Add a --namespace flag to the in-cluster audit (#742 )

merge the list of resources from custom checks and the generated controller list before deduplicating them (#727 )
Co-authored-by: Robert Brennan <accounts@rbren.io>
2026-08-29 22:17:16 +00:00 · 2022-04-08 07:54:03 -06:00 · 2022-04-07 10:18:04 -04:00 · 2022-04-07 09:11:51 -04:00 · 2022-04-07 09:10:57 -04:00 · 2022-04-05 16:20:34 +03:00
93 changed files with 18356 additions and 2314 deletions
@@ -1,5 +1,8 @@
 version: 2.1

+orbs:
+  rok8s: fairwinds/rok8s-scripts@11
+
 executors:
  vm:
    machine:
@@ -82,16 +85,6 @@ references:
          echo "Skipping Kubernetes tests for forked PR"
        fi

-  # Release scripts
-  install_goreleaser: &install_goreleaser
-    run:
-      name: Install GoReleaser
-      command: |
-        curl -fsSLo goreleaser.deb https://github.com/goreleaser/goreleaser/releases/download/v0.131.1/goreleaser_amd64.deb
-        echo "640790dcbfa864f26de4c26c2d491f293a64525c8c6641c5bbdec7136b38977e goreleaser.deb" | sha256sum -c -
-        sudo dpkg -i goreleaser.deb
-        rm goreleaser.deb
-
  docker_build: &docker_build
    run:
      name: Docker login and build
@@ -117,6 +110,26 @@ references:
        curl -X POST "$upload_url?name=dashboard.yaml" --data-binary "@./deploy/dashboard.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
        curl -X POST "$upload_url?name=webhook.yaml" --data-binary "@./deploy/webhook.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"

+  enable_experimental_features: &enable_experimental_docker_features
+    run:
+      name: enable experimental features
+      command: |
+        set -ex
+        apk --update add openssh
+        ssh remote-docker \<<EOF
+          sudo bash -c 'echo "{\"experimental\": true}" > /etc/docker/daemon.json'
+          sudo systemctl restart docker
+        EOF
+  install_vault_alpine: &install_vault_alpine
+    run:
+      name: install hashicorp vault
+      command: |
+        apk --update add curl yq
+        cd /tmp
+        curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+        unzip vault_1.9.3_linux_amd64.zip
+        mv vault /usr/bin/vault
+
 jobs:
  build:
    docker:
@@ -176,16 +189,25 @@ jobs:

  release_binary:
    working_directory: /go/src/github.com/fairwindsops/polaris/
+    resource_class: large
+    shell: /bin/bash
    docker:
-      - image: circleci/golang:1.16
+      - image: goreleaser/goreleaser:v1.3.0
    steps:
      - checkout
-      - setup_remote_docker
+      - setup_remote_docker:
+          version: 20.10.6
+      - *enable_experimental_docker_features
+      - *install_vault_alpine
+      - rok8s/get_vault_env:
+          vault_path: repo/global/env
+      - rok8s/get_vault_env:
+          vault_path: repo/polaris/env
      - *set_environment_variables
-      - *install_goreleaser
      - run: go get -u github.com/gobuffalo/packr/v2/packr2
      - run: git checkout -- . # FIXME: the go get makes the directory dirty
      - run: packr2
+      - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
      - run: goreleaser
      - *release_deploy_configs

@@ -198,7 +220,6 @@ jobs:
      - setup_remote_docker
      - *set_environment_variables
      - *docker_build_and_push
-
  publish_docs:
    docker:
      - image: cimg/node:15.5.1
@@ -213,17 +234,34 @@ jobs:
            npm run check-links
            npm run build
      - run:
-          name: Install AWS CLI
+          name: Install Tools
          command: |
+            cd /tmp
+            echo "Installing AWS CLI"
            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
            unzip awscliv2.zip
            sudo ./aws/install
+
+            echo "Installing Hashicorp Vault"
+            curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+            unzip vault_1.9.3_linux_amd64.zip
+            sudo mv vault /usr/bin/vault
+            sudo chmod +x /usr/bin/vault
+            vault --version
+
+            echo "Installing yq"
+            curl -LO https://github.com/mikefarah/yq/releases/download/v4.16.2/yq_linux_amd64.tar.gz
+            tar -zxvf yq_linux_amd64.tar.gz
+            sudo mv yq_linux_amd64 /usr/bin/yq
+            sudo chmod +x /usr/bin/yq
+            yq --version
+      - rok8s/get_vault_env:
+          vault_path: repo/polaris/env
      - run:
          name: Publish Docs Site to S3
          command: |
            cd ./dist
            aws s3 sync ./ s3://polaris.docs.fairwinds.com --delete
-
 workflows:
  version: 2

@@ -0,0 +1,58 @@
+name: Bug Report
+description: File a bug report
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report! Please fill the form below.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+      description: What is the expected or desired behavior?
+    validations:
+      required: true
+  - type: textarea
+    id: reproducible
+    attributes:
+      label: How can we reproduce this?
+      description: Please share the steps that we can take to reproduce this. Also include any relevant configuration.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The version of the tool that you are using. If a helm chart, please share the name of the chart.
+    validations:
+      required: true
+  - type: checkboxes
+    id: search
+    attributes:
+      label: Search
+      options:
+        - label: I did search for other open and closed issues before opening this.
+          required: true
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow the CODE_OF_CONDUCT in this repository.
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true
+  - type: textarea
+    id: ctx
+    attributes:
+      label: Additional context
+      description: Anything else you would like to add
+    validations:
+      required: false
@@ -1,58 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
---
-
---
-name: Bug report
-about: Let us know about an unexpected error, a crash, or an incorrect behavior.
-
---
-### Installation Process
-<!--- 
-Did you install polaris on your local machine, or in a kubernetes cluster? Did you use kubectl, helm, brew, a GitHub release, or the source code? Let us know below. 
--> 
-
-### Polaris Version
-<!---
-If you are using polaris locally, run `polaris --version` to show the version, and paste the result between the ``` marks below.
-
-If you are not running the latest version of Polaris, please try upgrading because your issue may have already been fixed.
-->
-
-```
-...
-```
-
-### Expected Behavior
-<!--
-What should have happened?
-->
-
-### Actual Behavior
-<!--
-What actually happened?
-->
-
-### Steps to Reproduce
-<!--
-Please list the full steps required to reproduce the issue, for example:
-1. `polaris --audit --output-format score`
-->
-
-### Additional Context
-<!--
-Are there anything atypical about your situation that we should know? 
-->
-
-### References
-<!--
-Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:
-
- #6017
-
-->
@@ -6,5 +6,3 @@ labels: ''
 assignees: ''

 ---
-
-
@@ -3,15 +3,16 @@ if [[ -z "$INPUT_VERSION" ]]; then
  echo "Missing polaris version information"
  exit 1
 fi
+POLARIS_URL=https://github.com/FairwindsOps/polaris/releases/download/$INPUT_VERSION/polaris_linux_amd64.tar.gz
 polaris version | grep "$INPUT_VERSION" &> /dev/null
 if [ $? == 0 ]; then
   echo "Polaris $INPUT_VERSION is already installed! Exiting gracefully."
   exit 0
 else
-  echo "Installing polaris to path."
+  echo "Installing polaris to path from " $POLARIS_URL
 fi
 TARGET_FILE="polaris.tar.gz"
-curl -LJ -o $TARGET_FILE 'https://github.com/FairwindsOps/polaris/releases/download/'"$INPUT_VERSION"'/polaris_'"$INPUT_VERSION"'_linux_386.tar.gz'
+curl -LJ -o $TARGET_FILE $POLARIS_URL
 mkdir polaris
 tar -xzf $TARGET_FILE -C polaris
 rm $TARGET_FILE
@@ -1,44 +1,24 @@
 version: 2
 updates:
- package-ecosystem: gomod
-  directory: "/"
-  schedule:
-    interval: weekly
-    time: "11:00"
-  ignore:
-  - dependency-name: cloud.google.com/go
-    versions:
-    - ">= 0.57.a, < 0.58"
-  - dependency-name: github.com/go-logr/logr
-    versions:
-    - ">= 0.2.a, < 0.3"
-  - dependency-name: github.com/go-logr/zapr
-    versions:
-    - ">= 0.2.a, < 0.3"
-  - dependency-name: github.com/googleapis/gnostic
-    versions:
-    - ">= 0.4.a, < 0.5"
-  - dependency-name: github.com/googleapis/gnostic
-    versions:
-    - ">= 0.5.a, < 0.6"
-  - dependency-name: github.com/qri-io/jsonschema
-    versions:
-    - ">= 0.2.a, < 0.3"
-  - dependency-name: k8s.io/api
-    versions:
-    - ">= 0.19.a, < 0.20"
-  - dependency-name: k8s.io/apimachinery
-    versions:
-    - ">= 0.19.a, < 0.20"
-  - dependency-name: k8s.io/client-go
-    versions:
-    - ">= 0.19.a, < 0.20"
-  - dependency-name: sigs.k8s.io/controller-runtime
-    versions:
-    - ">= 0.5.a, < 0.6"
-  - dependency-name: sigs.k8s.io/controller-runtime
-    versions:
-    - ">= 0.8.a, < 0.9"
-  - dependency-name: k8s.io/apimachinery
-    versions:
-    - 0.20.4
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
@@ -0,0 +1,13 @@
+This PR fixes #
+
+## Checklist
+* [ ] I have signed the CLA
+* [ ] I have updated/added any relevant documentation
+
+## Description
+### What's the goal of this PR?
+
+### What changes did you make?
+
+### What alternative solution should we consider, if any?
+
@@ -1,18 +0,0 @@
-daysUntilStale: 30
-daysUntilClose: 7
-onlyLabels: []
-exemptLabels:
-  - pinned
-  - security
-
-exemptProjects: false
-exemptMilestones: true
-exemptAssignees: false
-staleLabel: stale
-
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-
-limitPerRun: 30
@@ -0,0 +1,18 @@
+name: 'Close stale issues and PRs'
+on:
+  schedule:
+    - cron: '32 1 * * *'
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v4
+        with:
+          exempt-issue-labels: pinned
+          stale-pr-label: stale
+          stale-issue-label: stale
@@ -11,7 +11,7 @@ jobs:
      - name: Setup polaris
        uses: ./.github/actions/setup-polaris
        with:
-          version: 3.0.3
+          version: 4.2.0
      - name: Use command
        run: polaris version

@@ -22,6 +22,6 @@ jobs:
      - name: Setup polaris
        uses: fairwindsops/polaris/.github/actions/setup-polaris@master
        with:
-          version: 3.0.3
+          version: 4.2.0
      - name: Use command
        run: polaris version
@@ -1,4 +1,5 @@
 # Binaries for programs and plugins
+.go-version
 *.exe
 *.exe~
 *.dll
@@ -7,10 +7,14 @@ changelog:
    - '^docs:'
    - '^test:'
 builds:
-  - id: watcher
+  - id: polaris
    env:
      - CGO_ENABLED=0
      - GO111MODULE=on
+    goos:
+      - linux
+      - darwin
+      - windows
    goarch:
      - amd64
      - arm
@@ -18,9 +22,25 @@ builds:
    goarm:
      - 6
      - 7
+archives:
+  - id: polaris
+    builds: ["polaris"]
+    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
+signs:
+- cmd: cosign
+  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
+  artifacts: checksum
+release:
+  prerelease: auto
+  footer: |
+    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
+
+    ```
+    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
+    ```
 brews:
  - name: polaris
-    github:
+    tap:
      owner: FairwindsOps
      name: homebrew-tap
    folder: Formula
@@ -0,0 +1,24 @@
+header:
+  license:
+    spdx-id: Apache-2.0
+    copyright-owner: 'FairwindsOps, Inc.'
+  content: |
+    // Copyright 2019 FairwindsOps Inc
+    //
+    // Licensed under the Apache License, Version 2.0 (the "License");
+    // you may not use this file except in compliance with the License.
+    // You may obtain a copy of the License at
+    //
+    //     http://www.apache.org/licenses/LICENSE-2.0
+    //
+    // Unless required by applicable law or agreed to in writing, software
+    // distributed under the License is distributed on an "AS IS" BASIS,
+    // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    // See the License for the specific language governing permissions and
+    // limitations under the License.
+  paths:
+    - '**/*.go'
+  comment: on-failure
+dependency:
+  files:
+    - go.mod
@@ -1 +1,2 @@
-* @rbren @makoscafee @baderbuddy
+## DO NOT EDIT - Managed by Terraform
+* @rbren @makoscafee
@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at opensource@fairwinds.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/
@@ -1,4 +1,4 @@
-FROM golang:1.16 AS build-env
+FROM golang:1.17 AS build-env
 WORKDIR /go/src/github.com/fairwindsops/polaris/

 ENV GO111MODULE=on
@@ -15,7 +15,7 @@ RUN go get -u github.com/gobuffalo/packr/v2/packr2
 COPY . .
 RUN packr2 build -a -o polaris *.go

-FROM alpine:3.13
+FROM alpine:3.15.3
 WORKDIR /usr/local/bin
 RUN apk --no-cache add ca-certificates

@@ -3,7 +3,7 @@
  <br>
  <h3>Best Practices for Kubernetes Workload Configuration</h3>
  <a href="https://github.com/FairwindsOps/polaris">
-    <img src="https://img.shields.io/static/v1.svg?label=Version&message=4.0.4&color=239922">
+    <img src="https://img.shields.io/static/v1.svg?label=Version&message=5.1.0&color=239922">
  </a>
  <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
    <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
@@ -32,10 +32,18 @@ Polaris can be run in three different modes:
 ## Documentation
 Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)

+<!-- Begin boilerplate -->
 ## Join the Fairwinds Open Source Community

-The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap, and network with fellow Kubernetes users. [Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g) or [join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
+The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap,
+and network with fellow Kubernetes users.
+[Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)
+or
+[join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!

+<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
+</a>

 ## Other Projects from Fairwinds

@@ -45,14 +53,14 @@ Enjoying Polaris? Check out some of our other projects:
 * [Nova](https://github.com/FairwindsOps/Nova) - Check to see if any of your Helm charts have updates available
 * [rbac-manager](https://github.com/FairwindsOps/rbac-manager) - Simplify the management of RBAC in your Kubernetes clusters

+Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris)
 ## Fairwinds Insights
-<p align="center">
-  <a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
-    <img src="https://polaris.docs.fairwinds.com/img/insights-banner.png" alt="Fairwinds Insights" width="550"/>
-  </a>
-</p>
-
 If you're interested in running Polaris in multiple clusters,
 tracking the results over time, integrating with Slack, Datadog, and Jira,
 or unlocking other functionality, check out
-[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris), a platform for auditing and enforcing policy in Kubernetes clusters.
+[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris),
+a platform for auditing and enforcing policy in Kubernetes clusters.
+
+<a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
+</a>
@@ -17,10 +17,10 @@ schema:
              allOf:
                - not:
                    contains:
-                      const: ALL
+                      pattern: '^(?i)ALL$'
                - not:
                    contains:
-                      const: SYS_ADMIN
+                      pattern: '^(?i)SYS_ADMIN$'
                - not:
                    contains:
-                      const: NET_ADMIN
+                      pattern: '^(?i)NET_ADMIN$'
@@ -22,35 +22,35 @@ schema:
              type: array
              oneOf:
              - contains:
-                  const: ALL
+                  pattern: '^(?i)ALL$'
              - allOf:
                - contains:
-                    const: NET_ADMIN
+                    pattern: '^(?i)NET_ADMIN$'
                - contains:
-                    const: CHOWN
+                    pattern: '^(?i)CHOWN$'
                - contains:
-                    const: DAC_OVERRIDE
+                    pattern: '^(?i)DAC_OVERRIDE$'
                - contains:
-                    const: FSETID
+                    pattern: '^(?i)FSETID$'
                - contains:
-                    const: FOWNER
+                    pattern: '^(?i)FOWNER$'
                - contains:
-                    const: MKNOD
+                    pattern: '^(?i)MKNOD$'
                - contains:
-                    const: NET_RAW
+                    pattern: '^(?i)NET_RAW$'
                - contains:
-                    const: SETGID
+                    pattern: '^(?i)SETGID$'
                - contains:
-                    const: SETUID
+                    pattern: '^(?i)SETUID$'
                - contains:
-                    const: SETFCAP
+                    pattern: '^(?i)SETFCAP$'
                - contains:
-                    const: SETPCAP
+                    pattern: '^(?i)SETPCAP$'
                - contains:
-                    const: NET_BIND_SERVICE
+                    pattern: '^(?i)NET_BIND_SERVICE$'
                - contains:
-                    const: SYS_CHROOT
+                    pattern: '^(?i)SYS_CHROOT$'
                - contains:
-                    const: KILL
+                    pattern: '^(?i)KILL$'
                - contains:
-                    const: AUDIT_WRITE
+                    pattern: '^(?i)AUDIT_WRITE$'
@@ -1,18 +1,22 @@
-successMessage: disruptionsAllowed is greater than zero
-failureMessage: disruptionsAllowed is not greater than zero
+successMessage: Voluntary evictions are possible
+failureMessage: Voluntary evictions are not possible
 category: Reliability
 target: policy/PodDisruptionBudget
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
-  - status
+  - spec
  properties:
-    status:
+    spec:
      type: object
-      required:
-      - disruptionsAllowed
      properties:
-        disruptionsAllowed:
-          type: integer
-          minimum: 1
+          minAvailable:
+            not:
+              const: '100%'
+          maxUnavailable:
+            allOf:
+            - not:
+                const: 0
+            - not:
+                const: '0%'
@@ -9,3 +9,7 @@ schema:
  properties:
    imagePullPolicy:
      const: Always
+mutations:
+  - op: add
+    path: /imagePullPolicy
+    value: Always
@@ -24,6 +24,7 @@ import (
 	"os"
 	"os/exec"

+	cfg "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
@@ -31,16 +32,20 @@ import (
 	"sigs.k8s.io/yaml"
 )

-var setExitCode bool
-var onlyShowFailedTests bool
-var minScore int
-var auditOutputURL string
-var auditOutputFile string
-var auditOutputFormat string
-var resourceToAudit string
-var useColor bool
-var helmChart string
-var helmValues string
+var (
+	setExitCode         bool
+	onlyShowFailedTests bool
+	minScore            int
+	auditOutputURL      string
+	auditOutputFile     string
+	auditOutputFormat   string
+	resourceToAudit     string
+	useColor            bool
+	helmChart           string
+	helmValues          string
+	checks              []string
+	auditNamespace      string
+)

 func init() {
 	rootCmd.AddCommand(auditCmd)
@@ -55,7 +60,9 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
-	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-values", "", "Optional flag to add helm values")
+	auditCmd.PersistentFlags().StringVar(&helmValues, "helm-values", "", "Optional flag to add helm values")
+	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
+	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
 }

 var auditCmd = &cobra.Command{
@@ -66,9 +73,29 @@ var auditCmd = &cobra.Command{
 		if displayName != "" {
 			config.DisplayName = displayName
 		}
+		if len(checks) > 0 {
+			targetChecks := make(map[string]bool)
+			for _, check := range checks {
+				targetChecks[check] = true
+			}
+			for key := range config.Checks {
+				if isTarget := targetChecks[key]; !isTarget {
+					config.Checks[key] = cfg.SeverityIgnore
+				}
+			}
+		}
+		if auditNamespace != "" {
+			if helmChart != "" {
+				logrus.Warn("--namespace and --helm-chart are mutually exclusive. --namespace will be ignored.")
+			}
+			if auditPath != "" {
+				logrus.Warn("--namespace and --audit-path are mutually exclusive. --namespace will be ignored.")
+			}
+			config.Namespace = auditNamespace
+		}
 		if helmChart != "" {
 			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart)
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)
 			if err != nil {
 				logrus.Infof("Couldn't process helm chart: %v", err)
 				os.Exit(1)
@@ -102,7 +129,7 @@ var auditCmd = &cobra.Command{
 }

 // ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart string) (string, error) {
+func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
 	cmd := exec.Command("helm", "dependency", "update", helmChart)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -25,10 +25,11 @@ import (
 )

 var configPath string
-var disallowExemptions bool
+var disallowExemptions, disallowConfigExemptions, disallowAnnotationExemptions, fixChecks bool
 var logLevel string
 var auditPath string
 var displayName string
+var kubeContext string

 var (
 	version string
@@ -37,7 +38,10 @@ var (
 func init() {
 	// Flags
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "Location of Polaris configuration file.")
-	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any exemptions from configuration file.")
+	rootCmd.PersistentFlags().StringVarP(&kubeContext, "context", "x", "", "Set the kube context.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level.")
 	flag.Parse()
 	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
@@ -63,10 +67,10 @@ var rootCmd = &cobra.Command{
 			os.Exit(1)
 		}

-		if disallowExemptions {
-			config.DisallowExemptions = true
-		}
-
+		config.DisallowExemptions = disallowExemptions
+		config.DisallowConfigExemptions = disallowConfigExemptions
+		config.DisallowAnnotationExemptions = disallowAnnotationExemptions
+		config.KubeContext = kubeContext
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		logrus.Error("You must specify a sub-command.")
@@ -31,12 +31,12 @@ rules:
    verbs:
      - 'get'
      - 'list'
-  - apiGroups: 
+  - apiGroups:
      - 'monitoring.coreos.com'
-    resources: 
+    resources:
      - 'prometheuses'
      - 'alertmanagers'
-    verbs: 
+    verbs:
      - 'get'
      - 'list'
 ---
@@ -102,7 +102,7 @@ metadata:
    app: polaris
    component: dashboard
 spec:
-  replicas: 1
+  replicas: 2
  selector:
    matchLabels:
      app: polaris
@@ -119,7 +119,7 @@ spec:
        - dashboard
        - --port
        - "8080"
-        image: 'quay.io/fairwinds/polaris:4.0'
+        image: 'quay.io/fairwinds/polaris:5.1'
        imagePullPolicy: 'Always'
        name: dashboard
        ports:
@@ -31,12 +31,12 @@ rules:
    verbs:
      - 'get'
      - 'list'
-  - apiGroups: 
+  - apiGroups:
      - 'monitoring.coreos.com'
-    resources: 
+    resources:
      - 'prometheuses'
      - 'alertmanagers'
-    verbs: 
+    verbs:
      - 'get'
      - 'list'
 ---
@@ -101,7 +101,7 @@ metadata:
    app: polaris
    component: webhook
 spec:
-  replicas: 1
+  replicas: 2
  selector:
    matchLabels:
      app: polaris
@@ -117,7 +117,7 @@ spec:
          command:
            - polaris
            - webhook
-          image: 'quay.io/fairwinds/polaris:4.0'
+          image: 'quay.io/fairwinds/polaris:5.1'
          imagePullPolicy: 'Always'
          ports:
            - containerPort: 9876
@@ -23,6 +23,13 @@
  color: $successColor;
 }

+blockquote {
+  border-left: 0.2rem solid $warningColor;
+}
+blockquote p {
+  color: $warningColor;
+}
+
 .theme-default-content:not(.custom),
 .page-nav,
 .page-edit,
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation: Polaris can be run as an admission controller that acts as a validating webhook."
+---
 # Admission Controller
 > Want to manage the Admission Controller across multiple clusters? Check out
 > [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
@@ -1,6 +1,40 @@
 ---
 sidebarDepth: 0
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Changelog"
+
 ---
+## 5.1.0
+* Support `--context` flag for kubecontext
+* Treat core Kubernetes controllers (`Deployments`, `StatefulSets`, `DaemonSets`, `CronJobs`) as top-level objects, instead of following owner refs
+
+## 5.0.0
+* Renamed `multipleReplicasForDeployment` to `deploymentMissingReplicas`
+* Changed `RunAsRootAllowed` and `hostNetworkSet` default severity to `danger`
+* Changed `deploymentMissingReplicas` default severity to `warning`
+
+## 4.2.0
+* New flags `--disallow-(config|annotation)-exemptions`
+* Kubernetes dependency updates
+* Documentation updates
+## 4.1.0
+* Handle case-insentitivity in capabilities checks
+* Change test for PDB disruptions to better handle IaC
+
+## 4.0.9
+* Update Alpine base image
+
+## 4.0.8
+* Fix support for namespace checks
+
+## 4.0.7
+* Fix goreleaser format
+
+## 4.0.6
+* Change goreleaser format
+* Fix `--helm-values` flag
+
 ## 4.0.5
 * Bugfix for repeated objects on the dashboard

@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Ensure that CPU and memory settings are configured, so that Kubernetes can schedule your workload effectively"
+---
 # Efficiency

 These checks ensure that CPU and memory settings are configured, so that
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Make sure your Kubernetes workloads are always available, and are running the correct image."
+---
 # Reliability

 These checks help to make sure your workloads are always available,
@@ -10,7 +15,7 @@ key | default | description
 `tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
 `pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
 `priorityClassNotSet` | `ignore` | Fails when a priorityClassName is not set for a pod.
-`multipleReplicasForDeployment` | `ignore` | Fails when there is only one replica for a deployment.
+`deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
 `missingPodDisruptionBudget` | `ignore` 

 ## Background
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Security Checks Documentation"
+---
 # Security

 These checks are related to security concerns. Workloads that fail these
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Learn your CLI options"
+---
 #### CLI Options

 ```
@@ -14,10 +19,13 @@ webhook
      Runs the webhook webserver

 # global flags
-c, --config string         Location of Polaris configuration file.
-    --disallow-exemptions   Disallow any exemptions from configuration file.
-    --kubeconfig string     Paths to a kubeconfig. Only required if out-of-cluster.
-    --log-level string      Logrus log level. (default "info")
+-c, --config string                    Location of Polaris configuration file.
+-x, --context string                   Set the kube context.
+    --disallow-exemptions              Disallow any exemptions from configuration file.
+    --disallow-config-exemptions       Disallow exemptions set within the configuration file.
+    --disallow-annotation-exemptions   Disallow any exemption defined as a controller annotation.
+    --kubeconfig string                Paths to a kubeconfig. Only required if out-of-cluster.
+    --log-level string                 Logrus log level. (default "info")

 # dashboard flags
    --audit-path string          If specified, audits one or more YAML files instead of a cluster.
@@ -30,12 +38,14 @@ webhook

 # audit flags
    --audit-path string               If specified, audits one or more YAML files instead of a cluster.
+    --checks stringArray              Optional flag to specify specific checks to check
    --color                           Whether to use color in pretty format. (default true)
    --display-name string             An optional identifier for the audit.
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
    --helm-chart string               Will fill out Helm template
    --helm-values string              Optional flag to add helm values
 -h, --help                            help for audit
+    --namespace string                Namespace to audit. Only applies to in-cluster audits
    --only-show-failed-tests          If specified, audit output will only show failed tests.
    --output-file string              Destination file for audit results.
    --output-url string               Destination URL to send audit results.
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Contribution Code of Conduct"
+---
 # Code of Conduct

 ## Our Pledge
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Contribution Guidelines"
+---
 # Contributing

 Issues, whether bugs, tasks, or feature requests are essential for keeping Polaris great. We believe it should be as easy as possible to contribute changes that get things working in your environment. There are a few guidelines that we need contributors to follow so that we can keep on top of things.
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation on setting checks by severity "
+---
 # Check Settings
 Each check can be assigned a `severity`. Only checks with a severity of `danger` or `warning` will be validated. The results of these validations are visible on the dashboard. In the case of the validating webhook, only failures with a severity of `danger` will result in a change being rejected.

@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Learn about Polaris defaults and how to customize configurations. "
+---
 # Configuration

 The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/examples/config.yaml).
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation: Create your own checks, you can use JSON Schema"
+---
 # Custom Checks

 If you'd like to create your own checks, you can use [JSON Schema](https://json-schema.org/).
@@ -93,6 +98,19 @@ customChecks:
                  resourceMaximum: "2"
 ```

+## Resource Presence
+You can test for the presence of a resource in each Namespace. For example, to
+ensure an AlertmanagerConfig is in every Namespace:
+```yaml
+successMessage: Namespace has monitoring configuration
+failureMessage: Namespace should have monitoring configuration
+category: Security
+target: Namespace
+schema: {}
+additionalSchemas:
+  monitoring.coreos.com/AlertmanagerConfig: {}
+```
+
 ## Templating
 You can also utilize go templating in your JSON schema in order to match one field against another.
 E.g. here is the built-in check to ensure that the `name` annotation matches the object's name:
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Exemptions"
+---
 # Exemptions
 Sometimes a workload really does need to do things that Polaris considers insecure. For instance,
 many of the `kube-system` workloads need to run as root, or need access to the host network. In these
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Ways to run Polaris | The Polaris dashboard can be installed on a cluster using kubectl or Helm"
+---
 # Dashboard

 > Want to see Polaris results for all your clusters in a single dashboard? Check out
@@ -1,3 +1,8 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation | Polaris can be used on the command line to audit local Kubernetes manifests stored in YAML files."
+---
 # Infrastructure as Code
 > Want to see results for all your IaC repos in one place? Check out
 > [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
@@ -83,9 +88,9 @@ The version number of the release tag.
 ##### Example usage

 ```yaml
-uses: fairwindsops/polaris@master
+uses: fairwindsops/polaris/.github/actions/setup-polaris@master
 with:
-  version: "3.0.3"
+  version: 5.0.0
 ```

 Example inside a job:
@@ -94,9 +99,9 @@ Example inside a job:
 steps:
  - uses: actions/checkout@v2
  - name: Setup polaris
-    uses: fairwindsops/polaris@master
+    uses: fairwindsops/polaris/.github/actions/setup-polaris@master
    with:
-      version: 3.0.3
+      version: 5.0.0

  - name: Use command
    run: polaris version
@@ -0,0 +1,5 @@
+---
+meta:
+  - name: description
+    content: "Fairwinds Polaris | Documentation"
+---
@@ -26,7 +26,8 @@
  "scripts": {
    "build": "npm run build:readme && npm run build:docs",
    "build:docs": "vuepress build -d ../dist/",
-    "build:readme": "cat ../README.md | grep -v 'ocumentation' | sed \"s/https:\\/\\/\\w\\+.docs.fairwinds.com//g\" > README.md",
+    "build:metadata": "cat main-metadata.md > README.md || true",
+    "build:readme": "npm run build:metadata && cat ../README.md | grep -v 'ocumentation' | sed \"s/https:\\/\\/\\w\\+.docs.fairwinds.com//g\" >> README.md",
    "check-links": "vuepress check-md",
    "serve": "npm run build:readme && vuepress dev --port 3003",
    "vuepress": "vuepress"
@@ -1,6 +1,6 @@
 checks:
  # reliability
-  multipleReplicasForDeployment: warning
+  deploymentMissingReplicas: warning
  priorityClassNotSet: warning
  tagNotSpecified: danger
  pullPolicyNotAlways: warning
@@ -16,16 +16,17 @@ checks:
  hostPIDSet: danger
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
-  runAsRootAllowed: warning
+  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
  insecureCapabilities: warning
-  hostNetworkSet: warning
+  hostNetworkSet: danger
  hostPortSet: warning
  # custom
  resourceLimits: warning
  imageRegistry: danger

+  
 exemptions:
  - controllerNames:
    - my-network-controller
@@ -87,3 +88,4 @@ customChecks:
          not:
            pattern: ^quay.io

+namespce: test-ns
@@ -1,6 +1,6 @@
 checks:
  # reliability
-  multipleReplicasForDeployment: ignore
+  deploymentMissingReplicas: warning
  priorityClassNotSet: ignore
  tagNotSpecified: danger
  pullPolicyNotAlways: warning
@@ -20,14 +20,15 @@ checks:
  hostPIDSet: danger
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
-  runAsRootAllowed: warning
+  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
  insecureCapabilities: warning
-  hostNetworkSet: warning
+  hostNetworkSet: danger
  hostPortSet: warning
  tlsSettingsMissing: warning

+
 exemptions:
  - namespace: kube-system
    controllerNames:
@@ -201,3 +202,5 @@ exemptions:
      - kube-hunter
    rules:
      - runAsRootAllowed
+
+namespace: test-ns
@@ -3,10 +3,9 @@ module github.com/fairwindsops/polaris
 go 1.15

 require (
-	cloud.google.com/go v0.74.0 // indirect
-	github.com/Azure/go-autorest/autorest v0.11.15 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.10 // indirect
-	github.com/fatih/color v1.12.0
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.6.0
+	github.com/fatih/color v1.13.0
 	github.com/gobuffalo/packr/v2 v2.8.1
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.1.3 // indirect
@@ -15,14 +14,15 @@ require (
 	github.com/qri-io/jsonschema v0.1.1
 	github.com/rogpeppe/go-internal v1.6.2 // indirect
 	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.1.3
+	github.com/spf13/cobra v1.3.0
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.7.0
-	github.com/thoas/go-funk v0.8.0
+	github.com/thoas/go-funk v0.9.1
+	golang.org/x/text v0.3.7 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
-	k8s.io/api v0.21.2
-	k8s.io/apimachinery v0.21.2
-	k8s.io/client-go v0.21.2
-	sigs.k8s.io/controller-runtime v0.9.0
-	sigs.k8s.io/yaml v1.2.0
+	k8s.io/api v0.22.2
+	k8s.io/apimachinery v0.22.2
+	k8s.io/client-go v0.22.2
+	sigs.k8s.io/controller-runtime v0.10.1
+	sigs.k8s.io/yaml v1.3.0
 )
@@ -15,12 +15,12 @@
 package main

 import (
-	"github.com/fairwindsops/polaris/cmd/polaris"
+	cmd "github.com/fairwindsops/polaris/cmd/polaris"
 )

 const (
 	// Version represents the current release version of Polaris
-	Version = "4.0.5"
+	Version = "5.1.0"
 )

 func main() {
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config

 import (
@@ -13,7 +27,7 @@ var (
 	// tests as we migrate toward JSON schema
 	checkOrder = []string{
 		// Controller Checks
-		"multipleReplicasForDeployment",
+		"deploymentMissingReplicas",
 		// Pod checks
 		"hostIPCSet",
 		"hostPIDSet",
@@ -29,11 +29,16 @@ import (

 // Configuration contains all of the config for the validation checks.
 type Configuration struct {
-	DisplayName        string                 `json:"displayName"`
-	Checks             map[string]Severity    `json:"checks"`
-	CustomChecks       map[string]SchemaCheck `json:"customChecks"`
-	Exemptions         []Exemption            `json:"exemptions"`
-	DisallowExemptions bool                   `json:"disallowExemptions"`
+	DisplayName                  string                 `json:"displayName"`
+	Checks                       map[string]Severity    `json:"checks"`
+	CustomChecks                 map[string]SchemaCheck `json:"customChecks"`
+	Exemptions                   []Exemption            `json:"exemptions"`
+	DisallowExemptions           bool                   `json:"disallowExemptions"`
+	DisallowConfigExemptions     bool                   `json:"disallowConfigExemptions"`
+	DisallowAnnotationExemptions bool                   `json:"disallowAnnotationExemptions"`
+	Mutations                    []string               `json:"mutations"`
+	KubeContext                  string                 `json:"kubeContext"`
+	Namespace                    string                 `json:"namespace"`
 }

 // Exemption represents an exemption to normal rules
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config

 import (
@@ -11,7 +25,7 @@ func (conf Configuration) IsActionable(ruleID string, objMeta metav1.Object, con
 	if severity, ok := conf.Checks[ruleID]; !ok || !severity.IsActionable() {
 		return false
 	}
-	if conf.DisallowExemptions {
+	if conf.DisallowExemptions || conf.DisallowConfigExemptions {
 		return true
 	}
 	for _, exemption := range conf.Exemptions {
@@ -25,40 +25,40 @@ import (

 var confContainerTest = `
 checks:
-  multipleReplicasForDeployment: warning
+  deploymentMissingReplicas: warning
  priorityClassNotSet: warning
  pullPolicyNotAlways: warning
 exemptions:
  - namespace: prometheus
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
  - controllerNames: 
      - controller2
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
  - namespace: kube-system
    controllerNames:
      - controller3
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
  - containerNames:
      - container41
      - container42
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
  - namespace: kube-system
    containerNames:
      - container51
      - container52
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
  - controllerNames:
      - controller6
    containerNames:
      - container61
      - container62
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
  - namespace: kube-system
    controllerNames:
      - controller7
@@ -66,7 +66,7 @@ exemptions:
      - container71
      - container72
    rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
      - priorityClassNotSet
  - namespace: polaris
 `
@@ -86,22 +86,22 @@ func TestNamespaceExemptionForSpecifiedRules(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", ""), "")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", ""), "")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller1"), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller1"), "container11")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", ""), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", ""), "container11")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller1"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller1"), "")
 	assert.False(t, actionable)

 	actionable = parsedConf.IsActionable("pullPolicyNotAlways", createMeta("prometheus", "controller1"), "")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "")
 	assert.True(t, actionable)
 }

@@ -109,16 +109,16 @@ func TestNamespaceExemptionForAllRules(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", ""), "")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", ""), "")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", "controller1"), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", "controller1"), "container11")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", ""), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", ""), "container11")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", "controller1"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", "controller1"), "")
 	assert.False(t, actionable)

 	actionable = parsedConf.IsActionable("pullPolicyNotAlways", createMeta("polaris", "controller1"), "")
@@ -129,28 +129,28 @@ func TestControllerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller2"), "")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller2"), "")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller2"), "container21")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller2"), "container21")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller2"), "container21")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller2"), "container21")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller2"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller2"), "")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller3"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller3"), "")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller3"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller3"), "")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller3"), "container31")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller3"), "container31")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller4"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller4"), "")
 	assert.True(t, actionable)
 }

@@ -158,22 +158,22 @@ func TestOnlyContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container41")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container41")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container42")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container42")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller4"), "container41")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller4"), "container41")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container41")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container41")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller4"), "container41")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller4"), "container41")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container51")
 	assert.True(t, actionable)
 }

@@ -181,25 +181,25 @@ func TestNamespaceAndContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container51")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container51")
 	assert.False(t, actionable)

 	actionable = parsedConf.IsActionable("priorityClassNotSet", createMeta("kube-system", ""), "container51")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller5"), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller5"), "container51")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller5"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller5"), "")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("insights-agent", ""), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("insights-agent", ""), "container51")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container51")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller5"), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller5"), "container51")
 	assert.True(t, actionable)
 }

@@ -207,25 +207,25 @@ func TestControllerAndContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller6"), "container61")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller6"), "container61")
 	assert.False(t, actionable)

 	actionable = parsedConf.IsActionable("priorityClassNotSet", createMeta("", "controller6"), "container61")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller6"), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller6"), "container61")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller6"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller6"), "")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller7"), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller7"), "container61")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container61")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container61")
 	assert.True(t, actionable)
 }

@@ -233,28 +233,28 @@ func TestContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)

-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container71")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container71")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container71")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller7"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller7"), "container71")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller7"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller7"), "")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller7"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller7"), "container71")
 	assert.False(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("insights-agent", "controller7"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("insights-agent", "controller7"), "container71")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller6"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller6"), "container71")
 	assert.True(t, actionable)

-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller7"), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller7"), "container61")
 	assert.True(t, actionable)

 	actionable = parsedConf.IsActionable("priorityClassNotSet", createMeta("kube-system", "controller7"), "container71")
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config

 import (
@@ -51,6 +65,7 @@ type SchemaCheck struct {
 	AdditionalSchemas       map[string]map[string]interface{} `yaml:"additionalSchemas" json:"additionalSchemas"`
 	AdditionalSchemaStrings map[string]string                 `yaml:"additionalSchemaStrings" json:"additionalSchemaStrings"`
 	AdditionalValidators    map[string]jsonschema.RootSchema  `yaml:"-" json:"-"`
+	Mutations               []map[string]interface{}          `yaml:"mutations" json:"mutations"`
 }

 type resourceMinimum string
@@ -167,6 +182,9 @@ func (check *SchemaCheck) Initialize(id string) error {
 		}
 		check.SchemaString = string(jsonBytes)
 	}
+	if check.AdditionalSchemaStrings == nil {
+		check.AdditionalSchemaStrings = make(map[string]string)
+	}
 	for kind, schema := range check.AdditionalSchemas {
 		jsonBytes, err := json.Marshal(schema)
 		if err != nil {
@@ -130,13 +130,17 @@ func writeTemplate(tmpl *template.Template, data *templateData, w http.ResponseW

 func getConfigForQuery(base config.Configuration, query url.Values) config.Configuration {
 	c := base
-	exemptions := query.Get("disallowExemptions")
-	if exemptions == "false" {
-		c.DisallowExemptions = false
-	}
-	if exemptions == "true" {
+	switch query.Get("disallowExemptions") {
+	case "true":
 		c.DisallowExemptions = true
+		c.DisallowConfigExemptions = true
+		c.DisallowAnnotationExemptions = true
+	default:
+		c.DisallowExemptions = false
+		c.DisallowConfigExemptions = false
+		c.DisallowAnnotationExemptions = false
 	}
+
 	return c
 }

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package dashboard

 import (
@@ -238,4 +252,3 @@ func TestStringInSlice(t *testing.T) {
 	assert.Equal(t, expectedOutput, actual)
 	assert.NotEqual(t, true, actual)
 }
-
@@ -87,7 +87,7 @@
    <a class="align-self-center"
        target="_blank"
        href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
-      <img src="static/images/FW_Insights_Polaris.svg" />
+      <img src="static/images/benchmark.png" />
    </a>
  </div>

@@ -136,7 +136,11 @@

  {{ range $namespace, $results := .FilteredAuditData.GetResultsByNamespace }}
    <div id="{{ $namespace }}" class="card namespace">
+      {{ if eq $namespace "" }}
+      <h3>Cluster Resources</h3>
+      {{ else }}
      <h3>Namespace: <strong>{{ $namespace }}</strong></h3>
+      {{ end }}
      <div class="expandable-table">
        {{ range $index, $result := $results }}
          <div class="resource-info">
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package kube

 import (
@@ -114,6 +128,18 @@ func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, err
 }

+func isFinalKind(kind string) bool {
+	switch kind {
+		case
+			"Deployment",
+			"CronJob",
+			"StatefulSet",
+			"DaemonSet":
+			return true
+		}
+	return false
+	}
+
 func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
 	podWorkload, err := NewGenericResourceFromPod(podResource, nil)
 	if err != nil {
@@ -155,6 +181,9 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 		}
 		topMeta = objMeta
 		owners = abstractObject.GetOwnerReferences()
+		if isFinalKind(topKind) {
+			break
+		}
 	}

 	if lastKey != "" {
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package kube

 import (
@@ -213,7 +227,7 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)

 // CreateResourceProviderFromCluster creates a new ResourceProvider using live data from a cluster
 func CreateResourceProviderFromCluster(ctx context.Context, c conf.Configuration) (*ResourceProvider, error) {
-	kubeConf, configError := config.GetConfig()
+	kubeConf, configError := config.GetConfigWithContext(c.KubeContext)
 	if configError != nil {
 		logrus.Errorf("Error fetching KubeConfig: %v", configError)
 		return nil, configError
@@ -239,19 +253,38 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		logrus.Errorf("Error fetching Cluster API version: %v", err)
 		return nil, err
 	}
-	provider := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, "Cluster", clusterName)
+
+	sourceType := "Cluster"
+	if c.Namespace != "" {
+		logrus.Debug("namespace is specififed in config, setting source type to ClusterNamespace")
+		sourceType = "ClusterNamespace"
+	}
+	provider := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, sourceType, clusterName)

 	nodes, err := kube.CoreV1().Nodes().List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Nodes: %v", err)
 		return nil, err
 	}
-	namespaces, err := kube.CoreV1().Namespaces().List(ctx, listOpts)
-	if err != nil {
-		logrus.Errorf("Error fetching Namespaces: %v", err)
-		return nil, err
+
+	var namespaces *corev1.NamespaceList
+	if c.Namespace != "" {
+		ns, err := kube.CoreV1().Namespaces().Get(ctx, c.Namespace, metav1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+		namespaces = &corev1.NamespaceList{
+			Items: []corev1.Namespace{*ns},
+		}
+	} else {
+		nsList, err := kube.CoreV1().Namespaces().List(ctx, listOpts)
+		if err != nil {
+			logrus.Errorf("Error fetching Namespaces: %v", err)
+			return nil, err
+		}
+		namespaces = nsList
 	}
-	pods, err := kube.CoreV1().Pods("").List(ctx, listOpts)
+	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Pods: %v", err)
 		return nil, err
@@ -277,13 +310,17 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		for key := range check.AdditionalSchemas {
 			neededKinds = append(neededKinds, conf.TargetKind(key))
 		}
+		for key := range check.AdditionalSchemaStrings {
+			neededKinds = append(neededKinds, conf.TargetKind(key))
+		}
 		for _, kind := range neededKinds {
-			if !funk.Contains(conf.HandledTargets, kind) {
+			if !funk.Contains(conf.HandledTargets, kind) && !funk.Contains(additionalKinds, kind) {
 				additionalKinds = append(additionalKinds, kind)
 			}
 		}
 	}

+	var kubernetesResources []GenericResource
 	for _, kind := range additionalKinds {
 		groupKind := parseGroupKind(maybeTransformKindIntoGroupKind(string(kind)))
 		mapping, err := (restMapper).RESTMapping(groupKind)
@@ -292,7 +329,7 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			return nil, err
 		}

-		objects, err := (*dynamic).Resource(mapping.Resource).Namespace("").List(ctx, metav1.ListOptions{})
+		objects, err := (*dynamic).Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 			return nil, err
@@ -302,7 +339,7 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			if err != nil {
 				return nil, err
 			}
-			provider.Resources.addResource(res)
+			kubernetesResources = append(kubernetesResources, res)
 		}
 	}

@@ -313,9 +350,12 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		logrus.Errorf("Error loading controllers from pods: %v", err)
 		return nil, err
 	}
+	// resources loaded from custom checks can also contain controllers and thus would be added twice to the provider
+	kubernetesResources = deduplicateControllers(append(kubernetesResources, controllers...))
+
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
-	provider.Resources.addResources(controllers)
+	provider.Resources.addResources(kubernetesResources)
 	return &provider, nil
 }

@@ -338,14 +378,14 @@ func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClientPointe
 		}
 		interfaces = append(interfaces, workload)
 	}
-	return deduplicateControllers(interfaces), nil
+	return interfaces, nil
 }

 // Because the controllers with an Owner take on the name of the Owner, this eliminates any duplicates.
 // In cases like CronJobs older children can hang around, so this takes the most recent.
-func deduplicateControllers(inputControllers []GenericResource) []GenericResource {
+func deduplicateControllers(inputResources []GenericResource) []GenericResource {
 	controllerMap := make(map[string]GenericResource)
-	for _, controller := range inputControllers {
+	for _, controller := range inputResources {
 		key := controller.ObjectMeta.GetNamespace() + "/" + controller.Kind + "/" + controller.ObjectMeta.GetName()
 		oldController, ok := controllerMap[key]
 		if !ok || controller.ObjectMeta.GetCreationTimestamp().Time.After(oldController.ObjectMeta.GetCreationTimestamp().Time) {
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package kube

 import (
@@ -83,15 +97,6 @@ func TestAddResourcesFromReader(t *testing.T) {

 func TestGetResourceFromAPI(t *testing.T) {
 	k8s, dynamicInterface := test.SetupTestAPI(test.GetMockControllers("test")...)
-	resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, "test", &dynamicInterface, conf.Configuration{})
-	assert.Equal(t, nil, err, "Error should be nil")
-
-	assert.Equal(t, "Cluster", resources.SourceType, "Should have type Path")
-	assert.Equal(t, "test", resources.SourceName, "Should have source name")
-	assert.IsType(t, time.Now(), resources.CreationTime, "Creation time should be set")
-
-	assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
-	assert.Equal(t, 5, len(resources.Resources), "Should have 5 controllers")

 	expectedNames := map[string]bool{
 		"deploy":      false,
@@ -100,12 +105,68 @@ func TestGetResourceFromAPI(t *testing.T) {
 		"statefulset": false,
 		"daemonset":   false,
 	}
-	for _, controllers := range resources.Resources {
-		for _, ctrl := range controllers {
-			expectedNames[ctrl.ObjectMeta.GetName()] = true
-		}
+
+	tests := []struct {
+		name        string
+		config      conf.Configuration
+		want        *ResourceProvider
+		wantErr     bool
+		clusterName string
+	}{
+		{
+			name:        "standard",
+			config:      conf.Configuration{},
+			clusterName: "test1",
+			want: &ResourceProvider{
+				SourceType:   "Cluster",
+				SourceName:   "test1",
+				CreationTime: time.Now(),
+			},
+		},
+		{
+			name: "namespaced",
+			config: conf.Configuration{
+				Namespace: "test",
+			},
+			clusterName: "test2",
+			want: &ResourceProvider{
+				SourceType:   "ClusterNamespace",
+				SourceName:   "test2",
+				CreationTime: time.Now(),
+			},
+		},
+		{
+			name: "namespace does not exist",
+			config: conf.Configuration{
+				Namespace: "test3",
+			},
+			clusterName: "test3",
+			wantErr:     true,
+		},
 	}
-	for name, val := range expectedNames {
-		assert.Equal(t, true, val, name)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, tt.clusterName, &dynamicInterface, tt.config)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.want.SourceType, resources.SourceType)
+				assert.Equal(t, tt.want.SourceName, resources.SourceName)
+				assert.IsType(t, tt.want.CreationTime, resources.CreationTime)
+				assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
+				assert.Equal(t, 5, len(resources.Resources), "Should have 5 controllers")
+
+				for _, controllers := range resources.Resources {
+					for _, ctrl := range controllers {
+						expectedNames[ctrl.ObjectMeta.GetName()] = true
+					}
+				}
+				for name, val := range expectedNames {
+					assert.Equal(t, true, val, name)
+				}
+			}
+		})
 	}
 }
@@ -0,0 +1,78 @@
+package mutation
+
+import (
+	"encoding/json"
+	"fmt"
+
+	jsonpatch "github.com/evanphx/json-patch/v5"
+	"github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/validator"
+)
+
+// ApplyAllSchemaMutations applies available mutation to a single resource
+func ApplyAllSchemaMutations(conf *config.Configuration, resourceProvider *kube.ResourceProvider, resource kube.GenericResource, mutations []map[string]interface{}) (kube.GenericResource, error) {
+	resByte := resource.OriginalObjectJSON
+	var jsonByte []byte
+	mutationByte, err := json.Marshal(mutations)
+	if err != nil {
+		return resource, err
+	}
+
+	patch, err := jsonpatch.DecodePatch(mutationByte)
+	if err != nil {
+		return resource, err
+	}
+	jsonByte, err = patch.Apply(resByte)
+	if err != nil {
+		return resource, err
+	}
+	mutated, err := kube.NewGenericResourceFromBytes(jsonByte)
+	if err != nil {
+		return resource, err
+	}
+
+	return mutated, nil
+}
+
+// GetMutationsFromResults returns all mutations from results
+func GetMutationsFromResults(conf *config.Configuration, results []validator.Result) map[string][]map[string]interface{} {
+	allMutationsFromResults := make(map[string][]map[string]interface{})
+	for _, result := range results {
+		key := fmt.Sprintf("%s/%s/%s", result.Kind, result.Name, result.Namespace)
+
+		for _, resultMessage := range result.Results {
+			if len(resultMessage.Mutations) > 0 {
+				mutations, ok := allMutationsFromResults[key]
+				if !ok {
+					mutations = make([]map[string]interface{}, 0)
+				}
+				allMutationsFromResults[key] = append(mutations, resultMessage.Mutations...)
+			}
+		}
+
+		for _, resultMessage := range result.PodResult.Results {
+			if len(resultMessage.Mutations) > 0 {
+				mutations, ok := allMutationsFromResults[key]
+				if !ok {
+					mutations = make([]map[string]interface{}, 0)
+				}
+				allMutationsFromResults[key] = append(mutations, resultMessage.Mutations...)
+			}
+		}
+
+		for _, containerResult := range result.PodResult.ContainerResults {
+			for _, resultMessage := range containerResult.Results {
+				if len(resultMessage.Mutations) > 0 {
+					mutations, ok := allMutationsFromResults[key]
+					if !ok {
+						mutations = make([]map[string]interface{}, 0)
+					}
+					allMutationsFromResults[key] = append(mutations, resultMessage.Mutations...)
+				}
+			}
+		}
+
+	}
+	return allMutationsFromResults
+}
@@ -45,7 +45,7 @@ func TestValidatePDB(t *testing.T) {
 	assert.False(t, results.Success)
 	assert.Equal(t, conf.SeverityWarning, results.Severity)
 	assert.Equal(t, "Reliability", results.Category)
-	assert.EqualValues(t, "disruptionsAllowed is not greater than zero", results.Message)
+	assert.EqualValues(t, "Voluntary evictions are not possible", results.Message)
 }

 func TestValidateIngress(t *testing.T) {
@@ -64,11 +64,11 @@ func TestControllerLevelChecks(t *testing.T) {
 	testResources := func(res *kube.ResourceProvider) {
 		c := conf.Configuration{
 			Checks: map[string]conf.Severity{
-				"multipleReplicasForDeployment": conf.SeverityDanger,
+				"deploymentMissingReplicas": conf.SeverityDanger,
 			},
 		}
 		expectedResult := ResultMessage{
-			ID:       "multipleReplicasForDeployment",
+			ID:       "deploymentMissingReplicas",
 			Severity: "danger",
 			Category: "Reliability",
 		}
@@ -85,7 +85,7 @@ func TestControllerLevelChecks(t *testing.T) {
 				expectedResult.Message = "Only one replica is scheduled"
 			}
 			expectedResults := ResultSet{
-				"multipleReplicasForDeployment": expectedResult,
+				"deploymentMissingReplicas": expectedResult,
 			}

 			assert.Equal(t, "Deployment", actualResult.Kind)
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator

 import (
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator

 import (
@@ -72,12 +72,13 @@ type ClusterInfo struct {

 // ResultMessage is the result of a given check
 type ResultMessage struct {
-	ID       string
-	Message  string
-	Details  []string
-	Success  bool
-	Severity config.Severity
-	Category string
+	ID        string
+	Message   string
+	Details   []string
+	Success   bool
+	Severity  config.Severity
+	Category  string
+	Mutations []map[string]interface{}
 }

 // ResultSet contiains the results for a set of checks
@@ -164,7 +165,11 @@ func (res AuditData) GetPrettyOutput(useColor bool) string {

 // GetPrettyOutput returns a human-readable string
 func (res Result) GetPrettyOutput() string {
-	str := titleColor.Sprint(fmt.Sprintf("%s %s in namespace %s\n", res.Kind, res.Name, res.Namespace))
+	str := titleColor.Sprint(fmt.Sprintf("%s %s", res.Kind, res.Name))
+	if res.Namespace != "" {
+		str += titleColor.Sprint(fmt.Sprintf(" in namespace %s", res.Namespace))
+	}
+	str += "\n"
 	str += res.Results.GetPrettyOutput()
 	if res.PodResult != nil {
 		str += res.PodResult.GetPrettyOutput()
@@ -1,11 +1,27 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator

 import (
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"

 	"github.com/qri-io/jsonschema"
+	"github.com/sirupsen/logrus"
 	"github.com/thoas/go-funk"
 	corev1 "k8s.io/api/core/v1"
 	metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -23,7 +39,9 @@ type schemaTestCase struct {
 }

 func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCase) (*config.SchemaCheck, error) {
-	if !conf.DisallowExemptions && hasExemptionAnnotation(test.Resource.ObjectMeta, checkID) {
+	if !conf.DisallowExemptions &&
+		!conf.DisallowAnnotationExemptions &&
+		hasExemptionAnnotation(test.Resource.ObjectMeta, checkID) {
 		return nil, nil
 	}
 	check, ok := conf.CustomChecks[checkID]
@@ -237,6 +255,7 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	}
 	var passes bool
 	var issues []jsonschema.ValError
+	var prefix string
 	if check.SchemaTarget != "" {
 		if check.SchemaTarget == config.TargetPod && check.Target == config.TargetContainer {
 			podCopy := *test.Resource.PodSpec
@@ -248,7 +267,15 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 		}
 	} else if check.Target == config.TargetPod {
 		passes, issues, err = check.CheckPod(test.Resource.PodSpec)
+		prefix = getJSONSchemaPrefix(test.Resource.Kind)
 	} else if check.Target == config.TargetContainer {
+		containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
+			return value.Name == test.Container.Name
+		})
+		prefix = getJSONSchemaPrefix(test.Resource.Kind)
+		if prefix != "" {
+			prefix += "/containers/" + strconv.Itoa(containerIndex)
+		}
 		passes, issues, err = check.CheckContainer(test.Container)
 	} else {
 		passes, issues, err = check.CheckObject(test.Resource.Resource.Object)
@@ -261,6 +288,13 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 			break
 		}
 		resources := test.ResourceProvider.Resources[groupkind]
+		namespace := test.Resource.ObjectMeta.GetNamespace()
+		if test.Resource.Kind == "Namespace" {
+			namespace = test.Resource.ObjectMeta.GetName()
+		}
+		resources = funk.Filter(resources, func(res kube.GenericResource) bool {
+			return res.ObjectMeta.GetNamespace() == namespace
+		}).([]kube.GenericResource)
 		objects := funk.Map(resources, func(res kube.GenericResource) interface{} {
 			return res.Resource.Object
 		}).([]interface{})
@@ -270,6 +304,16 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 		}
 	}
 	result := makeResult(conf, check, passes, issues)
+	if !passes {
+		if funk.Contains(conf.Mutations, checkID) {
+			mutations := funk.Map(check.Mutations, func(mutation map[string]interface{}) map[string]interface{} {
+				mutationCopy := deepCopyMutation(mutation)
+				mutationCopy["path"] = prefix + mutationCopy["path"].(string)
+				return mutationCopy
+			}).([]map[string]interface{})
+			result.Mutations = mutations
+		}
+	}
 	return &result, nil
 }

@@ -281,3 +325,25 @@ func getSortedKeys(m map[string]config.Severity) []string {
 	sort.Strings(keys)
 	return keys
 }
+
+func deepCopyMutation(source map[string]interface{}) map[string]interface{} {
+	destination := map[string]interface{}{}
+	for key, value := range source {
+		destination[key] = value
+	}
+	return destination
+}
+
+func getJSONSchemaPrefix(kind string) (prefix string) {
+	if kind == "CronJob" {
+		prefix = "/spec/jobTemplate/spec/template/spec"
+	} else if kind == "Pod" {
+		prefix = "/spec"
+	} else if (kind == "Deployment") || (kind == "Daemonset") ||
+		(kind == "Statefulset") || (kind == "Job") || (kind == "ReplicationController") {
+		prefix = "/spec/template/spec"
+	} else {
+		logrus.Warningf("Mutation for this this resource (%s) is not supported", kind)
+	}
+	return prefix
+}
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator

 import (
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator

 import (
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add: ["all"]
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add:
+        - nEt_aDmIn
@@ -6,9 +6,8 @@ metadata:
    app.kubernetes.io/name: nginx
 spec:
  containers:
-  - name: nginx 
+  - name: nginx
    image: nginx
    securityContext:
      capabilities:
        add:
-        
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+        - All
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - net_admin
+          - ChOwN
+          - DaC_OverriDE
+          - fsetid
+          - FOWNER
+          - MKNOD
+          - NET_RAW
+          - SETGID
+          - SETUID
+          - SETFCAP
+          - SETPCAP
+          - NET_BIND_SERVICE
+          - SYS_CHROOT
+          - KILL
+          - AUDIT_WRITE
+
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zookeeper
+  namespace: rightnamespace
+  labels:
+    app: zookeeper
+spec:
+  template:
+    spec:
+      containers:
+      - name: zookeeper
+        image: zookeeper
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: zk-pdb
+  namespace: wrongnamespace
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: zookeeper
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  minAvailable: 100%
+  maxUnavailable: 5
@@ -4,5 +4,5 @@ metadata:
  name: nginx
  labels:
    env: test
-status:
-  disruptionsAllowed: 1
+spec:
+  maxUnavailable: 0
@@ -4,5 +4,5 @@ metadata:
  name: nginx
  labels:
    env: test
-status:
-  disruptionsAllowed: 0
+spec:
+  minAvailable: 100%
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  minAvaiable: 5
+  maxUnavailable: 10%
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  maxUnavailable: 5%
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  minAvaiable: 5
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec: {}
@@ -0,0 +1,18 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: hello
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: hello
+            image: busybox
+            command:
+            - /bin/sh
+            - -c
+            - date; echo Hello from the Kubernetes cluster
+          restartPolicy: OnFailure
@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.14.2
+        ports:
+        - containerPort: 80
@@ -0,0 +1,19 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: hello
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: hello
+            image: busybox
+            imagePullPolicy: Always
+            command:
+            - /bin/sh
+            - -c
+            - date; echo Hello from the Kubernetes cluster
+          restartPolicy: OnFailure
@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.14.2
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package test

 import (
@@ -88,7 +102,10 @@ func MockController(apiVersion, kind, namespace, name string, spec map[string]in
 	if err != nil {
 		panic(err)
 	}
-	json.Unmarshal(b, &dest)
+	err = json.Unmarshal(b, &dest)
+	if err != nil {
+		panic(err)
+	}
 	return pod
 }

@@ -158,6 +175,15 @@ func MockReplicationController(namespace, name string) (corev1.ReplicationContro
 	return rc, pod
 }

+// MockNamespace returns a namespace object.
+func MockNamespace(name string) corev1.Namespace {
+	return corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+	}
+}
+
 // SetupTestAPI creates a test kube API struct.
 func SetupTestAPI(objects ...runtime.Object) (kubernetes.Interface, dynamic.Interface) {
 	scheme := runtime.NewScheme()
@@ -221,12 +247,19 @@ func SetupTestAPI(objects ...runtime.Object) (kubernetes.Interface, dynamic.Inte
 				{Name: "poddisruptionbudgets", Namespaced: true, Kind: "PodDisruptionBudget", Version: "v1"},
 			},
 		},
+		{
+			GroupVersion: "core/v1",
+			APIResources: []metav1.APIResource{
+				{Name: "namespaces", Namespaced: false, Kind: "Namespace"},
+			},
+		},
 	}
 	return k, dynamicClient
 }

 // GetMockControllers returns mocked controllers for 5 major controller types
 func GetMockControllers(namespace string) []runtime.Object {
+	ns := MockNamespace(namespace)
 	deploy, deployPod := MockDeploy(namespace, "deploy")
 	statefulset, statefulsetPod := MockStatefulSet(namespace, "statefulset")
 	daemonset, daemonsetPod := MockDaemonSet(namespace, "daemonset")
@@ -238,5 +271,6 @@ func GetMockControllers(namespace string) []runtime.Object {
 		&statefulset, &statefulsetPod,
 		&cronjob, &cronjobPod,
 		&job, &jobPod,
+		&ns,
 	}
 }
@@ -0,0 +1,50 @@
+package test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/stretchr/testify/assert"
+	"github.com/thoas/go-funk"
+)
+
+var configYaml = `
+checks:
+  pullPolicyNotAlways: warning
+mutations:
+  - pullPolicyNotAlways
+`
+
+func TestMutations(t *testing.T) {
+	c, err := config.Parse([]byte(configYaml))
+	assert.NoError(t, err)
+	assert.Len(t, c.Mutations, 1)
+
+	for _, tc := range testCases {
+		if tc.failure && funk.Contains(c.Mutations, tc.check) {
+			key := fmt.Sprintf("%s/%s", tc.check, strings.ReplaceAll(tc.filename, "failure", "success"))
+			successResources, ok := successResourceMap[key]
+			assert.True(t, ok)
+			assert.Len(t, tc.resources.Resources, 1)
+			assert.Len(t, successResources.Resources, 1)
+			results, err := validator.ApplyAllSchemaChecksToResourceProvider(&c, tc.resources)
+			assert.NoError(t, err)
+			assert.Len(t, results, 1)
+			allMutations := mutation.GetMutationsFromResults(&c, results)
+			assert.Len(t, allMutations, 1)
+			for kind, resources := range tc.resources.Resources {
+				key := fmt.Sprintf("%s/%s/%s", resources[0].Kind, resources[0].Resource.GetName(), resources[0].Resource.GetNamespace())
+				mutations := allMutations[key]
+				assert.Len(t, mutations, 1)
+				mutated, err := mutation.ApplyAllSchemaMutations(&c, tc.resources, resources[0], mutations)
+				assert.NoError(t, err)
+				expected := successResources.Resources[kind][0]
+				assert.Equal(t, expected.Resource.Object, mutated.Resource.Object)
+			}
+		}
+	}
+}
@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package test

 import (
@@ -24,6 +38,8 @@ type testCase struct {
 	failure   bool
 }

+var successResourceMap = map[string]*kube.ResourceProvider{}
+
 func init() {
 	_, baseDir, _, _ := runtime.Caller(0)
 	baseDir = filepath.Dir(baseDir) + "/checks"
@@ -49,6 +65,10 @@ func init() {
 				resources: resources,
 				failure:   strings.Contains(tc.Name(), "failure"),
 			})
+			if !strings.Contains(tc.Name(), "failure") {
+				key := fmt.Sprintf("%s/%s", check, tc.Name())
+				successResourceMap[key] = resources
+			}
 		}
 	}
 }