update goreleaser (#850)

* add debug info

* remove extra build step

* try and fix memory usage

* fix pointers

* add more debug logs

* fix up caching for replicasets

* fix import

* replace info with debug

* add logs

* dont cache jobs

* gofmt

* fix import

.circleci/config.yml

@@ -2,6 +2,7 @@ version: 2.1
 
 orbs:
   rok8s: fairwinds/rok8s-scripts@11
+  oss-docs: fairwinds/oss-docs@0
 
 executors:
   vm:
@@ -21,6 +22,7 @@ references:
         echo 'export GOPROXY=https://proxy.golang.org' >> ${BASH_ENV}
         echo 'export GO111MODULE=on' >> ${BASH_ENV}
         echo 'export GOFLAGS=-mod=mod' >> ${BASH_ENV}
+        echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
 
   install_k8s: &install_k8s
     run:
@@ -31,20 +33,20 @@ references:
         sudo apt-get install -yqq jq git
 
         echo "Installing KIND"
-        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.8.1/kind-linux-amd64
+        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.14.0/kind-linux-amd64
         chmod 0755 kind-linux-amd64
         sudo mv kind-linux-amd64 /usr/local/bin/kind
         kind version
 
         echo "Installing Kubectl"
-        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.18.6/bin/linux/amd64/kubectl
+        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.21.12/bin/linux/amd64/kubectl
         chmod 0755 kubectl
         sudo mv kubectl /usr/local/bin/
         kubectl version --client
 
 
         echo "Creating Kubernetes Cluster with Kind"
-        kind create cluster --wait=90s --image kindest/node:v1.15.11
+        kind create cluster --wait=90s --image kindest/node:v1.21.12
         docker ps -a
 
         kubectl version
@@ -85,13 +87,6 @@ references:
           echo "Skipping Kubernetes tests for forked PR"
         fi
 
-  docker_build: &docker_build
-    run:
-      name: Docker login and build
-      command: |
-        docker-pull -f .circleci/build.config
-        docker-build -f .circleci/build.config
-
   docker_build_and_push: &docker_build_and_push
     run:
       name: Docker login, build, and push
@@ -101,15 +96,6 @@ references:
         docker login quay.io -u="${fairwinds_quay_user}" -p="${fairwinds_quay_token}"
         docker-push -f .circleci/build.config
 
-  release_deploy_configs: &release_deploy_configs
-    run:
-      name: Release deploy configs
-      command: |
-        upload_url=$(curl --silent https://api.github.com/repos/FairwindsOps/polaris/releases/latest | grep upload_url)
-        upload_url=$(echo $upload_url | sed -e 's/.*\(https.*\){.*$/\1/')
-        curl -X POST "$upload_url?name=dashboard.yaml" --data-binary "@./deploy/dashboard.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
-        curl -X POST "$upload_url?name=webhook.yaml" --data-binary "@./deploy/webhook.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
-
   enable_experimental_features: &enable_experimental_docker_features
     run:
       name: enable experimental features
@@ -131,15 +117,6 @@ references:
         mv vault /usr/bin/vault
 
 jobs:
-  build:
-    docker:
-      - image: quay.io/reactiveops/ci-images:v11.0-stretch
-    steps:
-      - checkout
-      - setup_remote_docker
-      - *set_environment_variables
-      - *docker_build
-
   push:
     docker:
       - image: quay.io/reactiveops/ci-images:v11.0-stretch
@@ -159,17 +136,13 @@ jobs:
       - *test_k8s
 
   test:
-    working_directory: /go/src/github.com/fairwindsops/polaris/
     docker:
-      - image: circleci/golang:1.16
+      - image: cimg/go:1.19
     steps:
       - checkout
       - *set_environment_variables
-      - run: go get -u golang.org/x/lint/golint
-      - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
-      - run: go list ./... | grep -v vendor | xargs go vet
+      - run: go vet ./...
       - run: go test ./... -coverprofile=coverage.txt -covermode=count
-      - run: go run main.go audit --audit-path ./deploy --set-exit-code-below-score 100 --set-exit-code-on-danger
       - *test_binary_dashboard
 
   insights:
@@ -178,11 +151,6 @@ jobs:
     steps:
       - checkout
       - setup_remote_docker
-      - run:
-          name: Adjust configs for latest image
-          command: |
-            sed -r "s|'(quay.io/fairwinds/polaris:).+'|'\1${CIRCLE_SHA1}'|" ./deploy/webhook.yaml > ./deploy/dashboard.yaml
-            sed -r "s|'(quay.io/fairwinds/polaris:).+'|'\1${CIRCLE_SHA1}'|" ./deploy/dashboard.yaml > ./deploy/webhook.yaml
       - run:
           name: Insights CI
           command: curl -L https://insights.fairwinds.com/v0/insights-ci.sh | bash
@@ -192,7 +160,7 @@ jobs:
     resource_class: large
     shell: /bin/bash
     docker:
-      - image: goreleaser/goreleaser:v1.3.0
+      - image: goreleaser/goreleaser:v1.11.14
     steps:
       - checkout
       - setup_remote_docker:
@@ -209,7 +177,6 @@ jobs:
       - run: packr2
       - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
       - run: goreleaser
-      - *release_deploy_configs
 
   release_images:
     working_directory: /go/src/github.com/fairwindsops/polaris/
@@ -220,61 +187,16 @@ jobs:
       - setup_remote_docker
       - *set_environment_variables
       - *docker_build_and_push
-  publish_docs:
-    docker:
-      - image: cimg/node:15.5.1
-    steps:
-      - checkout
-      - run:
-          name: Build Docs Site
-          command: |
-            set -e
-            cd ./docs
-            npm install
-            npm run check-links
-            npm run build
-      - run:
-          name: Install Tools
-          command: |
-            cd /tmp
-            echo "Installing AWS CLI"
-            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
-            unzip awscliv2.zip
-            sudo ./aws/install
-
-            echo "Installing Hashicorp Vault"
-            curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
-            unzip vault_1.9.3_linux_amd64.zip
-            sudo mv vault /usr/bin/vault
-            sudo chmod +x /usr/bin/vault
-            vault --version
-
-            echo "Installing yq"
-            curl -LO https://github.com/mikefarah/yq/releases/download/v4.16.2/yq_linux_amd64.tar.gz
-            tar -zxvf yq_linux_amd64.tar.gz
-            sudo mv yq_linux_amd64 /usr/bin/yq
-            sudo chmod +x /usr/bin/yq
-            yq --version
-      - rok8s/get_vault_env:
-          vault_path: repo/polaris/env
-      - run:
-          name: Publish Docs Site to S3
-          command: |
-            cd ./dist
-            aws s3 sync ./ s3://polaris.docs.fairwinds.com --delete
 workflows:
   version: 2
 
-  build:
+  test_and_push:
     jobs:
       - test
-      - build:
-          requires:
-            - test
       - push:
           context: org-global
           requires:
-            - build
+            - test
           filters:
             branches:
               ignore: /pull\/[0-9]+/
@@ -309,7 +231,8 @@ workflows:
               ignore: /.*/
             tags:
               ignore: /^testing-.*/
-      - publish_docs:
+      - oss-docs/publish-docs:
+          repository: polaris
           filters:
             branches:
               ignore: /.*/

.github/ISSUE_TEMPLATE/feature_request.md

@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ''
-labels: ''
+labels: [triage, enhancement]
 assignees: ''
 
 ---

.github/ISSUE_TEMPLATE/other.md

@@ -2,7 +2,7 @@
 name: Other
 about: For misc. tasks like research or continued conversation
 title: ''
-labels: ''
+labels: [triage]
 assignees: ''
 
 ---

.github/dependabot.yml

@@ -1,3 +1,4 @@
+## DO NOT EDIT - Managed by Terraform
 version: 2
 updates:
   - package-ecosystem: "docker"
@@ -17,8 +18,3 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.github/pull_request_template.md

@@ -1,3 +1,4 @@
+
 This PR fixes #
 
 ## Checklist

.goreleaser.yml

@@ -8,6 +8,8 @@ changelog:
     - '^test:'
 builds:
   - id: polaris
+    ldflags:
+      - -X main.Version={{.Version}} -X main.Commit={{.Commit}} -s -w
     env:
       - CGO_ENABLED=0
       - GO111MODULE=on

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.17 AS build-env
+FROM golang:1.19 AS build-env
 WORKDIR /go/src/github.com/fairwindsops/polaris/
 
 ENV GO111MODULE=on
@@ -10,13 +10,14 @@ ENV GOARCH=amd64
 COPY go.mod .
 COPY go.sum .
 RUN go mod download
-RUN go get -u github.com/gobuffalo/packr/v2/packr2
+RUN go install github.com/gobuffalo/packr/v2/packr2@latest
 
 COPY . .
 RUN packr2 build -a -o polaris *.go
 
-FROM alpine:3.15.3
+FROM alpine:3.16
 WORKDIR /usr/local/bin
+RUN apk -U upgrade
 RUN apk --no-cache add ca-certificates
 
 RUN addgroup -S polaris && adduser -u 1200 -S polaris -G polaris

README.md

@@ -1,9 +1,9 @@
 <div align="center" class="no-border">
   <img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
   <br>
-  <h3>Best Practices for Kubernetes Workload Configuration</h3>
-  <a href="https://github.com/FairwindsOps/polaris">
-    <img src="https://img.shields.io/static/v1.svg?label=Version&message=5.1.0&color=239922">
+  <h3>Polaris is an open source policy engine for Kubernetes</h3>
+  <a href="https://github.com/FairwindsOps/polaris/releases">
+    <img src="https://img.shields.io/github/v/release/FairwindsOps/polaris">
   </a>
   <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
     <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
@@ -16,15 +16,12 @@
   </a>
 </div>
 
-Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
-Kubernetes pods and controllers are configured using best practices, helping you avoid
-problems in the future.
+Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.
 
 Polaris can be run in three different modes:
-* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard), so you can audit what's running inside your cluster.
-* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
-* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
-
+* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard) - Validate Kubernetes resources against policy-as-code.
+* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller) - Automatically reject or modify workloads that don't adhere to your organization's policies.
+* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code) - Incorporate policy-as-code into the CI/CD process to test local YAML files.
 <p align="center">
   <img src="https://polaris.docs.fairwinds.com/img/architecture.svg" alt="Polaris Architecture" width="550"/>
 </p>

checks/automountServiceAccountToken.yaml

@@ -0,0 +1,36 @@
+successMessage: The ServiceAccount will not be automounted
+failureMessage: The ServiceAccount will be automounted
+category: Security
+target: PodSpec
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["serviceAccountName"]
+  properties:
+    serviceAccountName:
+      type: string
+    automountServiceAccountToken:
+      type: boolean
+      not:
+        const: true
+additionalSchemaStrings:
+  ServiceAccount: |
+    type: object
+    required:
+      - metadata
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
+      - automountServiceAccountToken
+      {{ end }}
+    properties:
+      metadata:
+        type: object
+        required: ["name"]
+        properties:
+          name:
+            type: string
+            const: "{{ .Polaris.PodSpec.serviceAccountName }}"
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
+      automountServiceAccountToken:
+        type: boolean
+        const: false
+      {{ end }}

checks/clusterrolePodExecAttach.yaml

@@ -0,0 +1,55 @@
+successMessage: The ClusterRole does not allow pods/exec or pods/attach
+failureMessage: The ClusterRole allows Pods/exec or pods/attach
+category: Security
+target: rbac.authorization.k8s.io/ClusterRole
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["metadata", "rules"]
+  anyOf:
+    # Do not alert on default ClusterRoles.
+    - properties:
+        metadata:
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: 'admin'
+                - const: "cluster-admin"
+                - const: "edit"
+                - const: "system:aggregate-to-edit"
+                - const: "system:controller:generic-garbage-collector"
+                - const: "system:controller:namespace-controller"
+    - properties:
+        rules:
+          type: array
+          items:
+            type: object
+            not:
+              required: ["apiGroups", "resources", "verbs"]
+              properties:
+                apiGroups:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: ""
+                      - const: '*'
+                resources:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      - const: "pods/exec"
+                      - const: "pods/attach"
+                verbs:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      # An exec is also possible by `get`ing a web socket.
+                      - const: 'get'
+                      - const: 'create'

checks/clusterrolebindingClusterAdmin.yaml

@@ -0,0 +1,88 @@
+successMessage: The ClusterRoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
+failureMessage: The ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
+category: Security
+target: rbac.authorization.k8s.io/ClusterRoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Do not alert on default ClusterRoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: "cluster-admin"
+                - const: "system:controller:generic-garbage-collector"
+                - const: "system:controller:namespace-controller"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+              not:
+                const: "cluster-admin"
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # Do not alert on default ClusterRoleBindings.
+    {{ if and (ne .metadata.name "cluster-admin") (ne .metadata.name "system:controller:generic-garbage-collector") (ne .metadata.name "system:controller:namespace-controller") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      const: "*"
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      const: '*'
+                  verbs:
+                    type: array
+                    uniqueItems: true
+                    oneOf:
+                      - contains:
+                          type: string
+                          const: '*'
+                      - minItems: 7
+                        items:
+                          type: string
+                          enum:
+                            - "get"
+                            - "list"
+                            - "watch"
+                            - "create"
+                            - "update"
+                            - "patch"
+                            - "delete"
+    {{ end }}

checks/clusterrolebindingPodExecAttach.yaml

@@ -0,0 +1,82 @@
+successMessage: The ClusterRoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
+failureMessage: The ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
+category: Security
+target: rbac.authorization.k8s.io/ClusterRoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Do not alert on default ClusterRoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: "cluster-admin"
+                - const: "system:controller:generic-garbage-collector"
+                - const: "system:controller:namespace-controller"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # Do not alert on default ClusterRoleBindings.
+    {{ if and (ne .metadata.name "cluster-admin") (ne .metadata.name "system:controller:generic-garbage-collector") (ne .metadata.name "system:controller:namespace-controller") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: ""
+                        - const: '*'
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        - const: "pods/exec"
+                        - const: "pods/attach"
+                  verbs:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        # An exec is also possible by `get`ing a web socket.
+                        - const: 'get'
+                        - const: 'create'
+    {{ end }}

checks/cpuLimitsMissing.yaml

@@ -25,3 +25,8 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/limits/cpu
+    value: 100m
+    comment: "TODO: Set this to the maximum amount of CPU you want your workload to use"

checks/cpuRequestsMissing.yaml

@@ -25,3 +25,8 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/requests/cpu
+    value: 100m
+    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"

checks/dangerousCapabilities.yaml

@@ -24,3 +24,8 @@ schema:
                 - not:
                     contains:
                       pattern: '^(?i)NET_ADMIN$'
+
+
+mutations:
+  - op: remove
+    path: /securityContext/capabilities

checks/deploymentMissingReplicas.yaml

@@ -19,3 +19,7 @@ schema:
         replicas:
           type: integer
           minimum: 2
+mutations:
+  - op: add
+    path: /spec/replicas
+    value: 3

checks/hostIPCSet.yaml

@@ -1,7 +1,7 @@
 successMessage: Host IPC is not configured
 failureMessage: Host IPC should not be configured
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -9,3 +9,6 @@ schema:
     hostIPC:
       not:
         const: true
+mutations:
+  - op: remove
+    path: /hostIPC

checks/hostNetworkSet.yaml

@@ -1,7 +1,7 @@
 successMessage: Host network is not configured
 failureMessage: Host network should not be configured
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -9,3 +9,6 @@ schema:
     hostNetwork:
       not:
         const: true
+mutations:
+  - op: remove
+    path: /hostNetwork

checks/hostPIDSet.yaml

@@ -1,7 +1,7 @@
 successMessage: Host PID is not configured
 failureMessage: Host PID should not be configured
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -9,3 +9,6 @@ schema:
     hostPID:
       not:
         const: true
+mutations:
+  - op: remove
+    path: /hostPID

checks/hostPortSet.yaml

@@ -13,3 +13,6 @@ schema:
         properties:
           hostPort:
             const: 0
+mutations:
+  - op: remove
+    path: /ports/*/hostPort

checks/insecureCapabilities.yaml

@@ -54,3 +54,7 @@ schema:
                     pattern: '^(?i)KILL$'
                 - contains:
                     pattern: '^(?i)AUDIT_WRITE$'
+mutations:
+  - op: replace
+    path: /securityContext/capabilities
+    value: {"drop": ["ALL"]}

checks/linuxHardening.yaml

@@ -0,0 +1,89 @@
+successMessage: One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
+FailureMessage: Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
+category: Security
+target: Container
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
+    podOrContainerSeccompProfile:
+      type: object
+      {{ $podSeccompProfileType := .Polaris.PodSpec.securityContext.seccompProfile.type }}
+      required:
+      {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+        - securityContext
+      {{ end }}
+      properties:
+        securityContext:
+          type: object
+          required:
+          {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+            - seccompProfile
+          {{ end }}
+          properties:
+            seccompProfile:
+              type: object
+              required:
+              {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+                - type
+              {{ end }}
+              properties:
+                type:
+                  type: string
+                  allOf:
+                    - not:
+                        const: "Unconfined"
+                    {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+                    - minLength: 1
+                    {{ end }}
+    podOrContainerSELinuxOptions:
+      type: object
+      {{ $podSELinuxOptions := .Polaris.PodSpec.securityContext.seLinuxOptions }}
+      {{ if not $podSELinuxOptions }}
+      required: ["securityContext"]
+      properties:
+        securityContext:
+          type: object
+          required: ["seLinuxOptions"]
+          properties:
+            seLinuxOptions:
+              type: object
+              minProperties: 1
+      {{ end }}
+    containerDropCapabilities:
+      type: object
+      required: ["securityContext"]
+      properties:
+        securityContext:
+          type: object
+          required: ["capabilities"]
+          properties:
+            capabilities:
+              type: object
+              required: ["drop"]
+              properties:
+                drop:
+                  type: array
+                  minItems: 1
+                add:
+                  type: array
+                  items:
+                    type: string
+                    not:
+                      pattern: '^(?i)ALL$'
+  # End of definitions
+  {{/* Check for AppArmor which uses pod annotations. IF pod fields are missing,
+       require one of the other hardening measures. */}}
+  {{ $annotationName := (print "container.apparmor.security.beta.kubernetes.io/" .Polaris.Container.name) }}
+  {{/* Checking annotations before using index() avoids a nil panic when there are no annotations */}}
+  {{ $annotationExists := false }}
+  {{ if .Polaris.PodTemplate.metadata.annotations }}
+  {{ $annotationExists = index .Polaris "PodTemplate" "metadata" "annotations" $annotationName }}
+  {{ end }}
+  {{ if $annotationExists }}
+  type: object
+  {{ else }}
+  anyOf:
+  - $ref: "#/definitions/podOrContainerSeccompProfile"
+  - $ref: "#/definitions/podOrContainerSELinuxOptions"
+  - $ref: "#/definitions/containerDropCapabilities"
+  {{ end}}

checks/livenessProbeMissing.yaml

@@ -19,3 +19,8 @@ schema:
       type: object
       not:
         const: null
+mutations:
+  - op: add
+    path: /livenessProbe
+    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
+    comment: "TODO: Change the livenessProbe setting to reflect your application's health"

checks/memoryLimitsMissing.yaml

@@ -25,3 +25,8 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/limits/memory
+    value: "512Mi"
+    comment: "TODO: Set this to the maximum amount of memory you want your workload to use"

checks/memoryRequestsMissing.yaml

@@ -25,3 +25,8 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/requests/memory
+    value: "512Mi"
+    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"

checks/missingNetworkPolicy.yaml

@@ -0,0 +1,49 @@
+successMessage: A NetworkPolicy matches pod labels and contains egress and ingress rules
+failureMessage: A NetworkPolicy should match pod labels and contain applied egress and ingress rules
+category: Security
+target: PodTemplate
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    metadata:
+      type: object
+      properties:
+        labels:
+          type: object
+          minProperties: 1
+additionalSchemaStrings:
+  networking.k8s.io/NetworkPolicy: |
+    type: object
+    properties:
+      spec:
+        type: object
+        required: ["podSelector", "egress", "ingress"]
+        properties:
+          podSelector:
+            type: object
+            required: ["matchLabels"]
+            properties:
+              matchLabels:
+                type: object
+                oneOf:
+                {{ range $key, $value := .Polaris.PodTemplate.metadata.labels }}
+                - properties:
+                    "{{ $key }}":
+                      type: string
+                      const: {{ $value }}
+                  required: ["{{ $key }}"]
+                {{ end }}
+          egress:
+            type: array
+            minItems: 1
+          ingress:
+            minItems: 1
+            type: array
+          policyTypes:
+            type: array
+            allOf:
+              - contains:
+                  pattern: '^(?i)Egress$'
+              - contains:
+                  pattern: '^(?i)Ingress$'

checks/notReadOnlyRootFilesystem.yaml

@@ -2,7 +2,7 @@ successMessage: Filesystem is read only
 failureMessage: Filesystem should be read only
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:
@@ -40,4 +40,9 @@ schema:
           - securityContext
           properties:
             securityContext:
-              $ref: "#/definitions/goodSecurityContext"
+              $ref: "#/definitions/goodSecurityContext"
+mutations:
+  - op: add
+    path: /securityContext/readOnlyRootFilesystem
+    value: true
+

checks/priorityClassNotSet.yaml

@@ -1,9 +1,13 @@
 successMessage: Priority class has been set
 failureMessage: Priority class should be set
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
   required:
   - priorityClassName
+mutations:
+  - op: add
+    path: /priorityClassName
+    value: high-priority

checks/privilegeEscalationAllowed.yaml

@@ -2,7 +2,7 @@ successMessage: Privilege escalation not allowed
 failureMessage: Privilege escalation should not be allowed
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:
@@ -40,4 +40,9 @@ schema:
           - securityContext
           properties:
             securityContext:
-              $ref: "#/definitions/goodSecurityContext"
+              $ref: "#/definitions/goodSecurityContext"
+
+mutations:
+  - op: add
+    path: /securityContext/allowPrivilegeEscalation
+    value: false

checks/readinessProbeMissing.yaml

@@ -19,3 +19,8 @@ schema:
       type: object
       not:
         const: null
+mutations:
+  - op: add
+    path: /readinessProbe
+    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
+    comment: "TODO: Change the readinessProbe setting to reflect your application's readiness to serve traffic"

checks/rolePodExecAttach.yaml

@@ -0,0 +1,45 @@
+successMessage: The Role does not allow pods/exec or pods/attach
+failureMessage: The Role allows Pods/exec or pods/attach
+category: Security
+target: rbac.authorization.k8s.io/Role
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["metadata", "rules"]
+  properties:
+    metadata:
+      required: ["name"]
+      properties:
+        name:
+          type: string
+    rules:
+      type: array
+      items:
+        type: object
+        not:
+          required: ["apiGroups", "resources", "verbs"]
+          properties:
+            apiGroups:
+              type: array
+              contains:
+                type: string
+                anyOf:
+                  - const: ""
+                  - const: '*'
+            resources:
+              type: array
+              contains:
+                type: string
+                anyOf:
+                  - const: '*'
+                  - const: "pods/exec"
+                  - const: "pods/attach"
+            verbs:
+              type: array
+              contains:
+                type: string
+                anyOf:
+                  - const: '*'
+                  # An exec is also possible by `get`ing a web socket.
+                  - const: 'get'
+                  - const: 'create'

checks/rolebindingClusterAdminClusterRole.yaml

@@ -0,0 +1,84 @@
+successMessage: The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
+failureMessage: The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a Role.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["kind"]
+          properties:
+            kind:
+              type: string
+              const: "Role"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+              not:
+                const: "cluster-admin"
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "ClusterRole" }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      const: "*"
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      const: '*'
+                  verbs:
+                    type: array
+                    uniqueItems: true
+                    oneOf:
+                      - contains:
+                          type: string
+                          const: '*'
+                      - minItems: 7
+                        items:
+                          type: string
+                          enum:
+                            - "get"
+                            - "list"
+                            - "watch"
+                            - "create"
+                            - "update"
+                            - "patch"
+                            - "delete"
+    {{ end }}

checks/rolebindingClusterAdminRole.yaml

@@ -0,0 +1,82 @@
+successMessage: The RoleBinding does not reference a Role with wildcard permissions
+failureMessage: The RoleBinding references a Role with wildcard permissions
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a ClusterRole.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["kind"]
+          properties:
+            kind:
+              type: string
+              const: "ClusterRole"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "Role"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "Role" }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      const: "*"
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      const: '*'
+                  verbs:
+                    type: array
+                    uniqueItems: true
+                    oneOf:
+                      - contains:
+                          type: string
+                          const: '*'
+                      - minItems: 7
+                        items:
+                          type: string
+                          enum:
+                            - "get"
+                            - "list"
+                            - "watch"
+                            - "create"
+                            - "update"
+                            - "patch"
+                            - "delete"
+    {{ end }}

checks/rolebindingClusterRolePodExecAttach.yaml

@@ -0,0 +1,78 @@
+successMessage: The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
+failureMessage: The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a Role.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["kind"]
+          properties:
+            kind:
+              type: string
+              const: "Role"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "ClusterRole" }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: ""
+                        - const: '*'
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        - const: "pods/exec"
+                        - const: "pods/attach"
+                  verbs:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        # An exec is also possible by `get`ing a web socket.
+                        - const: 'get'
+                        - const: 'create'
+    {{ end }}

checks/rolebindingRolePodExecAttach.yaml

@@ -0,0 +1,81 @@
+successMessage: The RoleBinding does not reference a Role allowing Pod exec or attach
+failureMessage: The RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a ClusterRole.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "Role"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "Role"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "Role" }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: ""
+                        - const: '*'
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        - const: "pods/exec"
+                        - const: "pods/attach"
+                  verbs:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        # An exec is also possible by `get`ing a web socket.
+                        - const: 'get'
+                        - const: 'create'
+    {{ end }}

checks/runAsPrivileged.yaml

@@ -2,7 +2,7 @@ successMessage: Not running as privileged
 failureMessage: Should not be running as privileged
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:
@@ -21,4 +21,8 @@ schema:
       items:
         properties:
           securityContext:
-            $ref: "#/definitions/notBadSecurityContext"
+            $ref: "#/definitions/notBadSecurityContext"
+mutations:
+  - op: add
+    path: /securityContext/privileged
+    value: false

checks/runAsRootAllowed.yaml

@@ -2,7 +2,7 @@ successMessage: Is not allowed to run as root
 failureMessage: Should not be allowed to run as root
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:
@@ -50,3 +50,7 @@ schema:
           properties:
             securityContext:
               $ref: "#/definitions/goodSecurityContext"
+mutations:
+  - op: add
+    path: /securityContext/runAsNonRoot
+    value: true

checks/sensitiveConfigmapContent.yaml

@@ -0,0 +1,43 @@
+successMessage: The ConfigMap does not contain potentially sensitive content in its keys and values
+failureMessage: Potentially sensitive content is detected in the ConfigMap keys or values
+category: Security
+target: /ConfigMap
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["metadata"]
+  properties:
+    metadata:
+      required: ["name"]
+      properties:
+        name:
+          type: string
+    data:
+      type: object
+      propertyNames:
+        '$comment': These ConfigMap keys will be disallowed.
+        allOf:
+          - not:
+              pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+          - not:
+              pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+          - not:
+              pattern: '(?i)^AZURE_.+KEY$'
+          - not:
+              pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+          - not:
+              pattern: '(?i)password'
+          - not:
+              pattern: '(?i)token'
+          - not:
+              pattern: '(?i)bearer'
+          - not:
+              pattern: '(?i)secret'
+            '$comment': This allows ConfigMap keys not excluded above.
+          - pattern: '(?i).*'
+      additionalProperties:
+        '$comment': These ConfigMap values will be disallowed.
+        allOf:
+        - not:
+            '$comment': THis matches variations like begin private key, begin rsa private key ...
+            pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'

checks/sensitiveContainerEnvVar.yaml

@@ -0,0 +1,43 @@
+successMessage: The container does not set potentially sensitive environment variables
+failureMessage: The container sets potentially sensitive environment variables
+category: Security
+target: Container
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    env:
+      type: array
+      items:
+        type: object
+        required: ["name"]
+        properties:
+          name:
+            type: string
+            '$comment': These environment variable names will be disallowed.
+            allOf:
+              - not:
+                  pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+              - not:
+                  pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+              - not:
+                  pattern: '(?i)^AZURE_.+KEY$'
+              - not:
+                  pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+              - not:
+                  pattern: '(?i)password'
+              - not:
+                  pattern: '(?i)token'
+              - not:
+                  pattern: '(?i)bearer'
+              - not:
+                  pattern: '(?i)secret'
+                '$comment': This allows variable names not excluded above.
+              - pattern: '(?i).*'
+          value:
+            type: string
+            '$comment': These environment variable values will be disallowed.
+            allOf:
+            - not:
+                '$comment': THis matches variations like begin private key, begin rsa private key ...
+                pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'

cmd/polaris/fix.go

@@ -0,0 +1,197 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+const templateLineMarker = "# POLARIS_FIX_TMPL"
+const templateOpenMarker = "POLARIS_OPEN_TMPL"
+const templateCloseMarker = "POLARIS_CLOSE_TMPL"
+
+var (
+	filesPath   string
+	checksToFix []string
+	fixAll      bool
+	isTemplate  bool
+)
+
+func init() {
+	rootCmd.AddCommand(fixCommand)
+	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
+	fixCommand.PersistentFlags().BoolVar(&isTemplate, "template", false, "set to true when modifyng a YAML template, like a Helm chart (experimental)")
+	fixCommand.PersistentFlags().StringSliceVar(&checksToFix, "checks", []string{}, "Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations")
+}
+
+var fixCommand = &cobra.Command{
+	Use:   "fix",
+	Short: "Fix Infrastructure as code files.",
+	Long:  `Fix Infrastructure as code files.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		logrus.Debug("Setting up controller manager")
+
+		if filesPath == "" {
+			logrus.Error("Please specify a files-path flag")
+			cmd.Help()
+			os.Exit(1)
+		}
+		var yamlFiles []string
+		fileInfo, err := os.Stat(filesPath)
+		if err != nil {
+			logrus.Error(err)
+			os.Exit(1)
+		}
+		if fileInfo.IsDir() {
+			baseDir := filesPath
+			if !strings.HasSuffix(filesPath, "/") {
+				baseDir = baseDir + "/"
+			}
+			yamlFiles, err = getYamlFiles(baseDir)
+			if err != nil {
+				logrus.Error(err)
+				os.Exit(1)
+			}
+		} else {
+			yamlFiles = append(yamlFiles, filesPath)
+		}
+
+		if len(checksToFix) > 0 {
+			if len(checksToFix) == 1 && checksToFix[0] == "all" {
+				allchecks := []string{}
+				for key := range config.Checks {
+					allchecks = append(allchecks, key)
+				}
+				config.Mutations = allchecks
+			} else if len(checksToFix) == 0 && checksToFix[0] == "none" {
+				config.Mutations = nil
+			} else {
+				config.Mutations = checksToFix
+			}
+		}
+
+		for _, fullFilePath := range yamlFiles {
+			yamlContent, err := ioutil.ReadFile(fullFilePath)
+			if err != nil {
+				logrus.Fatalf("Error reading file with file path %s: %v", fullFilePath, err)
+			}
+
+			if err != nil {
+				logrus.Fatalf("Error marshalling %s: %v", fullFilePath, err)
+			}
+
+			if isTemplate {
+				yamlContent = []byte(detemplate(string(yamlContent)))
+			}
+			kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
+			results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
+			if err != nil {
+				logrus.Fatalf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+			}
+			allMutations := mutation.GetMutationsFromResults(results)
+
+			updatedYamlContent := ""
+			if len(allMutations) > 0 {
+				for _, resources := range kubeResources.Resources {
+					for _, resource := range resources {
+						key := fmt.Sprintf("%s/%s/%s", resource.Kind, resource.Resource.GetName(), resource.Resource.GetNamespace())
+						mutations := allMutations[key]
+						mutatedYamlContent, err := mutation.ApplyAllMutations(string(resource.OriginalObjectYAML), mutations)
+						if err != nil {
+							logrus.Errorf("Error applying schema mutations to the resource %s: %v", key, err)
+							os.Exit(1)
+						}
+						if updatedYamlContent != "" {
+							updatedYamlContent += "\n---\n"
+						}
+						updatedYamlContent += mutatedYamlContent
+					}
+				}
+			}
+
+			if isTemplate {
+				updatedYamlContent = retemplate(updatedYamlContent)
+			}
+
+			if updatedYamlContent != "" {
+				err = ioutil.WriteFile(fullFilePath, []byte(updatedYamlContent), 0644)
+				if err != nil {
+					logrus.Fatalf("Error writing output to file: %v", err)
+				}
+			}
+		}
+
+	},
+}
+
+func detemplate(content string) string {
+	lines := strings.Split(content, "\n")
+	for idx, line := range lines {
+		lines[idx] = detemplateLine(line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+func retemplate(content string) string {
+	lines := strings.Split(content, "\n")
+	for idx, line := range lines {
+		lines[idx] = retemplateLine(line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+func detemplateLine(line string) string {
+	if !strings.HasPrefix(strings.TrimSpace(line), "{{") {
+		line = strings.ReplaceAll(line, "{", templateOpenMarker)
+		line = strings.ReplaceAll(line, "}", templateCloseMarker)
+		return line
+	}
+	tmplStart := strings.Index(line, "{{")
+	newLine := line[:tmplStart] + templateLineMarker + line[tmplStart:]
+	return newLine
+}
+
+func retemplateLine(line string) string {
+	if !strings.Contains(line, templateLineMarker) {
+		line = strings.ReplaceAll(line, templateOpenMarker, "{")
+		line = strings.ReplaceAll(line, templateCloseMarker, "}")
+		return line
+	}
+	return strings.Replace(line, templateLineMarker, "", 1)
+}
+
+func getYamlFiles(rootpath string) ([]string, error) {
+	var list []string
+	err := filepath.Walk(rootpath, func(path string, info os.FileInfo, err error) error {
+		if info.IsDir() {
+			return nil
+		}
+		if filepath.Ext(path) == ".yaml" || filepath.Ext(path) == ".yml" {
+			list = append(list, path)
+		}
+		return nil
+	})
+	return list, err
+}

cmd/polaris/webhook.go

@@ -16,7 +16,6 @@ package cmd
 
 import (
 	"os"
-	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -29,11 +28,17 @@ import (
 
 var webhookPort int
 var disableWebhookConfigInstaller bool
+var enableMutations bool
+var enableValidations bool
+var certDir string
 
 func init() {
 	rootCmd.AddCommand(webhookCmd)
 	webhookCmd.PersistentFlags().IntVarP(&webhookPort, "port", "p", 9876, "Port for the dashboard webserver.")
-	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
+	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "Disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
+	webhookCmd.PersistentFlags().BoolVar(&enableValidations, "validate", true, "Enable the validating webhook to reject workloads with issues")
+	webhookCmd.PersistentFlags().BoolVar(&enableMutations, "mutate", false, "Enable the mutating webhook to modify workloads with issues")
+	webhookCmd.PersistentFlags().StringVar(&certDir, "cert-dir", "/opt/cert", "Directory in which tls certificate is located")
 }
 
 var webhookCmd = &cobra.Command{
@@ -44,7 +49,7 @@ var webhookCmd = &cobra.Command{
 		logrus.Debug("Setting up controller manager")
 
 		mgr, err := manager.New(k8sConfig.GetConfigOrDie(), manager.Options{
-			CertDir: "/opt/cert",
+			CertDir: certDir,
 			Port:    webhookPort,
 		})
 		if err != nil {
@@ -52,19 +57,25 @@ var webhookCmd = &cobra.Command{
 			os.Exit(1)
 		}
 
-		_, err = os.Stat("/opt/cert/tls.crt")
+		_, err = os.Stat(certDir + "/tls.crt")
 		if os.IsNotExist(err) {
-			time.Sleep(time.Second * 10)
 			panic("Cert does not exist")
 		}
 		server := mgr.GetWebhookServer()
 		server.CertName = "tls.crt"
 		server.KeyName = "tls.key"
 
-		// Iterate all the configurations supported controllers to scan and register them for webhooks
-		// Should only register controllers that are configured to be scanned
-		fwebhook.NewWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
+		if !enableMutations && !enableValidations {
+			logrus.Errorf("One of --mutate or --validate must be set to true")
+			os.Exit(1)
+		}
 
+		if enableValidations {
+			fwebhook.NewValidateWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
+		}
+		if enableMutations {
+			fwebhook.NewMutateWebhook(mgr, fwebhook.Mutator{Config: config, Client: mgr.GetClient()})
+		}
 		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
 		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
 			logrus.Errorf("Error starting manager: %v", err)

deploy/dashboard.yaml

@@ -1,156 +0,0 @@
----
-# Source: polaris/templates/0-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: polaris
----
-# Source: polaris/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: polaris
-  namespace: polaris
-  labels:
-    app: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-rules:
-  # required by controller-runtime code doing a cluster wide lookup
-  # when it seems namespace would suffice
-  - apiGroups:
-      - ''
-    resources:
-      - 'nodes'
-    verbs:
-      - 'get'
-      - 'list'
-  - apiGroups:
-      - 'monitoring.coreos.com'
-    resources:
-      - 'prometheuses'
-      - 'alertmanagers'
-    verbs:
-      - 'get'
-      - 'list'
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris-view
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: view
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: polaris
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/dashboard.service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
-  annotations:
-spec:
-  ports:
-  - name: http-dashboard
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: polaris
-    component: dashboard
-  type: ClusterIP
----
-# Source: polaris/templates/dashboard.deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
-    component: dashboard
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: polaris
-      component: dashboard
-  template:
-    metadata:
-      labels:
-        app: polaris
-        component: dashboard
-    spec:
-      containers:
-      - command:
-        - polaris
-        - dashboard
-        - --port
-        - "8080"
-        image: 'quay.io/fairwinds/polaris:5.1'
-        imagePullPolicy: 'Always'
-        name: dashboard
-        ports:
-        - containerPort: 8080
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        resources:
-          limits:
-            cpu: 150m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-              - ALL
-      serviceAccountName: polaris
-      nodeSelector:
-      tolerations:

deploy/webhook.yaml

@@ -1,270 +0,0 @@
----
-# Source: polaris/templates/0-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: polaris
----
-# Source: polaris/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: polaris
-  namespace: polaris
-  labels:
-    app: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-rules:
-  # required by controller-runtime code doing a cluster wide lookup
-  # when it seems namespace would suffice
-  - apiGroups:
-      - ''
-    resources:
-      - 'nodes'
-    verbs:
-      - 'get'
-      - 'list'
-  - apiGroups:
-      - 'monitoring.coreos.com'
-    resources:
-      - 'prometheuses'
-      - 'alertmanagers'
-    verbs:
-      - 'get'
-      - 'list'
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris-view
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: view
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: polaris
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/webhook.service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-spec:
-  ports:
-  - name: webhook
-    port: 443
-    protocol: TCP
-    targetPort: 9876
-  selector:
-    app: polaris
-    component: webhook
-  type: ClusterIP
----
-# Source: polaris/templates/webhook.deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-    component: webhook
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: polaris
-      component: webhook
-  template:
-    metadata:
-      labels:
-        app: polaris
-        component: webhook
-    spec:
-      containers:
-        - name: webhook
-          command:
-            - polaris
-            - webhook
-          image: 'quay.io/fairwinds/polaris:5.1'
-          imagePullPolicy: 'Always'
-          ports:
-            - containerPort: 9876
-          # These are fairly useless readiness/liveness probes for now
-          # Follow this issue for potential improvements:
-          # https://github.com/kubernetes-sigs/controller-runtime/issues/356
-          livenessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 100m
-              memory: 128Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: secret
-              mountPath: /opt/cert/
-              readOnly: true
-            - name: cr-logs
-              mountPath: /tmp/
-              readOnly: false
-      serviceAccountName:  polaris
-      nodeSelector:
-      tolerations:
-      volumes:
-        - name: secret
-          secret:
-            secretName: polaris
-        - name: cr-logs
-          emptyDir: {}
----
-# Source: polaris/templates/webhook.cert.yaml
-apiVersion: cert-manager.io/v1alpha2
-kind: Certificate
-metadata:
-  name: polaris-cert
-  namespace: polaris
-  labels:
-    app: polaris
-spec:
-  commonName: polaris-webhook.polaris.svc
-  dnsNames:
-  - polaris-webhook.polaris.svc
-  - polaris-webhook.polaris
-  - polaris-webhook
-  - polaris-webhook.polaris.svc.
-  issuerRef:
-    kind: Issuer
-    name: polaris-selfsigned
-  secretName: polaris
----
-# Source: polaris/templates/webhook.cert.yaml
-apiVersion: cert-manager.io/v1alpha2
-kind: Issuer
-metadata:
-  name: polaris-selfsigned
-  namespace: polaris
-spec:
-  selfSigned: {}
----
-# Source: polaris/templates/webhook.configuration.yaml
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: polaris-webhook
-  annotations:
-    cert-manager.io/inject-ca-from: polaris/polaris-cert
-webhooks:
-- admissionReviewVersions:
-  - v1beta1
-  clientConfig:
-    service:
-      name: polaris-webhook
-      namespace: polaris
-      path: /validate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Exact
-  name: polaris.fairwinds.com
-  namespaceSelector:
-    
-    matchExpressions:
-    - key: control-plane
-      operator: DoesNotExist
-  objectSelector:
-    
-    {}
-  rules:
-  - apiGroups:
-    - apps
-    apiVersions:
-    - v1
-    - v1beta1
-    - v1beta2
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - daemonsets
-    - deployments
-    - statefulsets
-    scope: Namespaced
-  - apiGroups:
-    - batch
-    apiVersions:
-    - v1
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - jobs
-    - cronjobs
-    scope: Namespaced
-  - apiGroups:
-    - ""
-    apiVersions:
-    - v1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - pods
-    - replicationcontrollers
-    scope: Namespaced
-  sideEffects: None
-  timeoutSeconds: 10

docs/.vuepress/public/scripts/marketing.js

@@ -27,3 +27,26 @@ new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
 j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
 })(window,document,'script','dataLayer','GTM-TM95WXQ');
+
+!function() {
+  var t = window.driftt = window.drift = window.driftt || [];
+  if (!t.init) {
+    if (t.invoked) return void (window.console && console.error && console.error("Drift snippet included twice."));
+    t.invoked = !0, t.methods = [ "identify", "config", "track", "reset", "debug", "show", "ping", "page", "hide", "off", "on" ],
+    t.factory = function(e) {
+      return function() {
+        var n = Array.prototype.slice.call(arguments);
+        return n.unshift(e), t.push(n), t;
+      };
+    }, t.methods.forEach(function(e) {
+      t[e] = t.factory(e);
+    }), t.load = function(t) {
+      var e = 3e5, n = Math.ceil(new Date() / e) * e, o = document.createElement("script");
+      o.type = "text/javascript", o.async = !0, o.crossorigin = "anonymous", o.src = "https://js.driftt.com/include/" + n + "/" + t + ".js";
+      var i = document.getElementsByTagName("script")[0];
+      i.parentNode.insertBefore(o, i);
+    };
+  }
+}();
+drift.SNIPPET_VERSION = '0.3.1';
+drift.load('dp7v3zbc7xhm');

docs/admission-controller.md

@@ -25,11 +25,6 @@ If you don't use cert-manager, you'll need to:
 * Create a TLS secret in your cluster with a valid certificate that uses that CA
 * Pass the name of that secret with the webhook.secretName parameter.
 
-### kubectl
-```bash
-kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/webhook.yaml
-```
-
 ### Helm
 ```bash
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable
@@ -50,3 +45,17 @@ output unless we are rejecting a workload altogether.
 This means that any checks with a severity of `warning` will still pass webhook validation,
 and the only evidence of that warning will either be in the Polaris dashboard or the
 Polaris webhook logs. This will change in a future version of Kubernetes.
+
+## Mutating Webhook
+By default, the Admission Controller is just pass/fail, but
+Polaris can also operate as a mutating webhook for many of the issues it checks for.
+This means Polaris will remediate the issue it finds, rather than rejecting
+the deployment.
+
+To enable the mutating webhook, add `--set webhook.mutate=true` to your
+Helm instlallation command.
+
+By default, the only mutation enabled is `pullPolicyNotAlways`. If you'd like to
+enable other mutations, you can set the `webhook.mutations` flag.
+
+

docs/changelog.md

@@ -5,6 +5,23 @@ meta:
     content: "Fairwinds Polaris | Changelog"
 
 ---
+## 7.0.2
+* Fixes for pretty CLI output
+* Some new checks (disabled by default)
+* Some additional features in templating engine
+
+## 7.0.1
+* Documentation updates
+
+## 7.0.0
+* Better support for `polaris fix`
+* `target: Pod` is now `target: PodSpec` (to differentiate naked Pods from Controllers)
+
+## 6.0.0
+* Preliminary support for `polaris fix` command
+* Changes to how Pod owners are determined
+* Removed YAML manifests from the `deploy/` directory - Helm is now the default install mechanism
+
 ## 5.1.0
 * Support `--context` flag for kubecontext
 * Treat core Kubernetes controllers (`Deployments`, `StatefulSets`, `DaemonSets`, `CronJobs`) as top-level objects, instead of following owner refs

docs/contributing.md

@@ -73,50 +73,7 @@ Each new pull request should:
 - Be up to date and/or rebased on the master branch
 
 ## Creating a new release
+To create a new release, simply tag this repo with the new version.
 
-### Patch releases
-Patch releases only need to change this repo. The Helm chart and deploy scripts
-will automatically pull in the latest changes.
-
-If the release involves changes to anything in the `deploy/` folder (e.g. new RBAC permissions),
-it needs to be a minor or major release in order to prevent breaking the Helm chart.
-
-1. Create a PR for this repo
-    1. Bump the version number in:
-        1. main.go
-        2. README.md
-    2. Update CHANGELOG.md
-    3. Merge your PR
-2. Tag the latest branch for this repo
-    1. Pull the latest commit for the `master` branch (which you just merged in your PR)
-    2. Run `git tag $VERSION && git push --tags`
-    3. Make sure CircleCI runs successfully for the new tag - this will push images to quay.io and create a release in GitHub
-        1. If CircleCI fails, check with Codeowners ASAP
-
-### Minor/Major releases
-Minor and major releases need to change both this repository and the
-[Helm chart repo](https://github.com/FairwindsOps/charts/).
-
-The steps are:
-1. Modify the [Helm chart](https://github.com/FairwindsOps/charts/stable/polaris)
-    1. Clone the helm charts repo
-        1. `git clone https://github.com/FairwindsOps/charts`
-        2. `git checkout -b yourname/update-polaris`
-    1. Bump the version number in `stable/polaris/Chart.yaml`
-    2. Make any necessary changes to the chart to support the new version of Polaris (e.g. new RBAC permissions)
-    3. **Don't merge yet!**
-2. Create a PR for this repo
-    1. Create a new branch named `yourname/update-version`
-    2. Bump the version number in:
-        1. main.go
-        2. README.md
-    3. Regenerate the deployment files. Assuming you've cloned the charts repo to `~/git/charts`:
-        1. `CHARTS_DIR=~/git/charts ./scripts/generate-deployment-files.sh`
-    4. Update CHANGELOG.md
-    5. Merge your PR
-3. Tag the latest branch for this repo
-    1. Pull the latest for the `master` branch
-    2. Run `git tag $VERSION && git push --tags`
-    3. Make sure CircleCI runs successfully for the new tag - this will push images to quay.io and create a release in GitHub
-        1. If CircleCI fails, check with Codeowners ASAP
-4. Create and merge a PR for your changes to the Helm chart
+For major and minor releases, don't forget to update the Helm chart at
+https://github.com/FairwindsOps/charts

docs/customization/custom-checks.md

@@ -43,10 +43,11 @@ check ID. Note that you'll also have to set its severity in the `checks` section
 * `category` - one of `Security`, `Efficiency`, or `Reliability`
 * `target` - specifies the type of resource to check. This can be:
   * a group and kind, e.g. `apps/Deployment` or `networking.k8s.io/Ingress`
-  * `Controller`, to check _any_ resource that contains a pod spec (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
-  * `Pod`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
+  * `Controller`, to check _any_ resource that creates Pods (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
+  * `PodTemplate`, same as `Controller`, but the schema applies to the Pod template rather than the top-level controller
+  * `PodSpec`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
   * `Container` same as `Controller`, but the schema applies to all Container specs rather than the top-level controller
-* `controllers` - if `target` is `Controller`, `Pod` or `Container`, you can use this to change which types of controllers are checked
+* `controllers` - if `target` is `Controller`, `PodSpec` or `Container`, you can use this to change which types of controllers are checked
 * `controllers.include` - _only_ check these controllers
 * `controllers.exclude` - check all controllers except these
 * `containers` - if `target` is `Container`, you can use this to decide if `initContainers`, `containers`, or both should be checked
@@ -134,6 +135,11 @@ schema:
               const: "{{ .metadata.name }}"
 ```
 
+* The object available via the go template is the full object, and not limited by `target`.
+* A check of `target: PodSpec` can directly access the pod specification via the go template variable `.Polaris.PodSpec`.
+* A check of `target: PodTemplate` can directly access the pod template via the go template variable `.Polaris.PodTemplate`.
+* A check of `target: Container` can directly access the container being checked via the go template variable `.Polaris.container`. The pod template and pod specification can also be accessed via the respective variables `.Polaris.PodTemplate` and `.Polaris.PodSpec`. Access to pod-level fields allows a container check to consult related fields from the pod, such as `securityContext`.
+
 You can also use the full [Go template syntax](https://golang.org/pkg/text/template/), though
 you may need to specify your schema as a string in order to use concepts like `range`. E.g.
 this check ensures that at least one of the object's labels is present in `matchLabels`:

docs/dashboard.md

@@ -16,11 +16,6 @@ don't conform to best practices.
 
 ## Installation
 
-### kubectl
-```bash
-kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/dashboard.yaml
-kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
-```
 ### Helm
 ```bash
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable

docs/infrastructure-as-code.md

@@ -25,6 +25,32 @@ brew install FairwindsOps/tap/polaris
 polaris version
 ```
 
+## Checking Infrastructure as Code files
+You can audit Kubernetes YAML files by running:
+```bash
+polaris audit --audit-path ./deploy/ --format=pretty
+```
+This will print out any issues Polaris finds in your manifests.
+
+Polaris can only check raw YAML manifests. If you'd like to check a Helm template,
+you can run `helm template` to generate a manifest that Polaris can check.
+
+## Fixing Issues
+Polaris can automatically fix many of the issues it finds. For example, you can run
+```bash
+polaris fix --files-path ./deploy/ --checks=all
+```
+
+to fix any issues inside the `deploy` directory. Polaris may leave
+comments next to some changes (e.g. liveness and readiness probes) prompting
+the user to set them to something more appropriate given the context of their
+application.
+
+Note that not all issues can be automatically fixed.
+
+Currently only raw YAML manifests can be mutated. Helm charts etc.
+still need to be changed manually.
+
 ## Running in a CI pipeline
 
 ### Set minimum score for an exit code

docs/package.json

@@ -8,9 +8,9 @@
   },
   "description": "A repository with a Vuepress template for Fairwinds projects",
   "devDependencies": {
-    "vuepress": "^1.4.0",
+    "vuepress": "^1.9.7",
     "vuepress-plugin-clean-urls": "^1.1.1",
-    "vuepress-plugin-redirect": "^1.2.3"
+    "vuepress-plugin-redirect": "^1.2.5"
   },
   "directories": {
     "doc": "docs"

examples/config-full.yaml

@@ -12,8 +12,11 @@ checks:
   memoryRequestsMissing: warning
   memoryLimitsMissing: warning
   # security
+  automountServiceAccountToken: warning
   hostIPCSet: danger
   hostPIDSet: danger
+  linuxHardening: danger
+  missingNetworkPolicy: warning
   notReadOnlyRootFilesystem: warning
   privilegeEscalationAllowed: danger
   runAsRootAllowed: danger
@@ -22,6 +25,13 @@ checks:
   insecureCapabilities: warning
   hostNetworkSet: danger
   hostPortSet: warning
+  sensitiveContainerEnvVar: danger
+  sensitiveConfigmapContent: danger
+  clusterrolePodExecAttach: danger
+  rolePodExecAttach: danger
+  clusterrolebindingPodExecAttach: danger
+  rolebindingClusterRolePodExecAttach: danger
+  rolebindingRolePodExecAttach: danger
   # custom
   resourceLimits: warning
   imageRegistry: danger
@@ -87,5 +97,3 @@ customChecks:
           type: string
           not:
             pattern: ^quay.io
-
-namespce: test-ns

examples/config.yaml

@@ -28,6 +28,8 @@ checks:
   hostPortSet: warning
   tlsSettingsMissing: warning
 
+mutations:
+  - pullPolicyNotAlways
 
 exemptions:
   - namespace: kube-system
@@ -202,5 +204,3 @@ exemptions:
       - kube-hunter
     rules:
       - runAsRootAllowed
-
-namespace: test-ns

fairwinds-insights.yaml

@@ -1,14 +1,7 @@
 options:
-  organization: fairwinds-opensource
+  organization: fairwinds-production
   baseBranch: master
 
-# These images will be scanned for vulnerabilities.
 images:
   docker:
   - quay.io/fairwinds/polaris:$CI_SHA1
-
-# These manifests will be scanned for configuration issues.
-manifests:
-  yaml:
-  - ./deploy/dashboard.yaml
-  - ./deploy/webhook.yaml

go.mod

@@ -1,28 +1,95 @@
 module github.com/fairwindsops/polaris
 
-go 1.15
+go 1.19
 
 require (
-	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
-	github.com/evanphx/json-patch/v5 v5.6.0
 	github.com/fatih/color v1.13.0
-	github.com/gobuffalo/packr/v2 v2.8.1
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/uuid v1.1.3 // indirect
+	github.com/gobuffalo/packr/v2 v2.8.3
 	github.com/gorilla/mux v1.8.0
-	github.com/karrick/godirwalk v1.16.1 // indirect
 	github.com/qri-io/jsonschema v0.1.1
-	github.com/rogpeppe/go-internal v1.6.2 // indirect
-	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.3.0
+	github.com/sirupsen/logrus v1.9.0
+	github.com/spf13/cobra v1.5.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.0
-	github.com/thoas/go-funk v0.9.1
+	github.com/stretchr/testify v1.8.0
+	github.com/thoas/go-funk v0.9.2
 	golang.org/x/text v0.3.7 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
-	k8s.io/api v0.22.2
-	k8s.io/apimachinery v0.22.2
-	k8s.io/client-go v0.22.2
-	sigs.k8s.io/controller-runtime v0.10.1
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/api v0.25.0
+	k8s.io/apimachinery v0.25.0
+	k8s.io/client-go v0.25.0
+	sigs.k8s.io/controller-runtime v0.13.0
 	sigs.k8s.io/yaml v1.3.0
 )
+
+require (
+	github.com/pkg/errors v0.9.1
+	gomodules.xyz/jsonpatch/v2 v2.2.0
+)
+
+require (
+	cloud.google.com/go/compute v1.9.0 // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.1 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/gobuffalo/logger v1.0.7 // indirect
+	github.com/gobuffalo/packd v1.0.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/gnostic v0.6.9 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/karrick/godirwalk v1.17.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/markbates/errx v1.1.0 // indirect
+	github.com/markbates/oncer v1.0.0 // indirect
+	github.com/markbates/safe v1.0.1 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.13.0 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.37.0 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
+	github.com/qri-io/jsonpointer v0.1.1 // indirect
+	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90 // indirect
+	golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect
+	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 // indirect
+	golang.org/x/sys v0.0.0-20220913175220-63ea55921009 // indirect
+	golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
+	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/component-base v0.25.0 // indirect
+	k8s.io/klog/v2 v2.80.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20220803164354-a70c9af30aea // indirect
+	k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73 // indirect
+	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+)

main.go

@@ -18,9 +18,11 @@ import (
 	cmd "github.com/fairwindsops/polaris/cmd/polaris"
 )
 
-const (
-	// Version represents the current release version of Polaris
-	Version = "5.1.0"
+var (
+	// Version is set during build
+	Version = "development"
+	// Commit is set during build
+	Commit = ""
 )
 
 func main() {

pkg/config/checks.go

@@ -32,6 +32,7 @@ var (
 		"hostIPCSet",
 		"hostPIDSet",
 		"hostNetworkSet",
+		"automountServiceAccountToken",
 		// Container checks
 		"memoryLimitsMissing",
 		"memoryRequestsMissing",
@@ -49,11 +50,23 @@ var (
 		"dangerousCapabilities",
 		"insecureCapabilities",
 		"priorityClassNotSet",
+		"linuxHardening",
+		"sensitiveContainerEnvVar",
 		// Other checks
 		"tlsSettingsMissing",
 		"pdbDisruptionsIsZero",
 		"metadataAndNameMismatched",
 		"missingPodDisruptionBudget",
+		"missingNetworkPolicy",
+		"sensitiveConfigmapContent",
+		"clusterrolePodExecAttach",
+		"rolePodExecAttach",
+		"clusterrolebindingPodExecAttach",
+		"rolebindingClusterRolePodExecAttach",
+		"rolebindingRolePodExecAttach",
+		"clusterrolebindingClusterAdmin",
+		"rolebindingClusterAdminClusterRole",
+		"rolebindingClusterAdminRole",
 	}
 )
 

pkg/config/schema.go

@@ -38,15 +38,26 @@ const (
 	TargetController TargetKind = "Controller"
 	// TargetContainer points to the container spec
 	TargetContainer TargetKind = "Container"
-	// TargetPod points to the pod spec
-	TargetPod TargetKind = "Pod"
+	// TargetPodSpec points to the pod spec
+	TargetPodSpec TargetKind = "PodSpec"
+	// TargetPodTemplate points to the pod template
+	TargetPodTemplate TargetKind = "PodTemplate"
 )
 
 // HandledTargets is a list of target names that are explicitly handled
 var HandledTargets = []TargetKind{
 	TargetController,
 	TargetContainer,
-	TargetPod,
+	TargetPodSpec,
+	TargetPodTemplate,
+}
+
+// Mutation defines how to change a YAML file, in the style of JSON Patch
+type Mutation struct {
+	Path    string
+	Op      string
+	Value   interface{}
+	Comment string
 }
 
 // SchemaCheck is a Polaris check that runs using JSON Schema
@@ -65,13 +76,14 @@ type SchemaCheck struct {
 	AdditionalSchemas       map[string]map[string]interface{} `yaml:"additionalSchemas" json:"additionalSchemas"`
 	AdditionalSchemaStrings map[string]string                 `yaml:"additionalSchemaStrings" json:"additionalSchemaStrings"`
 	AdditionalValidators    map[string]jsonschema.RootSchema  `yaml:"-" json:"-"`
-	Mutations               []map[string]interface{}          `yaml:"mutations" json:"mutations"`
+	Mutations               []Mutation                        `yaml:"mutations" json:"mutations"`
 }
 
 type resourceMinimum string
 type resourceMaximum string
 
-func unmarshalYAMLOrJSON(raw []byte, dest interface{}) error {
+// UnmarshalYAMLOrJSON is a helper function to unmarshal data in an arbitrary format
+func UnmarshalYAMLOrJSON(raw []byte, dest interface{}) error {
 	reader := bytes.NewReader(raw)
 	d := k8sYaml.NewYAMLOrJSONDecoder(reader, 4096)
 	for {
@@ -88,7 +100,7 @@ func unmarshalYAMLOrJSON(raw []byte, dest interface{}) error {
 // ParseCheck parses a check from a byte array
 func ParseCheck(id string, rawBytes []byte) (SchemaCheck, error) {
 	check := SchemaCheck{}
-	err := unmarshalYAMLOrJSON(rawBytes, &check)
+	err := UnmarshalYAMLOrJSON(rawBytes, &check)
 	if err != nil {
 		return check, err
 	}
@@ -232,24 +244,29 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
 	newCheck.AdditionalValidators = map[string]jsonschema.RootSchema{}
 	for kind, schemaStr := range newCheck.AdditionalSchemaStrings {
 		val := jsonschema.RootSchema{}
-		err := unmarshalYAMLOrJSON([]byte(schemaStr), &val)
+		err := UnmarshalYAMLOrJSON([]byte(schemaStr), &val)
 		if err != nil {
 			return nil, err
 		}
 		newCheck.AdditionalValidators[kind] = val
 	}
-	err := unmarshalYAMLOrJSON([]byte(newCheck.SchemaString), &newCheck.Validator)
+	err := UnmarshalYAMLOrJSON([]byte(newCheck.SchemaString), &newCheck.Validator)
 	if err != nil {
 		return nil, err
 	}
 	return &newCheck, err
 }
 
-// CheckPod checks a pod spec against the schema
-func (check SchemaCheck) CheckPod(pod *corev1.PodSpec) (bool, []jsonschema.ValError, error) {
+// CheckPodSpec checks a pod spec against the schema
+func (check SchemaCheck) CheckPodSpec(pod *corev1.PodSpec) (bool, []jsonschema.ValError, error) {
 	return check.CheckObject(pod)
 }
 
+// CheckPodTemplate checks a pod template against the schema
+func (check SchemaCheck) CheckPodTemplate(podTemplate interface{}) (bool, []jsonschema.ValError, error) {
+	return check.CheckObject(podTemplate)
+}
+
 // CheckController checks a controler's spec against the schema
 func (check SchemaCheck) CheckController(bytes []byte) (bool, []jsonschema.ValError, error) {
 	errs, err := check.Validator.ValidateBytes(bytes)
@@ -296,6 +313,11 @@ func (check SchemaCheck) CheckAdditionalObjects(groupkind string, objects []inte
 // IsActionable decides if this check applies to a particular target
 func (check SchemaCheck) IsActionable(target TargetKind, kind string, isInit bool) bool {
 	if funk.Contains(HandledTargets, target) {
+		if check.Target == TargetPodTemplate && target == TargetPodSpec {
+			// A target=PodSpec and check.Target=PodTemplate is expected
+			// because applyPodSchemaChecks() explicitly sets check.Target
+			return true
+		}
 		if check.Target != target {
 			return false
 		}

pkg/dashboard/dashboard.go

@@ -204,12 +204,14 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 
 	router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" && r.URL.Path != basePath {
+			logrus.Warningf("Path not found: %s", r.URL.Path)
 			http.NotFound(w, r)
 			return
 		}
 		adjustedConf := getConfigForQuery(c, r.URL.Query())
 
 		if auditData == nil {
+			logrus.Infof("Creating resource provider")
 			k, err := kube.CreateResourceProvider(r.Context(), auditPath, "", c)
 			if err != nil {
 				logrus.Errorf("Error fetching Kubernetes resources %v", err)
@@ -217,6 +219,7 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 				return
 			}
 
+			logrus.Infof("Running audit")
 			var auditData validator.AuditData
 			auditData, err = validator.RunAudit(adjustedConf, k)
 			if err != nil {
@@ -224,8 +227,10 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 				http.Error(w, "Error running audit", 500)
 				return
 			}
+			logrus.Infof("Sending results")
 			MainHandler(w, r, adjustedConf, auditData, basePath)
 		} else {
+			logrus.Infof("Sending results")
 			MainHandler(w, r, adjustedConf, *auditData, basePath)
 		}
 

pkg/kube/resource.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 
 	"github.com/sirupsen/logrus"
+	"github.com/thoas/go-funk"
 	"gopkg.in/yaml.v3"
 	kubeAPICoreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -29,27 +30,39 @@ import (
 	"k8s.io/client-go/dynamic"
 )
 
+// There are often many ReplicaSets that are orphaned (default 10 per deployment) so we don't cache all of them
+var skipListCacheKinds = []string{"ReplicaSet", "Job"}
+
 // GenericResource is a base implementation with some free methods for inherited structs
 type GenericResource struct {
 	Kind               string
 	ObjectMeta         kubeAPIMetaV1.Object
 	Resource           unstructured.Unstructured
 	PodSpec            *kubeAPICoreV1.PodSpec
+	PodTemplate        interface{}
 	OriginalObjectJSON []byte
+	OriginalObjectYAML []byte
 }
 
 // NewGenericResourceFromUnstructured creates a workload from an unstructured.Unstructured
-func NewGenericResourceFromUnstructured(unst unstructured.Unstructured) (GenericResource, error) {
+func NewGenericResourceFromUnstructured(unst unstructured.Unstructured, podSpecMap interface{}) (GenericResource, error) {
+	if unst.GetCreationTimestamp().Time.IsZero() {
+		unstructured.RemoveNestedField(unst.Object, "metadata", "creationTimestamp")
+		unstructured.RemoveNestedField(unst.Object, "status")
+	}
 	workload := GenericResource{
 		Kind:     unst.GetKind(),
 		Resource: unst,
 	}
-
 	objMeta, err := meta.Accessor(&unst)
 	if err != nil {
 		return workload, err
 	}
 	workload.ObjectMeta = objMeta
+	workload.PodTemplate, err = GetPodTemplate(unst.UnstructuredContent())
+	if err != nil {
+		return workload, err
+	}
 
 	b, err := json.Marshal(&unst)
 	if err != nil {
@@ -61,7 +74,9 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured) (Generic
 	if err != nil {
 		return workload, err
 	}
-	podSpecMap := GetPodSpec(m)
+	if podSpecMap == nil {
+		podSpecMap = GetPodSpec(m)
+	}
 	if podSpecMap != nil {
 		b, err = json.Marshal(podSpecMap)
 		if err != nil {
@@ -79,10 +94,15 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured) (Generic
 
 // NewGenericResourceFromPod builds a new workload for a given Pod without looking at parents
 func NewGenericResourceFromPod(podResource kubeAPICoreV1.Pod, originalObject interface{}) (GenericResource, error) {
+	podMap, err := SerializePod(&podResource)
+	if err != nil {
+		return GenericResource{}, err
+	}
 	workload := GenericResource{
-		Kind:       "Pod",
-		PodSpec:    &podResource.Spec,
-		ObjectMeta: podResource.ObjectMeta.GetObjectMeta(),
+		Kind:        "Pod",
+		PodSpec:     &podResource.Spec,
+		PodTemplate: podMap,
+		ObjectMeta:  podResource.ObjectMeta.GetObjectMeta(),
 	}
 	if originalObject != nil {
 		bytes, err := json.Marshal(originalObject)
@@ -113,7 +133,9 @@ func NewGenericResourceFromBytes(contentBytes []byte) (GenericResource, error) {
 	if err != nil {
 		return GenericResource{}, err
 	}
-	return NewGenericResourceFromUnstructured(unst)
+	res, err := NewGenericResourceFromUnstructured(unst, nil)
+	res.OriginalObjectYAML = contentBytes
+	return res, err
 }
 
 // ResolveControllerFromPod builds a new workload for a given Pod
@@ -128,18 +150,6 @@ func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, err
 }
 
-func isFinalKind(kind string) bool {
-	switch kind {
-		case
-			"Deployment",
-			"CronJob",
-			"StatefulSet",
-			"DaemonSet":
-			return true
-		}
-	return false
-	}
-
 func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
 	podWorkload, err := NewGenericResourceFromPod(podResource, nil)
 	if err != nil {
@@ -147,6 +157,8 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	}
 	topKind := "Pod"
 	topMeta := podWorkload.ObjectMeta
+	var topPodSpec interface{}
+	topPodSpec = podWorkload.Resource.Object
 	owners := podResource.ObjectMeta.GetOwnerReferences()
 	lastKey := ""
 	for len(owners) > 0 {
@@ -162,7 +174,12 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 		lastKey = key
 		abstractObject, ok := objectCache[key]
 		if !ok {
-			err := cacheAllObjectsOfKind(ctx, firstOwner.APIVersion, firstOwner.Kind, dynamicClient, restMapper, objectCache)
+			var err error
+			if funk.Contains(skipListCacheKinds, firstOwner.Kind) {
+				err = cacheSingleObject(ctx, firstOwner.APIVersion, firstOwner.Kind, topMeta.GetNamespace(), firstOwner.Name, dynamicClient, restMapper, objectCache)
+			} else {
+				err = cacheAllObjectsOfKind(ctx, firstOwner.APIVersion, firstOwner.Kind, dynamicClient, restMapper, objectCache)
+			}
 			if err != nil {
 				logrus.Warnf("Error caching objects of Kind %s %v", firstOwner.Kind, err)
 				break
@@ -179,16 +196,17 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 			logrus.Warnf("Error retrieving parent metadata %s of API %s and Kind %s because of error: %v ", firstOwner.Name, firstOwner.APIVersion, firstOwner.Kind, err)
 			return GenericResource{}, err
 		}
+		podSpec := GetPodSpec(abstractObject.Object)
+		if podSpec != nil {
+			topPodSpec = podSpec
+		}
 		topMeta = objMeta
 		owners = abstractObject.GetOwnerReferences()
-		if isFinalKind(topKind) {
-			break
-		}
 	}
 
 	if lastKey != "" {
 		unst := objectCache[lastKey]
-		return NewGenericResourceFromUnstructured(unst)
+		return NewGenericResourceFromUnstructured(unst, topPodSpec)
 	}
 	workload, err := NewGenericResourceFromPod(podResource, podResource)
 	if err != nil {
@@ -199,7 +217,21 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, nil
 }
 
+func cacheSingleObject(ctx context.Context, apiVersion, kind, namespace, name string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+	logrus.Debugf("Caching a single %s", kind)
+	object, err := getObject(ctx, namespace, kind, apiVersion, name, dynamicClient, restMapper)
+	if err != nil {
+		logrus.Warnf("Error retrieving object %s/%s/%s/%s because of error: %v", kind, apiVersion, namespace, name, err)
+		return err
+	}
+	key := fmt.Sprintf("%s/%s/%s", object.GetKind(), object.GetNamespace(), object.GetName())
+	logrus.Debugf("Caching key %s", key)
+	objectCache[key] = *object
+	return nil
+}
+
 func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+	logrus.Debugf("Caching all %s", kind)
 	fqKind := schema.FromAPIVersionAndKind(apiVersion, kind)
 	mapping, err := (*restMapper).RESTMapping(fqKind.GroupKind(), fqKind.Version)
 	if err != nil {
@@ -214,14 +246,15 @@ func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamic
 	}
 	for idx, object := range objects.Items {
 		key := fmt.Sprintf("%s/%s/%s", object.GetKind(), object.GetNamespace(), object.GetName())
+		logrus.Debugf("  caching key %s", key)
 		objectCache[key] = objects.Items[idx]
 	}
 	return nil
 }
 
 func getObject(ctx context.Context, namespace, kind, version, name string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper) (*unstructured.Unstructured, error) {
-	fqKind := schema.ParseGroupKind(kind)
-	mapping, err := (*restMapper).RESTMapping(fqKind, version)
+	fqKind := schema.FromAPIVersionAndKind(version, kind)
+	mapping, err := (*restMapper).RESTMapping(fqKind.GroupKind(), fqKind.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -241,3 +274,34 @@ func GetPodSpec(yaml map[string]interface{}) interface{} {
 	}
 	return nil
 }
+
+// GetPodTemplate looks inside arbitrary YAML for a Pod template, containing
+// fields `spec.containers`.
+// For example, it returns the `spec.template` level of a Kubernetes Deployment yaml.
+func GetPodTemplate(yaml map[string]interface{}) (podTemplate interface{}, err error) {
+	if yamlSpec, ok := yaml["spec"]; ok {
+		if yamlSpecMap, ok := yamlSpec.(map[string]interface{}); ok {
+			if _, ok := yamlSpecMap["containers"]; ok {
+				// This is a hack around unstructured.SetNestedField using DeepCopy which does
+				// not support the type int, and panics.
+				// Related: https://github.com/kubernetes/kubernetes/issues/62769
+				podTemplateJSON, err := json.Marshal(yaml)
+				if err != nil {
+					return nil, err
+				}
+				podTemplateMap := make(map[string]interface{})
+				err = json.Unmarshal(podTemplateJSON, &podTemplateMap)
+				if err != nil {
+					return nil, err
+				}
+				return podTemplateMap, nil
+			}
+		}
+	}
+	for _, podSpecField := range podSpecFields {
+		if childYaml, ok := yaml[podSpecField]; ok {
+			return GetPodTemplate(childYaml.(map[string]interface{}))
+		}
+	}
+	return nil, nil
+}

pkg/kube/resources.go

@@ -17,6 +17,7 @@ package kube
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -58,7 +59,12 @@ type resourceKindMap map[string][]GenericResource
 
 func (rkm resourceKindMap) addResource(r GenericResource) {
 	gvk := r.Resource.GroupVersionKind()
-	key := gvk.Group + "/" + gvk.Kind
+	var key string
+	if gvk.Group != "" {
+		key = gvk.Group + "/" + gvk.Kind
+	} else {
+		key = gvk.Kind
+	}
 	rkm[key] = append(rkm[key], r)
 }
 
@@ -182,7 +188,7 @@ func CreateResourceProviderFromResource(ctx context.Context, workload string) (*
 		logrus.Errorf("Could not find workload %s: %v", workload, err)
 		return nil, err
 	}
-	workloadObj, err := NewGenericResourceFromUnstructured(*obj)
+	workloadObj, err := NewGenericResourceFromUnstructured(*obj, nil)
 	if err != nil {
 		logrus.Errorf("Could not parse workload %s: %v", workload, err)
 		return nil, err
@@ -215,7 +221,11 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 			logrus.Errorf("Error reading file: %v", path)
 			return err
 		}
-		return resources.addResourcesFromYaml(string(contents))
+		err = resources.addResourcesFromYaml(string(contents))
+		if err != nil {
+			logrus.Warnf("Skipping %s: cannot add resource from YAML: %v", path, err)
+		}
+		return nil
 	}
 
 	err := filepath.Walk(directory, visitFile)
@@ -225,6 +235,13 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 	return &resources, nil
 }
 
+// CreateResourceProviderFromYaml returns a new ResourceProvider using the yaml
+func CreateResourceProviderFromYaml(yamlContent string) *ResourceProvider {
+	resources := newResourceProvider("unknown", "Content", "unknown")
+	resources.addResourcesFromYaml(string(yamlContent))
+	return &resources
+}
+
 // CreateResourceProviderFromCluster creates a new ResourceProvider using live data from a cluster
 func CreateResourceProviderFromCluster(ctx context.Context, c conf.Configuration) (*ResourceProvider, error) {
 	kubeConf, configError := config.GetConfigWithContext(c.KubeContext)
@@ -261,12 +278,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	}
 	provider := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, sourceType, clusterName)
 
+	logrus.Info("Loading nodes")
 	nodes, err := kube.CoreV1().Nodes().List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Nodes: %v", err)
 		return nil, err
 	}
 
+	logrus.Info("Loading namespaces")
 	var namespaces *corev1.NamespaceList
 	if c.Namespace != "" {
 		ns, err := kube.CoreV1().Namespaces().Get(ctx, c.Namespace, metav1.GetOptions{})
@@ -284,12 +303,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
+	logrus.Info("Loading pods")
 	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Pods: %v", err)
 		return nil, err
 	}
 
+	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
 		logrus.Errorf("Error getting API Group resources: %v", err)
@@ -329,13 +350,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			return nil, err
 		}
 
+		logrus.Info("Loading " + kind)
 		objects, err := (*dynamic).Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 			return nil, err
 		}
 		for _, obj := range objects.Items {
-			res, err := NewGenericResourceFromUnstructured(obj)
+			res, err := NewGenericResourceFromUnstructured(obj, nil)
 			if err != nil {
 				return nil, err
 			}
@@ -345,6 +367,7 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 
 	objectCache := map[string]unstructured.Unstructured{}
 
+	logrus.Info("Loading controllers")
 	controllers, err := LoadControllers(ctx, pods.Items, dynamic, &restMapper, objectCache)
 	if err != nil {
 		logrus.Errorf("Error loading controllers from pods: %v", err)
@@ -356,23 +379,25 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
 	provider.Resources.addResources(kubernetesResources)
+	logrus.Info("Done loading Kubernetes resources")
 	return &provider, nil
 }
 
 // LoadControllers loads a list of controllers from the kubeResources Pods
 func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClientPointer *dynamic.Interface, restMapperPointer *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
 	interfaces := []GenericResource{}
-	deduped := map[string]corev1.Pod{}
-	for _, pod := range pods {
+	deduped := map[string]*corev1.Pod{}
+	for idx, pod := range pods {
 		owners := pod.ObjectMeta.OwnerReferences
 		if len(owners) == 0 {
-			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = pod
+			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = &pods[idx]
 			continue
 		}
-		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = pod
+		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = &pods[idx]
 	}
-	for _, pod := range deduped {
-		workload, err := ResolveControllerFromPod(ctx, pod, dynamicClientPointer, restMapperPointer, objectCache)
+	for key, pod := range deduped {
+		logrus.Debugf("Resolving controller from pod %s", key)
+		workload, err := ResolveControllerFromPod(ctx, *pod, dynamicClientPointer, restMapperPointer, objectCache)
 		if err != nil {
 			return nil, err
 		}
@@ -436,7 +461,6 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 	decoder = k8sYaml.NewYAMLOrJSONDecoder(bytes.NewReader(contentBytes), 1000)
 
 	if err != nil {
-		logrus.Errorf("Invalid YAML: %s", string(contents))
 		return err
 	}
 	if resource.Kind == "Namespace" {
@@ -455,6 +479,7 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 		if err != nil {
 			return err
 		}
+		workload.OriginalObjectYAML = contentBytes
 		resources.Resources.addResource(workload)
 	} else {
 		newResource, err := NewGenericResourceFromBytes(contentBytes)
@@ -465,3 +490,45 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 	}
 	return err
 }
+
+// SerializePodSpec converts a typed PodSpec into a map[string]interface{}
+func SerializePodSpec(pod *corev1.PodSpec) (map[string]interface{}, error) {
+	podJSON, err := json.Marshal(pod)
+	if err != nil {
+		return nil, err
+	}
+	podMap := make(map[string]interface{})
+	err = json.Unmarshal(podJSON, &podMap)
+	if err != nil {
+		return nil, err
+	}
+	return podMap, nil
+}
+
+// SerializePod converts a typed Pod into a map[string]interface{}
+func SerializePod(pod *corev1.Pod) (map[string]interface{}, error) {
+	podJSON, err := json.Marshal(pod)
+	if err != nil {
+		return nil, err
+	}
+	podMap := make(map[string]interface{})
+	err = json.Unmarshal(podJSON, &podMap)
+	if err != nil {
+		return nil, err
+	}
+	return podMap, nil
+}
+
+// SerializeContainer converts a typed Container into a map[string]interface{}
+func SerializeContainer(container *corev1.Container) (map[string]interface{}, error) {
+	containerJSON, err := json.Marshal(container)
+	if err != nil {
+		return nil, err
+	}
+	containerMap := make(map[string]interface{})
+	err = json.Unmarshal(containerJSON, &containerMap)
+	if err != nil {
+		return nil, err
+	}
+	return containerMap, nil
+}

pkg/kube/resources_test.go

@@ -74,7 +74,7 @@ func TestGetMultipleResourceFromSingleFile(t *testing.T) {
 
 func TestGetMultipleResourceFromBadFile(t *testing.T) {
 	_, err := CreateResourceProviderFromPath("./test_files/test_3")
-	assert.NotEqual(t, nil, err, "CreateResource From Path should fail with bad yaml")
+	assert.Equal(t, nil, err, "CreateResource From Path should not fail with bad yaml")
 }
 
 func TestAddResourcesFromReader(t *testing.T) {

pkg/mutation/mutate.go

@@ -1,78 +1,435 @@
 package mutation
 
 import (
-	"encoding/json"
+	"bytes"
 	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/sirupsen/logrus"
+	yaml "gopkg.in/yaml.v3"
 
-	jsonpatch "github.com/evanphx/json-patch/v5"
 	"github.com/fairwindsops/polaris/pkg/config"
-	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/pkg/errors"
 )
 
-// ApplyAllSchemaMutations applies available mutation to a single resource
-func ApplyAllSchemaMutations(conf *config.Configuration, resourceProvider *kube.ResourceProvider, resource kube.GenericResource, mutations []map[string]interface{}) (kube.GenericResource, error) {
-	resByte := resource.OriginalObjectJSON
-	var jsonByte []byte
-	mutationByte, err := json.Marshal(mutations)
+const (
+	strTag  = "!!str"
+	seqTag  = "!!seq"
+	mapTag  = "!!map"
+	intTag  = "!!int"
+	boolTag = "!!bool"
+)
+
+// ApplyAllMutations applies available mutation to a single resource
+func ApplyAllMutations(manifest string, mutations []config.Mutation) (string, error) {
+	var mutated string
+	var doc yaml.Node
+	err := yaml.Unmarshal([]byte(manifest), &doc)
 	if err != nil {
-		return resource, err
+		return mutated, err
 	}
 
-	patch, err := jsonpatch.DecodePatch(mutationByte)
-	if err != nil {
-		return resource, err
-	}
-	jsonByte, err = patch.Apply(resByte)
-	if err != nil {
-		return resource, err
-	}
-	mutated, err := kube.NewGenericResourceFromBytes(jsonByte)
-	if err != nil {
-		return resource, err
+	for _, patch := range mutations {
+		splits := getSplitFromPath(patch.Path)
+		valueNode, err := getNodeFromValue(patch.Value, patch.Comment)
+		if err != nil {
+			return mutated, err
+		}
+		switch patch.Op {
+		case "add", "replace":
+			err = addOrReplaceValue(&doc, splits, valueNode)
+			if err != nil {
+				return mutated, err
+			}
+		case "remove":
+			// ignore error if the value specified does not exists
+			_ = removeNodes(&doc, splits)
+		}
 	}
 
-	return mutated, nil
+	buf := bytes.Buffer{}
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	err = enc.Encode(&doc)
+	if err != nil {
+		return mutated, err
+	}
+	err = enc.Close()
+	if err != nil {
+		return mutated, err
+	}
+
+	return buf.String(), nil
 }
 
 // GetMutationsFromResults returns all mutations from results
-func GetMutationsFromResults(conf *config.Configuration, results []validator.Result) map[string][]map[string]interface{} {
-	allMutationsFromResults := make(map[string][]map[string]interface{})
+func GetMutationsFromResults(results []validator.Result) map[string][]config.Mutation {
+	allMutationsFromResults := make(map[string][]config.Mutation)
 	for _, result := range results {
 		key := fmt.Sprintf("%s/%s/%s", result.Kind, result.Name, result.Namespace)
+		mutations := GetMutationsFromResult(&result)
+		allMutationsFromResults[key] = mutations
+	}
+	return allMutationsFromResults
+}
 
-		for _, resultMessage := range result.Results {
-			if len(resultMessage.Mutations) > 0 {
-				mutations, ok := allMutationsFromResults[key]
-				if !ok {
-					mutations = make([]map[string]interface{}, 0)
-				}
-				allMutationsFromResults[key] = append(mutations, resultMessage.Mutations...)
-			}
+// GetMutationsFromResult returns all mutations from single result
+func GetMutationsFromResult(result *validator.Result) []config.Mutation {
+	mutations := []config.Mutation{}
+	for _, resultMessage := range result.Results {
+		if len(resultMessage.Mutations) > 0 {
+			mutations = append(mutations, resultMessage.Mutations...)
 		}
+	}
 
+	if result.PodResult != nil {
 		for _, resultMessage := range result.PodResult.Results {
 			if len(resultMessage.Mutations) > 0 {
-				mutations, ok := allMutationsFromResults[key]
-				if !ok {
-					mutations = make([]map[string]interface{}, 0)
-				}
-				allMutationsFromResults[key] = append(mutations, resultMessage.Mutations...)
+				mutations = append(mutations, resultMessage.Mutations...)
 			}
 		}
 
 		for _, containerResult := range result.PodResult.ContainerResults {
 			for _, resultMessage := range containerResult.Results {
 				if len(resultMessage.Mutations) > 0 {
-					mutations, ok := allMutationsFromResults[key]
-					if !ok {
-						mutations = make([]map[string]interface{}, 0)
-					}
-					allMutationsFromResults[key] = append(mutations, resultMessage.Mutations...)
+					mutations = append(mutations, resultMessage.Mutations...)
 				}
 			}
 		}
-
 	}
-	return allMutationsFromResults
+
+	return mutations
+}
+
+func createPathAndFindNodes(node *yaml.Node, selectors []string, create bool) ([]*yaml.Node, error) {
+	var nodes []*yaml.Node
+	currentSelector := selectors[0]
+	isLastSelector := len(selectors) == 1
+	// array[N] or array[*] selectors.
+	if i := strings.LastIndex(currentSelector, "["); i > 0 && strings.HasSuffix(currentSelector, "]") {
+		arrayIndex := currentSelector[i+1 : len(currentSelector)-1]
+		currentSelector = currentSelector[:i]
+		if checkIfNodeExistedInContent(node.Content, currentSelector) || !create {
+			return findArrayNodes(selectors, currentSelector, node, nodes, arrayIndex, create)
+		}
+		index, err := strconv.Atoi(arrayIndex)
+		if err != nil {
+			if arrayIndex != "-" {
+				return nil, errors.Wrapf(err, "can't parse array index from %v/%v/", currentSelector, arrayIndex)
+			}
+			// if index provided is greater than or less than 0 for an empty array should throw an exception
+		} else if index != 0 {
+			return nil, errors.Errorf("array index (%s) does not exists because array (%s) does not exists", arrayIndex, currentSelector)
+		}
+		// default to zero since no node is present.
+		selectorsToCreateNodes := []string{currentSelector, "0"}
+		if len(selectors) > 1 {
+			selectorsToCreateNodes = append(selectorsToCreateNodes, selectors[1:]...)
+			return createNonExistingPath(selectorsToCreateNodes, node), nil
+		}
+	}
+	if currentSelector == "-" {
+		if isLastSelector {
+			return []*yaml.Node{node}, nil
+		}
+		_, err := createPathAndFindNodes(node, selectors[1:], create)
+		if err != nil {
+			return nil, err
+		}
+	}
+	switch node.Kind {
+	case yaml.MappingNode:
+		for i := 0; i < len(node.Content); i += 2 {
+			// Does the current key match the selector?
+			if node.Content[i].Value == currentSelector {
+				// Found last key, return its value.
+				if !isLastSelector {
+					// Match the rest of the selector path, ie. go deeper
+					// in to the value node.
+					return createPathAndFindNodes(node.Content[i+1], selectors[1:], create)
+				}
+				return []*yaml.Node{node.Content[i+1]}, nil
+			}
+		}
+	case yaml.ScalarNode:
+		// Overwrite any existing nodes.
+		node.Kind = yaml.MappingNode
+		node.Tag = mapTag
+		node.Value = ""
+	case yaml.SequenceNode:
+		return nil, errors.Errorf("parent node is array, use /*/ or /0/../%v/ instead of .%v to access its item(s) first", len(node.Content)-1, currentSelector)
+
+	default:
+		return nil, errors.Errorf("parent node is of unknown kind %v", node.Kind)
+	}
+	if !create {
+		return nil, errors.Errorf("failed to match %s", strings.Join(selectors, "/"))
+	}
+
+	return createNonExistingPath(selectors, node), nil
+}
+
+func addOrReplaceValue(node *yaml.Node, splits []string, value *yaml.Node) error {
+	if len(node.Content) == 0 {
+		return errors.New("No content in node")
+	}
+	nodes, err := createPathAndFindNodes(node.Content[0], splits, true)
+	if err != nil {
+		return err
+	}
+	for _, node := range nodes {
+		if node.Kind == yaml.ScalarNode {
+			// Overwrite an existing scalar value with a new value (whatever kind).
+			*node = *value
+		} else if node.Kind == yaml.MappingNode && value.Kind == yaml.MappingNode {
+			// Append new values onto an existing map node.
+			if len(value.Content) < 2 {
+				logrus.Error("Found a mapping node without enough content")
+				continue
+			}
+			mapKey := value.Content[0].Value
+			found := false
+			for idx, subNode := range node.Content {
+				if idx%2 != 0 {
+					continue
+				}
+				if subNode.Value == mapKey {
+					found = true
+					node.Content[idx+1] = value.Content[1]
+				}
+			}
+			if !found {
+				node.Content = append(value.Content, node.Content...)
+			}
+		} else if node.Kind == yaml.MappingNode && node.Content == nil {
+			// Overwrite a new map node we created in createPathAndFindNodes(), as confirmed
+			// by the nil check (the node.Content wouldn't be nil otherwise).
+			*node = *value
+		} else if node.Kind == yaml.SequenceNode && value.Kind == yaml.SequenceNode {
+			// Append new values onto an existing array node.
+			node.Content = append(node.Content, value.Content...)
+		} else if node.Kind == yaml.SequenceNode && value.Kind == yaml.ScalarNode {
+			// Append new value onto an existing array node.
+			node.Content = append(node.Content, value)
+		} else {
+			return errors.Errorf("can't overwrite %v value (line: %v, column: %v) with %v value", node.Tag, node.Line, node.Column, value.Tag)
+		}
+	}
+
+	return nil
+}
+
+func getNodeFromValue(value interface{}, comment string) (*yaml.Node, error) {
+	bytes, err := yaml.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	var doc yaml.Node
+	err = yaml.Unmarshal(bytes, &doc)
+	if err != nil {
+		return nil, err
+	}
+	if len(doc.Content) == 0 {
+		return nil, errors.New("Generated an empty YAML document")
+	}
+	if doc.Content[0].Kind == yaml.MappingNode {
+		doc.Content[0].Content[0].HeadComment = comment
+	} else {
+		doc.Content[0].LineComment = comment
+	}
+	return doc.Content[0], nil
+}
+
+func removeNodes(doc *yaml.Node, selectors []string) error {
+	err := removeMatchingNode(doc.Content[0], selectors)
+	if err != nil {
+		return errors.Wrapf(err, "failed to match %q", strings.Join(selectors, "/"))
+	}
+
+	return nil
+}
+
+func removeMatchingNode(node *yaml.Node, selectors []string) error {
+	currentSelector := selectors[0]
+	lastSelector := len(selectors) == 1
+	if i := strings.LastIndex(currentSelector, "["); i > 0 && strings.HasSuffix(currentSelector, "]") {
+		arrayIndex := currentSelector[i+1 : len(currentSelector)-1]
+		currentSelector = currentSelector[:i]
+
+		index, err := strconv.Atoi(arrayIndex)
+		if err != nil {
+			if arrayIndex == "*" {
+				index = -1
+			} else {
+				return errors.Wrapf(err, "can't parse array index from %v/%v/", currentSelector, arrayIndex)
+			}
+		} else if index < 0 {
+			return errors.Wrapf(err, "array index can't be negative %v/%v/", currentSelector, arrayIndex)
+		}
+		// Go into array node(s).
+		arrayNodes, err := createPathAndFindNodes(node, []string{currentSelector}, false)
+		if err != nil {
+			return errors.Errorf("can't find %v", currentSelector)
+		}
+		for _, arrayNode := range arrayNodes {
+			if arrayNode.Kind != yaml.SequenceNode {
+				return errors.Errorf("%v is not an array", currentSelector)
+			}
+			if index >= len(arrayNode.Content) {
+				return errors.Errorf("%v array doesn't have index %v", currentSelector, index)
+			}
+
+			var visitArrayNodes []*yaml.Node
+			if index >= 0 { // array[N]
+				visitArrayNodes = []*yaml.Node{arrayNode.Content[index]}
+			} else { // array[*]
+				visitArrayNodes = arrayNode.Content
+			}
+			for _, node := range visitArrayNodes {
+				lastSelector := len(selectors) == 1
+				if !lastSelector {
+					removeMatchingNode(node, selectors[1:])
+				}
+			}
+		}
+	}
+
+	// Iterate over the keys (the slice is key/value pairs).
+	for i := 0; i < len(node.Content); i += 2 {
+		if node.Content[i].Value == currentSelector {
+			// Key matches the selector.
+			if !lastSelector {
+				// Try to match the rest of the selector path in the value.
+				return removeMatchingNode(node.Content[i+1], selectors[1:])
+			}
+
+			node.Content[i] = nil   // Delete key.
+			node.Content[i+1] = nil // Delete value.
+			node.Content = append(node.Content[:i], node.Content[i+2:]...)
+			return nil
+		}
+	}
+
+	return errors.Errorf("can't find %q", strings.Join(selectors, "."))
+}
+
+func getSplitFromPath(path string) []string {
+	var digitStarCheck = regexp.MustCompile(`^[0-9*]+$`)
+	splits := strings.Split(path, "/")
+	var formatedSplit []string
+	for _, key := range splits {
+		if key == "" {
+			continue
+		}
+		if digitStarCheck.MatchString(key) {
+			lastElementIdx := len(formatedSplit) - 1
+			lastElement := formatedSplit[lastElementIdx]
+			lastElement = fmt.Sprintf("%s[%s]", lastElement, key)
+			formatedSplit[lastElementIdx] = lastElement
+			continue
+		}
+		formatedSplit = append(formatedSplit, key)
+	}
+	return formatedSplit
+}
+
+func findArrayNodes(selectors []string, currentSelector string, node *yaml.Node, nodes []*yaml.Node, arrayIndex string, create bool) ([]*yaml.Node, error) {
+
+	index, err := strconv.Atoi(arrayIndex)
+	if err != nil {
+		if arrayIndex == "*" {
+			index = -1
+		} else {
+			return nil, errors.Wrapf(err, "can't parse array index from %v/%v/", currentSelector, arrayIndex)
+		}
+	} else if index < 0 {
+		return nil, errors.Wrapf(err, "array index can't be negative %v/%v/", currentSelector, arrayIndex)
+	}
+	// Go into array node(s).
+	arrayNodes, err := createPathAndFindNodes(node, []string{currentSelector}, create)
+	if err != nil {
+		return nil, errors.Errorf("can't find %v", currentSelector)
+	}
+	for _, arrayNode := range arrayNodes {
+		if arrayNode.Kind != yaml.SequenceNode {
+			return nil, errors.Errorf("%v is not an array", currentSelector)
+		}
+		if index >= len(arrayNode.Content) {
+			return nil, errors.Errorf("%v array doesn't have index %v", currentSelector, index)
+		}
+
+		var visitArrayNodes []*yaml.Node
+		if index >= 0 { // array[N]
+			visitArrayNodes = []*yaml.Node{arrayNode.Content[index]}
+		} else { // array[*]
+			visitArrayNodes = arrayNode.Content
+		}
+
+		for i, node := range visitArrayNodes {
+			if len(selectors) == 1 {
+				// Last selector, use this as final node.
+				nodes = append(nodes, node)
+			} else {
+				// Go deeper into a specific array.
+				deeperNodes, err := createPathAndFindNodes(node, selectors[1:], create)
+				if err != nil {
+					return nil, errors.Wrapf(err, "failed to go deeper into %v/%v/", currentSelector, i)
+				}
+				nodes = append(nodes, deeperNodes...)
+			}
+		}
+	}
+	return nodes, nil
+}
+
+func checkIfNodeExistedInContent(nodes []*yaml.Node, currentSelector string) bool {
+	for i := 0; i < len(nodes); i += 2 {
+		// Does the current key match the selector?
+		if nodes[i].Value == currentSelector {
+			return true
+		}
+	}
+
+	return false
+}
+
+func createNonExistingPath(selectors []string, node *yaml.Node) []*yaml.Node {
+	var digitDashCheck = regexp.MustCompile(`^[0-9-]+$`)
+	// Create the rest of the selector path.
+	for idx, selector := range selectors {
+		if digitDashCheck.MatchString(selector) {
+			continue
+		}
+		kind, tag := yaml.MappingNode, mapTag
+		// if the next selector is "-" then current selector is sequence/slice/array
+		if idx < len(selectors)-1 && digitDashCheck.MatchString(selectors[idx+1]) {
+			kind, tag = yaml.SequenceNode, seqTag
+		}
+		var newNode = yaml.Node{
+			Content: []*yaml.Node{
+				{
+					Kind:  yaml.ScalarNode,
+					Tag:   strTag,
+					Value: selector,
+				},
+				{
+					Kind: kind,
+					Tag:  tag,
+				},
+			},
+		}
+		// if previous node is array/sequenceNode append a node rather than appending contents
+		if node.Kind == yaml.SequenceNode {
+			newNode.Kind = kind
+			node.Content = append(node.Content, &newNode)
+		} else {
+			node.Content = append(node.Content, newNode.Content...)
+		}
+		node = newNode.Content[len(newNode.Content)-1]
+	}
+	return []*yaml.Node{node}
+
 }

pkg/mutation/mutate_test.go

@@ -0,0 +1,157 @@
+package mutation
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/fairwindsops/polaris/pkg/config"
+)
+
+var oldYaml = `
+pets:
+  - name: fido
+    owners:
+      - name: Alice
+      - name: Bob
+        aliases:
+        - Robert
+  - name: scooby
+`
+
+var testCases = []struct {
+	original string
+	mutated  string
+	patch    config.Mutation
+	message  string
+}{{
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "Denver",
+		Path:  "/pets/0/owners/*/location",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+        location: Denver
+      - name: Bob
+        aliases:
+          - Robert
+        location: Denver
+  - name: scooby
+`,
+}, {
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:   "remove",
+		Path: "/pets/0/owners/*/aliases",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+      - name: Bob
+  - name: scooby
+`,
+}, {
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "rob",
+		Path:  "/pets/0/owners/*/aliases/-",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+        aliases:
+          - rob
+      - name: Bob
+        aliases:
+          - Robert
+          - rob
+  - name: scooby
+`,
+}, {
+	original: `
+pets:
+  - name: fido
+`,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "Alice",
+		Path:  "/pets/0/owners/0/name",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+`,
+}, {
+	original: `
+obj:
+  foo:
+    bar:
+      - a
+      - b
+  baz: quux
+`,
+	patch: config.Mutation{
+		Op: "replace",
+		Value: map[string]interface{}{
+			"bar": []string{"c", "d"},
+		},
+		Path: "/obj/foo",
+	},
+	mutated: `obj:
+  foo:
+    bar:
+      - c
+      - d
+  baz: quux
+`,
+}, {
+	original: `
+foo: bar
+`,
+	patch: config.Mutation{
+		Op:      "replace",
+		Value:   "baz",
+		Path:    "/foo",
+		Comment: "# We set this to baz",
+	},
+	mutated: `
+foo: baz # We set this to baz
+`,
+	message: "Expected a comment to appear",
+}, {
+	original: `
+foo: bar
+`,
+	patch: config.Mutation{
+		Op: "add",
+		Value: map[string]interface{}{
+			"baz": "quux",
+		},
+		Path:    "/extra",
+		Comment: "# These are extra things",
+	},
+	mutated: `
+foo: bar
+extra:
+  # These are extra things
+  baz: quux
+`,
+	message: "Expected a comment to appear next to an object",
+}}
+
+func TestApplyAllMutations(t *testing.T) {
+	for _, tc := range testCases {
+		mutated, err := ApplyAllMutations(tc.original, []config.Mutation{tc.patch})
+		assert.NoError(t, err)
+		assert.EqualValues(t, strings.TrimSpace(tc.mutated), strings.TrimSpace(mutated), tc.message)
+	}
+}

pkg/validator/arbitrary_test.go

@@ -33,7 +33,7 @@ func TestValidatePDB(t *testing.T) {
 		},
 	}
 	pdb := unstructured.Unstructured{}
-	res, err := kube.NewGenericResourceFromUnstructured(pdb)
+	res, err := kube.NewGenericResourceFromUnstructured(pdb, nil)
 	res.Kind = "PodDisruptionBudget"
 
 	actualResult, err := applyNonControllerSchemaChecks(&c, nil, res)
@@ -70,7 +70,7 @@ func TestValidateIngress(t *testing.T) {
 	if err != nil {
 		panic(err)
 	}
-	res, err := kube.NewGenericResourceFromUnstructured(unst)
+	res, err := kube.NewGenericResourceFromUnstructured(unst, nil)
 	if err != nil {
 		panic(err)
 	}

pkg/validator/output.go

@@ -16,6 +16,7 @@ package validator
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/fatih/color"
@@ -52,12 +53,21 @@ type AuditData struct {
 	Score                uint
 }
 
-// RemoveSuccessfulResults remove all test that have passed.
+// RemoveSuccessfulResults removes all tests that have passed
 func (res AuditData) RemoveSuccessfulResults() AuditData {
 	resCopy := res
-	resCopy.Results = funk.Map(res.Results, func(auditDataResult Result) Result {
+	resCopy.Results = []Result{}
+
+	filteredResults := funk.Map(res.Results, func(auditDataResult Result) Result {
 		return auditDataResult.removeSuccessfulResults()
 	}).([]Result)
+
+	for _, result := range filteredResults {
+		if result.isNotEmpty() {
+			resCopy.Results = append(resCopy.Results, result)
+		}
+	}
+
 	return resCopy
 }
 
@@ -78,12 +88,16 @@ type ResultMessage struct {
 	Success   bool
 	Severity  config.Severity
 	Category  string
-	Mutations []map[string]interface{}
+	Mutations []config.Mutation
 }
 
 // ResultSet contiains the results for a set of checks
 type ResultSet map[string]ResultMessage
 
+func (res ResultSet) isNotEmpty() bool {
+	return len(res) > 0
+}
+
 func (res ResultSet) removeSuccessfulResults() ResultSet {
 	newResults := ResultSet{}
 	for k, resultMessage := range res {
@@ -114,6 +128,13 @@ func (res Result) removeSuccessfulResults() Result {
 	return resCopy
 }
 
+func (res Result) isNotEmpty() bool {
+	if res.PodResult != nil {
+		return res.PodResult.isNotEmpty()
+	}
+	return res.Results.isNotEmpty()
+}
+
 // PodResult provides a list of validation messages for each pod.
 type PodResult struct {
 	Name             string
@@ -130,6 +151,15 @@ func (res PodResult) removeSuccessfulResults() PodResult {
 	return resCopy
 }
 
+func (res PodResult) isNotEmpty() bool {
+	for _, cr := range res.ContainerResults {
+		if cr.isNotEmpty() {
+			return true
+		}
+	}
+	return res.Results.isNotEmpty()
+}
+
 // ContainerResult provides a list of validation messages for each container.
 type ContainerResult struct {
 	Name    string
@@ -142,6 +172,10 @@ func (res ContainerResult) removeSuccessfulResults() ContainerResult {
 	return resCopy
 }
 
+func (res ContainerResult) isNotEmpty() bool {
+	return res.Results.isNotEmpty()
+}
+
 func fillString(id string, l int) string {
 	for len(id) < l {
 		id += " "
@@ -152,7 +186,7 @@ func fillString(id string, l int) string {
 // GetPrettyOutput returns a human-readable string
 func (res AuditData) GetPrettyOutput(useColor bool) string {
 	color.NoColor = !useColor
-	str := titleColor.Sprint(fmt.Sprintf("\n\nPolaris audited %s %s at %s\n", res.SourceType, res.SourceName, res.AuditTime))
+	str := titleColor.Sprint(fmt.Sprintf("Polaris audited %s %s at %s\n", res.SourceType, res.SourceName, res.AuditTime))
 	str += color.CyanString(fmt.Sprintf("    Nodes: %d | Namespaces: %d | Controllers: %d\n", res.ClusterInfo.Nodes, res.ClusterInfo.Namespaces, res.ClusterInfo.Controllers))
 	str += color.GreenString(fmt.Sprintf("    Final score: %d\n", res.Score))
 	str += "\n"
@@ -181,7 +215,7 @@ func (res Result) GetPrettyOutput() string {
 func (res PodResult) GetPrettyOutput() string {
 	str := res.Results.GetPrettyOutput()
 	for _, cont := range res.ContainerResults {
-		str += cont.GetPrettyOutput() + "\n"
+		str += cont.GetPrettyOutput()
 	}
 	return str
 }
@@ -209,7 +243,7 @@ func (res ResultSet) GetPrettyOutput() string {
 			}
 		}
 		if color.NoColor {
-			status = status[2:] // remove emoji
+			status = strings.Fields(status)[1] // remove emoji
 		}
 		str += fmt.Sprintf("%s%s %s\n", indent, checkColor.Sprint(fillString(msg.ID, minIDLength-len(indent))), status)
 		str += fmt.Sprintf("%s    %s - %s\n", indent, msg.Category, msg.Message)

pkg/validator/polaris_template_variable_test.go

@@ -0,0 +1,50 @@
+// Copyright 2019 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package validator
+
+import (
+	"testing"
+
+	conf "github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/test"
+	"github.com/stretchr/testify/require"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestGetTemplateInputReturnsPolarisSubKeys(t *testing.T) {
+	pod := test.MockPod() // Includes a container, required by GetPodSpec
+	pod.Spec.NodeName = "testNodeName"
+	pod.ObjectMeta.Name = "testpod"
+	genRes, err := kube.NewGenericResourceFromPod(pod, pod)
+	require.NoError(t, err, "creating new generic resource from a pod")
+	schemaTest := schemaTestCase{
+		Target:   conf.TargetPodSpec, // ends up being set in the case of target: PodTemplate
+		Resource: genRes,
+	}
+
+	templateInput, err := getTemplateInput(schemaTest)
+	require.NoError(t, err, "getting template input from a generic resource")
+	require.NotNil(t, templateInput)
+	nodeName, ok, err := unstructured.NestedString(templateInput, "Polaris", "PodSpec", "nodeName")
+	require.NoError(t, err, "getting Polaris.PodSpec.nodeName from template input")
+	require.True(t, ok, "getting Polaris.PodSpec.nodeName from template input")
+	require.Equal(t, "testNodeName", nodeName, "the nodeName from template output")
+	podName, ok, err := unstructured.NestedString(templateInput, "Polaris", "PodTemplate", "metadata", "name")
+	require.NoError(t, err, "getting Polaris.PodTemplate.metadata.name from template input")
+	require.True(t, ok, "getting Polaris.PodTemplate.metadata.name from template input")
+	require.Equal(t, "testpod", podName, "the pod from template input")
+}

pkg/validator/schema.go

@@ -15,6 +15,7 @@
 package validator
 
 import (
+	"errors"
 	"fmt"
 	"sort"
 	"strconv"
@@ -25,6 +26,7 @@ import (
 	"github.com/thoas/go-funk"
 	corev1 "k8s.io/api/core/v1"
 	metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
 	"github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
@@ -62,13 +64,55 @@ func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCas
 	if !check.IsActionable(test.Target, test.Resource.Kind, test.IsInitContianer) {
 		return nil, nil
 	}
-	checkPtr, err := check.TemplateForResource(test.Resource.Resource.Object)
+	templateInput, err := getTemplateInput(test)
+	if err != nil {
+		return nil, err
+	}
+	checkPtr, err := check.TemplateForResource(templateInput)
 	if err != nil {
 		return nil, err
 	}
 	return checkPtr, nil
 }
 
+// getTemplateInput augments a schemaTestCase.Resource.Resource.Object with
+// Polaris built-in variables. The result can be used as input for
+// CheckSchema.TemplateForResource().
+func getTemplateInput(test schemaTestCase) (map[string]interface{}, error) {
+	templateInput := test.Resource.Resource.Object
+	if templateInput == nil {
+		return nil, nil
+	}
+	if test.Target == config.TargetPodSpec || test.Target == config.TargetContainer {
+		podSpecMap, err := kube.SerializePodSpec(test.Resource.PodSpec)
+		if err != nil {
+			return nil, err
+		}
+		err = unstructured.SetNestedMap(templateInput, podSpecMap, "Polaris", "PodSpec")
+		if err != nil {
+			return nil, err
+		}
+		podTemplateMap, ok := test.Resource.PodTemplate.(map[string]interface{})
+		if ok {
+			err := unstructured.SetNestedMap(templateInput, podTemplateMap, "Polaris", "PodTemplate")
+			if err != nil {
+				return nil, err
+			}
+		}
+		if test.Target == config.TargetContainer {
+			containerMap, err := kube.SerializeContainer(test.Container)
+			if err != nil {
+				return nil, err
+			}
+			err = unstructured.SetNestedMap(templateInput, containerMap, "Polaris", "Container")
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	return templateInput, nil
+}
+
 func makeResult(conf *config.Configuration, check *config.SchemaCheck, passes bool, issues []jsonschema.ValError) ResultMessage {
 	details := []string{}
 	for _, issue := range issues {
@@ -110,6 +154,9 @@ func hasExemptionAnnotation(objMeta metaV1.Object, checkID string) bool {
 // ApplyAllSchemaChecksToResourceProvider applies all available checks to a ResourceProvider
 func ApplyAllSchemaChecksToResourceProvider(conf *config.Configuration, resourceProvider *kube.ResourceProvider) ([]Result, error) {
 	results := []Result{}
+	if resourceProvider == nil {
+		return nil, errors.New("No resource provider set, cannot apply schema checks")
+	}
 	for _, resources := range resourceProvider.Resources {
 		kindResults, err := ApplyAllSchemaChecksToAllResources(conf, resourceProvider, resources)
 		if err != nil {
@@ -128,7 +175,9 @@ func ApplyAllSchemaChecksToAllResources(conf *config.Configuration, resourceProv
 		if err != nil {
 			return results, err
 		}
-		results = append(results, result)
+		if result.Kind != "" && result.Name != "" {
+			results = append(results, result)
+		}
 	}
 	return results, nil
 }
@@ -164,6 +213,17 @@ func applyControllerSchemaChecks(conf *config.Configuration, resourceProvider *k
 	}
 	finalResult.Results = resultSet
 
+	nonControllerResults, err := applyTopLevelSchemaChecks(conf, resourceProvider, resource, false)
+	if err != nil {
+		return finalResult, err
+	}
+	for key, val := range nonControllerResults {
+		if _, ok := finalResult.Results[key]; ok {
+			return finalResult, errors.New("Duplicate finding for check " + key)
+		}
+		finalResult.Results[key] = val
+	}
+
 	podRS, err := applyPodSchemaChecks(conf, resourceProvider, resource)
 	if err != nil {
 		return finalResult, err
@@ -213,7 +273,7 @@ func applyTopLevelSchemaChecks(conf *config.Configuration, resources *kube.Resou
 
 func applyPodSchemaChecks(conf *config.Configuration, resources *kube.ResourceProvider, controller kube.GenericResource) (ResultSet, error) {
 	test := schemaTestCase{
-		Target:           config.TargetPod,
+		Target:           config.TargetPodSpec,
 		ResourceProvider: resources,
 		Resource:         controller,
 	}
@@ -257,16 +317,26 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	var issues []jsonschema.ValError
 	var prefix string
 	if check.SchemaTarget != "" {
-		if check.SchemaTarget == config.TargetPod && check.Target == config.TargetContainer {
+		if check.SchemaTarget == config.TargetPodSpec && check.Target == config.TargetContainer {
 			podCopy := *test.Resource.PodSpec
 			podCopy.InitContainers = []corev1.Container{}
 			podCopy.Containers = []corev1.Container{*test.Container}
-			passes, issues, err = check.CheckPod(&podCopy)
+			containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
+				return value.Name == test.Container.Name
+			})
+			prefix = getJSONSchemaPrefix(test.Resource.Kind)
+			if prefix != "" {
+				prefix += "/containers/" + strconv.Itoa(containerIndex)
+			}
+			passes, issues, err = check.CheckPodSpec(&podCopy)
 		} else {
 			return nil, fmt.Errorf("Unknown combination of target (%s) and schema target (%s)", check.Target, check.SchemaTarget)
 		}
-	} else if check.Target == config.TargetPod {
-		passes, issues, err = check.CheckPod(test.Resource.PodSpec)
+	} else if check.Target == config.TargetPodSpec {
+		passes, issues, err = check.CheckPodSpec(test.Resource.PodSpec)
+		prefix = getJSONSchemaPrefix(test.Resource.Kind)
+	} else if check.Target == config.TargetPodTemplate {
+		passes, issues, err = check.CheckPodTemplate(test.Resource.PodTemplate)
 		prefix = getJSONSchemaPrefix(test.Resource.Kind)
 	} else if check.Target == config.TargetContainer {
 		containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
@@ -287,13 +357,17 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 		if !passes {
 			break
 		}
+		if test.ResourceProvider == nil {
+			logrus.Warnf("No ResourceProvider available, check %s will not work in this context (e.g. admission control)", checkID)
+			break
+		}
 		resources := test.ResourceProvider.Resources[groupkind]
 		namespace := test.Resource.ObjectMeta.GetNamespace()
 		if test.Resource.Kind == "Namespace" {
 			namespace = test.Resource.ObjectMeta.GetName()
 		}
 		resources = funk.Filter(resources, func(res kube.GenericResource) bool {
-			return res.ObjectMeta.GetNamespace() == namespace
+			return res.ObjectMeta.GetNamespace() == "" || res.ObjectMeta.GetNamespace() == namespace
 		}).([]kube.GenericResource)
 		objects := funk.Map(resources, func(res kube.GenericResource) interface{} {
 			return res.Resource.Object
@@ -305,12 +379,12 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	}
 	result := makeResult(conf, check, passes, issues)
 	if !passes {
-		if funk.Contains(conf.Mutations, checkID) {
-			mutations := funk.Map(check.Mutations, func(mutation map[string]interface{}) map[string]interface{} {
+		if funk.Contains(conf.Mutations, checkID) && len(check.Mutations) > 0 {
+			mutations := funk.Map(check.Mutations, func(mutation config.Mutation) config.Mutation {
 				mutationCopy := deepCopyMutation(mutation)
-				mutationCopy["path"] = prefix + mutationCopy["path"].(string)
+				mutationCopy.Path = prefix + mutationCopy.Path
 				return mutationCopy
-			}).([]map[string]interface{})
+			}).([]config.Mutation)
 			result.Mutations = mutations
 		}
 	}
@@ -326,10 +400,12 @@ func getSortedKeys(m map[string]config.Severity) []string {
 	return keys
 }
 
-func deepCopyMutation(source map[string]interface{}) map[string]interface{} {
-	destination := map[string]interface{}{}
-	for key, value := range source {
-		destination[key] = value
+func deepCopyMutation(source config.Mutation) config.Mutation {
+	destination := config.Mutation{
+		Op:      source.Op,
+		Path:    source.Path,
+		Value:   source.Value,
+		Comment: source.Comment,
 	}
 	return destination
 }
@@ -339,11 +415,9 @@ func getJSONSchemaPrefix(kind string) (prefix string) {
 		prefix = "/spec/jobTemplate/spec/template/spec"
 	} else if kind == "Pod" {
 		prefix = "/spec"
-	} else if (kind == "Deployment") || (kind == "Daemonset") ||
-		(kind == "Statefulset") || (kind == "Job") || (kind == "ReplicationController") {
+	} else if (kind == "Deployment") || (kind == "DaemonSet") ||
+		(kind == "StatefulSet") || (kind == "Job") || (kind == "ReplicationController") {
 		prefix = "/spec/template/spec"
-	} else {
-		logrus.Warningf("Mutation for this this resource (%s) is not supported", kind)
 	}
 	return prefix
 }

pkg/webhook/mutate.go

@@ -0,0 +1,75 @@
+// Copyright 2022 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webhook
+
+import (
+	"context"
+
+	"github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/sirupsen/logrus"
+	"gomodules.xyz/jsonpatch/v2"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+	"sigs.k8s.io/yaml"
+)
+
+// Mutator mutate k8s resources.
+type Mutator struct {
+	Client  client.Client
+	Config  config.Configuration
+	decoder *admission.Decoder
+}
+
+var _ admission.Handler = &Mutator{}
+
+// NewMutateWebhook creates a mutating admission webhook for the apiType.
+func NewMutateWebhook(mgr manager.Manager, mutator Mutator) {
+	path := "/mutate"
+
+	mgr.GetWebhookServer().Register(path, &webhook.Admission{Handler: &mutator})
+}
+
+func (m *Mutator) mutate(req admission.Request) ([]jsonpatch.Operation, error) {
+	results, kubeResources, err := GetValidatedResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
+	if err != nil {
+		return nil, err
+	}
+	patches := mutation.GetMutationsFromResult(results)
+	originalYaml, err := yaml.JSONToYAML(kubeResources.OriginalObjectJSON)
+	if err != nil {
+		return nil, err
+	}
+	mutatedYamlStr, err := mutation.ApplyAllMutations(string(originalYaml), patches)
+	if err != nil {
+		return nil, err
+	}
+	return jsonpatch.CreatePatch(originalYaml, []byte(mutatedYamlStr))
+}
+
+// Handle for Validator to run validation checks.
+func (m *Mutator) Handle(ctx context.Context, req admission.Request) admission.Response {
+	logrus.Info("Starting request")
+	patches, err := m.mutate(req)
+	if err != nil {
+		return admission.Errored(403, err)
+	}
+	if patches == nil {
+		return admission.Allowed("Allowed")
+	}
+	return admission.Patched("", patches...)
+}

pkg/webhook/webhook.go

@@ -47,45 +47,49 @@ func (v *Validator) InjectDecoder(d *admission.Decoder) error {
 
 var _ admission.Handler = &Validator{}
 
-// NewWebhook creates a validating admission webhook for the apiType.
-func NewWebhook(mgr manager.Manager, validator Validator) {
+// NewValidateWebhook creates a validating admission webhook for the apiType.
+func NewValidateWebhook(mgr manager.Manager, validator Validator) {
 	path := "/validate"
 
 	mgr.GetWebhookServer().Register(path, &webhook.Admission{Handler: &validator})
 }
 
-func (v *Validator) handleInternal(req admission.Request) (*validator.Result, error) {
+func (v *Validator) handleInternal(req admission.Request) (*validator.Result, kube.GenericResource, error) {
+	return GetValidatedResults(req.AdmissionRequest.Kind.Kind, v.decoder, req, v.Config)
+}
+
+// GetValidatedResults returns the validated results.
+func GetValidatedResults(kind string, decoder *admission.Decoder, req admission.Request, config config.Configuration) (*validator.Result, kube.GenericResource, error) {
 	var controller kube.GenericResource
 	var err error
-	if req.AdmissionRequest.Kind.Kind == "Pod" {
+	if kind == "Pod" {
 		pod := corev1.Pod{}
-		err := v.decoder.Decode(req, &pod)
+		err := decoder.Decode(req, &pod)
 		if err != nil {
-			return nil, err
+			return nil, controller, err
 		}
 		if len(pod.ObjectMeta.OwnerReferences) > 0 {
 			logrus.Infof("Allowing owned pod %s/%s to pass through webhook", pod.ObjectMeta.Namespace, pod.ObjectMeta.Name)
-			return nil, nil
+			return nil, controller, nil
 		}
 		controller, err = kube.NewGenericResourceFromPod(pod, pod)
 	} else {
 		controller, err = kube.NewGenericResourceFromBytes(req.Object.Raw)
 	}
 	if err != nil {
-		return nil, err
+		return nil, controller, err
 	}
-	// TODO: consider enabling multi-resource checks
-	controllerResult, err := validator.ApplyAllSchemaChecks(&v.Config, nil, controller)
+	controllerResult, err := validator.ApplyAllSchemaChecks(&config, nil, controller)
 	if err != nil {
-		return nil, err
+		return nil, controller, err
 	}
-	return &controllerResult, nil
+	return &controllerResult, controller, nil
 }
 
 // Handle for Validator to run validation checks.
 func (v *Validator) Handle(ctx context.Context, req admission.Request) admission.Response {
 	logrus.Info("Starting request")
-	result, err := v.handleInternal(req)
+	result, _, err := v.handleInternal(req)
 	if err != nil {
 		logrus.Errorf("Error validating request: %v", err)
 		return admission.Errored(http.StatusBadRequest, err)

test/checks/automountServiceAccountToken/failure.all_true.yaml

@@ -0,0 +1,19 @@
+# This fails because automounting is true for both the pod and ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: true
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: true

test/checks/automountServiceAccountToken/failure.pod_true_serviceaccount_false.yaml

@@ -0,0 +1,19 @@
+# This fails because automounting is true for the pod, overriding the ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: true
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: false

test/checks/automountServiceAccountToken/failure.uses_defaults.yaml

@@ -0,0 +1,17 @@
+# This fails because automounting is not disabled anywhere.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test

test/checks/automountServiceAccountToken/success.pod.yaml

@@ -0,0 +1,19 @@
+# This succeeds because automounting is disabled at the pod.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: false
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+

test/checks/automountServiceAccountToken/success.pod_and_serviceaccount.yaml

@@ -0,0 +1,19 @@
+# This succeeds because automounting is disabled at the pod and ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: false
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: false

test/checks/automountServiceAccountToken/success.pod_false_serviceaccount_true.yaml

@@ -0,0 +1,19 @@
+# This succeeds because automounting is disabled at the pod, overriding the ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: false
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: true

test/checks/automountServiceAccountToken/success.serviceaccount.yaml

@@ -0,0 +1,18 @@
+# This succeeds because automounting is disabled at the ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: false

test/checks/clusterrolePodExecAttach/failure.all_wildcards.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole apiGroups, resources, and verbs are all * which allows pods/exec|attach.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/failure.attach_explicit.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.attach_using_verb_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach using all verbs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/failure.create_attach_and_exec_using_resource_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach|exec using all resources.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "*" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.create_attach_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/attach" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.create_exec_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/exec" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.exec_explicit.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.exec_verb_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec using all verbs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/failure.get_attach_and_exec_using_resource_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach|exec using all resources.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "*" ]
+    verbs: [ get ]

test/checks/clusterrolePodExecAttach/failure.get_attach_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/attach" ]
+    verbs: [ get ]

test/checks/clusterrolePodExecAttach/failure.get_exec_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/exec" ]
+    verbs: [ get ]

test/checks/clusterrolePodExecAttach/success.allow_unrelated_perms.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole does not allow pods/exec|attach.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ get, create ]

test/checks/clusterrolePodExecAttach/success.attach_wrong_verb.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole allows pods/attach but with a safe verb.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ list ]

test/checks/clusterrolePodExecAttach/success.defaultclusterrole_admin.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole is an expected default one (by name).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: admin
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ "create" ]

test/checks/clusterrolePodExecAttach/success.defaultclusterrole_clusteradmin.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole is an expected default one (by name).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-admin
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ "create" ]

test/checks/clusterrolePodExecAttach/success.exec_wrong_verb.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole allows pods/exec but with a safe verb.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ list ]

test/checks/clusterrolebindingClusterAdmin/failure.all_verbs.yaml

@@ -0,0 +1,33 @@
+# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards and all verbs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "get", "list", "watch", "create", "update", "patch", "delete" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser
+---
+# This Role exists so there is at least one Role for the additionalSchema to find.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: not-used
+  namespace: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ list ]

test/checks/clusterrolebindingClusterAdmin/failure.all_verbs_different_order.yaml

@@ -0,0 +1,33 @@
+# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards and all verbs (in different order from failure.all_verbs.yaml).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "get", "list", "delete", "update", "create", "patch", "watch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser
+---
+# This Role exists so there is at least one Role for the additionalSchema to find.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: not-used
+  namespace: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ list ]

test/checks/clusterrolebindingClusterAdmin/failure.default_clusteradmin_clusterrole.yaml

@@ -0,0 +1,26 @@
+# This fails because the ClusterRoleBinding references the default cluster-admin ClusterRole.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser
+---
+# This ClusterRole emulates the default cluster-admin one, only by name.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-admin
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - 'deployments'
+  verbs:
+  - 'get'

test/checks/clusterrolebindingClusterAdmin/failure.wildcards.yaml

@@ -0,0 +1,33 @@
+# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "*" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser
+---
+# This Role exists so there is at least one Role for the additionalSchema to find.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: not-used
+  namespace: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ list ]

test/checks/clusterrolebindingClusterAdmin/success.allow_unrelated_perms.yaml

@@ -0,0 +1,22 @@
+# This succeeds because the ClusterRoleBinding references a ClusterRole with safe permissions.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "deployments" ]
+    verbs: [ "get", "list" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser