empty commit

* pretty output

* add colors

* better nocolor

* fix up main title

* delint

* remove double negative

* update docs

.github/actions/setup-polaris/Dockerfile

@@ -0,0 +1,15 @@
+# The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action
+
+FROM alpine:3.10
+
+RUN	apk add --no-cache \
+  bash \
+  ca-certificates \
+  curl \
+  wget \
+  tar \
+  jq
+
+COPY get_polaris.sh /get_polaris.sh
+
+ENTRYPOINT ["/get_polaris.sh"]

.github/actions/setup-polaris/action.yaml

@@ -0,0 +1,22 @@
+name: 'Install polaris'
+description: 'Download a specific polaris version'
+
+inputs:
+  version:
+    description: 'version of polaris'
+    required: true
+    default: 'latest'
+
+runs:
+  using: 'docker'
+  image: './Dockerfile'
+  args:
+    - ${{ inputs.version }}
+
+outputs:
+  version:
+    description: 'Version of polaris installed'
+
+branding:
+  icon: 'download-cloud'
+  color: 'gray-dark'

.github/actions/setup-polaris/get_polaris.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+if [[ -z "$INPUT_VERSION" ]]; then
+  echo "Missing polaris version information"
+  exit 1
+fi
+polaris version | grep "$INPUT_VERSION" &> /dev/null
+if [ $? == 0 ]; then
+   echo "Polaris $INPUT_VERSION is already installed! Exiting gracefully."
+   exit 0
+else
+  echo "Installing polaris to path."
+fi
+TARGET_FILE="polaris.tar.gz"
+curl -LJ -o $TARGET_FILE 'https://github.com/FairwindsOps/polaris/releases/download/'"$INPUT_VERSION"'/polaris_'"$INPUT_VERSION"'_linux_386.tar.gz'
+mkdir polaris
+tar -xzf $TARGET_FILE -C polaris
+rm $TARGET_FILE
+echo "polaris" >> $GITHUB_PATH
+echo "::set-output name=version::$INPUT_VERSION"

.github/workflows/test_setup.yml

@@ -0,0 +1,27 @@
+name: Test setup-polaris
+on:
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  build-int:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Setup polaris
+        uses: ./.github/actions/setup-polaris
+        with:
+          version: 3.0.3
+      - name: Use command
+        run: polaris version
+
+  build-ext:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Setup polaris
+        uses: fairwindsops/polaris/.github/actions/setup-polaris@master
+        with:
+          version: 3.0.3
+      - name: Use command
+        run: polaris version

README.md

@@ -3,7 +3,7 @@
   <br>
   <h3>Best Practices for Kubernetes Workload Configuration</h3>
   <a href="https://github.com/FairwindsOps/polaris">
-    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.1.1&color=239922">
+    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.2.0&color=239922">
   </a>
   <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
     <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
@@ -11,9 +11,6 @@
   <a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
     <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
   </a>
-  <a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
-    <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
-  </a>
   <a href="https://insights.fairwinds.com/gh/FairwindsOps/polaris">
     <img src="https://insights.fairwinds.com/v0/gh/FairwindsOps/polaris/badge.svg">
   </a>
@@ -21,7 +18,7 @@
 
 Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
 Kubernetes pods and controllers are configured using best practices, helping you avoid
-problems in the future. Polaris can be run in a few different modes:
+problems in the future.
 
 Polaris can be run in three different modes:
 * As a [dashboard](https://polaris.docs.fairwinds.com/dashboard), so you can audit what's running inside your cluster.

checks/insecureCapabilities.yaml

@@ -5,27 +5,53 @@ target: Container
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
+  required:
+  - securityContext
   properties:
     securityContext:
       type: object
+      required:
+      - capabilities
       properties:
         capabilities:
           type: object
+          required:
+          - drop
           properties:
-            add:
-              enum:
-              - CHOWN
-              - DAC_OVERRIDE
-              - FSETID
-              - FOWNER
-              - MKNOD
-              - NET_RAW
-              - SETGID
-              - SETUID
-              - SETFCAP
-              - SETPCAP
-              - NET_BIND_SERVICE
-              - SYS_CHROOT
-              - KILL
-              - AUDIT_WRITE
+            drop:
+              type: array
+              oneOf:
+              - contains:
+                  const: ALL
+              - allOf:
+                - contains:
+                    const: NET_ADMIN
+                - contains:
+                    const: CHOWN
+                - contains:
+                    const: DAC_OVERRIDE
+                - contains:
+                    const: FSETID
+                - contains:
+                    const: FOWNER
+                - contains:
+                    const: MKNOD
+                - contains:
+                    const: NET_RAW
+                - contains:
+                    const: SETGID
+                - contains:
+                    const: SETUID
+                - contains:
+                    const: SETFCAP
+                - contains:
+                    const: SETPCAP
+                - contains:
+                    const: NET_BIND_SERVICE
+                - contains:
+                    const: SYS_CHROOT
+                - contains:
+                    const: KILL
+                - contains:
+                    const: AUDIT_WRITE
 

checks/privilegeEscalationAllowed.yaml

@@ -5,9 +5,12 @@ target: Container
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
+  required:
+  - securityContext
   properties:
     securityContext:
+      required:
+      - allowPrivilegeEscalation
       properties:
         allowPrivilegeEscalation:
-          not:
-            const: true
+          const: false

cmd/polaris/audit.go

@@ -32,20 +32,24 @@ import (
 )
 
 var setExitCode bool
+var onlyShowFailedTests bool
 var minScore int
 var auditOutputURL string
 var auditOutputFile string
 var auditOutputFormat string
 var resourceToAudit string
+var useColor bool
 
 func init() {
 	rootCmd.AddCommand(auditCmd)
 	auditCmd.PersistentFlags().StringVar(&auditPath, "audit-path", "", "If specified, audits one or more YAML files instead of a cluster.")
 	auditCmd.PersistentFlags().BoolVar(&setExitCode, "set-exit-code-on-danger", false, "Set an exit code of 3 when the audit contains danger-level issues.")
+	auditCmd.PersistentFlags().BoolVar(&onlyShowFailedTests, "only-show-failed-tests", false, "If specified, audit output will only show failed tests.")
 	auditCmd.PersistentFlags().IntVar(&minScore, "set-exit-code-below-score", 0, "Set an exit code of 4 when the score is below this threshold (1-100).")
 	auditCmd.PersistentFlags().StringVar(&auditOutputURL, "output-url", "", "Destination URL to send audit results.")
 	auditCmd.PersistentFlags().StringVar(&auditOutputFile, "output-file", "", "Destination file for audit results.")
-	auditCmd.PersistentFlags().StringVarP(&auditOutputFormat, "format", "f", "json", "Output format for results - json, yaml, or score.")
+	auditCmd.PersistentFlags().StringVarP(&auditOutputFormat, "format", "f", "json", "Output format for results - json, yaml, pretty, or score.")
+	auditCmd.PersistentFlags().BoolVar(&useColor, "color", true, "Whether to use color in pretty format.")
 	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 }
@@ -59,7 +63,7 @@ var auditCmd = &cobra.Command{
 			config.DisplayName = displayName
 		}
 
-		auditData := runAndReportAudit(cmd.Context(), config, auditPath, resourceToAudit, auditOutputFile, auditOutputURL, auditOutputFormat)
+		auditData := runAndReportAudit(cmd.Context(), config, auditPath, resourceToAudit, auditOutputFile, auditOutputURL, auditOutputFormat, useColor)
 
 		summary := auditData.GetSummary()
 		score := summary.GetScore()
@@ -73,7 +77,7 @@ var auditCmd = &cobra.Command{
 	},
 }
 
-func runAndReportAudit(ctx context.Context, c conf.Configuration, auditPath, workload, outputFile, outputURL, outputFormat string) validator.AuditData {
+func runAndReportAudit(ctx context.Context, c conf.Configuration, auditPath, workload, outputFile, outputURL, outputFormat string, useColor bool) validator.AuditData {
 	// Create a kubernetes client resource provider
 	k, err := kube.CreateResourceProvider(ctx, auditPath, workload)
 	if err != nil {
@@ -81,7 +85,7 @@ func runAndReportAudit(ctx context.Context, c conf.Configuration, auditPath, wor
 		os.Exit(1)
 	}
 	var auditData validator.AuditData
-	auditData, err = validator.RunAudit(c, k)
+	auditData, err = validator.RunAudit(c, k, onlyShowFailedTests)
 
 	if err != nil {
 		logrus.Errorf("Error while running audit on resources: %v", err)
@@ -96,6 +100,8 @@ func runAndReportAudit(ctx context.Context, c conf.Configuration, auditPath, wor
 		if err == nil {
 			outputBytes, err = yaml.JSONToYAML(jsonBytes)
 		}
+	} else if outputFormat == "pretty" {
+		outputBytes = []byte(auditData.GetPrettyOutput(useColor))
 	} else {
 		outputBytes, err = json.MarshalIndent(auditData, "", "  ")
 	}

docs/.vuepress/config-extras.js

@@ -33,6 +33,13 @@ module.exports = {
           "/infrastructure-as-code",
         ],
       },
+      {
+        title: "Usage",
+        collapsable: false,
+        children: [
+          "/cli",
+        ],
+      },
       {
         title: "Customization",
         collapsable: false,

docs/README.md

@@ -3,7 +3,7 @@
   <br>
   <h3>Best Practices for Kubernetes Workload Configuration</h3>
   <a href="https://github.com/FairwindsOps/polaris">
-    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.0.0&color=239922">
+    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.1.6&color=239922">
   </a>
   <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
     <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
@@ -11,11 +11,14 @@
   <a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
     <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
   </a>
+  <a href="https://insights.fairwinds.com/gh/FairwindsOps/polaris">
+    <img src="https://insights.fairwinds.com/v0/gh/FairwindsOps/polaris/badge.svg">
+  </a>
 </div>
 
 Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
 Kubernetes pods and controllers are configured using best practices, helping you avoid
-problems in the future. Polaris can be run in a few different modes:
+problems in the future.
 
 Polaris can be run in three different modes:
 * As a [dashboard](/dashboard), so you can audit what's running inside your cluster.

docs/changelog.md

@@ -2,6 +2,24 @@
 sidebarDepth: 0
 ---
 
+## 3.2.0
+* Add `--format=pretty` option for CLI output
+
+## 3.1.6
+* Fix nil pointer issue with --only-output-failed-tests
+
+## 3.1.5
+* Fix UI display of Ingress checks
+
+## 3.1.4
+* Fixes for exemption annotations for the admission controller
+
+## 3.1.3
+* Fixes for `privilegeEscalationAllowed` and `insecureCapabilities` checks to take Kubernetes defaults into account
+
+## 3.1.2
+* Start checking deployment configuration using Fairwinds Insights
+
 ## 3.1.1
 * Updated to alpine:3.13
 

docs/cli.md

@@ -0,0 +1,50 @@
+#### CLI Options
+
+```
+# top-level commands
+audit
+      Runs a one-time audit.
+dashboard
+      Runs the webserver for Polaris dashboard.
+help
+      Prints help, if you give it a command then it will print help for that command. Same as -h
+version
+      Prints the version of Polaris
+webhook
+      Runs the webhook webserver
+
+# global flags
+-c, --config string         Location of Polaris configuration file.
+    --disallow-exemptions   Disallow any exemptions from configuration file.
+    --kubeconfig string     Paths to a kubeconfig. Only required if out-of-cluster.
+    --log-level string      Logrus log level. (default "info")
+
+# dashboard flags
+    --audit-path string          If specified, audits one or more YAML files instead of a cluster.
+    --base-path string           Path on which the dashboard is served. (default "/")
+    --display-name string        An optional identifier for the audit.
+-h, --help                       help for dashboard
+    --listening-address string   Listening Address for the dashboard webserver.
+    --load-audit-file string     Runs the dashboard with data saved from a past audit.
+-p, --port int                   Port for the dashboard webserver. (default 8080)
+
+# audit flags
+    --audit-path string               If specified, audits one or more YAML files instead of a cluster.
+    --color                           Whether to use color in pretty format. (default true)
+    --display-name string             An optional identifier for the audit.
+-f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
+-h, --help                            help for audit
+    --only-show-failed-tests          If specified, audit output will only show failed tests.
+    --output-file string              Destination file for audit results.
+    --output-url string               Destination URL to send audit results.
+    --resource string                 Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.
+    --set-exit-code-below-score int   Set an exit code of 4 when the score is below this threshold (1-100).
+    --set-exit-code-on-danger         Set an exit code of 3 when the audit contains danger-level issues.
+
+
+# webhook flags
+    --disable-webhook-config-installer   disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.
+-h, --help                               help for webhook
+-p, --port int                           Port for the dashboard webserver. (default 9876)
+```
+

docs/cli/options.md

@@ -1,66 +0,0 @@
-#### CLI Options
-
-```
-# top-level commands
-audit
-      Runs a one-time audit.
-dashboard
-      Runs the webserver for Polaris dashboard.
-help
-      Prints help, if you give it a command then it will print help for that command. Same as -h
-version
-      Prints the version of Polaris
-webhook
-      Runs the webhook webserver
-
-# high-level flags
--c, --config string
-      Location of Polaris configuration file
---disallow-exemptions
-      Disallow any exemptions from configuration file.
--h, --help
-      Help for Polaris (same as help command)
---kubeconfig string
-      Path to a kubeconfig. Only required if out-of-cluster.
---log-level string
-      Logrus log level (default "info")
---master string
-      The address of the Kubernetes API server. Overrides any value in kubeconfig. Only required if out-of-cluster.
-
-# dashboard flags
---audit-path string
-      If specified, audits one or more YAML files instead of a cluster
---base-path string
-      Path on which the dashboard is served (default "/")
---display-name string
-      An optional identifier for the audit
---load-audit-file string
-      Runs the dashboard with data saved from a past audit.
--p, --port int
-      Port for the dashboard webserver (default 8080)
-
-# audit flags
---audit-path string
-      If specified, audits one or more YAML files instead of a cluster
---resource string
-      If specified, audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend
---display-name string
-      An optional identifier for the audit
---format string
-      Output format for results - json, yaml, or score (default "json")
---output-file string
-      Destination file for audit results
---output-url string
-      Destination URL to send audit results
---set-exit-code-below-score int
-      Set an exit code of 4 when the score is below this threshold (1-100)
---set-exit-code-on-danger
-      Set an exit code of 3 when the audit contains danger-level issues.
-
-# webhook flags
---disable-webhook-config-installer
-      disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping
--p, --port int
-      Port for the webhook webserver (default 9876)
-```
-

docs/contributing.md

@@ -32,12 +32,26 @@ We label issues with the ["good first issue" tag](https://github.com/FairwindsOp
 
 The following commands are all required to pass as part of Polaris testing:
 
-```
+```bash
 go list ./... | grep -v vendor | xargs golint -set_exit_status
 go list ./... | grep -v vendor | xargs go vet
 go test ./pkg/... -v -coverprofile cover.out
 ```
 
+### Webhook tests
+```bash
+kind create cluster --wait=90s --image kindest/node:v1.15.11 --name polaris-test
+docker build -t quay.io/fairwinds/polaris:debug . # or use your own registry
+docker push quay.io/fairwinds/polaris:debug
+helm repo add jetstack https://charts.jetstack.io
+kubectl create ns cert-manager
+helm install cert-manager jetstack/cert-manager --namespace cert-manager --version 0.16.1 --set "installCRDs=true" --wait
+POLARIS_IMAGE=quay.io/fairwinds/polaris:debug ./test/webhook_test.sh
+```
+to avoid the final cleanup for debugging purposes, you can run
+```bash
+SKIP_FINAL_CLEANUP=true IMAGE_TAG=debug ./test/webhook_test.sh
+```
 ## Creating a New Issue
 
 If you've encountered an issue that is not already reported, please create a [new issue](https://github.com/FairwindsOps/polaris/issues), choose `Bug Report`, `Feature Request` or `Misc.` and follow the instructions in the template. 

docs/infrastructure-as-code.md

@@ -21,8 +21,9 @@ polaris version
 ```
 
 ## Running in a CI pipeline
-You can tell the CLI to set an exit code if it detects certain issues with your
-YAML files.
+
+### Set minimum score for an exit code
+You can tell the CLI to set an exit code if it detects certain issues with your YAML files.
 For example, to fail if polaris detects *any* danger-level issues, or if the score drops below 90%:
 ```bash
 polaris audit --audit-path ./deploy/ \
@@ -30,3 +31,65 @@ polaris audit --audit-path ./deploy/ \
   --set-exit-code-below-score 90
 ```
 
+### Pretty-print results
+By default, results are output as JSON. You can get human-readable output with
+the `--format=pretty` flag:
+
+```bash
+polaris audit --audit-path ./deploy/ \
+  --format=pretty
+```
+
+You can also disable colors and emoji:
+```bash
+polaris audit --audit-path ./deploy/ \
+  --format=pretty \
+  --color=false
+```
+
+### Output only showing failed tests
+The CLI to gives you ability to display results containing only failed tests. 
+For example:
+```bash
+polaris audit --audit-path ./deploy/ \
+  --only-show-failed-tests true
+```
+
+### As Github Action
+#### Setup polaris action
+
+This action downloads a version of [polaris](https://github.com/FairwindsOps/polaris) and adds it to the path. It makes the [polaris cli](https://polaris.docs.fairwinds.com/infrastructure-as-code) ready to use in following steps of the same job.
+
+##### Inputs
+
+###### `version`
+
+The release version to fetch. This has to be in the form `<tag_name>`.
+
+##### Outputs
+
+###### `version`
+
+The version number of the release tag.
+
+##### Example usage
+
+```yaml
+uses: fairwindsops/polaris@master
+with:
+  version: "3.0.3"
+```
+
+Example inside a job:
+
+```yaml
+steps:
+  - uses: actions/checkout@v2
+  - name: Setup polaris
+    uses: fairwindsops/polaris@master
+    with:
+      version: 3.0.3
+
+  - name: Use command
+    run: polaris version
+```

go.mod

@@ -6,6 +6,7 @@ require (
 	cloud.google.com/go v0.74.0 // indirect
 	github.com/Azure/go-autorest/autorest v0.11.15 // indirect
 	github.com/Azure/go-autorest/autorest/adal v0.9.10 // indirect
+	github.com/fatih/color v1.7.0
 	github.com/gobuffalo/packr/v2 v2.8.1
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.1.3 // indirect
@@ -17,8 +18,8 @@ require (
 	github.com/prometheus/client_golang v1.9.0 // indirect
 	github.com/qri-io/jsonschema v0.1.1
 	github.com/rogpeppe/go-internal v1.6.2 // indirect
-	github.com/sirupsen/logrus v1.7.0
-	github.com/spf13/cobra v1.1.1
+	github.com/sirupsen/logrus v1.8.0
+	github.com/spf13/cobra v1.1.3
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.7.0
 	go.uber.org/zap v1.16.0 // indirect
@@ -27,11 +28,10 @@ require (
 	golang.org/x/sys v0.0.0-20201231184435-2d18734c6014 // indirect
 	golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf // indirect
 	golang.org/x/time v0.0.0-20201208040808-7e3f01d25324 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776
-	k8s.io/api v0.20.2
-	k8s.io/apimachinery v0.20.2
-	k8s.io/client-go v0.20.2
+	k8s.io/api v0.20.4
+	k8s.io/apimachinery v0.20.4
+	k8s.io/client-go v0.20.4
 	k8s.io/component-base v0.20.1 // indirect
 	sigs.k8s.io/controller-runtime v0.7.0
 	sigs.k8s.io/yaml v1.2.0

go.sum

@@ -166,6 +166,7 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch v4.9.0+incompatible h1:kLcOMZeuLAJvL2BPWLMIj5oaZQobrkAqrL+WFZwQses=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
@@ -412,6 +413,7 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
+github.com/magefile/mage v1.10.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -426,8 +428,10 @@ github.com/markbates/oncer v1.0.0 h1:E83IaVAHygyndzPimgUYJjbshhDTALZyXxvk9FOlQRY
 github.com/markbates/oncer v1.0.0/go.mod h1:Z59JA581E9GP6w96jai+TGqafHPW+cPfRxz2aSZ0mcI=
 github.com/markbates/safe v1.0.1 h1:yjZkbvRM6IzKj9tlu/zMJLS0n/V351OZWRnF3QfaUxI=
 github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
@@ -568,6 +572,8 @@ github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0 h1:ShrD1U9pZB12TX0cVy0DtePoCH97K8EtX+mg7ZARUtM=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.8.0 h1:nfhvjKcUMhBMVqbKHJlk5RPrrfYr/NMo3692g0dwfWU=
+github.com/sirupsen/logrus v1.8.0/go.mod h1:4GuYW9TZmE769R5STWrRakJc4UqQ3+QQ95fyz7ENv1A=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
@@ -581,6 +587,8 @@ github.com/spf13/cobra v0.0.6/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHN
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
 github.com/spf13/cobra v1.1.1 h1:KfztREH0tPxJJ+geloSLaAkaPkr4ki2Er5quFV1TDo4=
 github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJQMI=
+github.com/spf13/cobra v1.1.3 h1:xghbfqPkxzxP3C/f3n5DdpAbdKLj4ZE4BWQI362l53M=
+github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
@@ -1058,6 +1066,8 @@ k8s.io/api v0.20.1 h1:ud1c3W3YNzGd6ABJlbFfKXBKXO+1KdGfcgGGNgFR03E=
 k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
 k8s.io/api v0.20.2 h1:y/HR22XDZY3pniu9hIFDLpUCPq2w5eQ6aV/VFQ7uJMw=
 k8s.io/api v0.20.2/go.mod h1:d7n6Ehyzx+S+cE3VhTGfVNNqtGc/oL9DCdYYahlurV8=
+k8s.io/api v0.20.4 h1:xZjKidCirayzX6tHONRQyTNDVIR55TYVqgATqo6ZULY=
+k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
 k8s.io/apiextensions-apiserver v0.19.2 h1:oG84UwiDsVDu7dlsGQs5GySmQHCzMhknfhFExJMz9tA=
 k8s.io/apiextensions-apiserver v0.19.2/go.mod h1:EYNjpqIAvNZe+svXVx9j4uBaVhTB4C94HkY3w058qcg=
 k8s.io/apimachinery v0.19.2/go.mod h1:DnPGDnARWFvYa3pMHgSxtbZb7gpzzAZ1pTfaUNDVlmA=
@@ -1065,12 +1075,16 @@ k8s.io/apimachinery v0.20.1 h1:LAhz8pKbgR8tUwn7boK+b2HZdt7MiTu2mkYtFMUjTRQ=
 k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apimachinery v0.20.2 h1:hFx6Sbt1oG0n6DZ+g4bFt5f6BoMkOjKWsQFu077M3Vg=
 k8s.io/apimachinery v0.20.2/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
+k8s.io/apimachinery v0.20.4 h1:vhxQ0PPUUU2Ns1b9r4/UFp13UPs8cw2iOoTjnY9faa0=
+k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
 k8s.io/apiserver v0.19.2/go.mod h1:FreAq0bJ2vtZFj9Ago/X0oNGC51GfubKK/ViOKfVAOA=
 k8s.io/client-go v0.19.2/go.mod h1:S5wPhCqyDNAlzM9CnEdgTGV4OqhsW3jGO1UM1epwfJA=
 k8s.io/client-go v0.20.1 h1:Qquik0xNFbK9aUG92pxHYsyfea5/RPO9o9bSywNor+M=
 k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
 k8s.io/client-go v0.20.2 h1:uuf+iIAbfnCSw8IGAv/Rg0giM+2bOzHLOsbbrwrdhNQ=
 k8s.io/client-go v0.20.2/go.mod h1:kH5brqWqp7HDxUFKoEgiI4v8G1xzbe9giaCenUWJzgE=
+k8s.io/client-go v0.20.4 h1:85crgh1IotNkLpKYKZHVNI1JT86nr/iDCvq2iWKsql4=
+k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
 k8s.io/code-generator v0.19.2/go.mod h1:moqLn7w0t9cMs4+5CQyxnfA/HV8MF6aAVENF+WZZhgk=
 k8s.io/component-base v0.19.2 h1:jW5Y9RcZTb79liEhW3XDVTW7MuvEGP0tQZnfSX6/+gs=
 k8s.io/component-base v0.19.2/go.mod h1:g5LrsiTiabMLZ40AR6Hl45f088DevyGY+cCE2agEIVo=

main.go

@@ -20,7 +20,7 @@ import (
 
 const (
 	// Version represents the current release version of Polaris
-	Version = "3.1.1"
+	Version = "3.2.0"
 )
 
 func main() {

pkg/dashboard/dashboard.go

@@ -181,7 +181,7 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 			}
 
 			var auditDataObj validator.AuditData
-			auditDataObj, err = validator.RunAudit(adjustedConf, k)
+			auditDataObj, err = validator.RunAudit(adjustedConf, k, false)
 			if err != nil {
 				http.Error(w, "Error Fetching Deployments", http.StatusInternalServerError)
 				return
@@ -214,7 +214,7 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 			}
 
 			var auditData validator.AuditData
-			auditData, err = validator.RunAudit(adjustedConf, k)
+			auditData, err = validator.RunAudit(adjustedConf, k, false)
 			if err != nil {
 				logrus.Errorf("Error getting audit data: %v", err)
 				http.Error(w, "Error running audit", 500)

pkg/dashboard/templates/dashboard.gohtml

@@ -120,7 +120,7 @@
       </div>
       <div class="result-messages expandable-content">
         <form id="namespaceFiltersForm" class="namespace-list">
-          {{ range $namespace, $ctrlResults := .AuditData.GetResultsByNamespace }}
+          {{ range $namespace, $results := .AuditData.GetResultsByNamespace }}
             <div class="namespace-row">
               <input type="checkbox" name="{{ $namespace }}" id="namespace-{{ $namespace }}">
               <label for="namespace-{{ $namespace }}">{{ $namespace }}</label>
@@ -132,20 +132,18 @@
     </div>
   </div>
 
-  {{ range $namespace, $ctrlResults := .FilteredAuditData.GetResultsByNamespace }}
+  {{ range $namespace, $results := .FilteredAuditData.GetResultsByNamespace }}
     <div id="{{ $namespace }}" class="card namespace">
       <h3>Namespace: <strong>{{ $namespace }}</strong></h3>
       <div class="expandable-table">
-        {{ range $ctrlResults }}
+        {{ range $index, $result := $results }}
           <div class="resource-info">
             <div class="status-bar">
               <div class="status">
                 <div class="failing">
-                  {{ if .PodResult }}
-                    <div class="warning" style="width: {{ getWarningWidth .PodResult.GetSummary 200 }}px;">
-                      <div class="passing" style="width: {{ getSuccessWidth .PodResult.GetSummary 200 }}px;"></div>
-                    </div>
-                  {{ end }}
+                  <div class="warning" style="width: {{ getWarningWidth $result.GetSummary 200 }}px;">
+                    <div class="passing" style="width: {{ getSuccessWidth $result.GetSummary 200 }}px;"></div>
+                  </div>
                 </div>
               </div>
             </div>

pkg/kube/workload.go

@@ -76,6 +76,19 @@ func NewGenericWorkloadFromPod(podResource kubeAPICoreV1.Pod, originalObject int
 			return workload, err
 		}
 		workload.OriginalObjectJSON = bytes
+
+		var unst unstructured.Unstructured
+		err = json.Unmarshal(bytes, &unst.Object)
+		if err != nil {
+			logrus.Error("Couldn't marshal JSON for pod ", err)
+			return workload, err
+		}
+		objMeta, err := meta.Accessor(&unst)
+		if err != nil {
+			logrus.Error("Couldn't create meta accessor for unstructred ", err)
+			return workload, err
+		}
+		workload.ObjectMeta = objMeta
 	}
 	return workload, nil
 }

pkg/validator/container_test.go

@@ -555,14 +555,14 @@ func TestValidateSecurity(t *testing.T) {
 				Category: "Security",
 			}, {
 				ID:       "privilegeEscalationAllowed",
-				Message:  "Privilege escalation not allowed",
-				Success:  true,
+				Message:  "Privilege escalation should not be allowed",
+				Success:  false,
 				Severity: "danger",
 				Category: "Security",
 			}, {
 				ID:       "insecureCapabilities",
-				Message:  "Container does not have any insecure capabilities",
-				Success:  true,
+				Message:  "Container should not have insecure capabilities",
+				Success:  false,
 				Severity: "warning",
 				Category: "Security",
 			}, {
@@ -739,8 +739,8 @@ func TestValidateSecurity(t *testing.T) {
 				Category: "Security",
 			}, {
 				ID:       "insecureCapabilities",
-				Message:  "Container does not have any insecure capabilities",
-				Success:  true,
+				Message:  "Container should not have insecure capabilities",
+				Success:  false,
 				Severity: "warning",
 				Category: "Security",
 			}},
@@ -758,8 +758,8 @@ func TestValidateSecurity(t *testing.T) {
 				Category: "Security",
 			}, {
 				ID:       "insecureCapabilities",
-				Message:  "Container does not have any insecure capabilities",
-				Success:  true,
+				Message:  "Container should not have insecure capabilities",
+				Success:  false,
 				Severity: "danger",
 				Category: "Security",
 			}, {

pkg/validator/controller.go

@@ -15,16 +15,12 @@
 package validator
 
 import (
-	"strings"
-
 	"github.com/sirupsen/logrus"
 
 	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
 )
 
-const exemptionAnnotationKey = "polaris.fairwinds.com/exempt"
-
 // ValidateController validates a single controller, returns a Result.
 func ValidateController(conf *conf.Configuration, controller kube.GenericWorkload) (Result, error) {
 	podResult, err := ValidatePod(conf, controller)
@@ -56,9 +52,6 @@ func ValidateControllers(config *conf.Configuration, kubeResources *kube.Resourc
 
 	results := []Result{}
 	for _, controller := range controllersToAudit {
-		if !config.DisallowExemptions && hasExemptionAnnotation(controller) {
-			continue
-		}
 		result, err := ValidateController(config, controller)
 		if err != nil {
 			logrus.Warn("An error occurred validating controller:", err)
@@ -69,9 +62,3 @@ func ValidateControllers(config *conf.Configuration, kubeResources *kube.Resourc
 
 	return results, nil
 }
-
-func hasExemptionAnnotation(ctrl kube.GenericWorkload) bool {
-	annot := ctrl.ObjectMeta.GetAnnotations()
-	val := annot[exemptionAnnotationKey]
-	return strings.ToLower(val) == "true"
-}

pkg/validator/controller_test.go

@@ -193,7 +193,20 @@ func TestControllerExemptions(t *testing.T) {
 			"livenessProbeMissing":  conf.SeverityWarning,
 		},
 	}
+	expectedSum := CountSummary{
+		Successes: uint(0),
+		Warnings:  uint(1),
+		Dangers:   uint(1),
+	}
+	expectedExemptSum := CountSummary{
+		Successes: uint(0),
+		Warnings:  uint(0),
+		Dangers:   uint(0),
+	}
+	var actualResults []Result
+
 	pod := test.MockPod()
+	pod.ObjectMeta.Namespace = "foo"
 	workload, err := kube.NewGenericWorkloadFromPod(pod, nil)
 	assert.NoError(t, err)
 	workload.Kind = "Deployment"
@@ -201,12 +214,6 @@ func TestControllerExemptions(t *testing.T) {
 		Controllers: []kube.GenericWorkload{workload},
 	}
 
-	expectedSum := CountSummary{
-		Successes: uint(0),
-		Warnings:  uint(1),
-		Dangers:   uint(1),
-	}
-	var actualResults []Result
 	actualResults, err = ValidateControllers(&c, resources)
 	if err != nil {
 		panic(err)
@@ -215,6 +222,18 @@ func TestControllerExemptions(t *testing.T) {
 	assert.Equal(t, "Deployment", actualResults[0].Kind)
 	assert.EqualValues(t, expectedSum, actualResults[0].GetSummary())
 
+	c.Exemptions = []conf.Exemption{{
+		Namespace: "foo",
+	}}
+	actualResults, err = ValidateControllers(&c, resources)
+	if err != nil {
+		panic(err)
+	}
+	assert.Equal(t, 1, len(actualResults))
+	assert.Equal(t, "Deployment", actualResults[0].Kind)
+	assert.EqualValues(t, expectedExemptSum, actualResults[0].GetSummary())
+
+	c.Exemptions = nil
 	resources.Controllers[0].ObjectMeta.SetAnnotations(map[string]string{
 		exemptionAnnotationKey: "true",
 	})
@@ -222,5 +241,16 @@ func TestControllerExemptions(t *testing.T) {
 	if err != nil {
 		panic(err)
 	}
-	assert.Equal(t, 0, len(actualResults))
+	assert.Equal(t, 1, len(actualResults))
+	assert.Equal(t, "Deployment", actualResults[0].Kind)
+	assert.EqualValues(t, expectedExemptSum, actualResults[0].GetSummary())
+
+	c.DisallowExemptions = true
+	actualResults, err = ValidateControllers(&c, resources)
+	if err != nil {
+		panic(err)
+	}
+	assert.Equal(t, 1, len(actualResults))
+	assert.Equal(t, "Deployment", actualResults[0].Kind)
+	assert.EqualValues(t, expectedSum, actualResults[0].GetSummary())
 }

pkg/validator/fullaudit.go

@@ -16,7 +16,7 @@ import (
 )
 
 // RunAudit runs a full Polaris audit and returns an AuditData object
-func RunAudit(config conf.Configuration, kubeResources *kube.ResourceProvider) (AuditData, error) {
+func RunAudit(config conf.Configuration, kubeResources *kube.ResourceProvider, onlyShowFailedTests bool) (AuditData, error) {
 	displayName := config.DisplayName
 	if displayName == "" {
 		displayName = kubeResources.SourceName
@@ -49,6 +49,10 @@ func RunAudit(config conf.Configuration, kubeResources *kube.ResourceProvider) (
 		},
 		Results: results,
 	}
+	auditData.Score = auditData.GetSummary().GetScore()
+	if onlyShowFailedTests {
+		auditData.RemoveSuccessfulResults()
+	}
 	return auditData, nil
 }
 

pkg/validator/fullaudit_test.go

@@ -28,10 +28,12 @@ func TestGetTemplateData(t *testing.T) {
 		Warnings:  uint(3),
 		Dangers:   uint(3),
 	}
+	score := uint(0)
 
 	var actualAudit AuditData
-	actualAudit, err = RunAudit(c, resources)
+	actualAudit, err = RunAudit(c, resources, false)
 	assert.Equal(t, err, nil, "error should be nil")
+	assert.Equal(t, score, actualAudit.Score, "")
 	assert.EqualValues(t, sum, actualAudit.GetSummary())
 	assert.Equal(t, actualAudit.SourceType, "Cluster", "should be from a cluster")
 	assert.Equal(t, actualAudit.SourceName, "test", "should be from a cluster")

pkg/validator/output.go

@@ -15,8 +15,11 @@
 package validator
 
 import (
+	"fmt"
 	"time"
 
+	"github.com/fatih/color"
+
 	"github.com/fairwindsops/polaris/pkg/config"
 )
 
@@ -25,6 +28,17 @@ const (
 	PolarisOutputVersion = "1.0"
 )
 
+var (
+	successMessage = "🎉 Success"
+	dangerMessage  = "❌ Danger"
+	warningMessage = "😬 Warning"
+)
+
+var (
+	titleColor = color.New(color.FgBlue).Add(color.Bold)
+	checkColor = color.New(color.FgCyan)
+)
+
 // AuditData contains all the data from a full Polaris audit
 type AuditData struct {
 	PolarisOutputVersion string
@@ -34,6 +48,14 @@ type AuditData struct {
 	DisplayName          string
 	ClusterInfo          ClusterInfo
 	Results              []Result
+	Score                uint
+}
+
+// RemoveSuccessfulResults remove all test that have passed.
+func (res *AuditData) RemoveSuccessfulResults() {
+	for _, auditDataResult := range res.Results {
+		auditDataResult.removeSuccessfulResults()
+	}
 }
 
 // ClusterInfo contains Polaris results as well as some high-level stats
@@ -57,6 +79,14 @@ type ResultMessage struct {
 // ResultSet contiains the results for a set of checks
 type ResultSet map[string]ResultMessage
 
+func (res ResultSet) removeSuccessfulResults() {
+	for k, resultMessage := range res {
+		if resultMessage.Success {
+			delete(res, k)
+		}
+	}
+}
+
 // Result provides results for a Kubernetes object
 type Result struct {
 	Name        string
@@ -67,6 +97,11 @@ type Result struct {
 	CreatedTime time.Time
 }
 
+func (res *Result) removeSuccessfulResults() {
+	res.Results.removeSuccessfulResults()
+	res.PodResult.removeSuccessfulResults()
+}
+
 // PodResult provides a list of validation messages for each pod.
 type PodResult struct {
 	Name             string
@@ -74,8 +109,93 @@ type PodResult struct {
 	ContainerResults []ContainerResult
 }
 
+func (res *PodResult) removeSuccessfulResults() {
+	if res == nil {
+		return
+	}
+	res.Results.removeSuccessfulResults()
+	for _, containerResult := range res.ContainerResults {
+		containerResult.removeSuccessfulResults()
+	}
+}
+
 // ContainerResult provides a list of validation messages for each container.
 type ContainerResult struct {
 	Name    string
 	Results ResultSet
 }
+
+func (res *ContainerResult) removeSuccessfulResults() {
+	res.Results.removeSuccessfulResults()
+}
+
+func fillString(id string, l int) string {
+	for len(id) < l {
+		id += " "
+	}
+	return id
+}
+
+// GetPrettyOutput returns a human-readable string
+func (res AuditData) GetPrettyOutput(useColor bool) string {
+	color.NoColor = !useColor
+	str := titleColor.Sprint(fmt.Sprintf("\n\nPolaris audited %s %s at %s\n", res.SourceType, res.SourceName, res.AuditTime))
+	str += color.CyanString(fmt.Sprintf("    Nodes: %d | Namespaces: %d | Controllers: %d\n", res.ClusterInfo.Nodes, res.ClusterInfo.Namespaces, res.ClusterInfo.Controllers))
+	str += color.GreenString(fmt.Sprintf("    Final score: %d\n", res.Score))
+	str += "\n"
+	for _, result := range res.Results {
+		str += result.GetPrettyOutput() + "\n"
+	}
+	color.NoColor = false
+	return str
+}
+
+// GetPrettyOutput returns a human-readable string
+func (res Result) GetPrettyOutput() string {
+	str := titleColor.Sprint(fmt.Sprintf("%s %s in namespace %s\n", res.Kind, res.Name, res.Namespace))
+	str += res.Results.GetPrettyOutput()
+	if res.PodResult != nil {
+		str += res.PodResult.GetPrettyOutput()
+	}
+	return str
+}
+
+// GetPrettyOutput returns a human-readable string
+func (res PodResult) GetPrettyOutput() string {
+	str := res.Results.GetPrettyOutput()
+	for _, cont := range res.ContainerResults {
+		str += cont.GetPrettyOutput() + "\n"
+	}
+	return str
+}
+
+// GetPrettyOutput returns a human-readable string
+func (res ContainerResult) GetPrettyOutput() string {
+	str := titleColor.Sprint(fmt.Sprintf("  Container %s\n", res.Name))
+	str += res.Results.GetPrettyOutput()
+	return str
+}
+
+const minIDLength = 40
+
+// GetPrettyOutput returns a human-readable string
+func (res ResultSet) GetPrettyOutput() string {
+	indent := "    "
+	str := ""
+	for _, msg := range res {
+		status := color.GreenString(successMessage)
+		if !msg.Success {
+			if msg.Severity == config.SeverityWarning {
+				status = color.YellowString(warningMessage)
+			} else {
+				status = color.RedString(dangerMessage)
+			}
+		}
+		if color.NoColor {
+			status = status[2:] // remove emoji
+		}
+		str += fmt.Sprintf("%s%s %s\n", indent, checkColor.Sprint(fillString(msg.ID, minIDLength-len(indent))), status)
+		str += fmt.Sprintf("%s    %s - %s\n", indent, msg.Category, msg.Message)
+	}
+	return str
+}

pkg/validator/schema.go

@@ -116,17 +116,28 @@ func makeResult(conf *config.Configuration, check *config.SchemaCheck, passes bo
 	return result
 }
 
-func getExemptKey(checkID string) string {
-	return fmt.Sprintf("polaris.fairwinds.com/%s-exempt", checkID)
+const exemptionAnnotationKey = "polaris.fairwinds.com/exempt"
+const exemptionAnnotationPattern = "polaris.fairwinds.com/%s-exempt"
+
+func hasExemptionAnnotation(ctrl kube.GenericWorkload, checkID string) bool {
+	annot := ctrl.ObjectMeta.GetAnnotations()
+	val := annot[exemptionAnnotationKey]
+	if strings.ToLower(val) == "true" {
+		return true
+	}
+	checkKey := fmt.Sprintf(exemptionAnnotationPattern, checkID)
+	val = annot[checkKey]
+	if strings.ToLower(val) == "true" {
+		return true
+	}
+	return false
 }
 
 func applyPodSchemaChecks(conf *config.Configuration, controller kube.GenericWorkload) (ResultSet, error) {
 	results := ResultSet{}
 	checkIDs := getSortedKeys(conf.Checks)
-	objectAnnotations := controller.ObjectMeta.GetAnnotations()
 	for _, checkID := range checkIDs {
-		exemptValue := objectAnnotations[getExemptKey(checkID)]
-		if strings.ToLower(exemptValue) == "true" {
+		if !conf.DisallowExemptions && hasExemptionAnnotation(controller, checkID) {
 			continue
 		}
 		check, err := resolveCheck(conf, checkID, controller.Kind, config.TargetPod, controller.ObjectMeta, "", false)
@@ -148,10 +159,8 @@ func applyPodSchemaChecks(conf *config.Configuration, controller kube.GenericWor
 func applyControllerSchemaChecks(conf *config.Configuration, controller kube.GenericWorkload) (ResultSet, error) {
 	results := ResultSet{}
 	checkIDs := getSortedKeys(conf.Checks)
-	objectAnnotations := controller.ObjectMeta.GetAnnotations()
 	for _, checkID := range checkIDs {
-		exemptValue := objectAnnotations[getExemptKey(checkID)]
-		if strings.ToLower(exemptValue) == "true" {
+		if !conf.DisallowExemptions && hasExemptionAnnotation(controller, checkID) {
 			continue
 		}
 		check, err := resolveCheck(conf, checkID, controller.Kind, config.TargetController, controller.ObjectMeta, "", false)
@@ -173,13 +182,12 @@ func applyControllerSchemaChecks(conf *config.Configuration, controller kube.Gen
 func applyContainerSchemaChecks(conf *config.Configuration, controller kube.GenericWorkload, container *corev1.Container, isInit bool) (ResultSet, error) {
 	results := ResultSet{}
 	checkIDs := getSortedKeys(conf.Checks)
-	objectAnnotations := controller.ObjectMeta.GetAnnotations()
 	for _, checkID := range checkIDs {
-		exemptValue := objectAnnotations[getExemptKey(checkID)]
-		if strings.ToLower(exemptValue) == "true" {
+		if !conf.DisallowExemptions && hasExemptionAnnotation(controller, checkID) {
 			continue
 		}
 		check, err := resolveCheck(conf, checkID, controller.Kind, config.TargetContainer, controller.ObjectMeta, container.Name, isInit)
+
 		if err != nil {
 			return nil, err
 		} else if check == nil {

pkg/validator/summary.go

@@ -106,14 +106,18 @@ func (p PodResult) GetSummaryByCategory() CountSummaryByCategory {
 // GetSummary summarizes a Result
 func (c Result) GetSummary() CountSummary {
 	summary := c.Results.GetSummary()
-	summary.AddSummary(c.PodResult.GetSummary())
+	if c.PodResult != nil {
+		summary.AddSummary(c.PodResult.GetSummary())
+	}
 	return summary
 }
 
 // GetSummaryByCategory summarizes a Result
 func (c Result) GetSummaryByCategory() CountSummaryByCategory {
 	summary := c.Results.GetSummaryByCategory()
-	summary.AddSummary(c.PodResult.GetSummaryByCategory())
+	if c.PodResult != nil {
+		summary.AddSummary(c.PodResult.GetSummaryByCategory())
+	}
 	return summary
 }
 

test/checks/insecureCapabilities/failure.drop-most.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - NET_ADMIN
+          - CHOWN
+          - DAC_OVERRIDE
+          - FSETID
+          - FOWNER
+          - MKNOD
+          - NET_RAW
+          - SETGID
+          - SETUID
+          - SETFCAP
+          - SETPCAP
+          - NET_BIND_SERVICE
+          - SYS_CHROOT
+          - KILL
+
+

test/checks/insecureCapabilities/failure.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx

test/checks/insecureCapabilities/success.drop.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - ALL

test/checks/insecureCapabilities/success.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - NET_ADMIN
+          - CHOWN
+          - DAC_OVERRIDE
+          - FSETID
+          - FOWNER
+          - MKNOD
+          - NET_RAW
+          - SETGID
+          - SETUID
+          - SETFCAP
+          - SETPCAP
+          - NET_BIND_SERVICE
+          - SYS_CHROOT
+          - KILL
+          - AUDIT_WRITE
+

test/checks/privilegeEscalationAllowed/failure.unspecified.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx

test/checks/privilegeEscalationAllowed/failure.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      allowPrivilegeEscalation: true
+

test/checks/privilegeEscalationAllowed/success.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      allowPrivilegeEscalation: false

test/webhook_cases/failing_test.daemonset.v1beta2.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1beta2
 kind: DaemonSet
 metadata:
   name: fluentd-elasticsearch
-  namespace: kube-system
   labels:
     k8s-app: fluentd-logging
 spec:

test/webhook_cases/failing_test.daemonset.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: fluentd-elasticsearch
-  namespace: kube-system
   labels:
     k8s-app: fluentd-logging
 spec:
@@ -45,4 +44,4 @@ spec:
       - name: varlibdockercontainers
         hostPath:
           path: /var/lib/docker/containers
-        
+        

test/webhook_cases/passing_test.daemonset.v1beta2.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1beta2
 kind: DaemonSet
 metadata:
   name: fluentd-elasticsearch
-  namespace: kube-system
   labels:
     k8s-app: fluentd-logging
 spec:

test/webhook_cases/passing_test.daemonset.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: fluentd-elasticsearch
-  namespace: kube-system
   labels:
     k8s-app: fluentd-logging
 spec:
@@ -45,4 +44,4 @@ spec:
       - name: varlibdockercontainers
         hostPath:
           path: /var/lib/docker/containers
-        
+        

test/webhook_cases/passing_test.deployment.annotations.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+  annotations:
+    polaris.fairwinds.com/exempt: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.7.9
+        ports:
+        - containerPort: 80
+        securityContext:
+          allowPrivilegeEscalation: true
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+              - ALL

test/webhook_test.sh

@@ -1,17 +1,27 @@
 #!/bin/bash
 set -e
 
-#sed is replacing the polaris version with this commit sha so we are testing exactly this verison.
-sed -r "s|'(quay.io/fairwinds/polaris:).+'|'\1${CIRCLE_SHA1}'|" ./deploy/webhook.yaml > ./deploy/webhook-test.yaml
-
 # Testing to ensure that the webhook starts up, allows a correct deployment to pass,
-# and prevents a incorrectly formatted deployment. 
+# and prevents a incorrectly formatted deployment.
+BLUE='\033[0;34m'
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+NC='\033[0m' # No Color
+
+function get_timeout() {
+  if [[ "$OSTYPE" == "darwin"* ]]; then
+    date -v+4M +%s
+  else
+    date -d "+4 minutes" +%s
+  fi
+}
+
 function check_webhook_is_ready() {
     # Get the epoch time in one minute from now
     local timeout_epoch
 
     # Reset another 4 minutes to wait for webhook
-    timeout_epoch=$(date -d "+4 minutes" +%s)
+    timeout_epoch=$(get_timeout)
 
     # loop until this fails (desired condition is we cannot apply this yaml doc, which means the webhook is working
     echo "Waiting for webhook to be ready"
@@ -34,19 +44,23 @@ function check_timeout() {
         clean_up
         exit 1
     fi
-
 }
 
 # Clean up all your stuff
 function clean_up() {
+    echo -e "\n\nCleaning up (you may see some errors)...\n\n"
+    kubectl delete ns scale-test || true
+    kubectl delete ns polaris || true
+    kubectl delete ns tests || true
     # Clean up files you've installed (helps with local testing)
     for filename in test/webhook_cases/*.yaml; do
         # || true to avoid issues when we cannot delete
-        kubectl delete -f $filename &>/dev/null ||true
+        kubectl delete -f $filename ||true
     done
     # Uninstall webhook and webhook config
-    kubectl delete validatingwebhookconfigurations polaris-webhook --wait=false &>/dev/null
-    kubectl -n polaris delete deploy -l app=polaris --wait=false &>/dev/null
+    kubectl delete validatingwebhookconfigurations polaris-webhook --wait=false
+    kubectl -n polaris delete deploy -l app=polaris --wait=false
+    echo -e "\n\nDone cleaning up\n\n"
 }
 
 function grab_logs() {
@@ -56,39 +70,60 @@ function grab_logs() {
     kubectl -n polaris logs -l app=polaris
 }
 
-# Install a bad deployment
+#sed is replacing the polaris version with this commit sha so we are testing exactly this verison.
+if [ -z "${POLARIS_IMAGE}" ]; then
+  POLARIS_IMAGE="quay.io/fairwinds/polaris:$CIRCLE_SHA1"
+fi
+echo "using image $POLARIS_IMAGE"
+sed -E "s|'(quay.io/fairwinds/polaris:).+'|'${POLARIS_IMAGE}'|" ./deploy/webhook.yaml > ./deploy/webhook-test.yaml
+
+clean_up || true
+
+echo -e "Setting up..."
 kubectl create ns scale-test
+kubectl create ns polaris
+kubectl create ns tests
+
+# Install a bad deployment
 kubectl apply -n scale-test -f ./test/webhook_cases/failing_test.deployment.yaml
 
-# Install the webhook 
-kubectl apply -f ./deploy/webhook-test.yaml &> /dev/null
-
+# Install the webhook
+kubectl apply -n polaris -f ./deploy/webhook-test.yaml
 
 # wait for the webhook to come online
 check_webhook_is_ready
-sleep 30
+sleep 5
+
+kubectl logs -n polaris $(kubectl get po -oname -n polaris | grep webhook) --follow &
 
 # Webhook started, setting all tests as passed initially.
 ALL_TESTS_PASSED=1
 
 # Run tests against correctly configured objects
 for filename in test/webhook_cases/passing_test.*.yaml; do
-    echo $filename
-    if ! kubectl apply -f $filename &> /dev/null; then
+    echo -e "\n\n"
+    echo -e "${BLUE}TEST CASE: $filename${NC}"
+    if ! kubectl apply -n tests -f $filename; then
         ALL_TESTS_PASSED=0
-        echo "Test Failed: Polaris prevented a deployment with no configuration issues." 
-        kubectl logs -n polaris $(kubectl get po -oname -n polaris | grep webhook)
+        echo -e "${RED}****Test Failed: Polaris prevented a resource with no configuration issues****${NC}"
+    else
+        echo -e "${GREEN}****Test Passed: Polaris correctly allowed this resource****${NC}"
     fi
+    kubectl delete -n tests -f $filename || true
 done
 
 # Run tests against incorrectly configured objects
 for filename in test/webhook_cases/failing_test.*.yaml; do
-    echo $filename
-    if kubectl apply -f $filename &> /dev/null; then
+    echo -e "\n\n"
+    echo -e "${BLUE}TEST CASE: $filename${NC}"
+    if kubectl apply -n tests -f $filename; then
         ALL_TESTS_PASSED=0
-        echo "Test Failed: Polaris should have prevented this deployment due to configuration issues."
+        echo -e "${RED}****Test Failed: Polaris should have prevented this resource due to configuration issues.****${NC}"
         kubectl logs -n polaris $(kubectl get po -oname -n polaris | grep webhook)
+    else
+      echo -e "${GREEN}****Test Passed: Polaris correctly prevented this resource****${NC}"
     fi
+    kubectl delete -n tests -f $filename || true
 done
 
 kubectl -n scale-test scale deployment nginx-deployment --replicas=2
@@ -100,7 +135,9 @@ if [ $pod_count != 2 ]; then
   echo "Existing deployment was unable to scale after webhook installed: found $pod_count pods"
 fi
 
-clean_up
+if [ -z $SKIP_FINAL_CLEANUP ]; then
+  clean_up
+fi
 
 #Verify that all the tests passed.
 if [ $ALL_TESTS_PASSED -eq 1 ]; then