checks/efficiency",
+          "/checks/reliability",
+        ],
+      },
+    ]
+  }
+}

docs/.vuepress/config.js

@@ -0,0 +1,73 @@
+// This file is generated from FairwindsOps/documentation-template
+// DO NOT EDIT MANUALLY
+
+const fs = require('fs');
+const npath = require('path');
+
+const CONFIG_FILE = npath.join(__dirname, 'config-extras.js');
+const BASE_DIR = npath.join(__dirname, '..');
+
+const extras = require(CONFIG_FILE);
+if (!extras.title || !extras.description || !extras.themeConfig.docsRepo) {
+  throw new Error("Please specify 'title', 'description', and 'themeConfig.docsRepo' in config-extras.js");
+}
+
+const docFiles = fs.readdirSync(BASE_DIR)
+  .filter(f => f !== "README.md")
+  .filter(f => f !== ".vuepress")
+  .filter(f => f !== "node_modules")
+  .filter(f => npath.extname(f) === '.md' || npath.extname(f) === '');
+
+const sidebar = [['/', 'Home']].concat(docFiles.map(f => {
+  const ext = npath.extname(f);
+  if (ext === '') {
+    // this is a directory
+    const title = f;
+    const children = fs.readdirSync(npath.join(BASE_DIR, f)).map(subf => {
+      return '/' + f + '/' + npath.basename(subf);
+    });
+    return {title, children};
+  }
+  const path = npath.basename(f);
+  return path;
+}));
+
+const baseConfig = {
+  title: "",
+  description: "",
+  head: [
+    ['link', { rel: 'icon', href: '/favicon.png' }],
+    ['script', { src: '/scripts/modify.js' }],
+    ['script', { src: '/scripts/marketing.js' }],
+  ],
+  themeConfig: {
+    docsRepo: "",
+    docsDir: 'docs',
+    editLinks: true,
+    editLinkText: "Help us improve this page",
+    logo: '/img/fairwinds-logo.svg',
+    heroText: "",
+    sidebar,
+    nav: [
+      {text: 'View on GitHub', link: 'https://github.com/' + extras.themeConfig.docsRepo},
+    ],
+  },
+  plugins: {
+    'vuepress-plugin-clean-urls': {
+      normalSuffix: '/',
+      notFoundPath: '/404.html',
+    },
+    'check-md': {},
+  },
+}
+
+let config = JSON.parse(JSON.stringify(baseConfig))
+if (!fs.existsSync(CONFIG_FILE)) {
+  throw new Error("Please add config-extras.js to specify your project details");
+}
+for (let key in extras) {
+  if (!config[key]) config[key] = extras[key];
+  else if (key === 'head') config[key] = config[key].concat(extras[key]);
+  else Object.assign(config[key], extras[key]);
+}
+module.exports = config;

docs/.vuepress/public/img/FW_Insights_Polaris.svg

@@ -0,0 +1,421 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 3000 706.2" style="enable-background:new 0 0 3000 706.2;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#231039;}
+	.st1{fill:#6D6D6D;}
+	.st2{font-family:'CircularStd-Book';}
+	.st3{font-size:88.0749px;}
+	.st4{fill:#F36D21;}
+	.st5{fill:none;stroke:#F36D21;stroke-width:4;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}
+	.st6{fill:#898989;}
+	.st7{fill:#BCBCBC;}
+	.st8{fill:none;}
+	.st9{fill:#DBDBDB;}
+	.st10{enable-background:new    ;}
+	.st11{fill:#23183A;}
+	.st12{fill:#B5B5B5;}
+	.st13{fill:#9F234F;}
+	.st14{fill:#F08117;}
+	.st15{fill:#8ED0D9;}
+	.st16{fill:#A3A3A3;}
+	.st17{fill:#D1D1D1;}
+	.st18{fill:#D1D1D1;stroke:#23183A;stroke-width:2.3711;stroke-miterlimit:10;}
+	.st19{fill:none;stroke:#D1D1D1;stroke-width:6.6619;stroke-miterlimit:10;}
+	.st20{fill:#23103A;}
+	.st21{fill:#270D3C;}
+	.st22{fill:#26163C;}
+	.st23{fill:#F26722;}
+	.st24{fill:#F78F1E;}
+	.st25{fill:#F9AC78;}
+	.st26{fill:#FF6700;}
+	.st27{fill:url(#SVGID_1_);}
+	.st28{fill:url(#SVGID_2_);}
+	.st29{fill:url(#SVGID_3_);}
+	.st30{fill:url(#SVGID_4_);}
+</style>
+<g>
+	<g>
+		<g>
+			<path class="st0" d="M317.7,177.6h-149v-49.3h174.4v23.9C343.1,166.3,331.7,177.6,317.7,177.6z"/>
+			<path class="st0" d="M254.3,247.2h-85.6v-49.3h111v23.9C279.7,235.9,268.3,247.2,254.3,247.2z"/>
+			<path class="st0" d="M192.7,316.8h-24v-49.3H218v23.9C218,305.5,206.7,316.8,192.7,316.8z"/>
+		</g>
+	</g>
+	<g>
+		<path class="st0" d="M398.5,287.3V136.7h93.7v24H424V203h61.2v23.6H424v60.8H398.5z"/>
+		<path class="st0" d="M532.1,228l26.6-4c6-0.8,7.6-3.8,7.6-7.4c0-8.7-5.9-15.7-19.5-15.7c-13,0-20.2,8.3-21.2,18.7l-22.5-5.1
+			c1.9-17.8,18.1-33.8,43.6-33.8c31.9,0,44,18.1,44,38.7v51.4c0,9.3,1.1,15.5,1.3,16.6h-22.9c-0.2-0.6-1.1-4.9-1.1-13.2
+			c-4.9,7.9-15.1,16.4-31.9,16.4c-21.7,0-35.1-14.9-35.1-31.2C500.9,240.8,514.5,230.6,532.1,228z M566.3,244.4v-4.7l-27,4
+			c-7.6,1.3-13.8,5.5-13.8,14c0,7,5.3,13.4,15.1,13.4C554.4,271.2,566.3,264.6,566.3,244.4z"/>
+		<path class="st0" d="M632.4,131.4c8.9,0,16.1,7.2,16.1,16.1s-7.2,15.9-16.1,15.9c-8.7,0-15.9-7-15.9-15.9S623.7,131.4,632.4,131.4
+			z M620.3,287.3V183.9h24.4v103.5H620.3z"/>
+		<path class="st0" d="M737.2,208.3c-2.8-0.4-5.5-0.6-8.1-0.6c-19.1,0-27.8,11-27.8,30.4v49.3h-24.6V183.9h24v16.6
+			c4.9-11.3,16.4-17.8,30-17.8c3,0,5.5,0.4,6.6,0.6V208.3z"/>
+		<path class="st0" d="M844.3,183.9l24.4,71.6l20.6-71.6h25.1l-33.1,103.5h-24.6L830.9,213l-25.1,74.4h-25.3L747,183.9h26.3l21,71.6
+			l24.4-71.6H844.3z"/>
+		<path class="st0" d="M945.2,131.4c8.9,0,16.1,7.2,16.1,16.1s-7.2,15.9-16.1,15.9c-8.7,0-15.9-7-15.9-15.9S936.5,131.4,945.2,131.4
+			z M933.1,287.3V183.9h24.4v103.5H933.1z"/>
+		<path class="st0" d="M1014.1,287.3h-24.6V183.9h24v13.8c6.8-11.9,19.1-16.8,30.6-16.8c25.3,0,37.4,18.3,37.4,41v65.4h-24.6v-61.2
+			c0-12.8-5.7-22.9-21.2-22.9c-14,0-21.5,10.8-21.5,24.4V287.3z"/>
+		<path class="st0" d="M1207,268.4c0,9.3,0.9,17.2,1.1,18.9h-23.6c-0.4-2.3-1.1-9.1-1.1-13.4c-4.9,8.7-15.7,15.9-30.4,15.9
+			c-29.7,0-49.7-23.4-49.7-54.6c0-29.8,20.2-54.2,49.3-54.2c18.1,0,27.2,8.3,30.4,14.9v-62.5h24V268.4z M1155.8,268.2
+			c16.1,0,27.4-13.4,27.4-33.1s-11-32.1-27.2-32.1c-16.1,0-28,12.5-28,32.3C1128,255,1139,268.2,1155.8,268.2z"/>
+		<path class="st0" d="M1251.6,253.3c0.9,9.3,7.9,17.6,21,17.6c10.2,0,15.5-5.5,15.5-11.9c0-5.5-3.8-9.8-12.1-11.5l-15.3-3.4
+			c-18.3-4-27.8-15.9-27.8-30.2c0-18.1,16.6-33.4,38-33.4c28.9,0,38.2,18.7,39.9,28.9l-20.8,5.9c-0.9-5.9-5.3-15.5-19.1-15.5
+			c-8.7,0-14.9,5.5-14.9,11.9c0,5.5,4,9.6,10.4,10.8l15.7,3.2c19.5,4.2,29.7,16.2,29.7,31.4c0,15.7-12.7,33.1-39.1,33.1
+			c-30,0-41.4-19.5-42.7-31.2L1251.6,253.3z"/>
+		<path class="st0" d="M1391.2,287.3V136.7h25.9v150.7H1391.2z"/>
+		<path class="st0" d="M1475.8,287.3h-24.6V183.9h24v13.8c6.8-11.9,19.1-16.8,30.6-16.8c25.3,0,37.4,18.3,37.4,41v65.4h-24.6v-61.2
+			c0-12.8-5.7-22.9-21.2-22.9c-14,0-21.5,10.8-21.5,24.4V287.3z"/>
+		<path class="st0" d="M1585.4,253.3c0.9,9.3,7.9,17.6,21,17.6c10.2,0,15.5-5.5,15.5-11.9c0-5.5-3.8-9.8-12.1-11.5l-15.3-3.4
+			c-18.3-4-27.8-15.9-27.8-30.2c0-18.1,16.6-33.4,38-33.4c28.9,0,38.2,18.7,39.9,28.9l-20.8,5.9c-0.9-5.9-5.3-15.5-19.1-15.5
+			c-8.7,0-14.9,5.5-14.9,11.9c0,5.5,4,9.6,10.4,10.8l15.7,3.2c19.5,4.2,29.7,16.2,29.7,31.4c0,15.7-12.7,33.1-39.1,33.1
+			c-30,0-41.4-19.5-42.7-31.2L1585.4,253.3z"/>
+		<path class="st0" d="M1682.3,131.4c8.9,0,16.1,7.2,16.1,16.1s-7.2,15.9-16.1,15.9c-8.7,0-15.9-7-15.9-15.9
+			S1673.6,131.4,1682.3,131.4z M1670.2,287.3V183.9h24.4v103.5H1670.2z"/>
+		<path class="st0" d="M1741.8,287.1c1.7,12.8,11.7,22.3,25.9,22.3c19.5,0,29.3-10,29.3-31v-10.8c-4.5,8.1-14.9,15.1-30,15.1
+			c-27.6,0-47.8-21.2-47.8-50.4c0-27.6,19.3-50.4,47.8-50.4c16.1,0,26.1,6.6,30.6,15.1v-13.2h23.8v93.7c0,27.6-14.2,53.3-53.1,53.3
+			c-27.4,0-46.5-17-49.3-37.8L1741.8,287.1z M1797.7,232.3c0-17.6-11.3-29.1-26.6-29.1c-15.7,0-27,11.5-27,29.1
+			c0,18.1,10.8,29.3,27,29.3C1786.9,261.6,1797.7,250.1,1797.7,232.3z"/>
+		<path class="st0" d="M1876.3,287.3h-24.6V133.5h24.6v60.3c7-9.1,18.7-13,29.5-13c25.5,0,37.8,18.3,37.8,41v65.4H1919v-61.2
+			c0-12.8-5.7-22.9-21.2-22.9c-13.6,0-21,10.2-21.5,23.4V287.3z"/>
+		<path class="st0" d="M2004.9,183.9h21.5v21.9h-21.5v48c0,9.1,4,13,13.2,13c3.4,0,7.4-0.6,8.5-0.8v20.4c-1.5,0.6-6.2,2.3-15.1,2.3
+			c-19.1,0-31-11.5-31-30.8v-52.1h-19.1v-21.9h5.3c11,0,15.9-7,15.9-16.1v-15.5h22.3V183.9z"/>
+		<path class="st0" d="M2065.7,253.3c0.9,9.3,7.9,17.6,21,17.6c10.2,0,15.5-5.5,15.5-11.9c0-5.5-3.8-9.8-12.1-11.5l-15.3-3.4
+			c-18.3-4-27.8-15.9-27.8-30.2c0-18.1,16.6-33.4,38-33.4c28.9,0,38.2,18.7,39.9,28.9l-20.8,5.9c-0.9-5.9-5.3-15.5-19.1-15.5
+			c-8.7,0-14.9,5.5-14.9,11.9c0,5.5,4,9.6,10.4,10.8l15.7,3.2c19.5,4.2,29.7,16.2,29.7,31.4c0,15.7-12.7,33.1-39.1,33.1
+			c-30,0-41.4-19.5-42.7-31.2L2065.7,253.3z"/>
+	</g>
+</g>
+<g>
+	<text transform="matrix(1 0 0 1 2512.0906 491.5612)" class="st1 st2 st3">more</text>
+</g>
+<g>
+	<g>
+		<text transform="matrix(1 0 0 1 2088.605 491.561)" class="st4 st2 st3">+</text>
+	</g>
+	<g>
+		<text transform="matrix(1 0 0 1 2439.4316 491.561)" class="st4 st2 st3">+</text>
+	</g>
+	<g>
+		<text transform="matrix(1 0 0 1 1567.2388 491.561)" class="st4 st2 st3">+</text>
+	</g>
+	<g>
+		<text transform="matrix(1 0 0 1 1250.0308 491.5612)" class="st4 st2 st3">+</text>
+	</g>
+</g>
+<path class="st5" d="M524.4,621.6c0,0,476.7-73.4,685.5-33.6"/>
+<g>
+	<g>
+		<path class="st1" d="M1453,505.9c-0.8-0.1-1.6,0.3-2,1V503h-1.2v9.2h1.2v-0.9c0.4,0.7,1.2,1.1,2,1c1.8,0,2.8-1.4,2.8-3.2
+			C1455.8,507.2,1454.9,505.9,1453,505.9z M1452.8,511.3c-1,0-1.8-0.8-1.8-2.2c-0.1-1,0.6-2,1.6-2.1c0.1,0,0.1,0,0.2,0
+			c1.1,0,1.8,0.8,1.8,2.1C1454.6,510.4,1453.9,511.3,1452.8,511.3z"/>
+		<polygon class="st1" points="1459.4,510.3 1457.5,506.1 1456.2,506.1 1458.8,511.5 1457.3,514.7 1458.6,514.7 1462.6,506.1 
+			1461.2,506.1 		"/>
+		<path class="st1" d="M1466.4,512.6h1.1c0.5,0,0.9-0.4,0.9-0.9l0,0v-3.2h1.5c0.7,0,1.2-0.6,1.2-1.3v-0.6h-2.8v-2.2h3
+			c0.6,0,1.1-0.5,1.1-1.1v-0.7h-6.2L1466.4,512.6z"/>
+		<path class="st1" d="M1476.2,505.1c-0.7,0-1.4,0.2-2,0.7c-0.5,0.5-0.8,1.1-0.9,1.8h1.8c0-0.2,0.1-0.5,0.3-0.6
+			c0.2-0.2,0.5-0.3,0.8-0.2c0.3,0,0.6,0.1,0.8,0.2c0.2,0.2,0.3,0.5,0.2,0.8v0.2l-1.9,0.3c-0.3,0-0.6,0.1-0.9,0.2
+			c-0.3,0.1-0.5,0.2-0.7,0.4c-0.2,0.1-0.4,0.3-0.5,0.6c-0.1,0.3-0.2,0.6-0.2,0.9c0,0.6,0.2,1.1,0.6,1.5c0.4,0.4,1,0.6,1.6,0.6
+			c0.9,0.1,1.7-0.4,2.1-1.1v0.2c0.1,0.5,0.4,0.8,0.9,0.8h0.8v-4.7c0.1-0.7-0.2-1.5-0.8-2C1477.7,505.3,1476.9,505.1,1476.2,505.1z
+			 M1477.2,509.6c0,0.3-0.1,0.6-0.2,0.8c-0.1,0.2-0.3,0.4-0.5,0.5c-0.2,0.1-0.4,0.2-0.7,0.2c-0.2,0-0.4,0-0.6-0.2
+			c-0.1-0.1-0.2-0.3-0.2-0.5s0-0.4,0.1-0.5c0.2-0.1,0.4-0.2,0.6-0.2l1.5-0.3V509.6L1477.2,509.6z"/>
+		<path class="st1" d="M1481.7,502.1c-0.3,0-0.6,0.1-0.8,0.3s-0.4,0.5-0.4,0.8s0.1,0.6,0.3,0.8c0.2,0.2,0.5,0.3,0.8,0.3
+			s0.6-0.1,0.8-0.3s0.4-0.5,0.4-0.8s-0.1-0.6-0.4-0.8C1482.3,502.2,1482,502.1,1481.7,502.1z"/>
+		<path class="st1" d="M1480.8,512.6h0.9c0.5,0,0.9-0.4,0.9-0.9l0,0v-6.4h-1.9v7.3H1480.8z"/>
+		<path class="st1" d="M1486.4,506.4l-0.2-1.1h-1.6v7.3h1c0.5,0,0.9-0.4,0.9-0.9l0,0v-2.8c0-0.5,0.2-1,0.6-1.3
+			c0.4-0.3,0.9-0.5,1.4-0.5v-1.8c-0.5-0.1-1,0.1-1.4,0.3C1486.8,505.7,1486.6,506,1486.4,506.4z"/>
+		<path class="st1" d="M1497.3,509.8l-0.1,0.8l-0.1-0.8l-1.2-4.3h-1.7l-1.2,4.3l-0.1,0.8l-0.1-0.8l-1.1-4.3h-2l2.2,7.3h1.2
+			c0.4,0,0.8-0.3,0.9-0.7l1.1-3.6l1.1,4.2h1.3c0.4,0,0.8-0.3,0.9-0.7l2-6.6h-2L1497.3,509.8z"/>
+		<path class="st1" d="M1502.4,502.1c-0.3,0-0.6,0.1-0.8,0.3c-0.2,0.2-0.4,0.5-0.4,0.8s0.1,0.6,0.4,0.8c0.2,0.2,0.5,0.3,0.8,0.3
+			s0.6-0.1,0.8-0.3s0.4-0.5,0.4-0.8s-0.1-0.6-0.4-0.8C1503,502.2,1502.7,502.1,1502.4,502.1z"/>
+		<path class="st1" d="M1501.5,512.6h0.9c0.5,0,0.9-0.4,0.9-0.9l0,0v-6.4h-1.9v7.3H1501.5z"/>
+		<path class="st1" d="M1509.1,505.1c-0.4,0-0.8,0.1-1.2,0.3c-0.3,0.2-0.6,0.5-0.8,0.8l-0.1-1h-1.7v7.4h1c0.5,0,1-0.5,0.9-1v-2.8
+			c0-0.5,0.1-0.9,0.4-1.3c0.2-0.3,0.5-0.5,0.9-0.4c0.3,0,0.6,0.1,0.8,0.3c0.2,0.3,0.3,0.6,0.2,1v4.2h0.9c0.6,0,1-0.4,1-1v-3.7
+			c0-0.7-0.2-1.4-0.6-2C1510.4,505.3,1509.7,505.1,1509.1,505.1z"/>
+		<path class="st1" d="M1518.3,506.1c-0.2-0.3-0.5-0.5-0.9-0.7c-0.4-0.2-0.9-0.2-1.3-0.2c-0.9,0-1.8,0.4-2.4,1.1
+			c-0.7,0.7-1,1.7-1,2.7c0,0.7,0.1,1.3,0.4,1.9c0.3,0.6,0.7,1,1.3,1.4c0.5,0.3,1.1,0.5,1.7,0.5c0.9,0.1,1.8-0.4,2.3-1.1v0.2
+			c0.1,0.4,0.5,0.7,1,0.7h0.8v-10.5h-1.9V506.1z M1518.3,509c0,0.5-0.2,1.1-0.6,1.5c-0.3,0.4-0.8,0.6-1.3,0.6s-1-0.2-1.3-0.6
+			c-0.7-0.9-0.7-2.1,0-2.9c0.3-0.4,0.8-0.6,1.3-0.6c0.3,0,0.6,0.1,0.9,0.2c0.3,0.2,0.5,0.4,0.6,0.7c0.2,0.3,0.3,0.6,0.3,1v0.1
+			H1518.3z"/>
+		<path class="st1" d="M1526.8,509c-0.5-0.4-1.1-0.7-1.8-0.8c-0.3-0.1-0.7-0.2-1-0.3c-0.2-0.1-0.3-0.3-0.2-0.5
+			c0-0.2,0.1-0.4,0.2-0.5c0.1-0.2,0.3-0.2,0.6-0.2c0.4-0.1,0.8,0.2,0.8,0.6c0,0.1,0,0.1,0,0.2h1.8c0-0.6-0.2-1.3-0.8-1.7
+			c-0.5-0.4-1.2-0.6-1.9-0.6c-0.7-0.1-1.5,0.2-2,0.7c-0.5,0.4-0.7,1-0.7,1.7c0,0.5,0.2,1,0.6,1.4c0.5,0.4,1.1,0.6,1.7,0.7
+			c0.4,0.1,0.7,0.2,1,0.3c0.2,0.1,0.3,0.3,0.2,0.6c0,0.2-0.1,0.4-0.2,0.5c-0.2,0.2-0.4,0.2-0.7,0.2s-0.5-0.1-0.8-0.2l-0.1-0.2
+			c-0.2-0.3-0.5-0.5-0.8-0.5h-1.2c0,0.7,0.4,1.4,1.1,1.8c0.6,0.4,1.3,0.6,2,0.6c0.4,0,0.7,0,1.1-0.2c0.3-0.1,0.6-0.2,0.9-0.4
+			c0.3-0.2,0.5-0.4,0.6-0.7c0.1-0.3,0.2-0.7,0.2-1.1C1527.3,509.9,1527.1,509.4,1526.8,509z"/>
+	</g>
+	<path class="st1" d="M1334.1,495.3h-9.5v-48.8h9.3v7c3.6-6.1,9.3-8.4,15-8.4c11.7,0,17.5,8.4,17.5,19.3v31h-9.5v-29.3
+		c0-6.8-2.8-12.3-11.4-12.3c-7.5,0-11.4,6-11.4,13.4V495.3z"/>
+	<path class="st1" d="M1460.5,494.5h-9.6l-19.8-48.8h10.8l13.9,37.6l14-37.6h10.2L1460.5,494.5z"/>
+	<path class="st1" d="M1500.3,466.6l13.2-1.9c2.9-0.4,3.8-1.9,3.8-3.7c0-4.8-3.1-8.7-10.6-8.7c-6.7,0-10.5,4.2-11.1,9.8l-9.1-2.1
+		c1-9.3,9.4-15.8,20-15.8c14.6,0,20.3,8.3,20.3,17.9v24.5c0,4.3,0.4,6.8,0.6,8h-9.3c-0.2-1.2-0.5-3-0.5-6.6c-2.1,3.5-7,8.1-15.7,8.1
+		c-9.9,0-16.3-6.9-16.3-14.6C1485.5,472.7,1491.9,467.9,1500.3,466.6z M1517.3,473.6v-2.2l-14.9,2.2c-4.1,0.6-7.1,2.9-7.1,7.3
+		c0,3.7,3,7.1,7.9,7.1C1511,488.1,1517.3,484.3,1517.3,473.6z"/>
+</g>
+<g>
+	<path class="st1" d="M1977.8,504.3c-0.9,0-1.5,0.4-1.7,0.9v-3.4h-1v7.9h1v-0.8c0.3,0.6,0.9,0.9,1.7,0.9c1.6,0,2.4-1.2,2.4-2.8
+		C1980.2,505.5,1979.4,504.3,1977.8,504.3z M1977.6,508.9c-0.9,0-1.6-0.7-1.6-1.9c0-1.1,0.7-1.8,1.6-1.8c1,0,1.6,0.7,1.6,1.8
+		C1979.2,508.1,1978.6,508.9,1977.6,508.9z"/>
+	<polygon class="st1" points="1983.4,508 1981.7,504.4 1980.5,504.4 1982.8,509.1 1981.5,511.9 1982.6,511.9 1986,504.4 
+		1984.9,504.4 	"/>
+	<path class="st1" d="M1989.4,510h0.9c0.4,0,0.8-0.3,0.8-0.8v-2.8h1.3c0.6,0,1.1-0.5,1.1-1.1v-0.5h-2.4V503h2.6c0.5,0,1-0.4,1-1
+		v-0.6h-5.3V510z"/>
+	<path class="st1" d="M1997.7,503.6c-0.7,0-1.3,0.2-1.7,0.6c-0.5,0.4-0.7,0.9-0.7,1.6h1.6c0-0.2,0.1-0.4,0.3-0.5s0.4-0.2,0.7-0.2
+		s0.5,0,0.7,0.2c0.1,0.2,0.2,0.3,0.2,0.7v0.2l-1.6,0.3c-0.3,0-0.6,0.1-0.8,0.2c-0.2,0.1-0.4,0.2-0.6,0.3c-0.2,0.1-0.3,0.3-0.4,0.5
+		c-0.1,0.2-0.1,0.4-0.1,0.7c0,0.6,0.2,1,0.5,1.3c0.4,0.3,0.8,0.5,1.4,0.5c0.8,0,1.4-0.3,1.8-1v0.2c0,0.4,0.4,0.7,0.8,0.7h0.7v-4.1
+		c0-0.7-0.2-1.3-0.7-1.7S1998.5,503.6,1997.7,503.6z M1998.5,507.4c0,0.3-0.1,0.5-0.2,0.7c-0.1,0.2-0.3,0.3-0.4,0.4
+		c-0.2,0.1-0.3,0.1-0.6,0.1s-0.4,0-0.5-0.1c-0.1-0.1-0.2-0.2-0.2-0.4c0-0.2,0-0.3,0.1-0.4c0.1-0.1,0.3-0.2,0.5-0.2l1.3-0.3V507.4z"
+		/>
+	<path class="st1" d="M2002.6,501c-0.3,0-0.5,0.1-0.7,0.3c-0.2,0.2-0.3,0.4-0.3,0.7s0,0.5,0.3,0.7c0.2,0.2,0.4,0.3,0.7,0.3
+		s0.5-0.1,0.7-0.3c0.2-0.2,0.3-0.4,0.3-0.7s-0.1-0.5-0.3-0.7C2003.1,501.1,2002.8,501,2002.6,501z"/>
+	<path class="st1" d="M2001.8,510h0.8c0.4,0,0.8-0.3,0.8-0.8v-5.5h-1.6V510z"/>
+	<path class="st1" d="M2006.5,504.7l-0.2-1h-1.4v6.2h0.9c0.4,0,0.8-0.3,0.8-0.8v-2.4c0-0.6,0.2-0.9,0.5-1.2c0.3-0.3,0.7-0.4,1.2-0.4
+		v-1.6c-0.5,0-0.9,0.1-1.2,0.3C2006.9,504.1,2006.7,504.4,2006.5,504.7z"/>
+	<path class="st1" d="M2015.9,507.5l-0.1,0.7l-0.1-0.7l-1-3.8h-1.4l-1,3.8l-0.1,0.7l-0.1-0.7l-1-3.8h-1.7l1.9,6.2h1
+		c0.3,0,0.7-0.2,0.8-0.6l1-3.1l1.1,3.7h1.1c0.3,0,0.7-0.2,0.8-0.6l1.7-5.6h-1.7L2015.9,507.5z"/>
+	<path class="st1" d="M2020.3,501c-0.3,0-0.5,0.1-0.7,0.3c-0.2,0.2-0.3,0.4-0.3,0.7c0,0.3,0.1,0.5,0.3,0.7c0.2,0.2,0.4,0.3,0.7,0.3
+		s0.5-0.1,0.7-0.3s0.3-0.4,0.3-0.7s-0.1-0.5-0.3-0.7C2020.8,501.1,2020.6,501,2020.3,501z"/>
+	<path class="st1" d="M2019.5,510h0.8c0.4,0,0.8-0.3,0.8-0.8v-5.5h-1.6V510z"/>
+	<path class="st1" d="M2026,503.6c-0.4,0-0.7,0.1-1,0.3c-0.3,0.2-0.5,0.4-0.7,0.7l-0.1-0.8h-1.4v6.2h0.8c0.4,0,0.8-0.3,0.8-0.8v-2.4
+		c0-0.5,0.1-0.9,0.3-1.1s0.4-0.4,0.8-0.4c0.3,0,0.5,0.1,0.7,0.3c0.1,0.2,0.2,0.5,0.2,0.8v3.7h0.8c0.4,0,0.8-0.3,0.8-0.8v-3.2
+		c0-0.7-0.2-1.3-0.5-1.7C2027.2,503.8,2026.7,503.6,2026,503.6z"/>
+	<path class="st1" d="M2034,504.4c-0.2-0.2-0.4-0.4-0.7-0.6c-0.3-0.1-0.7-0.2-1.1-0.2c-0.8,0-1.5,0.3-2.1,0.9
+		c-0.6,0.6-0.8,1.4-0.8,2.3c0,0.6,0.1,1.1,0.3,1.7c0.3,0.5,0.6,0.9,1,1.2s1,0.4,1.5,0.4c0.9,0,1.6-0.3,2-1l0,0.2
+		c0.1,0.3,0.4,0.7,0.8,0.7h0.7v-9h-1.6V504.4z M2033.9,506.9c0,0.5-0.2,1-0.5,1.3c-0.3,0.3-0.7,0.5-1.1,0.5c-0.5,0-0.8-0.1-1.1-0.5
+		c-0.3-0.3-0.4-0.7-0.4-1.3s0.1-1,0.4-1.3s0.7-0.5,1.1-0.5c0.3,0,0.5,0,0.7,0.2c0.2,0.1,0.4,0.3,0.6,0.6
+		C2033.9,506.1,2033.9,506.4,2033.9,506.9L2033.9,506.9z"/>
+	<path class="st1" d="M2041.3,506.9c-0.3-0.3-0.8-0.5-1.6-0.7c-0.4-0.1-0.7-0.2-0.9-0.3c-0.1-0.1-0.2-0.2-0.2-0.4
+		c0-0.2,0-0.3,0.2-0.4c0.1-0.1,0.3-0.2,0.5-0.2c0.4,0,0.7,0.2,0.7,0.7h1.6c0-0.6-0.2-1.1-0.7-1.4c-0.4-0.3-1-0.5-1.6-0.5
+		c-0.7,0-1.3,0.2-1.7,0.6c-0.4,0.4-0.6,0.9-0.6,1.4c0,0.5,0.1,0.9,0.5,1.2c0.3,0.3,0.8,0.5,1.5,0.6c0.4,0.1,0.7,0.2,0.9,0.3
+		c0.1,0.1,0.2,0.3,0.2,0.5c0,0.2-0.1,0.3-0.2,0.4c-0.1,0.1-0.3,0.2-0.6,0.2s-0.5-0.1-0.7-0.2c0,0-0.1-0.1-0.1-0.1
+		c-0.2-0.3-0.4-0.4-0.7-0.4h-1c0,0.6,0.3,1.1,0.9,1.5c0.4,0.3,1,0.5,1.7,0.5c0.3,0,0.6,0,0.9-0.1c0.3,0,0.5-0.2,0.7-0.3
+		c0.2-0.1,0.4-0.3,0.5-0.6s0.2-0.6,0.2-0.9C2041.8,507.6,2041.6,507.2,2041.3,506.9z"/>
+	<g>
+		<path class="st1" d="M2011.4,483.3c0.7,4.7,5.5,12.1,16.9,12.1c10.3,0,15.2-7,15.2-12.9c0-6.1-4-10.7-11.5-12.3l-6.7-1.5
+			c-3.2-0.7-4.8-2.5-4.8-5c0-2.8,2.8-5.5,6.9-5.5c6.6,0,8.3,4.8,8.6,6.9l7.2-2.7c-0.9-3.7-4.4-11.1-15.8-11.1
+			c-8.1,0-14.8,6-14.8,13.1c0,5.9,3.9,10.3,10.4,11.7l7.1,1.6c3.5,0.8,5.4,2.8,5.4,5.4c0,2.9-2.5,5.5-7.1,5.5
+			c-5.9,0-9.2-3.5-9.7-7.8L2011.4,483.3z M2007.1,452.6h-11.2l-18,18.4v-39.4h-8v62.5h8v-12.5l5.8-5.8l13.6,18.3h10.2l-18-24
+			L2007.1,452.6z M1941.6,458.8c7.1,0,10.1,4.7,11.1,8.8l7.3-3.1c-1.7-6.3-7.4-13.2-18.5-13.2c-11.8,0-20.9,9.1-20.9,22
+			c0,12.6,8.9,22.1,21,22.1c10.8,0,16.8-7,18.7-13l-7.2-3.1c-0.9,3.3-3.8,8.6-11.6,8.6c-6.7,0-12.7-5.1-12.7-14.6
+			C1929,463.6,1935,458.8,1941.6,458.8 M1892.5,451.3c-12.4,0-21.2,9.4-21.2,22c0,12.7,8.8,22.1,21.2,22.1
+			c12.4,0,21.2-9.4,21.2-22.1C1913.8,460.7,1905,451.3,1892.5,451.3 M1892.5,488.1c-6.9,0-13-5.2-13-14.9c0-9.6,6-14.8,13-14.8
+			c6.9,0,13,5.2,13,14.8C1905.5,483,1899.4,488.1,1892.5,488.1 M1860.9,431.6h-8.1v62.5h8.1V431.6z M1829.1,436.8
+			c0,3.2,2.6,5.8,5.8,5.8c3.3,0,5.9-2.6,5.9-5.8c0-3.3-2.6-5.9-5.9-5.9C1831.7,431,1829.1,433.6,1829.1,436.8 M1839,452.6h-8v41.5h8
+			V452.6z M1809.3,488.5c0,2.5,0.3,4.7,0.4,5.6h7.9c-0.1-0.7-0.4-3.7-0.4-7.7v-54.8h-8v26.9c-1.4-3.4-5.4-7-12.7-7
+			c-11.7,0-19.7,10-19.7,21.8c0,12.4,7.5,22,19.7,22c6.5,0,10.9-3.5,12.9-7.4V488.5L1809.3,488.5z M1785,473.2
+			c0-8.5,4.8-14.6,12.3-14.6c7.4,0,11.9,5.9,11.9,14.4c0,8.6-4.6,15-12,15C1789.4,488.1,1785,481.7,1785,473.2 M1766.3,431.6h-8.1
+			v62.5h8.1V431.6z M1696.7,494.1v-30h-29.3v7.6h21.2c-0.3,6.3-5.3,16-18.9,16c-11,0-21.3-8-21.3-24.3c0-16.2,10.7-24.1,21.7-24.1
+			c9.5,0,16.7,5.2,19.4,14l7.7-3.3c-3.5-11.1-13.8-18.5-27.1-18.5c-15.1,0-30.3,11.1-30.3,31.9c0,20.7,14.3,32,29.7,32
+			c10.3,0,16.9-5.1,19.6-9.9l0.8,8.6C1689.8,494.1,1696.7,494.1,1696.7,494.1z"/>
+		<g>
+			<path class="st1" d="M1740.6,509.4c-9.3,0-21.3-12.9-29.5-27.8c-4.9-8.8-8.2-17.9-9.5-25.4c-1.8-11.2,1.6-15.6,4.7-17.4
+				c3.1-1.7,8.7-2.3,17.2,5.2c5.8,5,11.7,12.7,16.6,21.5c9.6,17.3,14.3,37.5,4.7,42.8C1743.6,509,1742.1,509.4,1740.6,509.4z
+				 M1710.7,444.6c-0.4,0-0.7,0.1-1,0.2c-1.3,0.7-2.2,4.2-1.3,10.3c1.1,6.8,4.2,15,8.7,23.2c10.3,18.6,21.5,25.6,24.4,24
+				c2.9-1.6,2.9-14.9-7.4-33.4c-4.5-8.1-9.9-15.1-15.1-19.6C1715.4,445.9,1712.4,444.6,1710.7,444.6z"/>
+		</g>
+		<polygon class="st6" points="1725.6,495.2 1728.5,497.4 1730.7,494.5 1734,496 1735.4,492.7 1739,493.4 1739.6,489.9 
+			1743.2,489.6 1743,486 1746.4,485 1745.4,481.6 1748.4,479.7 1746.6,476.6 1749.1,474.1 1746.6,471.5 1748.4,468.5 1745.4,466.6 
+			1746.4,463.2 1743,462.1 1743.2,458.5 1739.6,458.3 1739,454.8 1735.4,455.4 1734,452.1 1730.7,453.6 1728.5,450.8 1725.6,453 
+			1722.8,450.8 1720.6,453.6 1717.3,452.1 1715.9,455.4 1712.3,454.8 1711.7,458.3 1708.1,458.5 1708.3,462.1 1704.9,463.2 
+			1705.9,466.6 1702.9,468.5 1704.7,471.5 1702.2,474.1 1704.7,476.6 1702.9,479.7 1705.9,481.6 1704.9,485 1708.3,486.1 
+			1708.1,489.6 1711.7,489.9 1712.3,493.4 1715.9,492.7 1717.3,496 1720.6,494.5 1722.8,497.4 		"/>
+		<g>
+			<path class="st7" d="M1725.6,491.9c9.8,0,17.8-8,17.8-17.8c0-9.8-8-17.8-17.8-17.8c-9.8,0-17.8,8-17.8,17.8
+				C1707.8,483.9,1715.8,491.9,1725.6,491.9"/>
+			<g>
+				<path class="st1" d="M1740.6,509.4c-9.6,0-21.7-13.7-29.5-27.8c-4.9-8.8-8.2-17.9-9.5-25.4c-1.8-11.2,1.6-15.6,4.7-17.4l3.3,6
+					c-1.3,0.7-2.2,4.2-1.3,10.3c1.1,6.8,4.2,15,8.7,23.2c9.3,16.9,20.4,25.4,24.2,24.1l2.2,6.5
+					C1742.6,509.2,1741.6,509.4,1740.6,509.4z"/>
+			</g>
+		</g>
+	</g>
+</g>
+<g>
+	<path class="st1" d="M2177.7,512.3v-64.9h8.8v7.2c2.5-4.7,8.1-8.3,15.6-8.3c13.9,0,21.4,10.7,21.4,24.3c0,13.9-8,24.6-21.7,24.6
+		c-7.1,0-12.6-3.4-15.1-7.5v24.7L2177.7,512.3L2177.7,512.3z M2200.4,454.3c-8.3,0-13.9,7-13.9,16.3c0,9.6,5.5,16.4,13.9,16.4
+		c8.4,0,13.8-6.9,13.8-16.4C2214.2,461.3,2208.9,454.3,2200.4,454.3z"/>
+	<path class="st1" d="M2235.1,493.9v-70h9.1v70.1L2235.1,493.9L2235.1,493.9z"/>
+	<path class="st1" d="M2276.1,495.3c-10.8,0-17.4-8.1-17.4-18.7v-29.3h9.1v27.9c0,6.4,2.9,12,10.5,12c7.3,0,11-4.9,11-11.9v-28h9.1
+		v38c0,3.7,0.3,7,0.5,8.6h-8.7c-0.2-1.1-0.4-3.7-0.4-5.6C2287.3,493.1,2281.5,495.3,2276.1,495.3z"/>
+	<path class="st1" d="M2326.2,447.4h10.1v8.2h-10.1v24.2c0,4.3,1.7,6.4,6.5,6.4c1.2,0,2.8-0.2,3.6-0.4v7.7c-0.8,0.3-3.1,0.9-6.2,0.9
+		c-7.9,0-13-4.9-13-13.3v-25.5h-8.9v-8.2h2.5c5.1,0,7.1-3.1,7.1-7.1v-7.6h8.3V447.4z"/>
+	<rect x="2353.9" y="456.8" class="st8" width="26.1" height="26.1"/>
+	<g id="XMLID_3_">
+		<g>
+			<path class="st1" d="M2367.8,445.7c15.1,0,25.8,10.5,25.8,24.7c0,14.2-10.7,24.8-25.8,24.8c-15.1,0-25.8-10.5-25.8-24.8
+				C2342,456.2,2352.7,445.7,2367.8,445.7z M2384.9,470.1c0-9.4-7.7-17.1-17.1-17.1s-17.1,7.7-17.1,17.1c0,9.4,7.7,17.1,17.1,17.1
+				C2377.2,487.2,2384.9,479.6,2384.9,470.1z"/>
+		</g>
+	</g>
+	<g>
+		<path class="st1" d="M2320.6,504.5c-1,0-1.7,0.5-1.9,1v-3.8h-1.1v8.8h1.1v-0.9c0.4,0.6,1,1,1.9,1c1.7,0,2.7-1.4,2.7-3.1
+			C2323.3,505.9,2322.4,504.5,2320.6,504.5z M2320.4,509.7c-1,0-1.7-0.8-1.7-2.1c0-1.3,0.7-2.1,1.7-2.1c1.1,0,1.7,0.8,1.7,2.1
+			C2322.1,508.9,2321.4,509.7,2320.4,509.7z"/>
+		<polygon class="st1" points="2326.8,508.7 2324.9,504.7 2323.6,504.7 2326.1,509.9 2324.7,513 2325.9,513 2329.7,504.7 
+			2328.5,504.7 		"/>
+		<path class="st1" d="M2333.4,510.9h1c0.5,0,0.9-0.4,0.9-0.9V507h1.5c0.7,0,1.2-0.6,1.2-1.2v-0.5h-2.7v-2.1h2.9
+			c0.6,0,1.1-0.5,1.1-1.1v-0.7h-5.9V510.9z"/>
+		<path class="st1" d="M2342.7,503.8c-0.8,0-1.5,0.2-1.9,0.7c-0.5,0.4-0.8,1-0.8,1.7h1.7c0-0.2,0.1-0.4,0.3-0.6s0.4-0.2,0.7-0.2
+			c0.3,0,0.6,0,0.7,0.2c0.1,0.2,0.2,0.4,0.2,0.7v0.2l-1.8,0.3c-0.3,0-0.6,0.1-0.9,0.2c-0.2,0.1-0.5,0.2-0.7,0.4
+			c-0.2,0.1-0.4,0.3-0.5,0.6s-0.1,0.5-0.1,0.8c0,0.6,0.2,1.2,0.6,1.5c0.4,0.4,0.9,0.6,1.6,0.6c0.9,0,1.6-0.3,2-1.1v0.2
+			c0,0.4,0.4,0.8,0.9,0.8h0.7v-4.6c0-0.8-0.2-1.5-0.7-1.9C2344.2,504,2343.6,503.8,2342.7,503.8z M2343.7,508c0,0.3-0.1,0.6-0.2,0.8
+			c-0.1,0.2-0.3,0.3-0.5,0.4c-0.2,0.1-0.4,0.1-0.6,0.1c-0.2,0-0.4,0-0.6-0.1c-0.1-0.1-0.2-0.2-0.2-0.4c0-0.2,0-0.4,0.1-0.5
+			c0.1-0.1,0.3-0.2,0.6-0.2l1.4-0.3V508z"/>
+		<path class="st1" d="M2348.1,500.9c-0.3,0-0.5,0.1-0.7,0.3c-0.2,0.2-0.3,0.5-0.3,0.8c0,0.3,0,0.5,0.3,0.7c0.2,0.2,0.5,0.3,0.8,0.3
+			c0.3,0,0.6-0.1,0.8-0.3c0.2-0.2,0.3-0.4,0.3-0.7c0-0.3-0.1-0.6-0.3-0.8C2348.7,501,2348.4,500.9,2348.1,500.9z"/>
+		<path class="st1" d="M2347.2,510.9h0.9c0.5,0,0.9-0.4,0.9-0.9V504h-1.8V510.9z"/>
+		<path class="st1" d="M2352.5,505l-0.2-1.1h-1.6v7h1c0.5,0,0.9-0.4,0.9-0.9v-2.7c0-0.6,0.2-1,0.5-1.3c0.3-0.3,0.8-0.4,1.4-0.4v-1.7
+			c-0.5,0-1,0.1-1.3,0.3C2352.9,504.4,2352.7,504.7,2352.5,505z"/>
+		<path class="st1" d="M2362.9,508.2l-0.1,0.7l-0.1-0.7l-1.2-4.2h-1.6l-1.2,4.2l-0.1,0.7l-0.1-0.7l-1.1-4.2h-1.9l2.1,6.9h1.1
+			c0.4,0,0.7-0.2,0.9-0.6l1.1-3.5l1.3,4.1h1.2c0.4,0,0.8-0.2,0.9-0.6l1.9-6.3h-1.9L2362.9,508.2z"/>
+		<path class="st1" d="M2367.9,500.9c-0.3,0-0.6,0.1-0.8,0.3c-0.2,0.2-0.3,0.4-0.3,0.7c0,0.3,0.1,0.6,0.3,0.7
+			c0.2,0.2,0.5,0.3,0.8,0.3c0.3,0,0.5-0.1,0.8-0.3c0.2-0.2,0.3-0.4,0.3-0.7s-0.1-0.5-0.3-0.7C2368.4,501,2368.2,500.9,2367.9,500.9z
+			"/>
+		<path class="st1" d="M2367,510.9h0.9c0.5,0,0.9-0.4,0.9-0.9V504h-1.8V510.9z"/>
+		<path class="st1" d="M2374.2,503.8c-0.5,0-0.8,0.1-1.2,0.3c-0.3,0.2-0.5,0.4-0.7,0.8l-0.1-0.9h-1.6v7h0.9c0.5,0,0.9-0.4,0.9-0.9
+			v-2.7c0-0.6,0.1-1,0.3-1.3s0.5-0.4,0.9-0.4c0.3,0,0.6,0.1,0.7,0.3c0.1,0.2,0.2,0.5,0.2,0.9v4.1h0.9c0.5,0,0.9-0.4,0.9-0.9v-3.6
+			c0-0.8-0.2-1.4-0.6-1.9C2375.5,504,2375,503.8,2374.2,503.8z"/>
+		<path class="st1" d="M2383.1,504.7c-0.2-0.2-0.4-0.4-0.8-0.6c-0.4-0.1-0.8-0.2-1.3-0.2c-0.9,0-1.7,0.3-2.3,1
+			c-0.6,0.7-0.9,1.6-0.9,2.6c0,0.7,0.1,1.3,0.4,1.8c0.3,0.6,0.7,1,1.2,1.3c0.5,0.3,1.1,0.5,1.7,0.5c1,0,1.7-0.3,2.2-1.1l0,0.2
+			c0.1,0.4,0.4,0.7,0.9,0.7h0.8v-10h-1.8V504.7z M2383,507.5c0,0.6-0.2,1.1-0.5,1.4s-0.7,0.5-1.2,0.5c-0.5,0-0.9-0.1-1.3-0.5
+			c-0.3-0.3-0.5-0.8-0.5-1.4s0.1-1.1,0.5-1.4c0.3-0.3,0.8-0.5,1.3-0.5c0.3,0,0.6,0,0.8,0.2c0.2,0.1,0.4,0.3,0.6,0.6
+			C2382.9,506.6,2383,507,2383,507.5L2383,507.5z"/>
+		<path class="st1" d="M2391.2,507.5c-0.3-0.3-0.9-0.6-1.7-0.7c-0.5-0.1-0.8-0.2-1-0.3c-0.1-0.1-0.2-0.2-0.2-0.5
+			c0-0.2,0-0.3,0.2-0.5c0.1-0.1,0.3-0.2,0.5-0.2c0.5,0,0.8,0.2,0.8,0.8h1.7c0-0.7-0.2-1.2-0.7-1.6c-0.4-0.4-1.1-0.6-1.8-0.6
+			c-0.8,0-1.5,0.2-1.9,0.6c-0.4,0.4-0.7,1-0.7,1.6c0,0.6,0.1,1,0.5,1.4c0.3,0.3,0.9,0.5,1.7,0.7c0.4,0.1,0.8,0.2,1,0.3
+			c0.1,0.1,0.2,0.3,0.2,0.5c0,0.2-0.1,0.4-0.2,0.5c-0.1,0.1-0.3,0.2-0.6,0.2c-0.3,0-0.5-0.1-0.7-0.2c0,0-0.1-0.1-0.1-0.1
+			c-0.2-0.3-0.4-0.5-0.8-0.5h-1.1c0,0.7,0.3,1.3,1,1.7c0.4,0.4,1.1,0.6,1.9,0.6c0.4,0,0.7,0,1-0.1c0.3,0,0.6-0.2,0.8-0.4
+			c0.2-0.1,0.4-0.4,0.6-0.7s0.2-0.6,0.2-1C2391.8,508.2,2391.6,507.8,2391.2,507.5z"/>
+	</g>
+	<path class="st9" d="M2379,461.3c-0.1,0.1-0.1,0.1-0.1,0.2c-0.1,0.5-0.4,0.9-0.6,1.4c-0.3,0.8,0.1,2.7-0.7,3.2
+		c-1,0.6-2.1-1.3-3-2.1c-0.9-0.8-2.5-0.4-3.6-0.7c-0.9-0.2-1.8-0.9-2.8-0.6c-0.8,0.2-1.6,1.3-2.4,1.6c0-0.4,0-0.8-0.4-0.5
+		c-0.9,0.7-1.6,1.5-2.5,2.1c-0.1,0.1-0.1-0.1-0.2,0c-0.1,0.2-1.2,0.1-1.2,0.4c0,1-0.1,2.4-1,2.8c-0.1,0-0.4-1.4-0.5-1.5
+		c-0.1,0-0.9,1-1,0.8c-0.7-0.8-1.3-1.2-2.3-1.7c-0.5-0.3-1.8,0.6-2.2,0.2c-0.1-0.1-0.2-0.2-0.3-0.3c-0.3,1.2-0.5,2.5-0.5,3.7
+		c0,7.9,6.4,14.3,14.3,14.3c7.9,0,14.3-6.4,14.3-14.3C2382.2,466.8,2381,463.7,2379,461.3z"/>
+	<path class="st1" d="M2361.5,466.1c0,1-0.1,2.4-1,2.8c-0.1,0-0.4-1.4-0.5-1.5c-0.1,0-0.9,1-1,0.8c-0.7-0.8-1.3-1.2-2.3-1.7
+		c-0.5-0.3-1.8,0.6-2.2,0.2c-0.1-0.1-0.2-0.2-0.3-0.3c1.7-6.1,7.2-10.5,13.8-10.5c4.5,0,8.5,2.1,11.1,5.3c0,0.1-0.1,0.1-0.1,0.2
+		c-0.1,0.5-0.4,0.9-0.6,1.4c-0.3,0.8,0,2.7-0.7,3.2c-1,0.6-2.1-1.3-3-2.1c-0.9-0.8-2.5-0.4-3.6-0.7c-0.9-0.2-1.8-0.9-2.8-0.6
+		c-0.8,0.2-1.6,1.3-2.4,1.6c0-0.4,0-0.8-0.4-0.5c-0.9,0.7-1.7,1.5-2.5,2.1c-0.1,0.1-0.1-0.1-0.2,0
+		C2362.6,466,2361.5,465.9,2361.5,466.1z"/>
+	<path class="st1" d="M2376.5,472.6c-1.1-0.2-2.1,0.1-2.9,0.8c-0.4-0.9-1.3-1.7-2.4-1.9c-1.8-0.4-3.6,0.8-3.9,2.6
+		c-0.7,3.6,3.9,8.1,4.1,8.3c0.1,0.1,0.2,0.1,0.3,0.2c0.1,0,0.2,0,0.4,0c0.2-0.1,6.3-2.4,7-6C2379.5,474.8,2378.4,473,2376.5,472.6z"
+		/>
+</g>
+<g>
+	<g class="st10">
+		<path class="st11" d="M611.3,540V410.3h17.6v14.5c5-9.3,16.1-16.6,31.1-16.6c27.8,0,42.7,21.5,42.7,48.5
+			c0,27.7-16.1,49.1-43.3,49.1c-14.3,0-25.1-6.8-30.2-15.1V540H611.3z M656.8,424.2c-16.6,0-27.7,13.9-27.7,32.5
+			c0,19.1,11,32.9,27.7,32.9c16.8,0,27.5-13.7,27.5-32.9C684.2,438.1,673.8,424.2,656.8,424.2z"/>
+		<path class="st11" d="M813.4,456.7c0,28.4-19.7,49.5-47.6,49.5c-27.8,0-47.6-21.1-47.6-49.5c0-28.2,19.7-49.3,47.6-49.3
+			C793.7,407.4,813.4,428.4,813.4,456.7z M794.8,456.7c0-21.5-13.5-33.1-29-33.1c-15.5,0-29,11.6-29,33.1c0,21.7,13.5,33.3,29,33.3
+			C781.3,489.9,794.8,478.3,794.8,456.7z"/>
+		<path class="st11" d="M836.6,503.3v-140h18.2v140H836.6z"/>
+		<path class="st11" d="M908.2,450.1l25.1-3.7c5.6-0.8,7.2-3.7,7.2-7c0-9.1-6-16.6-20.1-16.6c-12.8,0-19.9,7.9-21.1,18.8l-17.4-4.1
+			c1.9-17.8,18-30.2,38.1-30.2c27.8,0,38.7,15.9,38.7,34V488c0,8.1,0.8,13,1.2,15.3H942c-0.4-2.3-1-5.8-1-12.6
+			c-4.1,6.6-13.3,15.5-30,15.5c-19,0-31.1-13.1-31.1-27.8C879.9,461.7,892.1,452.4,908.2,450.1z M940.5,463.4v-4.3l-28.4,4.3
+			c-7.7,1.2-13.5,5.6-13.5,13.9c0,7,5.8,13.5,15.1,13.5C928.5,490.9,940.5,483.7,940.5,463.4z"/>
+		<path class="st11" d="M1038.5,428.6c-2.7-0.4-5.4-0.6-7.9-0.6c-15.3,0-25.5,8.1-25.5,28.6v46.6h-18.2v-93h17.8v16.2
+			c6.8-14.3,18.4-17.8,27.8-17.8c2.5,0,5,0.4,6,0.6V428.6z"/>
+		<path class="st11" d="M1066.7,361.9c7.3,0,13.2,5.8,13.2,13.1c0,7.2-5.8,13-13.2,13c-7.2,0-13-5.8-13-13
+			C1053.8,367.7,1059.6,361.9,1066.7,361.9z M1057.8,503.3v-93h18v93H1057.8z"/>
+		<path class="st11" d="M1114.5,473.3c1.2,9.7,8.5,17.4,21.7,17.4c10.2,0,15.9-5.8,15.9-12.4c0-5.8-4.3-10.2-12-12l-15.9-3.5
+			c-14.5-3.1-23.2-13-23.2-26.1c0-15.9,14.9-29.4,33.1-29.4c25.5,0,33.5,16.6,35.4,24.9l-16.1,6c-0.8-4.8-4.6-15.5-19.3-15.5
+			c-9.3,0-15.5,6-15.5,12.4c0,5.6,3.5,9.7,10.6,11.2l15.1,3.3c16.8,3.7,25.7,13.9,25.7,27.7c0,13.1-11,28.8-34,28.8
+			c-25.5,0-36.4-16.4-37.9-27.1L1114.5,473.3z"/>
+	</g>
+	<circle class="st11" cx="765.9" cy="456.2" r="49.7"/>
+	<circle class="st12" cx="787.6" cy="478.1" r="2.8"/>
+	<circle class="st12" cx="744.8" cy="478.5" r="2.8"/>
+	<g>
+		<path class="st13" d="M750.9,431.5c0.6,0.8,1.2,1.6,1.7,2.3c3,3.8,5.9,7.7,8.9,11.5c0.3,0.3,0.3,0.8,0.2,1.1
+			c-0.9,1.5-1.8,3-2.7,4.5c-1.3,2-2.5,4.2-3.8,6.2c0,0,0,0.1-0.1,0.2c0.6-0.4,1.2-0.7,1.7-1.1c3-1.8,6-3.7,9-5.5
+			c0.4-0.2,0.8-0.1,1.3,0.2c2.8,2.1,5.6,4.4,8.4,6.5c1.7,1.3,3.2,2.5,4.9,3.8c0.1,0.1,0.2,0.2,0.4,0.2c-3.6-4.6-7.1-9.1-10.7-13.7
+			c-0.3-0.4-0.4-0.8-0.2-1.1c1.1-1.8,2.2-3.6,3.3-5.4c1.1-1.7,2.2-3.6,3.2-5.4c-0.4,0.2-0.7,0.4-1.1,0.7c-2.2,1.4-4.5,2.7-6.7,4.1
+			c-1,0.6-1.9,1.2-3,1.8c-0.4,0.3-0.8,0.2-1.3-0.2c-3.1-2.4-6.1-4.8-9.2-7.2C753.9,433.7,752.5,432.6,750.9,431.5
+			C751,431.5,750.9,431.5,750.9,431.5z"/>
+		<path class="st14" d="M772.7,439.7c-0.4,0.3-0.7,0.5-1.1,0.8c-1.8,1.3-3.6,2.5-5.4,3.8c-0.2,0.1-0.4,0.1-0.6,0
+			c-0.9-0.6-1.7-1.3-2.6-1.8c-1.3-0.9-2.5-1.7-3.7-2.6c0,0,0,0-0.1-0.1c0.3,0.4,0.5,0.7,0.7,1.1c1.3,1.8,2.5,3.6,3.8,5.4
+			c0.2,0.2,0.1,0.4,0,0.7c-1,1.4-1.8,2.6-2.8,4c-0.6,0.8-1.1,1.6-1.7,2.3c0,0.1-0.1,0.1-0.1,0.2c2.1-1.6,4.3-3,6.5-4.6
+			c0.2-0.1,0.4-0.1,0.6,0c1.1,0.8,2.1,1.6,3.2,2.2c1.1,0.8,2.1,1.6,3.2,2.2c-0.2-0.2-0.3-0.4-0.5-0.7c-1-1.4-1.8-2.6-2.8-4
+			c-0.4-0.6-0.9-1.2-1.3-1.7c-0.2-0.2-0.2-0.4,0-0.7c1.1-1.5,2-2.9,3.1-4.4C771.7,441,772.2,440.3,772.7,439.7L772.7,439.7z"/>
+		<path class="st14" d="M765.9,434.5c-0.1,0.6-0.2,1.1-0.3,1.7c-0.5,2.7-1,5.4-1.4,8.2c0,0.2-0.3,0.5-0.5,0.5
+			c-1.4,0.2-2.7,0.5-4,0.7c-1.8,0.3-3.7,0.7-5.6,1c0,0-0.1,0-0.2,0.1c0.6,0.1,1.1,0.2,1.6,0.3c2.7,0.5,5.4,1,8.2,1.5
+			c0.3,0.1,0.5,0.3,0.6,0.6c0.4,2,0.7,4,1.1,6c0.2,1.2,0.4,2.3,0.6,3.5c0,0.1,0,0.2,0.1,0.3c0.6-3.3,1.2-6.5,1.7-9.8
+			c0-0.3,0.3-0.5,0.5-0.5c1.7-0.3,3.2-0.6,4.9-0.9c1.7-0.3,3.2-0.6,4.9-0.9c-0.3-0.1-0.7-0.1-1-0.2c-2-0.4-4-0.7-6-1.1
+			c-0.9-0.2-1.7-0.3-2.7-0.5c-0.4-0.1-0.6-0.2-0.6-0.6c-0.4-2.2-0.8-4.4-1.2-6.6C766.2,436.6,766.1,435.5,765.9,434.5L765.9,434.5z"
+			/>
+		<path class="st15" d="M765.9,439.7c-0.1,0.3-0.1,0.6-0.2,0.9c-0.3,1.6-0.5,3.1-0.8,4.7c0,0.1-0.2,0.3-0.3,0.3
+			c-0.8,0.1-1.6,0.3-2.2,0.4c-1.1,0.2-2.1,0.4-3.2,0.6c0,0,0,0-0.1,0c0.3,0.1,0.6,0.1,0.9,0.2c1.6,0.3,3.1,0.5,4.7,0.8
+			c0.2,0,0.3,0.2,0.3,0.3c0.2,1.2,0.4,2.2,0.6,3.4c0.1,0.7,0.2,1.4,0.3,1.9v0.1c0.3-1.8,0.7-3.7,1-5.5c0-0.2,0.1-0.3,0.3-0.3
+			c0.9-0.2,1.8-0.3,2.7-0.5c0.9-0.2,1.8-0.3,2.7-0.5c-0.2,0-0.4-0.1-0.6-0.1c-1.2-0.2-2.2-0.4-3.4-0.6c-0.5-0.1-1-0.2-1.6-0.3
+			c-0.2,0-0.3-0.1-0.4-0.3c-0.2-1.3-0.4-2.5-0.7-3.7C766.1,440.8,766,440.3,765.9,439.7L765.9,439.7z"/>
+	</g>
+	<path class="st16" d="M748.6,465.4l-13.1,10.8c-0.8,0.7-0.4,1.9,0.7,1.9h26.2c1.1,0,1.6-1.4,0.7-1.9l-13.1-10.8
+		C749.5,465.1,749,465.1,748.6,465.4z"/>
+	<path class="st16" d="M782.8,465.4l-13.1,10.8c-0.8,0.7-0.4,1.9,0.7,1.9h26.2c1.1,0,1.6-1.4,0.7-1.9l-13.1-10.8
+		C783.7,465.1,783.1,465.1,782.8,465.4z"/>
+	<path class="st17" d="M764.7,462.4l-23.1,18.9c-1.5,1.2-0.6,3.5,1.3,3.5h46.2c1.8,0,2.7-2.3,1.3-3.5l-23.1-18.9
+		C766.4,461.8,765.4,461.8,764.7,462.4z"/>
+	<path class="st18" d="M765,471.8l-17.7,14.5c-1.1,0.9-0.5,2.7,1,2.7h35.4c1.5,0,2-1.7,1-2.7l-17.8-14.5
+		C766.3,471.3,765.5,471.3,765,471.8z"/>
+	<path class="st17" d="M765.2,474.7l-14.8,12c-0.9,0.8-0.4,2.2,0.8,2.2h29.4c1.2,0,1.7-1.5,0.8-2.2l-14.6-12
+		C766.3,474.3,765.7,474.3,765.2,474.7z"/>
+	<circle class="st19" cx="765.9" cy="456.2" r="34.9"/>
+	<g>
+		<path class="st20" d="M1020.6,524.4c-2,0-3.4,1-3.9,2v-7.7h-2.3v18h2.3V535c0.7,1.3,2.1,2.1,3.9,2.1c3.5,0,5.6-2.8,5.6-6.3
+			C1026,527.2,1024.2,524.4,1020.6,524.4z M1020.1,534.9c-2.1,0-3.5-1.7-3.5-4.3c0-2.6,1.5-4.2,3.5-4.2c2.2,0,3.5,1.6,3.5,4.2
+			C1023.7,533.2,1022.3,534.9,1020.1,534.9z"/>
+		<polygon class="st20" points="1033.2,533 1029.5,524.8 1026.8,524.8 1031.9,535.4 1028.9,541.7 1031.5,541.7 1039.2,524.8 
+			1036.7,524.8 		"/>
+		<path class="st20" d="M1046.8,537.4h2.1c1,0,1.8-0.8,1.8-1.8v-6.3h3c1.4,0,2.5-1.2,2.5-2.5v-1.1h-5.5v-4.4h6c1.2,0,2.2-1,2.2-2.2
+			v-1.4h-12V537.4z"/>
+		<path class="st20" d="M1065.8,522.9c-1.6,0-3,0.5-4,1.4c-1.1,0.9-1.6,2.1-1.7,3.6h3.6c0-0.5,0.2-0.9,0.6-1.2
+			c0.4-0.3,0.9-0.5,1.5-0.5c0.6,0,1.2,0.1,1.5,0.5c0.3,0.4,0.5,0.8,0.5,1.5v0.5l-3.7,0.7c-0.7,0.1-1.3,0.2-1.8,0.4
+			c-0.5,0.2-1,0.5-1.4,0.8c-0.5,0.3-0.8,0.7-1,1.2s-0.3,1-0.3,1.7c0,1.3,0.5,2.4,1.2,3c0.9,0.8,1.9,1.2,3.2,1.2
+			c1.8,0,3.2-0.7,4.1-2.2v0.4c0.1,0.9,0.9,1.6,1.8,1.6h1.5v-9.3c0-1.7-0.5-3-1.5-3.9C1068.8,523.3,1067.5,522.9,1065.8,522.9z
+			 M1067.7,531.6c0,0.6-0.2,1.2-0.5,1.7c-0.3,0.4-0.6,0.7-1,0.9c-0.4,0.2-0.8,0.3-1.3,0.3c-0.5,0-0.9-0.1-1.2-0.3
+			c-0.3-0.2-0.4-0.5-0.4-0.9c0-0.5,0.1-0.8,0.3-1c0.3-0.2,0.7-0.4,1.2-0.5l2.9-0.6V531.6z"/>
+		<path class="st20" d="M1076.8,517c-0.6,0-1.1,0.2-1.5,0.6c-0.5,0.4-0.7,1-0.7,1.6c0,0.6,0.1,1.1,0.6,1.5c0.5,0.4,1,0.6,1.6,0.6
+			c0.6,0,1.2-0.2,1.6-0.6c0.5-0.4,0.7-0.9,0.7-1.5c0-0.6-0.2-1.2-0.7-1.6C1078,517.2,1077.4,517,1076.8,517z"/>
+		<path class="st20" d="M1075,537.4h1.9c1,0,1.8-0.8,1.8-1.8v-12.4h-3.7V537.4z"/>
+		<path class="st20" d="M1085.8,525.4l-0.4-2.2h-3.2v14.2h2c1,0,1.8-0.8,1.8-1.8v-5.5c0-1.3,0.4-2.1,1.1-2.7
+			c0.7-0.6,1.7-0.9,2.8-0.9V523c-1.1,0-2,0.2-2.7,0.7C1086.6,524.1,1086.1,524.7,1085.8,525.4z"/>
+		<path class="st20" d="M1107.1,531.9l-0.3,1.5l-0.3-1.5l-2.4-8.5h-3.3l-2.4,8.5l-0.3,1.5l-0.3-1.5l-2.2-8.5h-3.9l4.3,14.1h2.3
+			c0.8,0,1.5-0.5,1.8-1.3l2.3-7l2.6,8.3h2.5c0.8,0,1.6-0.5,1.8-1.3l3.9-12.8h-3.9L1107.1,531.9z"/>
+		<path class="st20" d="M1117.2,517c-0.6,0-1.2,0.2-1.6,0.6c-0.5,0.4-0.7,0.9-0.7,1.5c0,0.7,0.2,1.2,0.7,1.5c0.5,0.4,1,0.6,1.6,0.6
+			c0.6,0,1.1-0.2,1.6-0.6c0.5-0.4,0.7-0.9,0.7-1.5c0-0.6-0.3-1.1-0.7-1.5C1118.3,517.2,1117.8,517,1117.2,517z"/>
+		<path class="st20" d="M1115.3,537.4h1.9c1,0,1.8-0.8,1.8-1.8v-12.4h-3.7V537.4z"/>
+		<path class="st20" d="M1130.1,522.9c-1,0-1.7,0.2-2.4,0.6c-0.6,0.4-1.1,0.9-1.5,1.6l-0.3-1.9h-3.2v14.2h1.9c1,0,1.9-0.8,1.9-1.9
+			V530c0-1.2,0.2-2,0.7-2.6s1-0.9,1.8-0.9c0.6,0,1.2,0.3,1.5,0.7c0.3,0.4,0.5,1.1,0.5,1.9v8.3h1.8c1,0,1.9-0.8,1.9-1.9v-7.3
+			c0-1.7-0.4-2.9-1.2-3.9C1132.7,523.4,1131.6,522.9,1130.1,522.9z"/>
+		<path class="st20" d="M1148.1,524.8c-0.4-0.5-0.9-0.9-1.7-1.3c-0.8-0.3-1.6-0.5-2.6-0.5c-1.9,0-3.5,0.7-4.8,2.1
+			c-1.3,1.4-1.9,3.2-1.9,5.3c0,1.4,0.3,2.6,0.8,3.8c0.6,1.2,1.4,2,2.4,2.7c1,0.7,2.2,1,3.4,1c2.1,0,3.6-0.7,4.6-2.2l0.1,0.4
+			c0.2,0.8,0.9,1.5,1.8,1.5h1.6v-20.4h-3.7V524.8z M1148,530.4c0,1.2-0.4,2.2-1.1,2.9c-0.7,0.7-1.5,1.1-2.5,1.1
+			c-1.1,0-1.9-0.3-2.6-1.1c-0.7-0.7-1-1.7-1-2.9s0.3-2.2,1-2.9s1.6-1.1,2.6-1.1c0.6,0,1.2,0.1,1.7,0.4c0.5,0.2,0.9,0.7,1.3,1.3
+			c0.4,0.6,0.6,1.3,0.6,2.1V530.4z"/>
+		<path class="st20" d="M1164.8,530.4c-0.7-0.7-1.9-1.2-3.6-1.5c-1-0.2-1.6-0.4-2-0.6c-0.3-0.2-0.5-0.5-0.5-1c0-0.4,0.1-0.7,0.4-1
+			c0.2-0.3,0.6-0.4,1.1-0.4c1,0,1.6,0.5,1.6,1.6h3.6c0-1.4-0.5-2.5-1.5-3.3c-0.9-0.8-2.2-1.2-3.7-1.2c-1.7,0-3,0.4-3.9,1.3
+			c-0.9,0.9-1.4,2-1.4,3.3c0,1.2,0.3,2.1,1.1,2.8c0.7,0.6,1.8,1.1,3.4,1.4c0.9,0.2,1.6,0.4,2,0.7c0.3,0.3,0.5,0.6,0.5,1.1
+			c0,0.4-0.2,0.8-0.5,1c-0.3,0.3-0.7,0.4-1.3,0.4c-0.6,0-1.1-0.2-1.5-0.5c-0.1-0.1-0.2-0.2-0.3-0.3c-0.4-0.6-0.9-1-1.6-1h-2.3
+			c0.1,1.4,0.6,2.6,2.1,3.5c0.9,0.8,2.3,1.2,4,1.2c0.8,0,1.4-0.1,2.1-0.3c0.6-0.1,1.2-0.4,1.7-0.8c0.5-0.3,0.9-0.8,1.2-1.4
+			s0.4-1.3,0.4-2.1C1165.9,532,1165.5,531.1,1164.8,530.4z"/>
+	</g>
+</g>
+<radialGradient id="SVGID_1_" cx="1402.3696" cy="470.6803" r="16.1424" fx="1402.6445" fy="471.3849" gradientUnits="userSpaceOnUse">
+	<stop  offset="0" style="stop-color:#FFF7F2"/>
+	<stop  offset="1" style="stop-color:#6D6D6D"/>
+</radialGradient>
+<circle class="st27" cx="1402.4" cy="470.7" r="16.1"/>
+<path class="st1" d="M1402.4,442.2c17.3,0,29.6,12.1,29.6,28.4c0,16.3-12.3,28.5-29.6,28.5s-29.6-12.1-29.6-28.5
+	S1385.1,442.2,1402.4,442.2z M1422,470.4c0-10.9-8.8-19.7-19.7-19.7c-10.9,0-19.7,8.8-19.7,19.7c0,10.9,8.8,19.7,19.7,19.7
+	c0,0,0,0,0,0C1413.2,490,1422,481.2,1422,470.4L1422,470.4z"/>
+<radialGradient id="SVGID_2_" cx="1402.3696" cy="470.6803" r="21.6422" fx="1402.7382" fy="471.625" gradientUnits="userSpaceOnUse">
+	<stop  offset="0" style="stop-color:#FFF7F2"/>
+	<stop  offset="1" style="stop-color:#6D6D6D"/>
+</radialGradient>
+<polygon class="st28" points="1406.9,470.7 1406.9,470.6 1406.9,470.7 1425.5,450.6 1402.4,466.2 1402.4,466.2 1379.2,450.6 
+	1397.8,470.7 1379.2,490.7 1402.4,475.2 1402.3,475.1 1402.4,475.1 1402.4,475.2 1425.5,490.7 1406.9,470.7 "/>
+</svg>

docs/.vuepress/public/img/fairwinds-logo.svg

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 486.5 92.3" style="enable-background:new 0 0 486.5 92.3;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#FFFFFF;}
+</style>
+<g>
+	<g>
+		<path class="st0" d="M72.5,24.3H0.4V0.4h84.4V12C84.8,18.8,79.3,24.3,72.5,24.3z"/>
+		<path class="st0" d="M41.8,58H0.4V34.1h53.7v11.6C54.1,52.5,48.6,58,41.8,58z"/>
+		<path class="st0" d="M12,91.7H0.4V67.8h23.9v11.6C24.2,86.2,18.7,91.7,12,91.7z"/>
+	</g>
+	<g>
+		<path class="st0" d="M121.7,77V16.9h36.9v4.2c0,3.7-3,6.8-6.8,6.8h-18.4v13.5H150v3.5c0,4.1-3.3,7.5-7.5,7.5h-9.1v19.1    c0,3-2.5,5.5-5.5,5.5H121.7z"/>
+		<path class="st0" d="M161.1,64.7c0-2,0.3-3.7,1-5.1c0.7-1.5,1.6-2.7,2.9-3.6c1.3-1,2.7-1.7,4.2-2.3c1.6-0.6,3.3-1,5.4-1.3l11.3-2    v-1.5c0-2-0.5-3.5-1.6-4.6c-1-1.1-2.6-1.6-4.5-1.6s-3.4,0.5-4.6,1.4c-1.2,1-1.8,2.2-1.8,3.8h-10.8c0.3-4.5,1.9-8.2,5.1-11    c3.1-2.8,7.2-4.3,12.3-4.3c5.3,0,9.5,1.3,12.6,4s4.7,6.6,4.7,11.8V77h-4.7c-2.8,0-5.1-2.1-5.5-4.8l-0.1-1.1    c-2.7,4.6-6.9,6.8-12.4,6.8c-3.9,0-7.1-1.2-9.6-3.6C162.4,72,161.1,68.8,161.1,64.7z M172.3,64c0,1.2,0.4,2.1,1.3,2.8    c0.9,0.7,2.1,1,3.7,1c1.4,0,2.7-0.3,3.9-0.9c1.2-0.6,2.2-1.5,3-2.7c1-1.4,1.5-3.2,1.5-5.3v-1.2l-8.7,1.8c-1.6,0.3-2.8,0.8-3.6,1.5    C172.7,61.8,172.3,62.7,172.3,64z"/>
+		<path class="st0" d="M207,20.9c0-1.8,0.7-3.6,2-4.9c1.3-1.2,2.8-1.9,4.6-1.9c1.8,0,3.6,0.6,4.9,1.9c1.4,1.3,2.1,2.9,2.1,4.8    s-0.7,3.4-2,4.7c-1.3,1.3-2.9,1.9-4.8,1.9s-3.5-0.6-4.8-1.9C207.7,24.2,207.1,22.7,207,20.9z M208.2,77V33.5h11.2v38    c0,3-2.5,5.5-5.5,5.5H208.2z"/>
+		<path class="st0" d="M230.4,77V33.5h9.6l1.1,6.8c0.8-2.1,2.3-3.9,4.4-5.2c2.1-1.4,4.9-2.1,8.3-2.1v11c-3.5,0-6.4,0.9-8.6,2.6    s-3.4,4.4-3.5,8.1v16.7c0,3-2.5,5.5-5.5,5.5L230.4,77L230.4,77z"/>
+		<path class="st0" d="M259.6,33.5h11.9l6.6,26.1l0.8,4.6l1-4.6l7.4-26.1h9.9l7.4,26.1l0.9,4.6l0.8-4.6l6.7-26.1h11.9L313,72.9    c-0.7,2.4-3,4.1-5.5,4.1H300l-7.9-25.6L285,73c-0.8,2.3-3,3.9-5.4,3.9h-7L259.6,33.5z"/>
+		<path class="st0" d="M330.5,20.7c0-1.8,0.7-3.4,2-4.7c1.3-1.3,2.9-1.9,4.8-1.9c1.8,0,3.4,0.6,4.8,1.9c1.3,1.3,2,2.8,2,4.7    c0,1.9-0.7,3.4-2,4.7c-1.3,1.3-2.9,1.9-4.8,1.9s-3.5-0.6-4.8-1.9C331.2,24.2,330.5,22.6,330.5,20.7z M331.7,77V33.5h11.2v38    c0,3-2.5,5.5-5.5,5.5H331.7z"/>
+		<path class="st0" d="M354.8,77V33.5h9.6l0.9,5.8c1.1-2,2.6-3.6,4.6-4.9c2-1.2,4.4-1.9,7.2-1.9c4.5,0,8,1.4,10.4,4.3    s3.6,6.8,3.6,11.9v22.5c0,3.2-2.6,5.7-5.7,5.7h-5.5V51.4c0-2.5-0.5-4.5-1.6-5.8c-1-1.3-2.6-2-4.6-2c-2.3,0-4.1,0.9-5.5,2.7    c-1.4,1.8-2.2,4.4-2.2,7.9v17.1c0,3.2-2.6,5.7-5.7,5.7L354.8,77L354.8,77z"/>
+		<path class="st0" d="M399.1,55.2c0-6.4,1.9-11.8,5.7-16.1c3.8-4.3,8.7-6.5,14.5-6.5c2.9,0,5.5,0.5,7.8,1.6s4,2.4,5.2,4.1V14.4    h11.2V77h-4.8c-2.7,0-5-2-5.4-4.7l-0.2-1.2c-3.1,4.5-7.7,6.8-13.9,6.8c-3.8,0-7.3-1-10.4-3s-5.5-4.7-7.2-8.2    C399.9,63.3,399.1,59.4,399.1,55.2z M410.5,55.2c0,3.7,1,6.6,3.1,8.9c2.1,2.3,4.7,3.4,7.8,3.4c2.9,0,5.5-1.1,7.7-3.2    c2.2-2.2,3.3-5.1,3.3-8.8V55c0-2.5-0.6-4.6-1.7-6.5s-2.5-3.2-4.1-4.1s-3.4-1.3-5.2-1.3c-3.1,0-5.7,1.1-7.8,3.4    S410.5,51.6,410.5,55.2z"/>
+		<path class="st0" d="M452.2,63.8h6.9c2,0,3.7,1.2,4.8,2.9c0.2,0.4,0.6,0.7,0.9,1c1.1,0.9,2.6,1.4,4.5,1.4c1.7,0,3-0.4,4-1.1    c0.9-0.7,1.4-1.8,1.4-3c0-1.4-0.5-2.5-1.6-3.3s-3.2-1.5-6.2-2.1c-4.8-0.8-8.3-2.3-10.5-4.4c-2.3-2.1-3.4-4.9-3.4-8.5    c0-4,1.4-7.4,4.2-10.1c2.8-2.7,6.8-4.1,11.9-4.1c4.6,0,8.4,1.3,11.3,3.8c2.9,2.5,4.5,5.8,4.7,9.9H474c-0.1-3.3-1.7-5-5-5    c-1.5,0-2.7,0.4-3.5,1.2c-0.8,0.8-1.3,1.8-1.3,3.1c0,1.4,0.5,2.4,1.6,3.1s3.1,1.3,6,1.8c5.1,0.9,8.8,2.4,10.9,4.5    c2.2,2.1,3.2,5,3.2,8.7c0,2.4-0.4,4.5-1.3,6.4c-0.9,1.8-2.1,3.3-3.7,4.4c-1.6,1.1-3.3,2-5.3,2.5c-2,0.6-4.1,0.8-6.5,0.8    c-5.3,0-9.4-1.3-12.3-3.8C453.9,71.6,452.3,68.2,452.2,63.8z"/>
+	</g>
+</g>
+</svg>

docs/.vuepress/public/scripts/marketing.js

@@ -0,0 +1,33 @@
+/*
+ * This file is generated from FairwindsOps/documentation-template
+ * DO NOT EDIT MANUALLY
+ */
+
+var llcookieless = true;
+var sf14gv = 32793;
+(function() {
+  var sf14g = document.createElement('script');
+  sf14g.src = 'https://lltrck.com/lt-v2.min.js';
+  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(sf14g, s);
+})();
+
+(function() {
+  var gtag = document.createElement('script');
+  gtag.src = "https://www.googletagmanager.com/gtag/js?id=G-ZR5M5SRYKY";
+  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(gtag, s);
+  window.dataLayer = window.dataLayer || [];
+  function gtag(){dataLayer.push(arguments);}
+  gtag('js', new Date());
+  gtag('config', 'G-ZR5M5SRYKY');
+})();
+
+!function(f,b,e,v,n,t,s)
+{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
+n.callMethod.apply(n,arguments):n.queue.push(arguments)};
+if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
+n.queue=[];t=b.createElement(e);t.async=!0;
+t.src=v;s=b.getElementsByTagName(e)[0];
+s.parentNode.insertBefore(t,s)}(window,document,'script',
+'https://connect.facebook.net/en_US/fbevents.js');
+fbq('init', '521127644762074');
+fbq('track', 'PageView');

docs/.vuepress/public/scripts/modify.js

@@ -0,0 +1,15 @@
+/*
+ * This file is generated from FairwindsOps/documentation-template
+ * DO NOT EDIT MANUALLY
+ */
+
+document.addEventListener("DOMContentLoaded", function(){
+  setTimeout(function() {
+    var link = document.getElementsByClassName('home-link')[0];
+    linkClone = link.cloneNode(true);
+    linkClone.href = "https://fairwinds.com";
+    link.setAttribute('target', '_blank');
+    link.parentNode.replaceChild(linkClone, link);
+  }, 1000);
+});
+

docs/.vuepress/styles/index.styl

@@ -0,0 +1,79 @@
+/*
+ * This file is generated from FairwindsOps/documentation-template
+ * DO NOT EDIT MANUALLY
+ */
+
+.github-only {
+  display: none;
+}
+
+.text-primary {
+  color: $primaryColor;
+}
+.text-danger {
+  color: $dangerColor;
+}
+.text-warning {
+  color: $warningColor;
+}
+.text-info {
+  color: $infoColor;
+}
+.text-success {
+  color: $successColor;
+}
+
+blockquote {
+  border-left: 0.2rem solid $warningColor;
+}
+blockquote p {
+  color: $warningColor;
+}
+
+.theme-default-content:not(.custom),
+.page-nav,
+.page-edit,
+footer {
+  margin: 0 !important;
+}
+
+.theme-default-content:not(.custom) > h2 {
+  padding-top: 7rem;
+}
+
+.navbar .site-name {
+  display: none;
+}
+
+.navbar, .navbar .links {
+  background-color: $primaryColor !important;
+}
+
+.navbar .links a {
+  color: #fff;
+}
+.navbar .links a svg {
+  display: none;
+}
+
+img {
+  border: 5px solid #f7f7f7;
+}
+
+.no-border img,
+img.no-border,
+header img {
+  border: none;
+}
+
+.mini-img {
+  text-align: center;
+}
+
+.theme-default-content:not(.custom) .mini-img img {
+  max-width: 300px;
+}
+
+.page {
+  padding-bottom: 0 !important;
+}

docs/.vuepress/styles/palette.styl

@@ -0,0 +1,32 @@
+/*
+ * This file is generated from FairwindsOps/documentation-template
+ * DO NOT EDIT MANUALLY
+ */
+
+
+$primaryColor = #23103A
+$dangerColor = #A0204C
+$warningColor = #FF6C00
+$infoColor = #8BD2DC
+$successColor = #28a745
+
+$accentColor = #FF6C00
+$textColor = #2c3e50
+$borderColor = #eaecef
+$codeBgColor = #282c34
+$arrowBgColor = #ccc
+$badgeTipColor = #42b983
+$badgeWarningColor = darken(#ffe564, 35%)
+$badgeErrorColor = #DA5961
+
+// layout
+$navbarHeight = 3.6rem
+$sidebarWidth = 20rem
+$contentWidth = 740px
+$homePageWidth = 960px
+
+// responsive breakpoints
+$MQNarrow = 959px
+$MQMobile = 719px
+$MQMobileNarrow = 419px
+

docs/.vuepress/theme/index.js

@@ -0,0 +1,3 @@
+module.exports = {
+  extend: '@vuepress/theme-default'
+}

docs/.vuepress/theme/layouts/Layout.vue

@@ -0,0 +1,45 @@
+<template>
+  <ParentLayout>
+    <template #page-bottom>
+      <div class="custom-footer">
+        <div class="left-footer">
+          <a href="https://fairwinds.com" target="_blank">Learn more about Fairwinds</a>
+          <a href="https://fairwinds.com/insights" target="_blank">Try Fairwinds Insights</a>
+        </div>
+        <div class="right-footer">
+          <a href="https://www.fairwinds.com/privacy-policy" target="_blank">Privacy Policy</a>
+        </div>
+      </div>
+    </template>
+  </ParentLayout>
+</template>
+
+<script>
+import ParentLayout from '@parent-theme/layouts/Layout.vue'
+
+export default {
+  name: 'Layout',
+
+  components: {
+    ParentLayout
+  }
+}
+</script>
+
+<style>
+  div.custom-footer {
+    display: flex;
+    justify-content: space-between;
+    border-top: 1px solid #eaecef;
+    padding: 2rem 2.5rem;
+  }
+  .custom-footer .left-footer {
+    margin-top: 0 !important;
+  }
+  .custom-footer .left-footer a:first-of-type {
+    margin-right: 1.5rem;
+  }
+  .custom-footer a {
+    color: #4e6e8e;
+  }
+</style>

docs/README.md

@@ -0,0 +1,67 @@
+<div align="center" class="no-border">
+  <img src="/img/polaris-logo.png" alt="Polaris Logo">
+  <br>
+  <h3>Best Practices for Kubernetes Workload Configuration</h3>
+  <a href="https://github.com/FairwindsOps/polaris">
+    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.1.6&color=239922">
+  </a>
+  <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
+    <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
+  </a>
+  <a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
+    <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
+  </a>
+  <a href="https://insights.fairwinds.com/gh/FairwindsOps/polaris">
+    <img src="https://insights.fairwinds.com/v0/gh/FairwindsOps/polaris/badge.svg">
+  </a>
+</div>
+
+Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
+Kubernetes pods and controllers are configured using best practices, helping you avoid
+problems in the future.
+
+Polaris can be run in three different modes:
+* As a [dashboard](/dashboard), so you can audit what's running inside your cluster.
+* As an [admission controller](/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
+* As a [command-line tool](/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
+
+<p align="center">
+  <img src="/img/architecture.svg" alt="Polaris Architecture" width="550"/>
+</p>
+
+**Want to learn more?** Reach out on [the Slack channel](https://fairwindscommunity.slack.com/messages/polaris) ([request invite](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)), send an email to `opensource@fairwinds.com`, or join us for [office hours on Zoom](https://fairwindscommunity.slack.com/messages/office-hours)
+
+
+
+## Integration with Fairwinds Insights
+<p align="center">
+  <img src="/img/FW_Insights_Polaris.svg" alt="Fairwinds Insights" width="550"/>
+</p>
+
+[Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
+is a platform for auditing Kubernetes clusters and enforcing policy. If you'd like to:
+* manage Polaris across a fleet of clusters
+* track findings over time
+* send results to services like Slack and Datadog
+* add additional checks from tools like
+[Trivy](https://github.com/aquasecurity/trivy),
+[Goldilocks](https://github.com/FairwindsOps/goldilocks/), and
+[OPA](https://www.openpolicyagent.org)
+
+you can sign up for a [free account here](https://insights.fairwinds.com?source=polaris).
+
+## Contributing
+PRs welcome! Check out the [Contributing Guidelines](/contributing) and [Code of Conduct](/code-of-conduct) for more information.
+
+## Further Information
+A history of changes to this project can be viewed in the [Changelog](/changelog)
+
+If you'd like to learn more about Polaris, or if you'd like to speak with
+a Kubernetes expert, you can contact `info@fairwinds.com` or [visit our website](https://fairwinds.com)
+
+---
+
+<p align="center">
+  <img src="/img/dashboard-screenshot.png" alt="Polaris Dashboard" width="550"/>
+</p>
+

docs/admission-controller.md

@@ -0,0 +1,82 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation: Polaris can be run as an admission controller that acts as a validating webhook."
+---
+# Admission Controller
+> Want to manage the Admission Controller across multiple clusters? Check out
+> [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
+
+Polaris can be run as an admission controller that acts as a validating webhook.
+This accepts the same configuration as the dashboard, and can run the same validations.
+
+The webhook will reject any workloads that trigger a danger-level check.
+This is indicative of the greater goal of Polaris, not just to encourage better
+configuration through dashboard visibility, but to actually enforce it with this webhook.
+
+Note that Polaris will not alter your workloads, only block workloads that don't conform to the configured policies.
+
+## Installation
+A valid TLS certificate is required for the Polaris Validating Webhook. If you have cert-manager installed in your cluster then the install methods below will work.
+
+If you don't use cert-manager, you'll need to:
+
+* Supply a CA Bundle with the `webhook.caBundle`
+* Create a TLS secret in your cluster with a valid certificate that uses that CA
+* Pass the name of that secret with the webhook.secretName parameter.
+
+### Helm
+```bash
+helm repo add fairwinds-stable https://charts.fairwinds.com/stable
+helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris --create-namespace \
+  --set webhook.enable=true --set dashboard.enable=false
+```
+
+## Workload Types
+The webhook comes with built-in support for a handful of known controller types,
+such as Deployments, Jobs, and DaemonSets. To add new controller types,
+you can set `webhook.rules` in the
+[Helm chart](https://github.com/FairwindsOps/charts/tree/master/stable/polaris)
+
+## Warnings
+Unfortunately we have not found a way to display warnings as part of `kubectl`
+output unless we are rejecting a workload altogether.
+
+This means that any checks with a severity of `warning` will still pass webhook validation,
+and the only evidence of that warning will either be in the Polaris dashboard or the
+Polaris webhook logs. This will change in a future version of Kubernetes.
+
+## Mutating Webhook
+By default, the Admission Controller is just pass/fail, but
+Polaris can also operate as a mutating webhook for many of the issues it checks for.
+This means Polaris will remediate the issue it finds, rather than rejecting
+the deployment.
+
+To enable the mutating webhook, add `--set webhook.mutate=true` to your
+Helm installation command.
+
+The following default checks currently have mutation support enabled:
+* `hostPIDSet`
+* `hostNetworkSet`
+* `hostIPCSet`
+* `priorityClassNotSet`
+* `hostPortSet`
+* `pullPolicyNotAlways`
+* `deploymentMissingReplicas`
+* `dangerousCapabilities`
+* `cpuLimitsMissing`
+* `memoryLimitsMissing`
+* `livenessProbeMissing`
+* `memoryRequestsMissing`
+* `cpuRequestsMissing`
+* `runAsPrivileged`
+* `readinessProbeMissing`
+* `privilegeEscalationAllowed`
+* `notReadOnlyRootFilesystem`
+* `insecureCapabilities`
+* `runAsRootAllowed`
+
+If you'd like to
+enable other mutations, you can set the `webhook.mutations` flag.
+
+

docs/changelog.md

@@ -0,0 +1,344 @@
+---
+sidebarDepth: 0
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Changelog"
+
+---
+
+## 9.1.1
+* Fix `hpaMinAvailability` failure message
+* Fix `missingPodDisruptionBudget` typo
+* Rewrite `hpaMaxAvailability` check to use go-template
+
+## 9.1.0
+* Add HPA `minAvailable` and HPA `maxAvailable` checks 
+* Fix typo for PDB `minAvailable`
+
+## 9.0.1
+* Fix comments handling in `addOrReplaceValue` function
+
+## 9.0.0
+* Expose issue fixer and mutations in the library
+* Remove `packr` in favor of `go:embed`
+
+## 8.5.6
+* Fix trying to list cluster-level resources
+
+## 8.5.5
+* Fix missing PDB check
+
+## 8.5.4
+* Fix conditional expressions should be at very top of `additionalSchemaStrings`
+* Update alpine to 3.19
+
+## 8.5.3
+* Add quiet flag to polaris audit CLI command to suppress 'upload to Insights' prompt
+
+## 8.5.2
+* Switch to `controller-utils` package to get workloads
+
+## 8.5.1
+* Update `topologySpreadConstraint` check
+
+## 8.5.0
+* Add helm-skip-tests flag
+* Update CLI docs
+* Handle multiple helm-values files
+
+## 8.4.0
+* Change kubernetes.io/ label from name to instance
+
+## 8.3.0
+* Add option to filter audit results by severity level
+* Add insights prompt
+
+## 8.2.4
+* Fix nil pointer issue with webhook
+
+## 8.2.3
+* Add category for `metadataAndNameMismatched`.
+* Fix category for `priorityClassNotSet`.
+
+## 8.2.2
+* Fix webhook server cert dir argument
+
+## 8.2.1
+* Fix on Insights integration
+
+## 8.2.0
+* Minor fixes for NSA checks
+
+## 8.1.0
+* Add `insights-host` global flag to configure Fairwinds Insights host (defaults to `https://insights.fairwinds.com`).
+* Add new `auth` sub-commands be able to authenticate on Polaris using Fairwinds Insights credentials
+  - `login` - login using Fairwinds Insights credentials via the web interface or provide a token
+  - `logout` - logout from Fairwinds Insights
+  - `status` - show relevant information regarding login state
+  - `token` - prints the token from local storage
+* Add new `audit` flags to be able to upload Workloads and Polaris results to Fairwinds Insights
+  - `upload-insights` - indicates that the results should be uploaded to Fairwinds Insights. (defaults to `false`)
+  - `cluster-name`  - cluster name that the results belongs to. Creates the cluster if it does not exist. (required if `upload-insights` is used) 
+
+
+## 8.0.0
+* Change default severity from `ignore` to `warning` for `priorityClassNotSet`, `metadataAndNameMismatched`, `missingPodDisruptionBudget`, `automountServiceAccountToken`, `missingNetworkPolicy` checks.
+* Change default severity from `warning` to `danger` for `sensitiveContainerEnvVar`, `sensitiveConfigmapContent`, `clusterrolePodExecAttach`, `rolePodExecAttach`, `clusterrolebindingPodExecAttach`, `rolebindingClusterRolePodExecAttach`, `rolebindingRolePodExecAttach`,`clusterrolebindingClusterAdmin`,`rolebindingClusterAdminClusterRole`,`rolebindingClusterAdminRole` checks.
+
+## 7.4.0
+* Skip https certificate verification (#920)
+
+## 7.3.0
+* Add a check for `topologySpreadConstraint` (#879)
+
+## 7.2.0
+* Enable new RBAC / sensitive content / Pod exec checks, add `hasPrefix` and `hasSuffix` functions to the GO template, exempt `system:` name prefixes for RBAC checks, sensitive content checks ignore `valueFrom`, (#832)
+
+## 7.1.0
+* Let Polaris modify YAML without losing comments/formatting (#821)
+* Add checks for RBAC allowing exec or attaching to a Pod (#820)
+* Add `clusterrolebindingClusterAdmin`, `rolebindingClusterAdminRole`, and `rolebindingClusterAdminClusterRole` checks + schema tests (#823)
+
+## 7.0.2
+* Fixes for pretty CLI output
+* Some new checks (disabled by default)
+* Some additional features in templating engine
+
+## 7.0.1
+* Documentation updates
+
+## 7.0.0
+* Better support for `polaris fix`
+* `target: Pod` is now `target: PodSpec` (to differentiate naked Pods from Controllers)
+
+## 6.0.0
+* Preliminary support for `polaris fix` command
+* Changes to how Pod owners are determined
+* Removed YAML manifests from the `deploy/` directory - Helm is now the default install mechanism
+
+## 5.1.0
+* Support `--context` flag for kubecontext
+* Treat core Kubernetes controllers (`Deployments`, `StatefulSets`, `DaemonSets`, `CronJobs`) as top-level objects, instead of following owner refs
+
+## 5.0.0
+* Renamed `multipleReplicasForDeployment` to `deploymentMissingReplicas`
+* Changed `RunAsRootAllowed` and `hostNetworkSet` default severity to `danger`
+* Changed `deploymentMissingReplicas` default severity to `warning`
+
+## 4.2.0
+* New flags `--disallow-(config|annotation)-exemptions`
+* Kubernetes dependency updates
+* Documentation updates
+## 4.1.0
+* Handle case-insentitivity in capabilities checks
+* Change test for PDB disruptions to better handle IaC
+
+## 4.0.9
+* Update Alpine base image
+
+## 4.0.8
+* Fix support for namespace checks
+
+## 4.0.7
+* Fix goreleaser format
+
+## 4.0.6
+* Change goreleaser format
+* Fix `--helm-values` flag
+
+## 4.0.5
+* Bugfix for repeated objects on the dashboard
+
+## 4.0.4
+* Bugfix for validating webhook and non-pod checks
+
+## 4.0.3
+* Fixed bad interaction between `--set-exit-score-below` and `--only-show-failed-tests`
+* Dependency updates
+* Support for Helm chart scanning
+
+## 4.0.2
+* Goreleaser fix
+
+## 4.0.1
+* Goreleaser fix
+
+## 4.0.0
+* Add support for arbitrary resources, like Ingress or PodDisruptionBudget
+* Add support check templating (see docs)
+* Add support for multi-resource checks (see docs)
+
+### Breaking Changes
+* In custom checks, `jsonSchema` is now `schemaString`
+* Check `pdbDisruptionsAllowedGreaterThanZero` is now called `pdbDisruptionsIsZero`
+
+## 3.2.0
+* Add `--format=pretty` option for CLI output
+
+## 3.1.6
+* Fix nil pointer issue with --only-output-failed-tests
+
+## 3.1.5
+* Fix UI display of Ingress checks
+
+## 3.1.4
+* Fixes for exemption annotations for the admission controller
+
+## 3.1.3
+* Fixes for `privilegeEscalationAllowed` and `insecureCapabilities` checks to take Kubernetes defaults into account
+
+## 3.1.2
+* Start checking deployment configuration using Fairwinds Insights
+
+## 3.1.1
+* Updated to alpine:3.13
+
+## 3.1.0
+* Added support for Ingress objects
+* Fixes for exemptions, including support for exempting entire namespaces
+
+## 3.0.0
+* **Breaking** - fixed inconsistency in how controller-level checks are handled
+Custom checks with `target: Controller` should remove `Object` from the top-level of the
+JSON schema (see changes to `./checks/multipleReplicasForDeployment.yaml`)
+
+## 2.0.1
+* Fixed Polaris deployment process
+
+## 2.0.0
+* Standardize categories of checks into Security, Reliability, and Efficiency
+* Changes to the dashboard UI
+* Update controller-runtime
+
+## 1.2.1
+* Update date on dashboard footer
+
+## 1.2.0
+* Add ability to audit a single workload
+* Enable `pullPolicyAlways` by default
+* Fix for finding parent resources
+
+## 1.1.1
+* Show controller checks on dashboard
+* Fix for orphaned pods w/ controller checks
+
+## 1.1.0
+* Add namespace filter in UI
+* Add priorityClass check
+* Support reading from STDIN
+* Ensure severity is set for all custom checks
+* Support audit files which use \r or \r\n as newline character
+* Add option to exempt an entire controller from checks via config file
+* Fixed case where parent resources trigger error
+* Fixed UI zero-state
+
+## 1.0.3
+* Fixed case where parent resources trigger error
+* Fixed dashboard link when `--base-path` is set
+
+## 1.0.2
+* Fixed case where custom CRDs are not covered by RBAC
+
+## 1.0.1
+* Added ARM binaries to releases
+
+## 1.0.0
+### New Features
+* Added support for custom checks using JSON Schema
+* Added support for arbitrary controllers, rather than a pre-configured set
+    * removed support for `controllers_to_scan` in config
+* Added the ability to exempt a particular controller from a particular check.
+* Docker image now includes the default config
+
+### Breaking Changes
+* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/examples) for examples of the new formats.
+    * removed config-level configuration for checks like max/min memory settings
+    * changed severity `error` to `danger`
+* Breaking changes to the CLI
+    * CLI flag `--set-exit-code-on-error` is now `--set-exit-code-on-danger`
+    * Flags `--version`, `--dashboard`, `--webhook`, and `--audit` are now arguments
+    * Port flags are now just `--port`
+
+## 0.6.0
+* Fixed webhook support in Kubernetes 1.16
+  * this also removes support for 1.8
+* Added support for exemptions via controller annotations
+
+## 0.5.2
+* Fixed missing success messages for resource requests/limits
+
+## 0.5.1
+* Added a few more exemptions
+* Started checking exemptions based on controller name prefix
+* `runAsUser != 0` now passes the `runAsNonRoot` check
+
+## 0.5.0
+* Added `--load-audit-file` flag to run the dashboard from an existing audit
+* Added an `ID` field to each check in the output
+* Skip health checks for jobs, cronjobs, initcontainers
+* Added support for exemptions
+* Fixed dashboard base path option
+
+## 0.4.0
+* Added additional Pod Controllers to scan PodSpec (`jobs`, `cronjobs`, `daemonsets`, `replicationcontrollers`)
+
+## 0.3.1
+* Changed dashboard branding to refer to new org name Fairwinds
+
+## 0.3.0
+* Added `--set-exit-code-on-error` and `--set-exit-code-below-score` flags to better support CI/CD
+
+## 0.2.1
+* [Fix](https://github.com/FairwindsOps/polaris/issues/146): Fixed logic on RunAsNonRoot check to incorporate settings in podSpec
+
+## 0.2.0
+* Added `--output-format` flag for better CI/CD support
+* Added `--display-name` flag
+* Added support for StatefulSets
+* Show error message if no kubeconfig is set
+
+## 0.1.5
+* [Fix](https://github.com/FairwindsOps/polaris/issues/125): ignore limits/requests for initContainers
+* [Fix](https://github.com/FairwindsOps/polaris/issues/132): support custom base path
+
+## 0.1.4
+* [Fix](https://github.com/FairwindsOps/polaris/issues/116): details pages getting template errors
+* [Fix](https://github.com/FairwindsOps/polaris/issues/114): support all auth providers
+* [Fix](https://github.com/FairwindsOps/polaris/issues/112): Ignore readiness probe for initContainers
+
+## 0.1.3
+* [Fix](https://github.com/FairwindsOps/polaris/issues/109): dashboard not updating when running persistently
+
+## 0.1.2
+* Stored all third-party assets (e.g. Charts.js) to local files to support offline dashboard viewing
+* Fix: custom configs in `ConfigMap` not respected
+
+## 0.1.1
+* [Fix](https://github.com/FairwindsOps/polaris/issues/93): missing `config.yaml` and dashboard assets in binary releases
+* Added some tests and better error handling
+
+## 0.1.0
+* Dashboard fully functional
+* Validating webhook functional, but still considered beta
+* Checks:
+  * Health
+    * readiness probe missing
+    * liveness probe missing
+  * Images
+    * tag not specified
+    * pull policy not always
+  * Networking
+    * host network set
+    * host port set
+  * Resources
+    * cpu/memory requests missing
+    * cpu/memory limits missing
+    * cpu/memory ranges exceeded
+  * Security
+    * security capabilities
+    * host IPC set
+    * host PID set
+    * not read-only fs
+    * privilege escalation allowed
+    * run as root allowed
+    * run as privileged

docs/checks/efficiency.md

@@ -0,0 +1,36 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Ensure that CPU and memory settings are configured, so that Kubernetes can schedule your workload effectively"
+---
+# Efficiency
+
+These checks ensure that CPU and memory settings are configured, so that
+Kubernetes can schedule your workload effectively.
+
+## Presence Checks
+
+To simplify ensure that these values have been set, the following attributes are available:
+
+key | default | description
+----|---------|------------
+`cpuRequestsMissing` | `warning` | Fails when `resources.requests.cpu` attribute is not configured.
+`memoryRequestsMissing` | `warning` | Fails when `resources.requests.memory` attribute is not configured.
+`cpuLimitsMissing` | `warning` | Fails when `resources.limits.cpu` attribute is not configured.
+`memoryLimitsMissing` | `warning` | Fails when `resources.limits.memory` attribute is not configured.
+
+## Background
+
+Configuring resource requests and limits for containers running in Kubernetes is an important best practice to follow. Setting appropriate resource requests will ensure that all your applications have sufficient compute resources. Setting appropriate resource limits will ensure that your applications do not consume too many resources.
+
+Having these values appropriately configured ensures that:
+
+* Cluster autoscaling can function as intended. New nodes are scheduled once pods are unable to be scheduled on an existing node due to insufficient resources. This will not happen if resource requests are not configured.
+
+* Each container has sufficient access to compute resources. Without resource requests, a pod may be scheduled on a node that is already overutilized. Without resource limits, a single poorly behaving pod could utilize the majority of resources on a node, significantly impacting the performance of other pods on the same node.
+
+## Further Reading
+
+- [Kubernetes Docs: Managing Compute Resources for Containers](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
+- [Kubernetes best practices: Resource requests and limits](https://cloud.google.com/blog/products/gcp/kubernetes-best-practices-resource-requests-and-limits)
+- [Vertical Pod Autoscaler (can automatically set resource requests and limits)](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler)

docs/checks/reliability.md

@@ -0,0 +1,76 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Make sure your Kubernetes workloads are always available, and are running the correct image."
+---
+# Reliability
+
+These checks help to make sure your workloads are always available,
+and are running the correct image.
+
+key | default | description
+----|---------|------------
+`readinessProbeMissing` | `warning` | Fails when a readiness probe is not configured for a pod.
+`livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
+`tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
+`pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
+`priorityClassNotSet` | `warning` | Fails when a priorityClassName is not set for a pod.
+`deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
+`missingPodDisruptionBudget` | `warning` | Fails when PDB is missing.
+`metadataAndInstanceMismatched` | `warning` | Fails when label `app.kubernetes.io/instance` and `metadata.name` mismatch
+`topologySpreadConstraint` | `warning` | Fails when there is no topology spread constraint on the pod
+`hpaMaxAvailability` | `warning` | Fails when `maxAvailable` lesser or equal than `minAvailable` (if defined) for a HorizontalPodAutoscaler
+`hpaMinAvailability` | `warning` | Fails when `minAvailable` (if defined) lesser or equal to one for a HorizontalPodAutoscaler
+`pdbMinAvailableGreaterThanHPAMinReplicas` | `warning` |  Fails when PDB `minAvailable` is greater than HPA `minReplicas`
+
+## Background
+
+### Liveness and Readiness Probes
+Readiness and liveness probes can help maintain the health of applications running inside Kubernetes. By default, Kubernetes only knows whether or not a process is running, not if it's healthy. Properly configured readiness and liveness probes will also be able to ensure the health of an application.
+
+Readiness probes are designed to ensure that an application has reached a "ready" state. In many cases there is a period of time between when a webserver process starts and when it is ready to receive traffic. A readiness probe can ensure the traffic is not sent to a pod until it is actually ready to receive traffic.
+
+Liveness probes are designed to ensure that an application stays in a healthy state. When a liveness probe fails, the pod will be restarted.
+
+### Image Pull Policy
+Docker's `latest` tag is applied by default to images where a tag hasn't been specified. Not specifying a specific version of an image can lead to a wide variety of problems. The underlying image could include unexpected breaking changes that break your application whenever the latest image is pulled. Reusing the same tag for multiple versions of an image can lead to different nodes in the same cluster having different versions of an image, even if the tag is identical.
+
+Related to that, relying on cached versions of a Docker image can become a security vulnerability. By default, an image will be pulled if it isn't already cached on the node attempting to run it. This can result in variations in images that are running per node, or potentially provide a way to gain access to an image without having direct access to the ImagePullSecret. With that in mind, it's often better to ensure the a pod has `pullPolicy: Always` specified, so images are always pulled directly from their source.
+
+### Topology Spread Constraints
+
+By default, the Kubernetes scheduler uses a bin-packing algorithm to fit as many pods as possible into a cluster. The scheduler prefers a more evenly distributed general node load to app replicas precisely spread across nodes. Therefore, by default, multi-replica is not guaranteed to be spread across multiple availability zones. Kubernetes provides topologySpreadConstraint configuration in order to better ensure pod spread across multiple AZs and/or Hosts.
+
+Example of a topologySpreadConstraint spreading across zones:
+
+```
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: demo-basic-demo
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: basic-demo
+      app.kubernetes.io/instance: demo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: basic-demo
+        app.kubernetes.io/instance: demo
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "topology.kubernetes.io/zone"
+          whenUnsatisfiable: ScheduleAnyway
+```
+
+
+## Further Reading
+
+- [What's Wrong With The Docker :latest Tag?](https://vsupalov.com/docker-latest-tag/)
+- [Kubernetes’ AlwaysPullImages Admission Control — the Importance, Implementation, and Security Vulnerability in its Absence](https://medium.com/@trstringer/kubernetes-alwayspullimages-admission-control-the-importance-implementation-and-security-d83ff3815840)
+- [Kubernetes Docs: Configure Liveness and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
+- [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
+- [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)
+- [Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)

docs/checks/security.md

@@ -0,0 +1,56 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Security Checks Documentation"
+---
+# Security
+
+These checks are related to security concerns. Workloads that fail these
+checks may make your cluster more vulnerable, often by introducing a path
+for privilege escalation.
+
+key | default | description
+----|---------|------------
+`automountServiceAccountToken` | `warning` | Fails when `automountServiceAccountToken` is automounted.
+`hostIPCSet` | `danger` | Fails when `hostIPC` attribute is configured.
+`hostPIDSet` | `danger` | Fails when `hostPID` attribute is configured.
+`linuxHardening` | `danger` | Fails when neither `AppArmor`, `Seccomp`, `SELinux`, or dropping Linux Capabilities is in use.
+`notReadOnlyRootFilesystem` | `warning` | Fails when `securityContext.readOnlyRootFilesystem` is not true.
+`privilegeEscalationAllowed` | `danger` | Fails when `securityContext.allowPrivilegeEscalation` is true.
+`runAsRootAllowed` | `warning` | Fails when `securityContext.runAsNonRoot` is not true.
+`runAsPrivileged` | `danger` | Fails when `securityContext.privileged` is true.
+`insecureCapabilities` | `warning` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks/insecureCapabilities.yaml)
+`dangerousCapabilities` | `danger` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks/dangerousCapabilities.yaml)
+`hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
+`hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
+`tlsSettingsMissing` | `warning` | Fails when an Ingress lacks TLS settings.
+`sensitiveContainerEnvVar` | `danger` | Fails when the container sets potentially sensitive environment variables.
+`sensitiveConfigmapContent` | `danger` | Fails when potentially sensitive content is detected in the ConfigMap keys or values.
+`missingNetworkPolicy` | `warning`
+`clusterrolePodExecAttach` | `danger` | Fails when the ClusterRole allows Pods/exec or pods/attach.
+`rolePodExecAttach` | `danger` | Fails when the Role allows Pods/exec or pods/attach.
+`clusterrolebindingPodExecAttach` | `danger` | Fails when the ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
+`rolebindingRolePodExecAttach` | `danger` | Fails when the RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist.
+`rolebindingClusterRolePodExecAttach` | `danger` | Fails when the RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
+`clusterrolebindingClusterAdmin` | `danger` | Fails when the ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
+`rolebindingClusterAdminClusterRole` | `danger` | Fails when the RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
+`rolebindingClusterAdminRole` | `danger` | Fails when the RoleBinding references a Role with wildcard permissions.
+
+## Background
+
+Securing workloads in Kubernetes is an important part of overall cluster security. The overall goal should be to ensure that containers are running with as minimal privileges as possible. This includes avoiding privilege escalation, not running containers with a root user, not giving excessive access to the host network, and using read only file systems wherever possible.
+
+A pod running with the `hostNetwork` attribute enabled will have access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. There are certain examples where setting `hostNetwork` to true is required, such as deploying a networking plugin like Flannel.
+
+Setting the `hostPort` attribute on a container will ensure that it is accessible on that specific port on each node it is deployed to. Unfortunately when this is specified, it limits where a pod can actually be scheduled in a cluster.
+
+Much of this configuration can be found in the `securityContext` attribute for both Kubernetes pods and containers. Where configuration is available at both a pod and container level, Polaris validates both.
+
+## Further Reading
+- [Kubernetes Docs: Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+- [KubeCon 2018 Keynote: Running with Scissors](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
+- [Kubernetes Security Book](https://kubernetes-security.info/)
+- [Kubernetes Docs: Set capabilities for a Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container)
+- [Linux Programmer's Manual: Capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html)
+- [Kubernetes Docs: Configuration Best Practices](https://kubernetes.io/docs/concepts/configuration/overview/#services)
+- [Accessing Kubernetes Pods from Outside of the Cluster](http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster/)

docs/cli.md

@@ -0,0 +1,74 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Learn your CLI options"
+---
+#### CLI Options
+
+```
+# top-level commands
+audit
+      Runs a one-time audit.
+dashboard
+      Runs the webserver for Polaris dashboard.
+fix
+      Fix Infrastructure as code files.
+help
+      Prints help, if you give it a command then it will print help for that command. Same as -h
+version
+      Prints the version of Polaris
+webhook
+      Runs the webhook webserver.
+
+# global flags
+-c, --config string                    Location of Polaris configuration file.
+-x, --context string                   Set the kube context.
+    --disallow-exemptions              Disallow any exemptions from configuration file.
+    --disallow-config-exemptions       Disallow exemptions set within the configuration file.
+    --disallow-annotation-exemptions   Disallow any exemption defined as a controller annotation.
+    --kubeconfig string                Paths to a kubeconfig. Only required if out-of-cluster.
+    --insights-host string             Fairwinds Insights host URL. (default "https://insights.fairwinds.com")
+    --log-level string                 Logrus log level. (default "info")
+
+# dashboard flags
+    --audit-path string          If specified, audits one or more YAML files instead of a cluster.
+    --base-path string           Path on which the dashboard is served. (default "/")
+    --display-name string        An optional identifier for the audit.
+-h, --help                       help for dashboard
+    --listening-address string   Listening Address for the dashboard webserver.
+    --load-audit-file string     Runs the dashboard with data saved from a past audit.
+-p, --port int                   Port for the dashboard webserver. (default 8080)
+
+# audit flags
+    --audit-path string               If specified, audits one or more YAML files instead of a cluster.
+    --checks strings                  Optional flag to specify specific checks to check
+    --color                           Whether to use color in pretty format. (default true)
+    --display-name string             An optional identifier for the audit.
+-f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
+    --helm-chart string               Will fill out Helm template
+    --helm-values string              Optional flag to add helm values
+    --helm-skip-tests bool            Corresponds to --skip-tests of helm template
+-h, --help                            help for audit
+    --namespace string                Namespace to audit. Only applies to in-cluster audits
+    --only-show-failed-tests          If specified, audit output will only show failed tests.
+    --output-file string              Destination file for audit results.
+    --output-url string               Destination URL to send audit results.
+    --resource string                 Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.
+    --set-exit-code-below-score int   Set an exit code of 4 when the score is below this threshold (1-100).
+    --set-exit-code-on-danger         Set an exit code of 3 when the audit contains danger-level issues.
+    --severity string                 Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)
+    --skip-ssl-validation             Skip https certificate verification
+
+# fix flags
+    --checks strings      Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations
+    --files-path string   mutate and fix one or more YAML files in a specified folder
+-h, --help                help for fix
+    --template            set to true when modifyng a YAML template, like a Helm chart (experimental)
+
+
+# webhook flags
+    --disable-webhook-config-installer   disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.
+-h, --help                               help for webhook
+-p, --port int                           Port for the dashboard webserver. (default 9876)
+
+```

docs/code-of-conduct.md

@@ -0,0 +1,79 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Contribution Code of Conduct"
+---
+# Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at [INSERT EMAIL ADDRESS]. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

docs/contributing.md

@@ -0,0 +1,78 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Contribution Guidelines"
+---
+# Contributing
+
+Issues, whether bugs, tasks, or feature requests are essential for keeping Polaris great. We believe it should be as easy as possible to contribute changes that get things working in your environment. There are a few guidelines that we need contributors to follow so that we can keep on top of things.
+
+## Code of Conduct
+
+This project adheres to a [code of conduct](code-of-conduct.md). Please review this document before contributing to this project.
+
+## Sign the CLA
+Before you can contribute, you will need to sign the [Contributor License Agreement](https://cla-assistant.io/fairwindsops/polaris).
+
+## Project Structure
+
+Polaris is built on top of [controller-runtime](https://github.com/kubernetes-sigs/controller-runtime). It can run in 3 different modes, a dashboard, a webhook, or a reporter that prints or exports validation results. All of these modes make use of the shared `validator` and `config` packages. Adding new validations is possible by only making additions to those packages.
+
+## Getting Started
+
+We label issues with the ["good first issue" tag](https://github.com/FairwindsOps/polaris/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) if we believe they'll be a good starting point for new contributors. If you're interested in working on an issue, please start a conversation on that issue, and we can help answer any questions as they come up.
+
+## Setting Up Your Development Environment
+### Prerequisites
+* A properly configured Golang environment with Go 1.11 or higher
+* If you want to see the local changes you make on a Polaris dashboard, you will need access to a Kubernetes cluster defined in `~/.kube/config`
+
+### Installation
+* Install the project with `go get github.com/fairwindsops/polaris`
+* Change into the polaris directory which is installed at `$GOPATH/src/github.com/fairwindsops/polaris`
+* See the dashboard with `go run main.go dashboard`, then open http://localhost:8080/
+* See the audit data  `go run main.go audit`. This command shows the audit information on the command line. 
+
+## Running Tests
+
+The following commands are all required to pass as part of Polaris testing:
+
+```bash
+go list ./... | grep -v vendor | xargs golint -set_exit_status
+go list ./... | grep -v vendor | xargs go vet
+go test ./pkg/... -v -coverprofile cover.out
+```
+
+### Webhook tests
+```bash
+kind create cluster --wait=90s --image kindest/node:v1.15.11 --name polaris-test
+docker build -t quay.io/fairwinds/polaris:debug . # or use your own registry
+docker push quay.io/fairwinds/polaris:debug
+helm repo add jetstack https://charts.jetstack.io
+ helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait
+POLARIS_IMAGE=quay.io/fairwinds/polaris:debug ./test/webhook_test.sh
+```
+to avoid the final cleanup for debugging purposes, you can run
+```bash
+SKIP_FINAL_CLEANUP=true IMAGE_TAG=debug ./test/webhook_test.sh
+```
+## Creating a New Issue
+
+If you've encountered an issue that is not already reported, please create a [new issue](https://github.com/FairwindsOps/polaris/issues), choose `Bug Report`, `Feature Request` or `Misc.` and follow the instructions in the template. 
+
+
+## Creating a Pull Request
+
+Each new pull request should:
+
+- Reference any related issues
+- Add tests that show the issues have been solved
+- Pass existing tests and linting
+- Contain a clear indication of if they're ready for review, or a work in progress
+- Be up to date and/or rebased on the master branch
+
+## Creating a new release
+To create a new release, simply tag this repo with the new version.
+
+For major and minor releases, don't forget to update the Helm chart at
+https://github.com/FairwindsOps/charts

docs/customization/checks.md

@@ -0,0 +1,22 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation on setting checks by severity "
+---
+# Check Settings
+Each check can be assigned a `severity`. Only checks with a severity of `danger` or `warning` will be validated. The results of these validations are visible on the dashboard. In the case of the validating webhook, only failures with a severity of `danger` will result in a change being rejected.
+
+Polaris validation checks fall into several different categories:
+
+- [Security](/checks/security.md)
+- [Reliability](/checks/reliability.md)
+- [Efficiency](/checks/efficiency.md)
+
+To change the default severity levels, or to turn checks on or off, you can create your own `config.yaml`:
+```yaml
+checks:
+  tagNotSpecified: ignore
+  runAsRootAllowed: danger
+  pullPolicyNotAlways: warning
+```
+

docs/customization/configuration.md

@@ -0,0 +1,21 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Learn about Polaris defaults and how to customize configurations. "
+---
+# Configuration
+
+The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/pkg/config/default.yaml).
+
+You can customize the configuration to do things like:
+* Turn checks [on and off](checks.md)
+* Change the [severity level](checks.md) of checks
+* Add new [custom checks](custom-checks.md)
+* Add [exemptions](exemptions.md) for particular workloads or namespaces
+
+To pass in your custom configuration, follow the instructions for your environment:
+
+* CLI - set the `--config` argument to point to your `config.yaml`
+* Helm - set the `config` variable in your values file
+* kubectl - create a ConfigMap with your `config.yaml`, mount it as a volume, and use the `--config` argument in your Deployment
+

docs/customization/custom-checks.md

@@ -0,0 +1,240 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation: Create your own checks, you can use JSON Schema"
+---
+# Custom Checks
+
+If you'd like to create your own checks, you can use [JSON Schema](https://json-schema.org/).
+This is how built-in Polaris checks are defined as well - you can see all the built-in checks
+in the [checks folder](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks) for examples.
+
+If you write a check that could be useful for others, feel free to open a PR to add it in!
+
+## Basic Example
+For example, to disallow images from quay.io:
+
+```yaml
+checks:
+  imageRegistry: warning
+
+customChecks:
+  imageRegistry:
+    successMessage: Image comes from allowed registries
+    failureMessage: Image should not be from disallowed registry
+    category: Security
+    target: Container
+    schema:
+      '$schema': https://json-schema.org/draft/2019-09/schema
+      type: object
+      properties:
+        image:
+          type: string
+          not:
+            pattern: ^quay.io
+```
+
+## Available Options
+All custom checks should go under the `customChecks` field in your Polaris config, keyed by the
+check ID. Note that you'll also have to set its severity in the `checks` section of your Polaris config.
+
+* `successMessage` - the message to show when the check succeeds
+* `failureMessage` - the message to show when the check fails
+* `category` - one of `Security`, `Efficiency`, or `Reliability`
+* `target` - specifies the type of resource to check. This can be:
+  * a group and kind, e.g. `apps/Deployment` or `networking.k8s.io/Ingress`
+  * `Controller`, to check _any_ resource that creates Pods (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
+  * `PodTemplate`, same as `Controller`, but the schema applies to the Pod template rather than the top-level controller
+  * `PodSpec`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
+  * `Container` same as `Controller`, but the schema applies to all Container specs rather than the top-level controller
+* `controllers` - if `target` is `Controller`, `PodSpec` or `Container`, you can use this to change which types of controllers are checked
+* `controllers.include` - _only_ check these controllers
+* `controllers.exclude` - check all controllers except these
+* `containers` - if `target` is `Container`, you can use this to decide if `initContainers`, `containers`, or both should be checked
+* `containers.exclude` - can be set to a list including `initContainer` or `container`
+* `schema` - the JSON Schema to check against, as a YAML object
+* `schemaString` - this JSON Schema to check against, as a YAML or JSON string. See [Templating](#templating) below
+  * Note: only _one_ of `schema` and `schemaString` can be specified.
+* `additionalSchemas` - see [Multi-Resource Checks](#multi-resource-checks) below
+* `additionalSchemaStrings` - see [Multi-Resource Checks](#multi-resource-checks) below
+  * Note: only _one_ of `additionalSchemas` and `additionalSchemaStrings` can be specified.
+
+## Checking CPU and Memory
+We extend JSON Schema with `resourceMinimum` and `resourceMaximum` fields to help compare memory and CPU resource
+strings like `1000m` and `1G`. Here's an example check that memory and CPU falls within a certain range.
+```yaml
+customChecks:
+  resourceLimits:
+    containers:
+      exclude:
+      - initContainer
+    successMessage: Resource limits are within the required range
+    failureMessage: Resource limits should be within the required range
+    category: Resources
+    target: Container
+    schema:
+      '$schema': https://json-schema.org/draft/2019-09/schema
+      type: object
+      required:
+      - resources
+      properties:
+        resources:
+          type: object
+          required:
+          - limits
+          properties:
+            limits:
+              type: object
+              required:
+              - memory
+              - cpu
+              properties:
+                memory:
+                  type: string
+                  resourceMinimum: 100M
+                  resourceMaximum: 6G
+                cpu:
+                  type: string
+                  resourceMinimum: 100m
+                  resourceMaximum: "2"
+```
+
+## Resource Presence
+You can test for the presence of a resource in each Namespace. For example, to
+ensure an AlertmanagerConfig is in every Namespace:
+```yaml
+successMessage: Namespace has monitoring configuration
+failureMessage: Namespace should have monitoring configuration
+category: Security
+target: Namespace
+schema: {}
+additionalSchemas:
+  monitoring.coreos.com/AlertmanagerConfig: {}
+```
+
+## Templating
+You can also utilize go templating in your JSON schema in order to match one field against another.
+E.g. here is the built-in check to ensure that the `name` annotation matches the object's name:
+```yaml
+successMessage: Label app.kubernetes.io/name matches metadata.name
+failureMessage: Label app.kubernetes.io/name must match metadata.name
+target: Controller
+schema:
+  '$schema': https://json-schema.org/draft/2019-09/schema
+  type: object
+  properties:
+    metadata:
+      type: object
+      required: ["labels"]
+      properties:
+        labels:
+          type: object
+          required: ["app.kubernetes.io/name"]
+          properties:
+            app.kubernetes.io/name:
+              const: "{{ .metadata.name }}"
+```
+
+* The object available via the go template is the full object, and not limited by `target`.
+* A check of `target: PodSpec` can directly access the pod specification via the go template variable `.Polaris.PodSpec`.
+* A check of `target: PodTemplate` can directly access the pod template via the go template variable `.Polaris.PodTemplate`.
+* A check of `target: Container` can directly access the container being checked via the go template variable `.Polaris.container`. The pod template and pod specification can also be accessed via the respective variables `.Polaris.PodTemplate` and `.Polaris.PodSpec`. Access to pod-level fields allows a container check to consult related fields from the pod, such as `securityContext`.
+
+You can also use the full [Go template syntax](https://golang.org/pkg/text/template/), though
+you may need to specify your schema as a string in order to use concepts like `range`. E.g.
+this check ensures that at least one of the object's labels is present in `matchLabels`:
+```yaml
+schemaString: |
+  type: object
+  properties:
+    spec:
+      type: object
+      required: ["selector"]
+      properties:
+        selector:
+          type: object
+          required: ["matchLabels"]
+          properties:
+            matchLabels:
+              type: object
+              anyOf:
+              {{ range $key, $value := .metadata.labels }}
+              - properties:
+                  "{{ $key }}":
+                    type: string
+                    const: {{ $value }}
+                required: ["{{ $key }}"]
+              {{ end }}
+```
+
+### Additional Go Template Functions
+
+These functions are also available in the GO template.
+
+* [hasPrefix](https://pkg.go.dev/strings#HasPrefix) - for example, `hasPrefix "string" "prefix"`
+* [hasSuffix](https://pkg.go.dev/strings#HasSuffix) - for example, `hasSuffix "string" "suffix"`
+
+For example, the `hasPrefix` function can be used in a template to determine whether a resource name starts with `system:`
+```
+{{ if hasPrefix .metadata.name "system:" }}
+```
+
+## Multi-Resource Checks
+You can write checks that span multiple resources. This is helpful for ensuring e.g.
+that every Deployment has a PDB or an HPA associated with it.
+
+Here's the check to ensure that every Deployment has a PDB:
+```yaml
+successMessage: A PodDisruptionBudget is attached
+failureMessage: Should have a PodDisruptionBudget
+category: Reliability
+target: Controller
+controllers:
+  include:
+  - Deployment
+schema:
+  '$schema': https://json-schema.org/draft/2019-09/schema
+  type: object
+  properties:
+    metadata:
+      type: object
+      properties:
+        labels:
+          type: object
+          minProperties: 1
+additionalSchemaStrings:
+  policy/PodDisruptionBudget: |
+    type: object
+    properties:
+      spec:
+        type: object
+        required: ["selector"]
+        properties:
+          selector:
+            type: object
+            required: ["matchLabels"]
+            properties:
+              matchLabels:
+                type: object
+                anyOf:
+                {{ range $key, $value := .metadata.labels }}
+                - properties:
+                    "{{ $key }}":
+                      type: string
+                      const: {{ $value }}
+                  required: ["{{ $key }}"]
+                {{ end }}
+```
+
+## JSON vs YAML
+Schemas can also be specified as JSON strings instead of YAML, for easier copy/pasting:
+```yaml
+customChecks:
+  foo:
+    jsonSchema: |
+      {
+        "$schema": "https://json-schema.org/draft/2019-09/schema",
+        "type": "object"
+      }
+```
+

docs/customization/exemptions.md

@@ -0,0 +1,61 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Exemptions"
+---
+# Exemptions
+Sometimes a workload really does need to do things that Polaris considers insecure. For instance,
+many of the `kube-system` workloads need to run as root, or need access to the host network. In these
+cases, we can add **exemptions** to allow the workload to pass Polaris checks.
+
+Exemptions can be added in a few different ways: 
+ - Namespace: By editing the Polaris config.
+ - Controller: By annotating a controller, or editing the Polaris config.
+ - Container: By editing the Polaris config.
+
+## Annotations
+To exempt a controller from all checks via annotations, use the annotation `polaris.fairwinds.com/exempt=true`, e.g.
+```
+kubectl annotate deployment my-deployment polaris.fairwinds.com/exempt=true
+```
+
+To exempt a controller from a particular check via annotations, use an annotation in the form of `polaris.fairwinds.com/<check>-exempt=true`, e.g.
+```
+kubectl annotate deployment my-deployment polaris.fairwinds.com/cpuRequestsMissing-exempt=true
+```
+
+## Config
+
+To add exemptions via the config, you have to specify at least one or more of the following: 
+- A namespace
+- A list of controller names
+- A list of container names
+
+You can also specify a list of particular rules. If no rules are specified then every rule is exempted. 
+
+Controller names and container names are matched as a prefix, so an empty string will match every controller or container respectively.
+
+For example:
+```yaml
+exemptions:
+  # exemption valid for all rules on all containers in all controllers in default namespace
+  - namespace: default
+  # exemption valid for hostNetworkSet rule on all containers in dns-controller controller in kube-system namespace
+  - namespace: kube-system
+    controllerNames:
+      - dns-controller
+    rules:
+      - hostNetworkSet
+  # exemption valid for hostNetworkSet rule on all containers in dns-controller controller in all namespaces
+  - controllerNames:
+      - dns-controller
+    rules:
+      - hostNetworkSet
+  # exemption valid for hostNetworkSet rule on coredns container in all controllers in kube-system namespace
+  - namespace: kube-system
+  - containerNames:
+      - coredns
+    rules:
+      - hostNetworkSet
+```
+

docs/dashboard.md

@@ -0,0 +1,55 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Ways to run Polaris | The Polaris dashboard can be installed on a cluster using kubectl or Helm"
+---
+# Dashboard
+
+> Want to see Polaris results for all your clusters in a single dashboard? Check out
+> [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
+
+The Polaris dashboard can be installed on a cluster using kubectl or Helm. It
+can also be run locally, connecting to your cluster using the credentials stored in your `KUBECONFIG`.
+
+The dashboard is a good way to understand what workloads inside your cluster or Infrastructure as Code
+don't conform to best practices.
+
+## Installation
+
+### Helm
+```bash
+helm repo add fairwinds-stable https://charts.fairwinds.com/stable
+helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris --create-namespace
+kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
+```
+
+### Local Binary
+You'll need a valid `KUBECONFIG` set up for the dashboard to connect to your cluster.
+
+Binary releases can be dowloaded from the [releases page](https://github.com/fairwindsops/polaris/releases)
+or can be installed with [Homebrew](https://brew.sh/):
+```bash
+brew tap reactiveops/tap
+brew install reactiveops/tap/polaris
+polaris dashboard --port 8080
+```
+
+You can also point the dashboard to the local filesystem, instead of a live cluster:
+```bash
+polaris dashboard --port 8080 --audit-path=./deploy/
+```
+
+### Local Docker container
+
+```
+docker run -d -p8080:8080 -v ~/.kube/config:/opt/app/config:ro  quay.io/fairwinds/polaris:1.2 polaris dashboard --kubeconfig /opt/app/config
+```
+
+##  Using the Dashboard
+The Polaris dashboard is a way to get a simple visual overview of the current state of your Kubernetes workloads as well as a roadmap for what can be improved. The dashboard provides a cluster wide overview as well as breaking out results by category, namespace, and workload.
+
+<p align="center">
+  <img src="/img/dashboard-screenshot.png" alt="Polaris Dashboard" width="550"/>
+</p>
+
+Our default standards in Polaris are rather high, so don’t be surprised if your score is lower than you might expect. A key goal for Polaris was to set a high standard and aim for great configuration by default. If the defaults we’ve included are too strict, it’s easy to adjust the configuration as part of the deployment configuration to better suit your workloads.

docs/health-checks.md

@@ -1,22 +0,0 @@
-# Health Checks
-
-Polaris supports validating the presence of readiness and liveness probes in pods.
-
-key | default | description
-----|---------|------------
-`healthChecks.readinessProbeMissing` | `warning` | Fails when a readiness probe is not configured for a pod.
-`healthChecks.livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
-
-## Background
-
-Readiness and liveness probes can help maintain the health of applications running inside Kubernetes. By default, Kubernetes only knows whether or not a process is running, not if it's healthy. Properly configured readiness and liveness probes will also be able to ensure the health of an application.
-
-Readiness probes are designed to ensure that an application has reached a "ready" state. In many cases there is a period of time between when a webserver process starts and when it is ready to receive traffic. A readiness probe can ensure the traffic is not sent to a pod until it is actually ready to receive traffic.
-
-Liveness probes are designed to ensure that an application stays in a healthy state. When a liveness probe fails, the pod will be restarted.
-
-## Further Reading
-
-- [Kubernetes Docs: Configure Livenss and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
-- [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
-- [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)

docs/images.md

@@ -1,19 +0,0 @@
-# Images
-
-Polaris supports a number of checks related to the image specified by pods.
-
-key | default | description
-----|---------|------------
-`images.tagNotSpecified` | `error` | Fails when an image tag is either not specified or `latest`.
-`images.pullPolicyNotAlways` | `ignore` | Fails when an image pull policy is not `always`.
-
-## Background
-
-Docker's `latest` tag is applied by default to images where a tag hasn't been specified. Not specifying a specific version of an image can lead to a wide variety of problems. The underlying image could include unexpected breaking changes that break your application whenever the latest image is pulled. Reusing the same tag for multiple versions of an image can lead to different nodes in the same cluster having different versions of an image, even if the tag is identical.
-
-Related to that, relying on cached versions of a Docker image can become a security vulnerability. By default, an image will be pulled if it isn't already cached on the node attempting to run it. This can result in variations in images that are running per node, or potentially provide a way to gain access to an image without having direct access to the ImagePullSecret. With that in mind, it's often better to ensure the a pod has `pullPolicy: Always` specified, so images are always pulled directly from their source. This is not a check enabled by default with Polaris as organizations may not wish to add the overhead involved with pulling images for each pod.
-
-## Further Reading
-
-- [What's Wrong With The Docker :latest Tag?](https://vsupalov.com/docker-latest-tag/)
-- [Kubernetes’ AlwaysPullImages Admission Control — the Importance, Implementation, and Security Vulnerability in its Absence](https://medium.com/@trstringer/kubernetes-alwayspullimages-admission-control-the-importance-implementation-and-security-d83ff3815840)

docs/infrastructure-as-code.md

@@ -0,0 +1,134 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation | Polaris can be used on the command line to audit local Kubernetes manifests stored in YAML files."
+---
+# Infrastructure as Code
+> Want to see results for all your IaC repos in one place? Check out
+> [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
+
+Polaris can be used on the command line to audit local Kubernetes manifests stored in YAML files.
+This is particularly helpful for running Polaris against your infrastructure-as-code as part of a
+CI/CD pipeline. Use the available [command line flags](#running-in-a-ci-pipeline)
+to cause CI/CD to fail if your Polaris score drops below a certain threshold, or if any danger-level issues arise.
+
+
+## Install the CLI
+To run Polaris against your YAML manifests, e.g. as part of a Continuous Integration process,
+you'll need to install the CLI.
+
+Binary releases can be downloaded from the [releases page](https://github.com/fairwindsops/polaris/releases)
+or can be installed with [Homebrew](https://brew.sh/):
+```bash
+brew tap FairwindsOps/tap
+brew install FairwindsOps/tap/polaris
+polaris version
+```
+
+## Checking Infrastructure as Code files
+You can audit Kubernetes YAML files by running:
+```bash
+polaris audit --audit-path ./deploy/ --format=pretty
+```
+This will print out any issues Polaris finds in your manifests.
+
+Polaris can only check raw YAML manifests. If you'd like to check a Helm template,
+you can run `helm template` to generate a manifest that Polaris can check.
+
+## Fixing Issues
+Polaris can automatically fix many of the issues it finds. For example, you can run
+```bash
+polaris fix --files-path ./deploy/ --checks=all
+```
+
+to fix any issues inside the `deploy` directory. Polaris may leave
+comments next to some changes (e.g. liveness and readiness probes) prompting
+the user to set them to something more appropriate given the context of their
+application.
+
+Note that not all issues can be automatically fixed.
+
+Currently only raw YAML manifests can be mutated. Helm charts etc.
+still need to be changed manually.
+
+## Running in a CI pipeline
+
+### Set minimum score for an exit code
+You can tell the CLI to set an exit code if it detects certain issues with your YAML files.
+For example, to fail if polaris detects *any* danger-level issues, or if the score drops below 90%:
+```bash
+polaris audit --audit-path ./deploy/ \
+  --set-exit-code-on-danger \
+  --set-exit-code-below-score 90
+```
+
+### Pretty-print results
+By default, results are output as JSON. You can get human-readable output with
+the `--format=pretty` flag:
+
+```bash
+polaris audit --audit-path ./deploy/ \
+  --format=pretty
+```
+
+You can also disable colors and emoji:
+```bash
+polaris audit --audit-path ./deploy/ \
+  --format=pretty \
+  --color=false
+```
+
+### Output only showing failed tests
+The CLI to gives you ability to display results containing only failed tests. 
+For example:
+```bash
+polaris audit --audit-path ./deploy/ \
+  --only-show-failed-tests true
+```
+
+### Audit Helm Charts
+You can audit helm charts using the `--helm-chart` and `--helm-values` flags:
+```
+polaris audit \
+  --helm-chart ./deploy/chart \
+  --helm-values ./deploy/chart/values.yml
+```
+
+### As Github Action
+#### Setup polaris action
+
+This action downloads a version of [polaris](https://github.com/FairwindsOps/polaris) and adds it to the path. It makes the [polaris cli](https://polaris.docs.fairwinds.com/infrastructure-as-code) ready to use in following steps of the same job.
+
+##### Inputs
+
+###### `version`
+
+The release version to fetch. This has to be in the form `<tag_name>`.
+
+##### Outputs
+
+###### `version`
+
+The version number of the release tag.
+
+##### Example usage
+
+```yaml
+uses: fairwindsops/polaris/.github/actions/setup-polaris@master
+with:
+  version: 5.0.0
+```
+
+Example inside a job:
+
+```yaml
+steps:
+  - uses: actions/checkout@v2
+  - name: Setup polaris
+    uses: fairwindsops/polaris/.github/actions/setup-polaris@master
+    with:
+      version: 5.0.0
+
+  - name: Use command
+    run: polaris version
+```

docs/main-metadata.md

@@ -0,0 +1,5 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation"
+---

docs/networking.md

@@ -1,22 +0,0 @@
-# Networking
-
-Polaris supports a number of checks related to pod networking.
-
-key | default | description
-----|---------|------------
-`networking.hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
-`networking.hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
-
-
-## Background
-
-Although Kubernetes allows you to deploy a pod with access to the host network namespace, it's rarely a good idea. A pod running with the `hostNetwork` attribute enabled will have access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. There are certain examples where setting `hostNetwork` to true is required, such as deploying a networking plugin like Flannel.
-
-Setting the `hostPort` attribute on a container will ensure that it is accessible on that specific port on each node it is deployed to. Unfortunately when this is specified, it limits where a pod can actually be scheduled in a cluster.
-
-
-## Further Reading
-
-- [Kubernetes Docs: Configuration Best Practices](https://kubernetes.io/docs/concepts/configuration/overview/#services)
-
-- [Accessing Kubernetes Pods from Outside of the Cluster](http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster/)

docs/package.json

@@ -0,0 +1,36 @@
+{
+  "author": "",
+  "bugs": {
+    "url": "https://github.com/FairwindsOps/insights-docs/issues"
+  },
+  "dependencies": {
+    "vuepress-plugin-check-md": "0.0.2"
+  },
+  "description": "A repository with a Vuepress template for Fairwinds projects",
+  "devDependencies": {
+    "vuepress": "^1.9.7",
+    "vuepress-plugin-clean-urls": "^1.1.1",
+    "vuepress-plugin-redirect": "^1.2.5"
+  },
+  "directories": {
+    "doc": "docs"
+  },
+  "homepage": "https://github.com/FairwindsOps/insights-docs#readme",
+  "license": "MIT",
+  "main": "index.js",
+  "name": "fairwinds-docs-template",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/FairwindsOps/insights-docs.git"
+  },
+  "scripts": {
+    "build": "npm run build:readme && npm run build:docs",
+    "build:docs": "vuepress build -d ../dist/",
+    "build:metadata": "cat main-metadata.md > README.md || true",
+    "build:readme": "npm run build:metadata && cat ../README.md | grep -v 'ocumentation' | sed \"s/https:\\/\\/\\w\\+.docs.fairwinds.com//g\" >> README.md",
+    "check-links": "vuepress check-md",
+    "serve": "npm run build:readme && vuepress dev --port 3003",
+    "vuepress": "vuepress"
+  },
+  "version": "0.0.1"
+}

docs/resources.md

@@ -1,41 +0,0 @@
-# Resources
-
-Polaris supports a number of checks related to CPU and Memory requests and limits.
-
-## Presence Checks
-
-To simplify ensure that these values have been set, the following attributes are available:
-
-key | default | description
-----|---------|------------
-`resources.cpuRequestsMissing` | `error` | Fails when `resources.requests.cpu` attribute is not configured.
-`resources.memoryRequestsMissing` | `error` | Fails when `resources.requests.memory` attribute is not configured.
-`resources.cpuLimitsMissing` | `error` | Fails when `resources.limits.cpu` attribute is not configured.
-`resources.memoryLimitsMissing` | `error` | Fails when `resources.limits.memory` attribute is not configured.
-
-## Range Checks
-
-Polaris can also verify that those values fall within a certain range. These checks are not enabled by default, and as such do not have default values. The `cpuRequestRanges`, `cpuLimitRanges`, `memoryRequestRanges`, and `memoryLimitRanges` all support the following attributes:
-
-key | description
-----|------------
-`warning.below` | Warn when resource is below this value (or not defined)
-`warning.above` | Warn when resource is above this value
-`error.below` | Error when resource is below this value (or not defined)
-`error.above` | Error when resource is above this value
-
-## Background
-
-Configuring resource requests and limits for containers running in Kubernetes is an important best practice to follow. Setting appropriate resource requests will ensure that all your applications have sufficient compute resources. Setting appropriate resource limits will ensure that your applications do not consume too many resources.
-
-Having these values appropriately configured ensures that:
-
-* Cluster autoscaling can function as intended. New nodes are scheduled once pods are unable to be scheduled on an existing node due to insufficient resources. This will not happen if resource requests are not configured.
-
-* Each container has sufficient access to compute resources. Without resource requests, a pod may be scheduled on a node that is already overutilized. Without resource limits, a single poorly behaving pod could utilize the majority of resources on a node, significantly impacting the performance of other pods on the same node.
-
-## Further Reading
-
-- [Kubernetes Docs: Managing Compute Resources for Containers](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
-- [Kubernetes best practices: Resource requests and limits](https://cloud.google.com/blog/products/gcp/kubernetes-best-practices-resource-requests-and-limits)
-- [Vertical Pod Autoscaler (can automatically set resource requests and limits)](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler)

docs/security-capabilities.md

@@ -1,23 +0,0 @@
-# Security Capabilities
-
-Polaris supports a number of checks to ensure pods are running with a limited set of capabilities. Under `security.capabilities`, there are `error` and `warning` sections indicating the severity of failures for the following checks.
-
-key | default | description
-----|---------|------------
-`security.capabilities.error.ifAnyAdded` | [`SYS_ADMIN`, `NET_ADMIN`, `ALL`] | Fails when any of the listed capabilities have been added.
-`security.capabilities.error.ifAnyAddedBeyond` | `nil` | Fails when any capabilities have been added beyond the specified list.
-`security.capabilities.error.ifAnyNotDropped` | `nil` | Fails when any of the listed capabilities have not been dropped.
-`security.capabilities.warning.ifAnyAdded` | `nil` | Fails when any of the listed capabilities have been added.
-`security.capabilities.warning.ifAnyAddedBeyond` | [`CHOWN`, `DAC_OVERRIDE`, `FSETID`, `FOWNER`, `MKNOD`, `NET_RAW`, `SETGID`, `SETUID`, `SETFCAP`, `SETPCAP`, `NET_BIND_SERVICE`, `SYS_CHROOT`, `KILL`,`AUDIT_WRITE`] | Fails when any capabilities have been added beyond the specified list.
-`security.capabilities.warning.ifAnyNotDropped` | `nil` | Fails when any of the listed capabilities have not been dropped.
-
-## Background
-
-Linux Capabilities allow you to specify privileges for a process at a granular level. The [default list of capabilities](https://github.com/moby/moby/blob/master/oci/defaults.go#L15) included with a container are already fairly minimal, but often can be further restricted.
-
-With Kubernetes configuration, these capabilities can be added or removed by adjusting `securityContext.capabilities`.
-
-## Further Reading
-
-- [Kubernetes Docs: Set capabilities for a Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container)
-- [Linux Programmer's Manual: Capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html)

docs/security.md

@@ -1,27 +0,0 @@
-# Security
-
-Polaris supports a number of checks related to security.
-
-key | default | description
-----|---------|------------
-`security.hostIPCSet` | `error` | Fails when `hostIPC` attribute is configured.
-`security.hostPIDSet` | `error` | Fails when `hostPID` attribute is configured.
-`security.notReadOnlyRootFileSystem` | `warning` | Fails when `securityContext.readOnlyRootFilesystem` is not true.
-`security.privilegeEscalationAllowed` | `error` | Fails when `securityContext.allowPrivilegeEscalation` is true.
-`security.runAsRootAllowed` | `error` | Fails when `securityContext.runAsNonRoot` is not true.
-`security.runAsPrivileged` | `error` | Fails when `securityContext.privileged` is true.
-
-## Security Capabilities
-
-Additional validations are available to ensure pods are running with a limited set of capabilities. More information is available in our [Security Capabilities documentation](security-capabilities.md).
-
-## Background
-
-Securing workloads in Kubernetes is an important part of overall cluster security. The overall goal should be to ensure that containers are running with as minimal privileges as possible. This includes avoiding privilege escalation, not running containers with a root user, and using read only file systems wherever possible.
-
-Much of this configuration can be found in the `securityContext` attribute for both Kubernetes pods and containers. Where configuration is available at both a pod and container level, Polaris validates both.
-
-## Further Reading
-- [Kubernetes Docs: Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
-- [KubeCon 2018 Keynote: Running with Scissors](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
-- [Kubernetes Security Book](https://kubernetes-security.info/)

examples/failing-deployment.yaml

@@ -1,29 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: polaris-failing-deployment
-  labels:
-    app: polaris-failing-deployment
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: polaris-failing-deployment
-  template:
-    metadata:
-      labels:
-        app: polaris-failing-deployment
-    spec:
-      containers:
-      - name: this-will-fail
-        image: 'alpine'
-        command: [ "/bin/sh", "-c", "--" ]
-        args: [ "while true; do sleep 30; done;" ]
-        securityContext:
-          privileged: true
-          allowPrivilegeEscalation: true
-          readOnlyRootFilesystem: false
-          runAsNonRoot: false
-          capabilities:
-            add:
-              - ALL

examples/passing-deployment.yaml

@@ -1,52 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: polaris-passing-deployment
-  labels:
-    app: polaris-passing-deployment
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: polaris-passing-deployment
-  template:
-    metadata:
-      labels:
-        app: polaris-passing-deployment
-    spec:
-      containers:
-        - command:
-            - polaris
-            - --dashboard
-          image: 'quay.io/reactiveops/polaris:0.1.0'
-          imagePullPolicy: 'Always'
-          name: dashboard
-          ports:
-            - containerPort: 8080
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 20
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 20
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 100m
-              memory: 128Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL

fairwinds-insights.yaml

@@ -0,0 +1,7 @@
+options:
+  organization: fairwinds-production
+  baseBranch: master
+
+images:
+  docker:
+  - quay.io/fairwinds/polaris:$CI_SHA1

go.mod

@@ -0,0 +1,76 @@
+module github.com/fairwindsops/polaris
+
+go 1.24.4
+
+require (
+	github.com/fairwindsops/controller-utils v0.3.4
+	github.com/fatih/color v1.18.0
+	github.com/gorilla/mux v1.8.1
+	github.com/pkg/errors v0.9.1
+	github.com/qri-io/jsonpointer v0.1.1
+	github.com/qri-io/jsonschema v0.2.1
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.9.1
+	github.com/stretchr/testify v1.10.0
+	github.com/thoas/go-funk v0.9.3
+	gomodules.xyz/jsonpatch/v2 v2.5.0
+	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/api v0.33.1
+	k8s.io/apimachinery v0.33.1
+	k8s.io/client-go v0.33.1
+	sigs.k8s.io/controller-runtime v0.21.0
+	sigs.k8s.io/yaml v1.4.0
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.64.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/samber/lo v1.51.0 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/term v0.33.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/apiextensions-apiserver v0.33.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
+)

go.sum

@@ -0,0 +1,224 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
+github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/fairwindsops/controller-utils v0.3.4 h1:t1qulL2GVDVUJTIE4icpBy3KnsxFTavnNAbFnd60blc=
+github.com/fairwindsops/controller-utils v0.3.4/go.mod h1:9/hOHX70/LG40RgtFAjtXFiMWEpItqm6Scf+obRFB2Y=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
+github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
+github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
+github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.64.0 h1:pdZeA+g617P7oGv1CzdTzyeShxAGrTBsolKNOLQPGO4=
+github.com/prometheus/common v0.64.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
+github.com/qri-io/jsonpointer v0.1.1 h1:prVZBZLL6TW5vsSB9fFHFAMBLI4b0ri5vribQlTJiBA=
+github.com/qri-io/jsonpointer v0.1.1/go.mod h1:DnJPaYgiKu56EuDp8TU5wFLdZIcAnb/uH9v37ZaMV64=
+github.com/qri-io/jsonschema v0.2.1 h1:NNFoKms+kut6ABPf6xiKNM5214jzxAhDBrPHCJ97Wg0=
+github.com/qri-io/jsonschema v0.2.1/go.mod h1:g7DPkiOsK1xv6T/Ao5scXRkd+yTFygcANPBaaqW+VrI=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/samber/lo v1.51.0 h1:kysRYLbHy/MB7kQZf5DSN50JHmMsNEdeY24VzJFu7wI=
+github.com/samber/lo v1.51.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
+github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
+github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/thoas/go-funk v0.9.3 h1:7+nAEx3kn5ZJcnDm2Bh23N2yOtweO14bi//dvRtgLpw=
+github.com/thoas/go-funk v0.9.3/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
+gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/api v0.33.1 h1:tA6Cf3bHnLIrUK4IqEgb2v++/GYUtqiu9sRVk3iBXyw=
+k8s.io/api v0.33.1/go.mod h1:87esjTn9DRSRTD4fWMXamiXxJhpOIREjWOSjsW1kEHw=
+k8s.io/apiextensions-apiserver v0.33.1 h1:N7ccbSlRN6I2QBcXevB73PixX2dQNIW0ZRuguEE91zI=
+k8s.io/apiextensions-apiserver v0.33.1/go.mod h1:uNQ52z1A1Gu75QSa+pFK5bcXc4hq7lpOXbweZgi4dqA=
+k8s.io/apimachinery v0.33.1 h1:mzqXWV8tW9Rw4VeW9rEkqvnxj59k1ezDUl20tFK/oM4=
+k8s.io/apimachinery v0.33.1/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/client-go v0.33.1 h1:ZZV/Ks2g92cyxWkRRnfUDsnhNn28eFpt26aGc8KbXF4=
+k8s.io/client-go v0.33.1/go.mod h1:JAsUrl1ArO7uRVFWfcj6kOomSlCv+JpvIsp6usAGefA=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a h1:ZV3Zr+/7s7aVbjNGICQt+ppKWsF1tehxggNfbM7XnG8=
+k8s.io/kube-openapi v0.0.0-20250610211856-8b98d1ed966a/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
+sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

main.go

@@ -1,4 +1,4 @@
-// Copyright 2019 ReactiveOps
+// Copyright 2019 FairwindsOps Inc
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -15,256 +15,16 @@
 package main
 
 import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"strings"
-
-	"github.com/gorilla/mux"
-	conf "github.com/reactiveops/polaris/pkg/config"
-	"github.com/reactiveops/polaris/pkg/dashboard"
-	"github.com/reactiveops/polaris/pkg/kube"
-	"github.com/reactiveops/polaris/pkg/validator"
-	fwebhook "github.com/reactiveops/polaris/pkg/webhook"
-	"github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v2"
-	appsv1 "k8s.io/api/apps/v1"
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	apitypes "k8s.io/apimachinery/pkg/types"
-	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
-	"sigs.k8s.io/controller-runtime/pkg/client/config"
-	"sigs.k8s.io/controller-runtime/pkg/manager"
-	"sigs.k8s.io/controller-runtime/pkg/runtime/signals"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	cmd "github.com/fairwindsops/polaris/cmd/polaris"
 )
 
-const (
-	// Version represents the current release version of Polaris
-	Version = "0.1.0"
+var (
+	// Version is set during build
+	Version = "development"
+	// Commit is set during build
+	Commit = ""
 )
 
 func main() {
-	dashboard := flag.Bool("dashboard", false, "Runs the webserver for Polaris dashboard.")
-	webhook := flag.Bool("webhook", false, "Runs the webhook webserver.")
-	audit := flag.Bool("audit", false, "Runs a one-time audit.")
-	auditPath := flag.String("audit-path", "", "If specified, audits one or more YAML files instead of a cluster")
-	dashboardPort := flag.Int("dashboard-port", 8080, "Port for the dashboard webserver")
-	webhookPort := flag.Int("webhook-port", 9876, "Port for the webhook webserver")
-	auditOutputURL := flag.String("output-url", "", "Destination URL to send audit results")
-	auditOutputFile := flag.String("output-file", "", "Destination file for audit results")
-	configPath := flag.String("config", "config.yaml", "Location of Polaris configuration file")
-	logLevel := flag.String("log-level", logrus.InfoLevel.String(), "Logrus log level")
-	version := flag.Bool("version", false, "Prints the version of Polaris")
-	disableWebhookConfigInstaller := flag.Bool("disable-webhook-config-installer", false,
-		"disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping")
-
-	flag.Parse()
-
-	if *version {
-		fmt.Printf("Polaris version %s\n", Version)
-		os.Exit(0)
-	}
-
-	parsedLevel, err := logrus.ParseLevel(*logLevel)
-	if err != nil {
-		logrus.Errorf("log-level flag has invalid value %s", *logLevel)
-	} else {
-		logrus.SetLevel(parsedLevel)
-	}
-
-	c, err := conf.ParseFile(*configPath)
-	if err != nil {
-		logrus.Errorf("Error parsing config at %s: %v", *configPath, err)
-		os.Exit(1)
-	}
-
-	if !*dashboard && !*webhook && !*audit {
-		*audit = true
-	}
-
-	if *webhook {
-		startWebhookServer(c, *disableWebhookConfigInstaller, *webhookPort)
-	} else if *dashboard {
-		k, _ := kube.CreateResourceProvider(*auditPath)
-		startDashboardServer(c, k, *dashboardPort)
-	} else if *audit {
-		k, _ := kube.CreateResourceProvider(*auditPath)
-		runAudit(c, k, *auditOutputFile, *auditOutputURL)
-	}
-}
-
-func startDashboardServer(c conf.Configuration, k *kube.ResourceProvider, port int) {
-	router := mux.NewRouter()
-	router.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte("OK"))
-	})
-	router.HandleFunc("/results.json", func(w http.ResponseWriter, r *http.Request) {
-		dashboard.EndpointHandler(w, r, c, k)
-	})
-	router.HandleFunc("/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
-		http.ServeFile(w, r, "pkg/dashboard/assets/favicon-32x32.png")
-	})
-	router.HandleFunc("/details/{category}", func(w http.ResponseWriter, r *http.Request) {
-		vars := mux.Vars(r)
-		category := vars["category"]
-		category = strings.Replace(category, ".md", "", -1)
-		dashboard.DetailsHandler(w, r, category)
-	})
-	fileServer := http.FileServer(dashboard.GetAssetBox())
-	router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/" {
-			http.NotFound(w, r)
-			return
-		}
-		auditData, err := validator.RunAudit(c, k)
-		if err != nil {
-			logrus.Errorf("Error getting audit data: %v", err)
-			http.Error(w, "Error running audit", 500)
-			return
-		}
-		dashboard.MainHandler(w, r, auditData)
-	})
-	http.Handle("/static/", http.StripPrefix("/static/", fileServer))
-	http.Handle("/", router)
-
-	logrus.Infof("Starting Polaris dashboard server on port %d", port)
-	logrus.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", port), nil))
-}
-
-func startWebhookServer(c conf.Configuration, disableWebhookConfigInstaller bool, port int) {
-	logrus.Debug("Setting up controller manager")
-	mgr, err := manager.New(config.GetConfigOrDie(), manager.Options{})
-	if err != nil {
-		logrus.Errorf("Unable to set up overall controller manager: %v", err)
-		os.Exit(1)
-	}
-
-	polarisAppName := "polaris"
-	polarisResourceName := "polaris-webhook"
-	polarisNamespaceBytes, err := ioutil.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace")
-
-	if err != nil {
-		// Not exiting here as we have fallback options
-		logrus.Debugf("Error reading namespace information: %v", err)
-	}
-
-	polarisNamespace := string(polarisNamespaceBytes)
-	if polarisNamespace == "" {
-		polarisNamespace = polarisResourceName
-		logrus.Debugf("Could not determine current namespace, creating resources in %s namespace", polarisNamespace)
-	}
-
-	logrus.Info("Setting up webhook server")
-	as, err := webhook.NewServer(polarisResourceName, mgr, webhook.ServerOptions{
-		Port:                          int32(port),
-		CertDir:                       "/opt/cert",
-		DisableWebhookConfigInstaller: &disableWebhookConfigInstaller,
-		BootstrapOptions: &webhook.BootstrapOptions{
-			ValidatingWebhookConfigName: polarisResourceName,
-			Secret: &apitypes.NamespacedName{
-				Namespace: polarisNamespace,
-				Name:      polarisResourceName,
-			},
-
-			Service: &webhook.Service{
-				Namespace: polarisNamespace,
-				Name:      polarisResourceName,
-
-				// Selectors should select the pods that runs this webhook server.
-				Selectors: map[string]string{
-					"app":       polarisAppName,
-					"component": "webhook",
-				},
-			},
-		},
-	})
-
-	if err != nil {
-		logrus.Errorf("Error setting up webhook server: %v", err)
-		os.Exit(1)
-	}
-
-	logrus.Infof("Polaris webhook server listening on port %d", port)
-
-	d1 := fwebhook.NewWebhook("deployments", mgr, fwebhook.Validator{Config: c}, &appsv1.Deployment{})
-	d2 := fwebhook.NewWebhook("deployments-ext", mgr, fwebhook.Validator{Config: c}, &extensionsv1beta1.Deployment{})
-	logrus.Debug("Registering webhooks to the webhook server")
-	if err = as.Register(d1, d2); err != nil {
-		logrus.Debugf("Unable to register webhooks in the admission server: %v", err)
-		os.Exit(1)
-	}
-
-	logrus.Debug("Starting webhook manager")
-	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
-		logrus.Errorf("Error starting manager: %v", err)
-		os.Exit(1)
-	}
-}
-
-func runAudit(c conf.Configuration, k *kube.ResourceProvider, outputFile string, outputURL string) {
-	auditData, err := validator.RunAudit(c, k)
-
-	if err != nil {
-		panic(err)
-	}
-
-	if outputURL == "" && outputFile == "" {
-		yamlBytes, err := yaml.Marshal(auditData)
-
-		if err != nil {
-			logrus.Errorf("Error marshalling YAML: %v", err)
-			os.Exit(1)
-		}
-
-		os.Stdout.Write(yamlBytes)
-
-	} else {
-		jsonData, err := json.MarshalIndent(auditData, "", "  ")
-
-		if err != nil {
-			logrus.Errorf("Error marshalling JSON: %v", err)
-			os.Exit(1)
-		}
-
-		if outputURL != "" {
-			req, err := http.NewRequest("POST", outputURL, bytes.NewBuffer(jsonData))
-
-			if err != nil {
-				logrus.Errorf("Error building request for output: %v", err)
-				os.Exit(1)
-			}
-
-			req.Header.Set("Content-Type", "application/json")
-			client := &http.Client{}
-			resp, err := client.Do(req)
-
-			if err != nil {
-				logrus.Errorf("Error making request for output: %v", err)
-				os.Exit(1)
-			}
-
-			defer resp.Body.Close()
-
-			body, err := ioutil.ReadAll(resp.Body)
-
-			if err != nil {
-				logrus.Errorf("Error reading response: %v", err)
-				os.Exit(1)
-			}
-
-			logrus.Infof("Received response: %v", body)
-		}
-
-		if outputFile != "" {
-			err := ioutil.WriteFile(outputFile, []byte(jsonData), 0644)
-			if err != nil {
-				logrus.Errorf("Error writing output to file: %v", err)
-				os.Exit(1)
-			}
-		}
-	}
+	cmd.Execute(Version)
 }

pkg/config/checks.go

@@ -0,0 +1,98 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package config
+
+import (
+	"embed"
+	"fmt"
+
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	// We explicitly set the order to avoid thrash in the
+	// tests as we migrate toward JSON schema
+	checkOrder = []string{
+		// Controller Checks
+		"deploymentMissingReplicas",
+		// Pod checks
+		"hostIPCSet",
+		"hostPathSet",
+		"hostProcess",
+		"hostPIDSet",
+		"hostNetworkSet",
+		"automountServiceAccountToken",
+		"topologySpreadConstraint",
+		// Container checks
+		"procMount",
+		"memoryLimitsMissing",
+		"memoryRequestsMissing",
+		"cpuLimitsMissing",
+		"cpuRequestsMissing",
+		"readinessProbeMissing",
+		"livenessProbeMissing",
+		"pullPolicyNotAlways",
+		"tagNotSpecified",
+		"hostPortSet",
+		"runAsRootAllowed",
+		"runAsPrivileged",
+		"notReadOnlyRootFilesystem",
+		"privilegeEscalationAllowed",
+		"dangerousCapabilities",
+		"insecureCapabilities",
+		"priorityClassNotSet",
+		"linuxHardening",
+		"sensitiveContainerEnvVar",
+		// Other checks
+		"tlsSettingsMissing",
+		"pdbDisruptionsIsZero",
+		"metadataAndInstanceMismatched",
+		"missingPodDisruptionBudget",
+		"missingNetworkPolicy",
+		"sensitiveConfigmapContent",
+		"clusterrolePodExecAttach",
+		"rolePodExecAttach",
+		"clusterrolebindingPodExecAttach",
+		"rolebindingClusterRolePodExecAttach",
+		"rolebindingRolePodExecAttach",
+		"clusterrolebindingClusterAdmin",
+		"rolebindingClusterAdminClusterRole",
+		"rolebindingClusterAdminRole",
+		"hpaMaxAvailability",
+		"hpaMinAvailability",
+		"pdbMinAvailableGreaterThanHPAMinReplicas",
+	}
+
+	// BuiltInChecks contains the checks that come pre-installed w/ Polaris
+	BuiltInChecks = map[string]SchemaCheck{}
+
+	//go:embed all:checks
+	checksFS embed.FS
+)
+
+func init() {
+	for _, checkID := range checkOrder {
+		contents, err := checksFS.ReadFile(fmt.Sprintf("checks/%s.yaml", checkID))
+		if err != nil {
+			panic(err)
+		}
+		check, err := ParseCheck(checkID, contents)
+		if err != nil {
+			logrus.Errorf("Error while parsing check %s", checkID)
+			panic(err)
+		}
+		BuiltInChecks[checkID] = check
+	}
+}

pkg/config/checks/automountServiceAccountToken.yaml

@@ -0,0 +1,35 @@
+successMessage: The ServiceAccount will not be automounted
+failureMessage: The ServiceAccount will be automounted
+category: Security
+target: PodSpec
+schema:
+  '$schema': https://json-schema.org/draft/2019-09/schema
+  type: object
+  properties:
+    serviceAccountName:
+      type: string
+    automountServiceAccountToken:
+      type: boolean
+      not:
+        const: true
+additionalSchemaStrings:
+  ServiceAccount: |
+    {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
+    type: object
+    required:
+      - metadata
+      - automountServiceAccountToken
+    properties:
+      metadata:
+        type: object
+        required: ["name"]
+        properties:
+          name:
+            type: string
+            const: "{{ .Polaris.PodSpec.serviceAccountName }}"
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
+      automountServiceAccountToken:
+        type: boolean
+        const: false
+      {{ end }}
+    {{ end }}

pkg/config/checks/clusterrolePodExecAttach.yaml

@@ -0,0 +1,54 @@
+successMessage: The ClusterRole does not allow pods/exec or pods/attach
+failureMessage: The ClusterRole allows Pods/exec or pods/attach
+category: Security
+target: rbac.authorization.k8s.io/ClusterRole
+schemaString: |
+  '$schema': https://json-schema.org/draft/2019-09/schema
+  type: object
+  required: ["metadata", "rules"]
+  anyOf:
+    # Do not alert on default ClusterRoles.
+    - properties:
+        metadata:
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: 'admin'
+                - const: "cluster-admin"
+                - const: "edit"
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - properties:
+        rules:
+          type: array
+          items:
+            type: object
+            not:
+              required: ["apiGroups", "resources", "verbs"]
+              properties:
+                apiGroups:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: ""
+                      - const: '*'
+                resources:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      - const: "pods/exec"
+                      - const: "pods/attach"
+                verbs:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      # An exec is also possible by `get`ing a web socket.
+                      - const: 'get'
+                      - const: 'create'