Update checks severities (#950)

* change all ignore checks to warning

* promoting checks initially warning that should be danger.

* fixing docs and examples

* adds changelog

* fix changelog version

.circleci/config.yml

@@ -9,6 +9,17 @@ executors:
     machine:
       enabled: true
 
+commands:
+  install_goreleaser_dependencies:
+    description: Installs dependencies for CI scripts
+    steps:
+    - run: apk update
+    # gettext provides envsubst
+    - run: apk add gettext
+    # Register other docker platforms, to build arm64.
+    # This shouldn't be needed, why TBD.
+    - run: docker run --privileged --rm tonistiigi/binfmt --install all
+
 references:
   set_environment_variables: &set_environment_variables
     run:
@@ -87,32 +98,6 @@ references:
           echo "Skipping Kubernetes tests for forked PR"
         fi
 
-  docker_build: &docker_build
-    run:
-      name: Docker login and build
-      command: |
-        docker-pull -f .circleci/build.config
-        docker-build -f .circleci/build.config
-
-  docker_build_and_push: &docker_build_and_push
-    run:
-      name: Docker login, build, and push
-      command: |
-        docker-pull -f .circleci/build.config
-        docker-build -f .circleci/build.config
-        docker login quay.io -u="${fairwinds_quay_user}" -p="${fairwinds_quay_token}"
-        docker-push -f .circleci/build.config
-
-  enable_experimental_features: &enable_experimental_docker_features
-    run:
-      name: enable experimental features
-      command: |
-        set -ex
-        apk --update add openssh
-        ssh remote-docker \<<EOF
-          sudo bash -c 'echo "{\"experimental\": true}" > /etc/docker/daemon.json'
-          sudo systemctl restart docker
-        EOF
   install_vault_alpine: &install_vault_alpine
     run:
       name: install hashicorp vault
@@ -124,24 +109,6 @@ references:
         mv vault /usr/bin/vault
 
 jobs:
-  build:
-    docker:
-      - image: quay.io/reactiveops/ci-images:v11.0-stretch
-    steps:
-      - checkout
-      - setup_remote_docker
-      - *set_environment_variables
-      - *docker_build
-
-  push:
-    docker:
-      - image: quay.io/reactiveops/ci-images:v11.0-stretch
-    steps:
-      - checkout
-      - setup_remote_docker
-      - *set_environment_variables
-      - *docker_build_and_push
-
   test_k8s:
     working_directory: ~/polaris
     resource_class: medium
@@ -152,105 +119,62 @@ jobs:
       - *test_k8s
 
   test:
-    working_directory: /go/src/github.com/fairwindsops/polaris/
     docker:
-      - image: circleci/golang:1.17
+      - image: cimg/go:1.19
     steps:
       - checkout
       - *set_environment_variables
-      - run: go get -u golang.org/x/lint/golint
-      - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
-      - run: go list ./... | grep -v vendor | xargs go vet
+      - run: go vet ./...
       - run: go test ./... -coverprofile=coverage.txt -covermode=count
       - *test_binary_dashboard
 
-  insights:
-    docker:
-      - image: quay.io/reactiveops/ci-images:v11.0-stretch
-    steps:
-      - checkout
-      - setup_remote_docker
-      - run:
-          name: Insights CI
-          command: curl -L https://insights.fairwinds.com/v0/insights-ci.sh | bash
-
-  release_binary:
+  build_and_push:
     working_directory: /go/src/github.com/fairwindsops/polaris/
     resource_class: large
     shell: /bin/bash
     docker:
-      - image: goreleaser/goreleaser:v1.3.0
+      # The goreleaser image tag determins the version of Go.
+      # Manually check goreleaser images for their version of Go.
+      # Ref: https://hub.docker.com/r/goreleaser/goreleaser/tags
+      - image: goreleaser/goreleaser:v1.11.4
     steps:
       - checkout
       - setup_remote_docker:
-          version: 20.10.6
-      - *enable_experimental_docker_features
+          version: 20.10.11
       - *install_vault_alpine
       - rok8s/get_vault_env:
           vault_path: repo/global/env
       - rok8s/get_vault_env:
           vault_path: repo/polaris/env
       - *set_environment_variables
-      - run: go get -u github.com/gobuffalo/packr/v2/packr2
-      - run: git checkout -- . # FIXME: the go get makes the directory dirty
-      - run: packr2
-      - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
-      - run: goreleaser
+      - run: docker login quay.io -u="${FAIRWINDS_QUAY_USER}" -p="${FAIRWINDS_QUAY_TOKEN}"
+      - install_goreleaser_dependencies
+      - run: scripts/goreleaser.sh
 
-  release_images:
-    working_directory: /go/src/github.com/fairwindsops/polaris/
-    docker:
-      - image: quay.io/reactiveops/ci-images:v11.0-stretch
-    steps:
-      - checkout
-      - setup_remote_docker
-      - *set_environment_variables
-      - *docker_build_and_push
 workflows:
   version: 2
 
-  build:
-    jobs:
-      - test
-      - build:
-          requires:
-            - test
-      - push:
-          context: org-global
-          requires:
-            - build
-          filters:
-            branches:
-              ignore: /pull\/[0-9]+/
-      - insights:
-          requires:
-            - push
-          filters:
-            branches:
-              ignore: /pull\/[0-9]+/
-      - test_k8s:
-          requires:
-            - push
-          filters:
-            branches:
-              ignore: /pull\/[0-9]+/
-
   release:
     jobs:
-      - release_binary:
+      - test:
+          filters:
+            tags:
+              only: /.*/
+      - build_and_push:
           context: org-global
+          requires:
+            - test
           filters:
             branches:
-              ignore: /.*/
+              ignore: /pull\/[0-9]+/
             tags:
               ignore: /^testing-.*/
-      - release_images:
+      - test_k8s:
           requires:
-            - release_binary
-          context: org-global
+            - build_and_push
           filters:
             branches:
-              ignore: /.*/
+              ignore: /pull\/[0-9]+/
             tags:
               ignore: /^testing-.*/
       - oss-docs/publish-docs:

.github/ISSUE_TEMPLATE/feature_request.md

@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ''
-labels: ''
+labels: [triage, enhancement]
 assignees: ''
 
 ---

.github/ISSUE_TEMPLATE/other.md

@@ -2,7 +2,7 @@
 name: Other
 about: For misc. tasks like research or continued conversation
 title: ''
-labels: ''
+labels: [triage]
 assignees: ''
 
 ---

.github/actions/setup-polaris/Dockerfile

@@ -1,6 +1,6 @@
 # The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action
 
-FROM alpine:3.10
+FROM alpine:3.17
 
 RUN	apk add --no-cache \
   bash \

.github/actions/setup-polaris/get_polaris.sh

@@ -17,4 +17,4 @@ mkdir polaris
 tar -xzf $TARGET_FILE -C polaris
 rm $TARGET_FILE
 echo "polaris" >> $GITHUB_PATH
-echo "::set-output name=version::$INPUT_VERSION"
+echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT

.github/pull_request_template.md

@@ -1,3 +1,4 @@
+
 This PR fixes #
 
 ## Checklist

.github/workflows/test_setup.yml

@@ -7,7 +7,7 @@ jobs:
   build-int:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup polaris
         uses: ./.github/actions/setup-polaris
         with:
@@ -18,7 +18,7 @@ jobs:
   build-ext:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup polaris
         uses: fairwindsops/polaris/.github/actions/setup-polaris@master
         with:

.gitignore

@@ -1,4 +1,7 @@
-# Binaries for programs and plugins
+# goreleaser is run via a wrapper that creates .goreleaser.yml from .goreleaser.yml.envsubst
+.goreleaser.yml
+# dist
+# # Binaries for programs and plugins
 .go-version
 *.exe
 *.exe~

.goreleaser.yml

@@ -1,51 +0,0 @@
-checksum:
-  name_template: 'checksums.txt'
-changelog:
-  sort: asc
-  filters:
-    exclude:
-    - '^docs:'
-    - '^test:'
-builds:
-  - id: polaris
-    ldflags:
-      - -X main.Version={{.Version}} -X main.Commit={{.Commit}} -s -w
-    env:
-      - CGO_ENABLED=0
-      - GO111MODULE=on
-    goos:
-      - linux
-      - darwin
-      - windows
-    goarch:
-      - amd64
-      - arm
-      - arm64
-    goarm:
-      - 6
-      - 7
-archives:
-  - id: polaris
-    builds: ["polaris"]
-    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
-signs:
-- cmd: cosign
-  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
-  artifacts: checksum
-release:
-  prerelease: auto
-  footer: |
-    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
-
-    ```
-    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
-    ```
-brews:
-  - name: polaris
-    tap:
-      owner: FairwindsOps
-      name: homebrew-tap
-    folder: Formula
-    description: Open Source Best Practices for Kubernetes
-    test: |
-      system "#{bin}/polaris version"

.goreleaser.yml.envsubst

@@ -0,0 +1,113 @@
+checksum:
+  name_template: 'checksums.txt'
+changelog:
+  sort: asc
+  filters:
+    exclude:
+    - '^docs:'
+    - '^test:'
+env:
+  - GOBIN={{ .Env.TMPDIR }}/go-bin
+before:
+  hooks:
+    - go mod download
+    - ./scripts/install-and-run-packr2.sh
+builds:
+  - id: polaris
+    ldflags:
+      - -X main.Version={{.Version}} -X main.Commit={{.Commit}} -s -w
+    env:
+      - CGO_ENABLED=0
+      - GO111MODULE=on
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm
+      - arm64
+    goarm:
+      - 6
+      - 7
+archives:
+  - id: polaris
+    builds: ["polaris"]
+    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
+signs:
+- cmd: cosign
+  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
+  artifacts: checksum
+release:
+  # This is replaced using `envsubst`, depending on the git branch.
+  disable: ${skip_release}
+  prerelease: auto
+  footer: |
+    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
+
+    ```
+    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
+    ```
+brews:
+  - name: polaris
+    # This is replaced using `envsubst`, depending on the git branch.
+    skip_upload: ${skip_release}
+    tap:
+      owner: FairwindsOps
+      name: homebrew-tap
+    folder: Formula
+    description: Open Source Best Practices for Kubernetes
+    test: |
+      system "#{bin}/polaris version"
+dockers:
+  # There are multiple images to match the `--platform` docker build flag with
+  # combinations of `GOOS`, `GOARCH`, and `GOARM`
+- image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  use: buildx
+  build_flag_templates:
+  - "--platform=linux/amd64"
+- image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+  use: buildx
+  goarch: arm64
+  goos: linux
+  build_flag_templates:
+  - "--platform=linux/arm64"
+docker_manifests:
+# Create DOcker manifests that make multiple architectures available within a tag,
+# and provide partial-version tags like 2, and 2.2.
+- name_template: quay.io/fairwinds/polaris:{{ .FullCommit }}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Env.feature_docker_tag }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_feature_docker_tags}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:latest
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Tag }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Major }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
+- name_template: quay.io/fairwinds/polaris:{{ .Major }}.{{ .Minor }}
+  # This is replaced using `envsubst`, depending on the git branch.
+  skip_push: ${skip_release}
+  image_templates:
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
+  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"

CODEOWNERS

@@ -1,2 +1,2 @@
 ## DO NOT EDIT - Managed by Terraform
-* @rbren @makoscafee
+* @rbren @mggude

Dockerfile

@@ -1,27 +1,21 @@
-FROM golang:1.17 AS build-env
-WORKDIR /go/src/github.com/fairwindsops/polaris/
+FROM alpine:3.18
 
-ENV GO111MODULE=on
-ENV GOPROXY=https://proxy.golang.org
-ENV CGO_ENABLED=0
-ENV GOOS=linux
-ENV GOARCH=amd64
+LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
+      org.opencontainers.image.vendor="FairwindsOps, Inc." \
+      org.opencontainers.image.title="polaris" \
+      org.opencontainers.image.description="Polaris is a cli tool to help discover deprecated apiVersions in Kubernetes" \
+      org.opencontainers.image.documentation="https://polaris.docs.fairwinds.com/" \
+      org.opencontainers.image.source="https://github.com/FairwindsOps/polaris" \
+      org.opencontainers.image.url="https://github.com/FairwindsOps/polaris" \
+      org.opencontainers.image.licenses="Apache License 2.0"
 
-COPY go.mod .
-COPY go.sum .
-RUN go mod download
-RUN go get -u github.com/gobuffalo/packr/v2/packr2
-
-COPY . .
-RUN packr2 build -a -o polaris *.go
-
-FROM alpine:3.16.0
 WORKDIR /usr/local/bin
+RUN apk -U upgrade
 RUN apk --no-cache add ca-certificates
 
 RUN addgroup -S polaris && adduser -u 1200 -S polaris -G polaris
 USER 1200
-COPY --from=build-env /go/src/github.com/fairwindsops/polaris/polaris .
+COPY polaris .
 
 WORKDIR /opt/app
 

README.md

@@ -1,7 +1,7 @@
 <div align="center" class="no-border">
   <img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
   <br>
-  <h3>Best Practices for Kubernetes Workload Configuration</h3>
+  <h3>Polaris is an open source policy engine for Kubernetes</h3>
   <a href="https://github.com/FairwindsOps/polaris/releases">
     <img src="https://img.shields.io/github/v/release/FairwindsOps/polaris">
   </a>
@@ -16,15 +16,12 @@
   </a>
 </div>
 
-Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
-Kubernetes pods and controllers are configured using best practices, helping you avoid
-problems in the future.
+Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.
 
 Polaris can be run in three different modes:
-* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard), so you can audit what's running inside your cluster.
-* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
-* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
-
+* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard) - Validate Kubernetes resources against policy-as-code.
+* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller) - Automatically reject or modify workloads that don't adhere to your organization's policies.
+* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code) - Incorporate policy-as-code into the CI/CD process to test local YAML files.
 <p align="center">
   <img src="https://polaris.docs.fairwinds.com/img/architecture.svg" alt="Polaris Architecture" width="550"/>
 </p>
@@ -41,8 +38,9 @@ and network with fellow Kubernetes users.
 or
 [join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
 
-<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
-  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
+<a href="https://insights.fairwinds.com/auth/register/">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png"
+  alt="Love Fairwinds Open Source? Automate Fairwinds Open Source for free with Fairwinds Insights. Click to learn more" />
 </a>
 
 ## Other Projects from Fairwinds
@@ -58,9 +56,9 @@ Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_
 If you're interested in running Polaris in multiple clusters,
 tracking the results over time, integrating with Slack, Datadog, and Jira,
 or unlocking other functionality, check out
-[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris),
+[Fairwinds Insights](https://fairwinds.com/pricing),
 a platform for auditing and enforcing policy in Kubernetes clusters.
 
-<a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
+<a href="https://fairwinds.com/pricing">
   <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
 </a>

checks/automountServiceAccountToken.yaml

@@ -0,0 +1,36 @@
+successMessage: The ServiceAccount will not be automounted
+failureMessage: The ServiceAccount will be automounted
+category: Security
+target: PodSpec
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["serviceAccountName"]
+  properties:
+    serviceAccountName:
+      type: string
+    automountServiceAccountToken:
+      type: boolean
+      not:
+        const: true
+additionalSchemaStrings:
+  ServiceAccount: |
+    type: object
+    required:
+      - metadata
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
+      - automountServiceAccountToken
+      {{ end }}
+    properties:
+      metadata:
+        type: object
+        required: ["name"]
+        properties:
+          name:
+            type: string
+            const: "{{ .Polaris.PodSpec.serviceAccountName }}"
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
+      automountServiceAccountToken:
+        type: boolean
+        const: false
+      {{ end }}

checks/clusterrolePodExecAttach.yaml

@@ -0,0 +1,54 @@
+successMessage: The ClusterRole does not allow pods/exec or pods/attach
+failureMessage: The ClusterRole allows Pods/exec or pods/attach
+category: Security
+target: rbac.authorization.k8s.io/ClusterRole
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["metadata", "rules"]
+  anyOf:
+    # Do not alert on default ClusterRoles.
+    - properties:
+        metadata:
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: 'admin'
+                - const: "cluster-admin"
+                - const: "edit"
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - properties:
+        rules:
+          type: array
+          items:
+            type: object
+            not:
+              required: ["apiGroups", "resources", "verbs"]
+              properties:
+                apiGroups:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: ""
+                      - const: '*'
+                resources:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      - const: "pods/exec"
+                      - const: "pods/attach"
+                verbs:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      # An exec is also possible by `get`ing a web socket.
+                      - const: 'get'
+                      - const: 'create'

checks/clusterrolebindingClusterAdmin.yaml

@@ -0,0 +1,88 @@
+successMessage: The ClusterRoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
+failureMessage: The ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
+category: Security
+target: rbac.authorization.k8s.io/ClusterRoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Do not alert on default ClusterRoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: "cluster-admin"
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+              not:
+                const: "cluster-admin"
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # Do not alert on default ClusterRoleBindings.
+    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      const: "*"
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      const: '*'
+                  verbs:
+                    type: array
+                    uniqueItems: true
+                    oneOf:
+                      - contains:
+                          type: string
+                          const: '*'
+                      - minItems: 7
+                        items:
+                          type: string
+                          enum:
+                            - "get"
+                            - "list"
+                            - "watch"
+                            - "create"
+                            - "update"
+                            - "patch"
+                            - "delete"
+    {{ end }}

checks/clusterrolebindingPodExecAttach.yaml

@@ -0,0 +1,82 @@
+successMessage: The ClusterRoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
+failureMessage: The ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
+category: Security
+target: rbac.authorization.k8s.io/ClusterRoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Do not alert on default ClusterRoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - const: "cluster-admin"
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # Do not alert on default ClusterRoleBindings.
+    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: ""
+                        - const: '*'
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        - const: "pods/exec"
+                        - const: "pods/attach"
+                  verbs:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        # An exec is also possible by `get`ing a web socket.
+                        - const: 'get'
+                        - const: 'create'
+    {{ end }}

checks/cpuLimitsMissing.yaml

@@ -29,6 +29,4 @@ mutations:
   - op: add
     path: /resources/limits/cpu
     value: 100m
-comments:
-  - find: "cpu: 100m"
     comment: "TODO: Set this to the maximum amount of CPU you want your workload to use"

checks/cpuRequestsMissing.yaml

@@ -29,6 +29,4 @@ mutations:
   - op: add
     path: /resources/requests/cpu
     value: 100m
-comments:
-  - find: "cpu: 100m"
     comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"

checks/dangerousCapabilities.yaml

@@ -28,4 +28,4 @@ schema:
 
 mutations:
   - op: remove
-    path: /securityContext/capabilities
+    path: /securityContext/capabilities/add

checks/hostPortSet.yaml

@@ -12,4 +12,7 @@ schema:
       items:
         properties:
           hostPort:
-            const: 0
+            const: 0
+mutations:
+  - op: remove
+    path: /ports/*/hostPort

checks/insecureCapabilities.yaml

@@ -55,8 +55,6 @@ schema:
                 - contains:
                     pattern: '^(?i)AUDIT_WRITE$'
 mutations:
-  - op: remove
-    path: /securityContext/capabilities
-  - op: add
+  - op: replace
     path: /securityContext/capabilities
     value: {"drop": ["ALL"]}

checks/linuxHardening.yaml

@@ -0,0 +1,89 @@
+successMessage: One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
+FailureMessage: Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
+category: Security
+target: Container
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
+    podOrContainerSeccompProfile:
+      type: object
+      {{ $podSeccompProfileType := .Polaris.PodSpec.securityContext.seccompProfile.type }}
+      required:
+      {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+        - securityContext
+      {{ end }}
+      properties:
+        securityContext:
+          type: object
+          required:
+          {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+            - seccompProfile
+          {{ end }}
+          properties:
+            seccompProfile:
+              type: object
+              required:
+              {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+                - type
+              {{ end }}
+              properties:
+                type:
+                  type: string
+                  allOf:
+                    - not:
+                        const: "Unconfined"
+                    {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
+                    - minLength: 1
+                    {{ end }}
+    podOrContainerSELinuxOptions:
+      type: object
+      {{ $podSELinuxOptions := .Polaris.PodSpec.securityContext.seLinuxOptions }}
+      {{ if not $podSELinuxOptions }}
+      required: ["securityContext"]
+      properties:
+        securityContext:
+          type: object
+          required: ["seLinuxOptions"]
+          properties:
+            seLinuxOptions:
+              type: object
+              minProperties: 1
+      {{ end }}
+    containerDropCapabilities:
+      type: object
+      required: ["securityContext"]
+      properties:
+        securityContext:
+          type: object
+          required: ["capabilities"]
+          properties:
+            capabilities:
+              type: object
+              required: ["drop"]
+              properties:
+                drop:
+                  type: array
+                  minItems: 1
+                add:
+                  type: array
+                  items:
+                    type: string
+                    not:
+                      pattern: '^(?i)ALL$'
+  # End of definitions
+  {{/* Check for AppArmor which uses pod annotations. IF pod fields are missing,
+       require one of the other hardening measures. */}}
+  {{ $annotationName := (print "container.apparmor.security.beta.kubernetes.io/" .Polaris.Container.name) }}
+  {{/* Checking annotations before using index() avoids a nil panic when there are no annotations */}}
+  {{ $annotationExists := false }}
+  {{ if .Polaris.PodTemplate.metadata.annotations }}
+  {{ $annotationExists = index .Polaris "PodTemplate" "metadata" "annotations" $annotationName }}
+  {{ end }}
+  {{ if $annotationExists }}
+  type: object
+  {{ else }}
+  anyOf:
+  - $ref: "#/definitions/podOrContainerSeccompProfile"
+  - $ref: "#/definitions/podOrContainerSELinuxOptions"
+  - $ref: "#/definitions/containerDropCapabilities"
+  {{ end}}

checks/livenessProbeMissing.yaml

@@ -23,6 +23,4 @@ mutations:
   - op: add
     path: /livenessProbe
     value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
-comments:
-  - find: "livenessProbe:"
-    comment: "TODO: Change livenessProbe setting to reflect your health endpoints"
+    comment: "TODO: Change the livenessProbe setting to reflect your application's health"

checks/memoryLimitsMissing.yaml

@@ -29,6 +29,4 @@ mutations:
   - op: add
     path: /resources/limits/memory
     value: "512Mi"
-comments:
-  - find: "memory: 512Mi"
     comment: "TODO: Set this to the maximum amount of memory you want your workload to use"

checks/memoryRequestsMissing.yaml

@@ -29,6 +29,4 @@ mutations:
   - op: add
     path: /resources/requests/memory
     value: "512Mi"
-comments:
-  - find: "memory: 512Mi"
     comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"

checks/missingNetworkPolicy.yaml

@@ -0,0 +1,49 @@
+successMessage: A NetworkPolicy matches pod labels and contains egress and ingress rules
+failureMessage: A NetworkPolicy should match pod labels and contain applied egress and ingress rules
+category: Security
+target: PodTemplate
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    metadata:
+      type: object
+      properties:
+        labels:
+          type: object
+          minProperties: 1
+additionalSchemaStrings:
+  networking.k8s.io/NetworkPolicy: |
+    type: object
+    properties:
+      spec:
+        type: object
+        required: ["podSelector", "egress", "ingress"]
+        properties:
+          podSelector:
+            type: object
+            required: ["matchLabels"]
+            properties:
+              matchLabels:
+                type: object
+                oneOf:
+                {{ range $key, $value := .Polaris.PodTemplate.metadata.labels }}
+                - properties:
+                    "{{ $key }}":
+                      type: string
+                      const: {{ $value }}
+                  required: ["{{ $key }}"]
+                {{ end }}
+          egress:
+            type: array
+            minItems: 1
+          ingress:
+            minItems: 1
+            type: array
+          policyTypes:
+            type: array
+            allOf:
+              - contains:
+                  pattern: '^(?i)Egress$'
+              - contains:
+                  pattern: '^(?i)Ingress$'

checks/privilegeEscalationAllowed.yaml

@@ -40,4 +40,9 @@ schema:
           - securityContext
           properties:
             securityContext:
-              $ref: "#/definitions/goodSecurityContext"
+              $ref: "#/definitions/goodSecurityContext"
+
+mutations:
+  - op: add
+    path: /securityContext/allowPrivilegeEscalation
+    value: false

checks/readinessProbeMissing.yaml

@@ -23,6 +23,4 @@ mutations:
   - op: add
     path: /readinessProbe
     value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
-comments:
-  - find: "readinessProbe:"
-    comment: "TODO: Change livenessProbe setting to reflect your health endpoints"
+    comment: "TODO: Change the readinessProbe setting to reflect your application's readiness to serve traffic"

checks/rolePodExecAttach.yaml

@@ -0,0 +1,56 @@
+successMessage: The Role does not allow pods/exec or pods/attach
+failureMessage: The Role allows Pods/exec or pods/attach
+category: Security
+target: rbac.authorization.k8s.io/Role
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["metadata", "rules"]
+  anyOf:
+    # Do not alert on default Roles.
+    - properties:
+        metadata:
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - properties:
+        metadata:
+          required: ["name"]
+          properties:
+            name:
+              type: string
+        rules:
+          type: array
+          items:
+            type: object
+            not:
+              required: ["apiGroups", "resources", "verbs"]
+              properties:
+                apiGroups:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: ""
+                      - const: '*'
+                resources:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      - const: "pods/exec"
+                      - const: "pods/attach"
+                verbs:
+                  type: array
+                  contains:
+                    type: string
+                    anyOf:
+                      - const: '*'
+                      # An exec is also possible by `get`ing a web socket.
+                      - const: 'get'
+                      - const: 'create'

checks/rolebindingClusterAdminClusterRole.yaml

@@ -0,0 +1,98 @@
+successMessage: The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
+failureMessage: The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a Role.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["kind"]
+          properties:
+            kind:
+              type: string
+              const: "Role"
+    # Do not alert on default ClusterRoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+              not:
+                const: "cluster-admin"
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "ClusterRole" }}
+    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      const: "*"
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      const: '*'
+                  verbs:
+                    type: array
+                    uniqueItems: true
+                    oneOf:
+                      - contains:
+                          type: string
+                          const: '*'
+                      - minItems: 7
+                        items:
+                          type: string
+                          enum:
+                            - "get"
+                            - "list"
+                            - "watch"
+                            - "create"
+                            - "update"
+                            - "patch"
+                            - "delete"
+    {{ end }}
+    {{ end }}

checks/rolebindingClusterAdminRole.yaml

@@ -0,0 +1,96 @@
+successMessage: The RoleBinding does not reference a Role with wildcard permissions
+failureMessage: The RoleBinding references a Role with wildcard permissions
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a ClusterRole.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["kind"]
+          properties:
+            kind:
+              type: string
+              const: "ClusterRole"
+    # Do not alert on default RoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "Role"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "Role" }}
+    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      const: "*"
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      const: '*'
+                  verbs:
+                    type: array
+                    uniqueItems: true
+                    oneOf:
+                      - contains:
+                          type: string
+                          const: '*'
+                      - minItems: 7
+                        items:
+                          type: string
+                          enum:
+                            - "get"
+                            - "list"
+                            - "watch"
+                            - "create"
+                            - "update"
+                            - "patch"
+                            - "delete"
+    {{ end }}
+    {{ end }}

checks/rolebindingClusterRolePodExecAttach.yaml

@@ -0,0 +1,92 @@
+successMessage: The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
+failureMessage: The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a Role.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["kind"]
+          properties:
+            kind:
+              type: string
+              const: "Role"
+    # Do not alert on default RoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "ClusterRole"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "ClusterRole" }}
+    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: ""
+                        - const: '*'
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        - const: "pods/exec"
+                        - const: "pods/attach"
+                  verbs:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        # An exec is also possible by `get`ing a web socket.
+                        - const: 'get'
+                        - const: 'create'
+    {{ end }}
+    {{ end }}

checks/rolebindingRolePodExecAttach.yaml

@@ -0,0 +1,95 @@
+successMessage: The RoleBinding does not reference a Role allowing Pod exec or attach
+failureMessage: The RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist
+category: Security
+target: rbac.authorization.k8s.io/RoleBinding
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  anyOf:
+    # Pass RoleBindings that point to a ClusterRole.
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "Role"
+    # Do not alert on default RoleBindings.
+    - required: ["metadata"]
+      properties:
+        metadata:
+          type: object
+          required: ["name"]
+          properties:
+            name:
+              type: string
+              anyOf:
+                - pattern: '^system:'
+                - const: "gce:podsecuritypolicy:calico-sa"
+    - required: ["roleRef"]
+      properties:
+        roleRef:
+          required: ["apiGroup", "kind", "name"]
+          properties:
+            apiGroup:
+              type: string
+              const: "rbac.authorization.k8s.io"
+            kind:
+              type: string
+              const: "Role"
+            name:
+              type: string
+              minLength: 1
+additionalSchemaStrings:
+  rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
+    {{ if eq .roleRef.kind "Role" }}
+    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    required: ["metadata", "rules"]
+    allOf:
+      - properties:
+          metadata:
+            required: ["name"]
+            properties:
+              name:
+                type: string
+                const: "{{ .roleRef.name }}"
+      - properties:
+          rules:
+            type: array
+            items:
+              type: object
+              not:
+                required: ["apiGroups", "resources", "verbs"]
+                properties:
+                  apiGroups:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: ""
+                        - const: '*'
+                  resources:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        - const: "pods/exec"
+                        - const: "pods/attach"
+                  verbs:
+                    type: array
+                    contains:
+                      type: string
+                      anyOf:
+                        - const: '*'
+                        # An exec is also possible by `get`ing a web socket.
+                        - const: 'get'
+                        - const: 'create'
+    {{ end }}
+    {{ end }}

checks/sensitiveConfigmapContent.yaml

@@ -0,0 +1,43 @@
+successMessage: The ConfigMap does not contain potentially sensitive content in its keys and values
+failureMessage: Potentially sensitive content is detected in the ConfigMap keys or values
+category: Security
+target: /ConfigMap
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required: ["metadata"]
+  properties:
+    metadata:
+      required: ["name"]
+      properties:
+        name:
+          type: string
+    data:
+      type: object
+      propertyNames:
+        '$comment': These ConfigMap keys will be disallowed.
+        allOf:
+          - not:
+              pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+          - not:
+              pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+          - not:
+              pattern: '(?i)^AZURE_.+KEY$'
+          - not:
+              pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+          - not:
+              pattern: '(?i)password'
+          - not:
+              pattern: '(?i)token'
+          - not:
+              pattern: '(?i)bearer'
+          - not:
+              pattern: '(?i)secret'
+            '$comment': This allows ConfigMap keys not excluded above.
+          - pattern: '(?i).*'
+      additionalProperties:
+        '$comment': These ConfigMap values will be disallowed.
+        allOf:
+        - not:
+            '$comment': THis matches variations like begin private key, begin rsa private key ...
+            pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'

checks/sensitiveContainerEnvVar.yaml

@@ -0,0 +1,50 @@
+successMessage: The container does not set potentially sensitive environment variables
+failureMessage: The container sets potentially sensitive environment variables
+category: Security
+target: Container
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    env:
+      type: array
+      items:
+        type: object
+        oneOf:
+          - required: ["name", "value"]
+            properties:
+              name:
+                type: string
+                '$comment': These environment variable names will be disallowed.
+                allOf:
+                  - not:
+                      pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+                  - not:
+                      pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+                  - not:
+                      pattern: '(?i)^AZURE_.+KEY$'
+                  - not:
+                      pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+                  - not:
+                      pattern: '(?i)password'
+                  - not:
+                      pattern: '(?i)token'
+                  - not:
+                      pattern: '(?i)bearer'
+                  - not:
+                      pattern: '(?i)secret'
+                    '$comment': This allows variable names not excluded above.
+                  - pattern: '(?i).*'
+              value:
+                type: string
+                '$comment': These environment variable values will be disallowed.
+                allOf:
+                - not:
+                    '$comment': THis matches variations like begin private key, begin rsa private key ...
+                    pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'
+          - required: ["name", "valueFrom"]
+            properties:
+              name:
+                type: string
+              valueFrom:
+                type: object

checks/topologySpreadConstraint.yaml

@@ -0,0 +1,21 @@
+successMessage: Pod has a valid topology spread constraint
+failureMessage: Pod should be configured with a valid topology spread constraint
+category: Reliability
+target: PodSpec
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required:
+    - topologySpreadConstraints
+  properties:
+    topologySpreadConstraints:
+      type: array
+      items:
+        type: object
+        properties:
+          topologyKey:
+            anyOf:
+              - type: string
+                const: "kubernetes.io/hostname"
+              - type: string
+                const: "topology.kubernetes.io/zone"

cmd/polaris/audit.go

@@ -17,9 +17,10 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"os"
 	"os/exec"
@@ -45,6 +46,7 @@ var (
 	helmValues          string
 	checks              []string
 	auditNamespace      string
+	skipSslValidation   bool
 )
 
 func init() {
@@ -63,6 +65,7 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&helmValues, "helm-values", "", "Optional flag to add helm values")
 	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
 	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
+	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
 }
 
 var auditCmd = &cobra.Command{
@@ -137,13 +140,13 @@ func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
 		return "", err
 	}
 
-	dir, err := ioutil.TempDir("", "*")
+	dir, err := os.MkdirTemp("", "*")
 	if err != nil {
 		return "", err
 	}
 	params := []string{
 		"template", helmChart,
-		helmChart,
+		"--generate-name",
 		"--output-dir",
 		dir,
 	}
@@ -202,9 +205,13 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 			} else {
 				req.Header.Set("Content-Type", "text/plain")
 			}
-			client := &http.Client{}
-			resp, err := client.Do(req)
 
+			client := &http.Client{}
+			if skipSslValidation {
+				transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
+				client = &http.Client{Transport: transport}
+			}
+			resp, err := client.Do(req)
 			if err != nil {
 				logrus.Errorf("Error making request for output: %v", err)
 				os.Exit(1)
@@ -212,7 +219,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 
 			defer resp.Body.Close()
 
-			body, err := ioutil.ReadAll(resp.Body)
+			body, err := io.ReadAll(resp.Body)
 
 			if err != nil {
 				logrus.Errorf("Error reading response: %v", err)
@@ -223,7 +230,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 		}
 
 		if outputFile != "" {
-			err := ioutil.WriteFile(outputFile, []byte(outputBytes), 0644)
+			err := os.WriteFile(outputFile, outputBytes, 0644)
 			if err != nil {
 				logrus.Errorf("Error writing output to file: %v", err)
 				os.Exit(1)

cmd/polaris/fix.go

@@ -15,11 +15,7 @@
 package cmd
 
 import (
-	"bytes"
-	"errors"
 	"fmt"
-	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -29,19 +25,23 @@ import (
 	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	yamlV3 "gopkg.in/yaml.v3"
-	"sigs.k8s.io/yaml"
 )
 
+const templateLineMarker = "# POLARIS_FIX_TMPL"
+const templateOpenMarker = "POLARIS_OPEN_TMPL"
+const templateCloseMarker = "POLARIS_CLOSE_TMPL"
+
 var (
 	filesPath   string
 	checksToFix []string
 	fixAll      bool
+	isTemplate  bool
 )
 
 func init() {
 	rootCmd.AddCommand(fixCommand)
 	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
+	fixCommand.PersistentFlags().BoolVar(&isTemplate, "template", false, "set to true when modifyng a YAML template, like a Helm chart (experimental)")
 	fixCommand.PersistentFlags().StringSliceVar(&checksToFix, "checks", []string{}, "Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations")
 }
 
@@ -53,7 +53,7 @@ var fixCommand = &cobra.Command{
 		logrus.Debug("Setting up controller manager")
 
 		if filesPath == "" {
-			logrus.Error("Please specify a file-path flag")
+			logrus.Error("Please specify a files-path flag")
 			cmd.Help()
 			os.Exit(1)
 		}
@@ -76,8 +76,6 @@ var fixCommand = &cobra.Command{
 		} else {
 			yamlFiles = append(yamlFiles, filesPath)
 		}
-		var contentStr string
-		isFirstResource := true
 
 		if len(checksToFix) > 0 {
 			if len(checksToFix) == 1 && checksToFix[0] == "all" {
@@ -86,75 +84,58 @@ var fixCommand = &cobra.Command{
 					allchecks = append(allchecks, key)
 				}
 				config.Mutations = allchecks
+			} else if len(checksToFix) == 0 && checksToFix[0] == "none" {
+				config.Mutations = nil
 			} else {
 				config.Mutations = checksToFix
 			}
 		}
 
 		for _, fullFilePath := range yamlFiles {
-
-			yamlFile, err := ioutil.ReadFile(fullFilePath)
+			yamlContent, err := os.ReadFile(fullFilePath)
 			if err != nil {
 				logrus.Fatalf("Error reading file with file path %s: %v", fullFilePath, err)
 			}
 
-			dec := yamlV3.NewDecoder(bytes.NewReader(yamlFile))
+			if err != nil {
+				logrus.Fatalf("Error marshalling %s: %v", fullFilePath, err)
+			}
 
-			for {
-				data := map[string]interface{}{}
-				err := dec.Decode(&data)
-				// check it was parsed
-				if data == nil {
-					continue
-				}
-				// break the loop in case of EOF
-				if errors.Is(err, io.EOF) {
-					break
-				}
-				if err != nil {
-					logrus.Fatalf("Error decoding data for file with file path %s: %v", fullFilePath, err)
-				}
-				yamlContent, err := yamlV3.Marshal(data)
-				if err != nil {
-					logrus.Fatalf("Error marshalling %s: %v", fullFilePath, err)
-				}
-				kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
-				results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
-				if err != nil {
-					logrus.Fatalf("Error applying schema check to the resources %s: %v", fullFilePath, err)
-				}
-				comments, allMutations := mutation.GetMutationsAndCommentsFromResults(results)
-				updatedYamlContent := string(yamlContent)
-				if len(allMutations) > 0 {
-					for _, resources := range kubeResources.Resources {
-						key := fmt.Sprintf("%s/%s/%s", resources[0].Kind, resources[0].Resource.GetName(), resources[0].Resource.GetNamespace())
+			if isTemplate {
+				yamlContent = []byte(detemplate(string(yamlContent)))
+			}
+			kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
+			results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
+			if err != nil {
+				logrus.Fatalf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+			}
+			allMutations := mutation.GetMutationsFromResults(results)
+
+			updatedYamlContent := ""
+			if len(allMutations) > 0 {
+				for _, resources := range kubeResources.Resources {
+					for _, resource := range resources {
+						key := fmt.Sprintf("%s/%s/%s", resource.Kind, resource.Resource.GetName(), resource.Resource.GetNamespace())
 						mutations := allMutations[key]
-						mutated, err := mutation.ApplyAllSchemaMutations(&config, kubeResources, resources[0], mutations)
+						mutatedYamlContent, err := mutation.ApplyAllMutations(string(resource.OriginalObjectYAML), mutations)
 						if err != nil {
-							logrus.Errorf("Error applying schema mutations to the resources: %v", err)
+							logrus.Errorf("Error applying schema mutations to the resource %s: %v", key, err)
 							os.Exit(1)
 						}
-						mutatedYamlContent, err := yaml.JSONToYAML(mutated.OriginalObjectJSON)
-						if err != nil {
-							logrus.Errorf("Error converting JSON to Yaml : %v", err)
-							os.Exit(1)
+						if updatedYamlContent != "" {
+							updatedYamlContent += "\n---\n"
 						}
-						updatedYamlContent = mutation.UpdateMutatedContentWithComments(string(mutatedYamlContent), comments)
+						updatedYamlContent += mutatedYamlContent
 					}
 				}
-				if isFirstResource {
-					contentStr = updatedYamlContent
-					isFirstResource = false
-				} else {
-					contentStr += "\n"
-					contentStr += "---"
-					contentStr += "\n"
-					contentStr += updatedYamlContent
-				}
 			}
 
-			if contentStr != "" {
-				err = ioutil.WriteFile(fullFilePath, []byte(contentStr), 0644)
+			if isTemplate {
+				updatedYamlContent = retemplate(updatedYamlContent)
+			}
+
+			if updatedYamlContent != "" {
+				err = os.WriteFile(fullFilePath, []byte(updatedYamlContent), 0644)
 				if err != nil {
 					logrus.Fatalf("Error writing output to file: %v", err)
 				}
@@ -164,6 +145,42 @@ var fixCommand = &cobra.Command{
 	},
 }
 
+func detemplate(content string) string {
+	lines := strings.Split(content, "\n")
+	for idx, line := range lines {
+		lines[idx] = detemplateLine(line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+func retemplate(content string) string {
+	lines := strings.Split(content, "\n")
+	for idx, line := range lines {
+		lines[idx] = retemplateLine(line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+func detemplateLine(line string) string {
+	if !strings.HasPrefix(strings.TrimSpace(line), "{{") {
+		line = strings.ReplaceAll(line, "{", templateOpenMarker)
+		line = strings.ReplaceAll(line, "}", templateCloseMarker)
+		return line
+	}
+	tmplStart := strings.Index(line, "{{")
+	newLine := line[:tmplStart] + templateLineMarker + line[tmplStart:]
+	return newLine
+}
+
+func retemplateLine(line string) string {
+	if !strings.Contains(line, templateLineMarker) {
+		line = strings.ReplaceAll(line, templateOpenMarker, "{")
+		line = strings.ReplaceAll(line, templateCloseMarker, "}")
+		return line
+	}
+	return strings.Replace(line, templateLineMarker, "", 1)
+}
+
 func getYamlFiles(rootpath string) ([]string, error) {
 	var list []string
 	err := filepath.Walk(rootpath, func(path string, info os.FileInfo, err error) error {

cmd/polaris/root.go

@@ -15,13 +15,11 @@
 package cmd
 
 import (
-	"flag"
 	"os"
 
 	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 )
 
 var configPath string
@@ -42,9 +40,7 @@ func init() {
 	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
-	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level.")
-	flag.Parse()
-	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level to be output (trace, debug, info, warning, error, fatal, panic).")
 }
 
 var config conf.Configuration
@@ -80,6 +76,9 @@ var rootCmd = &cobra.Command{
 		}
 		os.Exit(1)
 	},
+	PersistentPostRun: func(cmd *cobra.Command, args []string) {
+		os.Stderr.WriteString("\n\nWant more? Automate Polaris for free with Fairwinds Insights!\n🚀 https://fairwinds.com/insights-signup/polaris 🚀 \n")
+	},
 }
 
 // Execute the stuff

cmd/polaris/version.go

@@ -31,4 +31,7 @@ var versionCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		fmt.Println("Polaris version:" + version)
 	},
+	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
+		return nil
+	},
 }

cmd/polaris/webhook.go

@@ -16,7 +16,6 @@ package cmd
 
 import (
 	"os"
-	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -31,6 +30,7 @@ var webhookPort int
 var disableWebhookConfigInstaller bool
 var enableMutations bool
 var enableValidations bool
+var certDir string
 
 func init() {
 	rootCmd.AddCommand(webhookCmd)
@@ -38,6 +38,7 @@ func init() {
 	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "Disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
 	webhookCmd.PersistentFlags().BoolVar(&enableValidations, "validate", true, "Enable the validating webhook to reject workloads with issues")
 	webhookCmd.PersistentFlags().BoolVar(&enableMutations, "mutate", false, "Enable the mutating webhook to modify workloads with issues")
+	webhookCmd.PersistentFlags().StringVar(&certDir, "cert-dir", "/opt/cert", "Directory in which tls certificate is located")
 }
 
 var webhookCmd = &cobra.Command{
@@ -48,7 +49,7 @@ var webhookCmd = &cobra.Command{
 		logrus.Debug("Setting up controller manager")
 
 		mgr, err := manager.New(k8sConfig.GetConfigOrDie(), manager.Options{
-			CertDir: "/opt/cert",
+			CertDir: certDir,
 			Port:    webhookPort,
 		})
 		if err != nil {
@@ -56,9 +57,8 @@ var webhookCmd = &cobra.Command{
 			os.Exit(1)
 		}
 
-		_, err = os.Stat("/opt/cert/tls.crt")
+		_, err = os.Stat(certDir + "/tls.crt")
 		if os.IsNotExist(err) {
-			time.Sleep(time.Second * 10)
 			panic("Cert does not exist")
 		}
 		server := mgr.GetWebhookServer()

docs/admission-controller.md

@@ -55,7 +55,28 @@ the deployment.
 To enable the mutating webhook, add `--set webhook.mutate=true` to your
 Helm instlallation command.
 
-By default, the only mutation enabled is `pullPolicyNotAlways`. If you'd like to
+The following default checks currently have mutation support enabled:
+* `hostPIDSet`
+* `hostNetworkSet`
+* `hostIPCSet`
+* `priorityClassNotSet`
+* `hostPortSet`
+* `pullPolicyNotAlways`
+* `deploymentMissingReplicas`
+* `dangerousCapabilities`
+* `cpuLimitsMissing`
+* `memoryLimitsMissing`
+* `livenessProbeMissing`
+* `memoryRequestsMissing`
+* `cpuRequestsMissing`
+* `runAsPrivileged`
+* `readinessProbeMissing`
+* `privilegeEscalationAllowed`
+* `notReadOnlyRootFilesystem`
+* `insecureCapabilities`
+* `runAsRootAllowed`
+
+If you'd like to
 enable other mutations, you can set the `webhook.mutations` flag.
 
 

docs/changelog.md

@@ -5,6 +5,30 @@ meta:
     content: "Fairwinds Polaris | Changelog"
 
 ---
+
+## 8.0.0
+* Change default severity from `ignore` to `warning` for `priorityClassNotSet`, `metadataAndNameMismatched`, `missingPodDisruptionBudget`, `automountServiceAccountToken`, `missingNetworkPolicy` checks.
+* Change default severity from `warning` to `danger` for `sensitiveContainerEnvVar`, `sensitiveConfigmapContent`, `clusterrolePodExecAttach`, `rolePodExecAttach`, `clusterrolebindingPodExecAttach`, `rolebindingClusterRolePodExecAttach`, `rolebindingRolePodExecAttach`,`clusterrolebindingClusterAdmin`,`rolebindingClusterAdminClusterRole`,`rolebindingClusterAdminRole` checks.
+
+## 7.4.0
+* Skip https certificate verification (#920)
+
+## 7.3.0
+* Add a check for `topologySpreadConstraint` (#879)
+
+## 7.2.0
+* Enable new RBAC / sensitive content / Pod exec checks, add `hasPrefix` and `hasSuffix` functions to the GO template, exempt `system:` name prefixes for RBAC checks, sensitive content checks ignore `valueFrom`, (#832)
+
+## 7.1.0
+* Let Polaris modify YAML without losing comments/formatting (#821)
+* Add checks for RBAC allowing exec or attaching to a Pod (#820)
+* Add `clusterrolebindingClusterAdmin`, `rolebindingClusterAdminRole`, and `rolebindingClusterAdminClusterRole` checks + schema tests (#823)
+
+## 7.0.2
+* Fixes for pretty CLI output
+* Some new checks (disabled by default)
+* Some additional features in templating engine
+
 ## 7.0.1
 * Documentation updates
 

docs/checks/reliability.md

@@ -14,22 +14,55 @@ key | default | description
 `livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
 `tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
 `pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
-`priorityClassNotSet` | `ignore` | Fails when a priorityClassName is not set for a pod.
+`priorityClassNotSet` | `warning` | Fails when a priorityClassName is not set for a pod.
 `deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
-`missingPodDisruptionBudget` | `ignore` 
+`missingPodDisruptionBudget` | `warning`
+`metadataAndNameMismatched` | `warning`
+`topologySpreadConstraint` | `warning` | Fails when there is no topology spread constraint on the pod
 
 ## Background
 
+### Liveness and Readiness Probes
 Readiness and liveness probes can help maintain the health of applications running inside Kubernetes. By default, Kubernetes only knows whether or not a process is running, not if it's healthy. Properly configured readiness and liveness probes will also be able to ensure the health of an application.
 
 Readiness probes are designed to ensure that an application has reached a "ready" state. In many cases there is a period of time between when a webserver process starts and when it is ready to receive traffic. A readiness probe can ensure the traffic is not sent to a pod until it is actually ready to receive traffic.
 
 Liveness probes are designed to ensure that an application stays in a healthy state. When a liveness probe fails, the pod will be restarted.
 
+### Image Pull Policy
 Docker's `latest` tag is applied by default to images where a tag hasn't been specified. Not specifying a specific version of an image can lead to a wide variety of problems. The underlying image could include unexpected breaking changes that break your application whenever the latest image is pulled. Reusing the same tag for multiple versions of an image can lead to different nodes in the same cluster having different versions of an image, even if the tag is identical.
 
 Related to that, relying on cached versions of a Docker image can become a security vulnerability. By default, an image will be pulled if it isn't already cached on the node attempting to run it. This can result in variations in images that are running per node, or potentially provide a way to gain access to an image without having direct access to the ImagePullSecret. With that in mind, it's often better to ensure the a pod has `pullPolicy: Always` specified, so images are always pulled directly from their source.
 
+### Topology Spread Constraints
+
+By default, the Kubernetes scheduler uses a bin-packing algorithm to fit as many pods as possible into a cluster. The scheduler prefers a more evenly distributed general node load to app replicas precisely spread across nodes. Therefore, by default, multi-replica is not guaranteed to be spread across multiple availability zones. Kubernetes provides topologySpreadConstraint configuration in order to better ensure pod spread across multiple AZs and/or Hosts.
+
+Example of a topologySpreadConstraint spreading across zones:
+
+```
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: demo-basic-demo
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: basic-demo
+      app.kubernetes.io/instance: demo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: basic-demo
+        app.kubernetes.io/instance: demo
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "topology.kubernetes.io/zone"
+          whenUnsatisfiable: ScheduleAnyway
+```
+
+
 ## Further Reading
 
 - [What's Wrong With The Docker :latest Tag?](https://vsupalov.com/docker-latest-tag/)
@@ -37,3 +70,4 @@ Related to that, relying on cached versions of a Docker image can become a secur
 - [Kubernetes Docs: Configure Liveness and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
 - [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
 - [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)
+- [Topology Spread Cosntraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)

docs/checks/security.md

@@ -11,8 +11,10 @@ for privilege escalation.
 
 key | default | description
 ----|---------|------------
+`automountServiceAccountToken` | `warning` | Fails when `automountServiceAccountToken` is automounted.
 `hostIPCSet` | `danger` | Fails when `hostIPC` attribute is configured.
 `hostPIDSet` | `danger` | Fails when `hostPID` attribute is configured.
+`linuxHardening` | `danger` | Fails when neither `AppArmor`, `Seccomp`, `SELinux`, or dropping Linux Capabilities is in use.
 `notReadOnlyRootFilesystem` | `warning` | Fails when `securityContext.readOnlyRootFilesystem` is not true.
 `privilegeEscalationAllowed` | `danger` | Fails when `securityContext.allowPrivilegeEscalation` is true.
 `runAsRootAllowed` | `warning` | Fails when `securityContext.runAsNonRoot` is not true.
@@ -22,6 +24,17 @@ key | default | description
 `hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
 `hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
 `tlsSettingsMissing` | `warning` | Fails when an Ingress lacks TLS settings.
+`sensitiveContainerEnvVar` | `danger` | Fails when the container sets potentially sensitive environment variables.
+`sensitiveConfigmapContent` | `danger` | Fails when potentially sensitive content is detected in the ConfigMap keys or values.
+`missingNetworkPolicy` | `warning`
+`clusterrolePodExecAttach` | `danger` | Fails when the ClusterRole allows Pods/exec or pods/attach.
+`rolePodExecAttach` | `danger` | Fails when the Role allows Pods/exec or pods/attach.
+`clusterrolebindingPodExecAttach` | `danger` | Fails when the ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
+`rolebindingRolePodExecAttach` | `danger` | Fails when the RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist.
+`rolebindingClusterRolePodExecAttach` | `danger` | Fails when the RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
+`clusterrolebindingClusterAdmin` | `danger` | Fails when the ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
+`rolebindingClusterAdminClusterRole` | `danger` | Fails when the RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
+`rolebindingClusterAdminRole` | `danger` | Fails when the RoleBinding references a Role with wildcard permissions.
 
 ## Background
 

docs/customization/custom-checks.md

@@ -44,6 +44,7 @@ check ID. Note that you'll also have to set its severity in the `checks` section
 * `target` - specifies the type of resource to check. This can be:
   * a group and kind, e.g. `apps/Deployment` or `networking.k8s.io/Ingress`
   * `Controller`, to check _any_ resource that creates Pods (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
+  * `PodTemplate`, same as `Controller`, but the schema applies to the Pod template rather than the top-level controller
   * `PodSpec`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
   * `Container` same as `Controller`, but the schema applies to all Container specs rather than the top-level controller
 * `controllers` - if `target` is `Controller`, `PodSpec` or `Container`, you can use this to change which types of controllers are checked
@@ -134,6 +135,11 @@ schema:
               const: "{{ .metadata.name }}"
 ```
 
+* The object available via the go template is the full object, and not limited by `target`.
+* A check of `target: PodSpec` can directly access the pod specification via the go template variable `.Polaris.PodSpec`.
+* A check of `target: PodTemplate` can directly access the pod template via the go template variable `.Polaris.PodTemplate`.
+* A check of `target: Container` can directly access the container being checked via the go template variable `.Polaris.container`. The pod template and pod specification can also be accessed via the respective variables `.Polaris.PodTemplate` and `.Polaris.PodSpec`. Access to pod-level fields allows a container check to consult related fields from the pod, such as `securityContext`.
+
 You can also use the full [Go template syntax](https://golang.org/pkg/text/template/), though
 you may need to specify your schema as a string in order to use concepts like `range`. E.g.
 this check ensures that at least one of the object's labels is present in `matchLabels`:
@@ -161,6 +167,18 @@ schemaString: |
               {{ end }}
 ```
 
+### Additional Go Template Functions
+
+These functions are also available in the GO template.
+
+* [hasPrefix](https://pkg.go.dev/strings#HasPrefix) - for example, `hasPrefix "string" "prefix"`
+* [hasSuffix](https://pkg.go.dev/strings#HasSuffix) - for example, `hasSuffix "string" "suffix"`
+
+For example, the `hasPrefix` function can be used in a template to determine whether a resource name starts with `system:`
+```
+{{ if hasPrefix .metadata.name "system:" }}
+```
+
 ## Multi-Resource Checks
 You can write checks that span multiple resources. This is helpful for ensuring e.g.
 that every Deployment has a PDB or an HPA associated with it.

docs/package.json

@@ -8,9 +8,9 @@
   },
   "description": "A repository with a Vuepress template for Fairwinds projects",
   "devDependencies": {
-    "vuepress": "^1.4.0",
+    "vuepress": "^1.9.7",
     "vuepress-plugin-clean-urls": "^1.1.1",
-    "vuepress-plugin-redirect": "^1.2.3"
+    "vuepress-plugin-redirect": "^1.2.5"
   },
   "directories": {
     "doc": "docs"

examples/config-full.yaml

@@ -6,14 +6,23 @@ checks:
   pullPolicyNotAlways: warning
   readinessProbeMissing: warning
   livenessProbeMissing: warning
+  topologySpreadConstraint: warning
+  pdbDisruptionsIsZero: warning
+  missingPodDisruptionBudget: warning
+  metadataAndNameMismatched: warning
+
   # efficiency
   cpuRequestsMissing: warning
   cpuLimitsMissing: warning
   memoryRequestsMissing: warning
   memoryLimitsMissing: warning
+
   # security
+  automountServiceAccountToken: warning
   hostIPCSet: danger
   hostPIDSet: danger
+  linuxHardening: danger
+  missingNetworkPolicy: warning
   notReadOnlyRootFilesystem: warning
   privilegeEscalationAllowed: danger
   runAsRootAllowed: danger
@@ -22,11 +31,21 @@ checks:
   insecureCapabilities: warning
   hostNetworkSet: danger
   hostPortSet: warning
+  tlsSettingsMissing: warning
+  sensitiveContainerEnvVar: danger
+  sensitiveConfigmapContent: danger
+  clusterrolePodExecAttach: danger
+  rolePodExecAttach: danger
+  clusterrolebindingPodExecAttach: danger
+  rolebindingClusterRolePodExecAttach: danger
+  rolebindingRolePodExecAttach: danger
+  clusterrolebindingClusterAdmin: danger
+  rolebindingClusterAdminClusterRole: danger
+  rolebindingClusterAdminRole: danger
   # custom
   resourceLimits: warning
   imageRegistry: danger
 
-  
 exemptions:
   - controllerNames:
     - my-network-controller

examples/config.yaml

@@ -1,23 +1,28 @@
 checks:
   # reliability
   deploymentMissingReplicas: warning
-  priorityClassNotSet: ignore
+  priorityClassNotSet: warning
   tagNotSpecified: danger
   pullPolicyNotAlways: warning
   readinessProbeMissing: warning
   livenessProbeMissing: warning
-  metadataAndNameMismatched: ignore
+  metadataAndNameMismatched: warning
   pdbDisruptionsIsZero: warning
-  missingPodDisruptionBudget: ignore
+  missingPodDisruptionBudget: warning
+  topologySpreadConstraint: warning
 
   # efficiency
   cpuRequestsMissing: warning
   cpuLimitsMissing: warning
   memoryRequestsMissing: warning
   memoryLimitsMissing: warning
+  
   # security
+  automountServiceAccountToken: warning
   hostIPCSet: danger
   hostPIDSet: danger
+  linuxHardening: warning
+  missingNetworkPolicy: warning
   notReadOnlyRootFilesystem: warning
   privilegeEscalationAllowed: danger
   runAsRootAllowed: danger
@@ -27,11 +32,61 @@ checks:
   hostNetworkSet: danger
   hostPortSet: warning
   tlsSettingsMissing: warning
+  sensitiveContainerEnvVar: danger
+  sensitiveConfigmapContent: danger
+  clusterrolePodExecAttach: danger
+  rolePodExecAttach: danger
+  clusterrolebindingPodExecAttach: danger
+  rolebindingClusterRolePodExecAttach: danger
+  rolebindingRolePodExecAttach: danger
+  clusterrolebindingClusterAdmin: danger
+  rolebindingClusterAdminClusterRole: danger
+  rolebindingClusterAdminRole: danger
+
 
 mutations:
   - pullPolicyNotAlways
 
 exemptions:
+  - namespace: kube-system
+    controllerNames:
+      - dns-controller
+      - ebs-csi-controller
+      - ebs-csi-node
+      - kindnet
+      - kops-controller
+      - kube-dns
+      - kube-flannel-ds
+      - kube-proxy
+      - kube-scheduler
+      - vpa-recommender
+    rules:
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
+  - namespace: kube-system
+    controllerNames:
+      - coredns
+    rules:
+      - automountServiceAccountToken
+      - missingNetworkPolicy
+  - namespace: kube-system
+    controllerNames:
+      - ebs-csi-controller
+    rules:
+      - sensitiveContainerEnvVar
+  - namespace: kube-system
+    controllerNames:
+      - coredns-autoscaler
+    rules:
+      - linuxHardening
+  - namespace: local-path-storage
+    controllerNames:
+      - local-path-provisioner
+    rules:
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
   - namespace: kube-system
     controllerNames:
       - kube-apiserver
@@ -54,7 +109,48 @@ exemptions:
       - runAsPrivileged
       - notReadOnlyRootFilesystem
       - hostPIDSet
+  - namespace: datadog
+    controllerNames:
+      - datadogtoken
+    rules:
+      - sensitiveConfigmapContent
+  - namespace: datadog
+    controllerNames:
+      - datadog-cluster-agent-apiserver
+    rules:
+      - rolebindingClusterAdminRole
+      - rolebindingRolePodExecAttach
 
+  - controllerNames:
+      - ingress-nginx-controller
+    rules:
+      - sensitiveConfigmapContent
+  - controllerNames:
+      - ingress-nginx-controller
+      - ingress-nginx-default-backend
+      - polaris
+      - rbac-manager
+    rules:
+      - automountServiceAccountToken
+      - missingNetworkPolicy
+  - controllerNames:
+      - aws-iam-authenticator
+      - aws-load-balancer-controller
+      - docker-registry
+      - external-dns
+      - kube2iam
+      - metrics-server
+    rules:
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
+  - controllerNames:
+      - oauth2-proxy
+    rules:
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
+      - sensitiveContainerEnvVar
   - controllerNames:
       - kube-flannel-ds
     rules:
@@ -72,6 +168,9 @@ exemptions:
       - runAsRootAllowed
       - readinessProbeMissing
       - livenessProbeMissing
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
 
   - controllerNames:
       - cluster-autoscaler
@@ -79,6 +178,9 @@ exemptions:
       - notReadOnlyRootFilesystem
       - runAsRootAllowed
       - readinessProbeMissing
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
 
   - controllerNames:
       - vpa
@@ -95,6 +197,10 @@ exemptions:
       - readinessProbeMissing
       - livenessProbeMissing
       - notReadOnlyRootFilesystem
+      - automountServiceAccountToken
+      - linuxHardening
+      - missingNetworkPolicy
+      - sensitiveContainerEnvVar
 
   - controllerNames:
       - nginx-ingress-controller

go.mod

@@ -1,60 +1,55 @@
 module github.com/fairwindsops/polaris
 
-go 1.17
+go 1.19
 
 require (
-	github.com/evanphx/json-patch/v5 v5.6.0
-	github.com/fatih/color v1.13.0
+	github.com/fatih/color v1.14.1
 	github.com/gobuffalo/packr/v2 v2.8.3
 	github.com/gorilla/mux v1.8.0
 	github.com/qri-io/jsonschema v0.1.1
-	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.4.0
-	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.1
-	github.com/thoas/go-funk v0.9.2
-	golang.org/x/text v0.3.7 // indirect
+	github.com/sirupsen/logrus v1.9.0
+	github.com/spf13/cobra v1.6.1
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/testify v1.8.1
+	github.com/thoas/go-funk v0.9.3
+	golang.org/x/text v0.7.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.24.1
-	k8s.io/apimachinery v0.24.1
-	k8s.io/client-go v0.24.1
-	sigs.k8s.io/controller-runtime v0.12.1
+	k8s.io/api v0.26.1
+	k8s.io/apimachinery v0.26.1
+	k8s.io/client-go v0.26.1
+	sigs.k8s.io/controller-runtime v0.14.4
 	sigs.k8s.io/yaml v1.3.0
 )
 
-require gomodules.xyz/jsonpatch/v2 v2.2.0
+require (
+	github.com/pkg/errors v0.9.1
+	gomodules.xyz/jsonpatch/v2 v2.2.0
+)
 
 require (
-	cloud.google.com/go/compute v1.6.1 // indirect
-	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
-	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
-	github.com/Azure/go-autorest/logger v0.2.1 // indirect
-	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.8.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.10.1 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/swag v0.21.1 // indirect
-	github.com/gobuffalo/logger v1.0.6 // indirect
-	github.com/gobuffalo/packd v1.0.1 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/gobuffalo/logger v1.0.7 // indirect
+	github.com/gobuffalo/packd v1.0.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v4 v4.4.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/gnostic v0.6.9 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/karrick/godirwalk v1.17.0 // indirect
@@ -62,32 +57,30 @@ require (
 	github.com/markbates/errx v1.1.0 // indirect
 	github.com/markbates/oncer v1.0.0 // indirect
 	github.com/markbates/safe v1.0.1 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.12.2 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.34.0 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/prometheus/client_golang v1.14.0 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.39.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/qri-io/jsonpointer v0.1.1 // indirect
-	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
-	golang.org/x/net v0.0.0-20220607020251-c690dde0001d // indirect
-	golang.org/x/oauth2 v0.0.0-20220524215830-622c5d57e401 // indirect
-	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
-	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 // indirect
-	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
+	golang.org/x/net v0.7.0 // indirect
+	golang.org/x/oauth2 v0.5.0 // indirect
+	golang.org/x/sys v0.5.0 // indirect
+	golang.org/x/term v0.5.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/component-base v0.24.1 // indirect
-	k8s.io/klog/v2 v2.60.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20220603121420-31174f50af60 // indirect
-	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
-	sigs.k8s.io/json v0.0.0-20220525155127-227cbc7cc124 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
+	k8s.io/component-base v0.26.1 // indirect
+	k8s.io/klog/v2 v2.90.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20230202010329-39b3636cbaa3 // indirect
+	k8s.io/utils v0.0.0-20230202215443-34013725500c // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )

pkg/config/checks.go

@@ -32,6 +32,8 @@ var (
 		"hostIPCSet",
 		"hostPIDSet",
 		"hostNetworkSet",
+		"automountServiceAccountToken",
+		"topologySpreadConstraint",
 		// Container checks
 		"memoryLimitsMissing",
 		"memoryRequestsMissing",
@@ -49,11 +51,23 @@ var (
 		"dangerousCapabilities",
 		"insecureCapabilities",
 		"priorityClassNotSet",
+		"linuxHardening",
+		"sensitiveContainerEnvVar",
 		// Other checks
 		"tlsSettingsMissing",
 		"pdbDisruptionsIsZero",
 		"metadataAndNameMismatched",
 		"missingPodDisruptionBudget",
+		"missingNetworkPolicy",
+		"sensitiveConfigmapContent",
+		"clusterrolePodExecAttach",
+		"rolePodExecAttach",
+		"clusterrolebindingPodExecAttach",
+		"rolebindingClusterRolePodExecAttach",
+		"rolebindingRolePodExecAttach",
+		"clusterrolebindingClusterAdmin",
+		"rolebindingClusterAdminClusterRole",
+		"rolebindingClusterAdminRole",
 	}
 )
 

pkg/config/config.go

@@ -19,8 +19,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
+	"os"
 	"strings"
 
 	"github.com/gobuffalo/packr/v2"
@@ -70,10 +70,10 @@ func ParseFile(path string) (Configuration, error) {
 		if err2 != nil {
 			return Configuration{}, err2
 		}
-		rawBytes, err = ioutil.ReadAll(response.Body)
+		rawBytes, err = io.ReadAll(response.Body)
 	} else {
 		// path is local
-		rawBytes, err = ioutil.ReadFile(path)
+		rawBytes, err = os.ReadFile(path)
 	}
 	if err != nil {
 		return Configuration{}, err

pkg/config/schema.go

@@ -25,7 +25,6 @@ import (
 
 	"github.com/qri-io/jsonschema"
 	"github.com/thoas/go-funk"
-	"gomodules.xyz/jsonpatch/v2"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	k8sYaml "k8s.io/apimachinery/pkg/util/yaml"
@@ -41,6 +40,8 @@ const (
 	TargetContainer TargetKind = "Container"
 	// TargetPodSpec points to the pod spec
 	TargetPodSpec TargetKind = "PodSpec"
+	// TargetPodTemplate points to the pod template
+	TargetPodTemplate TargetKind = "PodTemplate"
 )
 
 // HandledTargets is a list of target names that are explicitly handled
@@ -48,12 +49,15 @@ var HandledTargets = []TargetKind{
 	TargetController,
 	TargetContainer,
 	TargetPodSpec,
+	TargetPodTemplate,
 }
 
-// MutationComment is the comments added to a mutated file
-type MutationComment struct {
-	Find    string `yaml:"find" json:"find"`
-	Comment string `yaml:"comment" json:"comment"`
+// Mutation defines how to change a YAML file, in the style of JSON Patch
+type Mutation struct {
+	Path    string
+	Op      string
+	Value   interface{}
+	Comment string
 }
 
 // SchemaCheck is a Polaris check that runs using JSON Schema
@@ -72,14 +76,14 @@ type SchemaCheck struct {
 	AdditionalSchemas       map[string]map[string]interface{} `yaml:"additionalSchemas" json:"additionalSchemas"`
 	AdditionalSchemaStrings map[string]string                 `yaml:"additionalSchemaStrings" json:"additionalSchemaStrings"`
 	AdditionalValidators    map[string]jsonschema.RootSchema  `yaml:"-" json:"-"`
-	Mutations               []jsonpatch.Operation             `yaml:"mutations" json:"mutations"`
-	Comments                []MutationComment                 `yaml:"comments" json:"comments"`
+	Mutations               []Mutation                        `yaml:"mutations" json:"mutations"`
 }
 
 type resourceMinimum string
 type resourceMaximum string
 
-func unmarshalYAMLOrJSON(raw []byte, dest interface{}) error {
+// UnmarshalYAMLOrJSON is a helper function to unmarshal data in an arbitrary format
+func UnmarshalYAMLOrJSON(raw []byte, dest interface{}) error {
 	reader := bytes.NewReader(raw)
 	d := k8sYaml.NewYAMLOrJSONDecoder(reader, 4096)
 	for {
@@ -96,7 +100,7 @@ func unmarshalYAMLOrJSON(raw []byte, dest interface{}) error {
 // ParseCheck parses a check from a byte array
 func ParseCheck(id string, rawBytes []byte) (SchemaCheck, error) {
 	check := SchemaCheck{}
-	err := unmarshalYAMLOrJSON(rawBytes, &check)
+	err := UnmarshalYAMLOrJSON(rawBytes, &check)
 	if err != nil {
 		return check, err
 	}
@@ -219,7 +223,10 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
 	newCheck.AdditionalSchemaStrings = map[string]string{}
 
 	for kind, tmplString := range templateStrings {
-		tmpl := template.New(newCheck.ID)
+		tmpl := template.New(newCheck.ID).Funcs(template.FuncMap{
+			"hasPrefix": strings.HasPrefix,
+			"hasSuffix": strings.HasSuffix,
+		})
 		tmpl, err := tmpl.Parse(tmplString)
 		if err != nil {
 			return nil, err
@@ -240,13 +247,13 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
 	newCheck.AdditionalValidators = map[string]jsonschema.RootSchema{}
 	for kind, schemaStr := range newCheck.AdditionalSchemaStrings {
 		val := jsonschema.RootSchema{}
-		err := unmarshalYAMLOrJSON([]byte(schemaStr), &val)
+		err := UnmarshalYAMLOrJSON([]byte(schemaStr), &val)
 		if err != nil {
 			return nil, err
 		}
 		newCheck.AdditionalValidators[kind] = val
 	}
-	err := unmarshalYAMLOrJSON([]byte(newCheck.SchemaString), &newCheck.Validator)
+	err := UnmarshalYAMLOrJSON([]byte(newCheck.SchemaString), &newCheck.Validator)
 	if err != nil {
 		return nil, err
 	}
@@ -258,6 +265,11 @@ func (check SchemaCheck) CheckPodSpec(pod *corev1.PodSpec) (bool, []jsonschema.V
 	return check.CheckObject(pod)
 }
 
+// CheckPodTemplate checks a pod template against the schema
+func (check SchemaCheck) CheckPodTemplate(podTemplate interface{}) (bool, []jsonschema.ValError, error) {
+	return check.CheckObject(podTemplate)
+}
+
 // CheckController checks a controler's spec against the schema
 func (check SchemaCheck) CheckController(bytes []byte) (bool, []jsonschema.ValError, error) {
 	errs, err := check.Validator.ValidateBytes(bytes)
@@ -304,6 +316,11 @@ func (check SchemaCheck) CheckAdditionalObjects(groupkind string, objects []inte
 // IsActionable decides if this check applies to a particular target
 func (check SchemaCheck) IsActionable(target TargetKind, kind string, isInit bool) bool {
 	if funk.Contains(HandledTargets, target) {
+		if check.Target == TargetPodTemplate && target == TargetPodSpec {
+			// A target=PodSpec and check.Target=PodTemplate is expected
+			// because applyPodSchemaChecks() explicitly sets check.Target
+			return true
+		}
 		if check.Target != target {
 			return false
 		}

pkg/dashboard/dashboard.go

@@ -204,12 +204,14 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 
 	router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" && r.URL.Path != basePath {
+			logrus.Warningf("Path not found: %s", r.URL.Path)
 			http.NotFound(w, r)
 			return
 		}
 		adjustedConf := getConfigForQuery(c, r.URL.Query())
 
 		if auditData == nil {
+			logrus.Infof("Creating resource provider")
 			k, err := kube.CreateResourceProvider(r.Context(), auditPath, "", c)
 			if err != nil {
 				logrus.Errorf("Error fetching Kubernetes resources %v", err)
@@ -217,6 +219,7 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 				return
 			}
 
+			logrus.Infof("Running audit")
 			var auditData validator.AuditData
 			auditData, err = validator.RunAudit(adjustedConf, k)
 			if err != nil {
@@ -224,8 +227,10 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 				http.Error(w, "Error running audit", 500)
 				return
 			}
+			logrus.Infof("Sending results")
 			MainHandler(w, r, adjustedConf, auditData, basePath)
 		} else {
+			logrus.Infof("Sending results")
 			MainHandler(w, r, adjustedConf, *auditData, basePath)
 		}
 

pkg/dashboard/templates/navbar.gohtml

@@ -5,6 +5,7 @@
         <a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris" target="_blank">
           <img class="fw-logo" src="static/images/white_logo_fairwinds.svg" alt="Fairwinds" />
         </a>
+        <div style="color: white;"> Want more? Automate Polaris with <a href="https://www.fairwinds.com/insights-signup/polaris"><strong>Fairwinds Insights</strong></a></div>
         <div class="right-section p-0 d-flex justify-content-between">
           <a href="https://github.com/FairwindsOps" target="_blank">
             <img class="gh-logo" src="static/images/white_icon_github.svg" alt="Github" />

pkg/kube/resource.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 
 	"github.com/sirupsen/logrus"
+	"github.com/thoas/go-funk"
 	"gopkg.in/yaml.v3"
 	kubeAPICoreV1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -29,13 +30,18 @@ import (
 	"k8s.io/client-go/dynamic"
 )
 
+// There are often many ReplicaSets that are orphaned (default 10 per deployment) so we don't cache all of them
+var skipListCacheKinds = []string{"ReplicaSet", "Job"}
+
 // GenericResource is a base implementation with some free methods for inherited structs
 type GenericResource struct {
 	Kind               string
 	ObjectMeta         kubeAPIMetaV1.Object
 	Resource           unstructured.Unstructured
 	PodSpec            *kubeAPICoreV1.PodSpec
+	PodTemplate        interface{}
 	OriginalObjectJSON []byte
+	OriginalObjectYAML []byte
 }
 
 // NewGenericResourceFromUnstructured creates a workload from an unstructured.Unstructured
@@ -53,6 +59,10 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured, podSpecM
 		return workload, err
 	}
 	workload.ObjectMeta = objMeta
+	workload.PodTemplate, err = GetPodTemplate(unst.UnstructuredContent())
+	if err != nil {
+		return workload, err
+	}
 
 	b, err := json.Marshal(&unst)
 	if err != nil {
@@ -84,10 +94,15 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured, podSpecM
 
 // NewGenericResourceFromPod builds a new workload for a given Pod without looking at parents
 func NewGenericResourceFromPod(podResource kubeAPICoreV1.Pod, originalObject interface{}) (GenericResource, error) {
+	podMap, err := SerializePod(&podResource)
+	if err != nil {
+		return GenericResource{}, err
+	}
 	workload := GenericResource{
-		Kind:       "Pod",
-		PodSpec:    &podResource.Spec,
-		ObjectMeta: podResource.ObjectMeta.GetObjectMeta(),
+		Kind:        "Pod",
+		PodSpec:     &podResource.Spec,
+		PodTemplate: podMap,
+		ObjectMeta:  podResource.ObjectMeta.GetObjectMeta(),
 	}
 	if originalObject != nil {
 		bytes, err := json.Marshal(originalObject)
@@ -118,11 +133,13 @@ func NewGenericResourceFromBytes(contentBytes []byte) (GenericResource, error) {
 	if err != nil {
 		return GenericResource{}, err
 	}
-	return NewGenericResourceFromUnstructured(unst, nil)
+	res, err := NewGenericResourceFromUnstructured(unst, nil)
+	res.OriginalObjectYAML = contentBytes
+	return res, err
 }
 
 // ResolveControllerFromPod builds a new workload for a given Pod
-func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
+func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
 	workload, err := resolveControllerFromPod(ctx, podResource, dynamicClient, restMapper, objectCache)
 	if err != nil {
 		return workload, err
@@ -133,7 +150,7 @@ func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, err
 }
 
-func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
+func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
 	podWorkload, err := NewGenericResourceFromPod(podResource, nil)
 	if err != nil {
 		return podWorkload, err
@@ -157,7 +174,12 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 		lastKey = key
 		abstractObject, ok := objectCache[key]
 		if !ok {
-			err := cacheAllObjectsOfKind(ctx, firstOwner.APIVersion, firstOwner.Kind, dynamicClient, restMapper, objectCache)
+			var err error
+			if funk.Contains(skipListCacheKinds, firstOwner.Kind) {
+				err = cacheSingleObject(ctx, firstOwner.APIVersion, firstOwner.Kind, topMeta.GetNamespace(), firstOwner.Name, dynamicClient, restMapper, objectCache)
+			} else {
+				err = cacheAllObjectsOfKind(ctx, firstOwner.APIVersion, firstOwner.Kind, dynamicClient, restMapper, objectCache)
+			}
 			if err != nil {
 				logrus.Warnf("Error caching objects of Kind %s %v", firstOwner.Kind, err)
 				break
@@ -195,7 +217,21 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, nil
 }
 
-func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+func cacheSingleObject(ctx context.Context, apiVersion, kind, namespace, name string, dynamicClient dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+	logrus.Debugf("Caching a single %s", kind)
+	object, err := getObject(ctx, namespace, kind, apiVersion, name, dynamicClient, restMapper)
+	if err != nil {
+		logrus.Warnf("Error retrieving object %s/%s/%s/%s because of error: %v", kind, apiVersion, namespace, name, err)
+		return err
+	}
+	key := fmt.Sprintf("%s/%s/%s", object.GetKind(), object.GetNamespace(), object.GetName())
+	logrus.Debugf("Caching key %s", key)
+	objectCache[key] = *object
+	return nil
+}
+
+func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamicClient dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+	logrus.Debugf("Caching all %s", kind)
 	fqKind := schema.FromAPIVersionAndKind(apiVersion, kind)
 	mapping, err := (*restMapper).RESTMapping(fqKind.GroupKind(), fqKind.Version)
 	if err != nil {
@@ -203,25 +239,26 @@ func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamic
 		return err
 	}
 
-	objects, err := (*dynamicClient).Resource(mapping.Resource).Namespace("").List(ctx, kubeAPIMetaV1.ListOptions{})
+	objects, err := dynamicClient.Resource(mapping.Resource).Namespace("").List(ctx, kubeAPIMetaV1.ListOptions{})
 	if err != nil {
 		logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 		return err
 	}
 	for idx, object := range objects.Items {
 		key := fmt.Sprintf("%s/%s/%s", object.GetKind(), object.GetNamespace(), object.GetName())
+		logrus.Debugf("  caching key %s", key)
 		objectCache[key] = objects.Items[idx]
 	}
 	return nil
 }
 
-func getObject(ctx context.Context, namespace, kind, version, name string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper) (*unstructured.Unstructured, error) {
-	fqKind := schema.ParseGroupKind(kind)
-	mapping, err := (*restMapper).RESTMapping(fqKind, version)
+func getObject(ctx context.Context, namespace, kind, version, name string, dynamicClient dynamic.Interface, restMapper *meta.RESTMapper) (*unstructured.Unstructured, error) {
+	fqKind := schema.FromAPIVersionAndKind(version, kind)
+	mapping, err := (*restMapper).RESTMapping(fqKind.GroupKind(), fqKind.Version)
 	if err != nil {
 		return nil, err
 	}
-	object, err := (*dynamicClient).Resource(mapping.Resource).Namespace(namespace).Get(ctx, name, kubeAPIMetaV1.GetOptions{})
+	object, err := dynamicClient.Resource(mapping.Resource).Namespace(namespace).Get(ctx, name, kubeAPIMetaV1.GetOptions{})
 	return object, err
 }
 
@@ -237,3 +274,34 @@ func GetPodSpec(yaml map[string]interface{}) interface{} {
 	}
 	return nil
 }
+
+// GetPodTemplate looks inside arbitrary YAML for a Pod template, containing
+// fields `spec.containers`.
+// For example, it returns the `spec.template` level of a Kubernetes Deployment yaml.
+func GetPodTemplate(yaml map[string]interface{}) (podTemplate interface{}, err error) {
+	if yamlSpec, ok := yaml["spec"]; ok {
+		if yamlSpecMap, ok := yamlSpec.(map[string]interface{}); ok {
+			if _, ok := yamlSpecMap["containers"]; ok {
+				// This is a hack around unstructured.SetNestedField using DeepCopy which does
+				// not support the type int, and panics.
+				// Related: https://github.com/kubernetes/kubernetes/issues/62769
+				podTemplateJSON, err := json.Marshal(yaml)
+				if err != nil {
+					return nil, err
+				}
+				podTemplateMap := make(map[string]interface{})
+				err = json.Unmarshal(podTemplateJSON, &podTemplateMap)
+				if err != nil {
+					return nil, err
+				}
+				return podTemplateMap, nil
+			}
+		}
+	}
+	for _, podSpecField := range podSpecFields {
+		if childYaml, ok := yaml[podSpecField]; ok {
+			return GetPodTemplate(childYaml.(map[string]interface{}))
+		}
+	}
+	return nil, nil
+}

pkg/kube/resources.go

@@ -17,9 +17,9 @@ package kube
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -58,7 +58,12 @@ type resourceKindMap map[string][]GenericResource
 
 func (rkm resourceKindMap) addResource(r GenericResource) {
 	gvk := r.Resource.GroupVersionKind()
-	key := gvk.Group + "/" + gvk.Kind
+	var key string
+	if gvk.Group != "" {
+		key = gvk.Group + "/" + gvk.Kind
+	} else {
+		key = gvk.Kind
+	}
 	rkm[key] = append(rkm[key], r)
 }
 
@@ -177,7 +182,7 @@ func CreateResourceProviderFromResource(ctx context.Context, workload string) (*
 		return nil, err
 	}
 	restMapper := restmapper.NewDiscoveryRESTMapper(groupResources)
-	obj, err := getObject(ctx, namespace, kind, version, name, &dynamicInterface, &restMapper)
+	obj, err := getObject(ctx, namespace, kind, version, name, dynamicInterface, &restMapper)
 	if err != nil {
 		logrus.Errorf("Could not find workload %s: %v", workload, err)
 		return nil, err
@@ -210,7 +215,7 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 		if !strings.HasSuffix(path, ".yml") && !strings.HasSuffix(path, ".yaml") {
 			return nil
 		}
-		contents, err := ioutil.ReadFile(path)
+		contents, err := os.ReadFile(path)
 		if err != nil {
 			logrus.Errorf("Error reading file: %v", path)
 			return err
@@ -253,11 +258,11 @@ func CreateResourceProviderFromCluster(ctx context.Context, c conf.Configuration
 		logrus.Errorf("Error connecting to dynamic interface: %v", err)
 		return nil, err
 	}
-	return CreateResourceProviderFromAPI(ctx, api, kubeConf.Host, &dynamicInterface, c)
+	return CreateResourceProviderFromAPI(ctx, api, kubeConf.Host, dynamicInterface, c)
 }
 
 // CreateResourceProviderFromAPI creates a new ResourceProvider from an existing k8s interface
-func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interface, clusterName string, dynamic *dynamic.Interface, c conf.Configuration) (*ResourceProvider, error) {
+func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interface, clusterName string, dynamic dynamic.Interface, c conf.Configuration) (*ResourceProvider, error) {
 	listOpts := metav1.ListOptions{}
 	serverVersion, err := kube.Discovery().ServerVersion()
 	if err != nil {
@@ -272,12 +277,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	}
 	provider := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, sourceType, clusterName)
 
+	logrus.Info("Loading nodes")
 	nodes, err := kube.CoreV1().Nodes().List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Nodes: %v", err)
 		return nil, err
 	}
 
+	logrus.Info("Loading namespaces")
 	var namespaces *corev1.NamespaceList
 	if c.Namespace != "" {
 		ns, err := kube.CoreV1().Namespaces().Get(ctx, c.Namespace, metav1.GetOptions{})
@@ -295,12 +302,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
+	logrus.Info("Loading pods")
 	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Pods: %v", err)
 		return nil, err
 	}
 
+	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
 		logrus.Errorf("Error getting API Group resources: %v", err)
@@ -340,7 +349,8 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			return nil, err
 		}
 
-		objects, err := (*dynamic).Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
+		logrus.Info("Loading " + kind)
+		objects, err := dynamic.Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 			return nil, err
@@ -356,6 +366,7 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 
 	objectCache := map[string]unstructured.Unstructured{}
 
+	logrus.Info("Loading controllers")
 	controllers, err := LoadControllers(ctx, pods.Items, dynamic, &restMapper, objectCache)
 	if err != nil {
 		logrus.Errorf("Error loading controllers from pods: %v", err)
@@ -367,23 +378,25 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
 	provider.Resources.addResources(kubernetesResources)
+	logrus.Info("Done loading Kubernetes resources")
 	return &provider, nil
 }
 
 // LoadControllers loads a list of controllers from the kubeResources Pods
-func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClientPointer *dynamic.Interface, restMapperPointer *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
+func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClient dynamic.Interface, restMapperPointer *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
 	interfaces := []GenericResource{}
-	deduped := map[string]corev1.Pod{}
-	for _, pod := range pods {
+	deduped := map[string]*corev1.Pod{}
+	for idx, pod := range pods {
 		owners := pod.ObjectMeta.OwnerReferences
 		if len(owners) == 0 {
-			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = pod
+			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = &pods[idx]
 			continue
 		}
-		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = pod
+		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = &pods[idx]
 	}
-	for _, pod := range deduped {
-		workload, err := ResolveControllerFromPod(ctx, pod, dynamicClientPointer, restMapperPointer, objectCache)
+	for key, pod := range deduped {
+		logrus.Debugf("Resolving controller from pod %s", key)
+		workload, err := ResolveControllerFromPod(ctx, *pod, dynamicClient, restMapperPointer, objectCache)
 		if err != nil {
 			return nil, err
 		}
@@ -413,7 +426,7 @@ func deduplicateControllers(inputResources []GenericResource) []GenericResource
 }
 
 func (resources *ResourceProvider) addResourcesFromReader(reader io.Reader) error {
-	contents, err := ioutil.ReadAll(reader)
+	contents, err := io.ReadAll(reader)
 	if err != nil {
 		logrus.Errorf("Error reading from %v: %v", reader, err)
 		return err
@@ -465,6 +478,7 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 		if err != nil {
 			return err
 		}
+		workload.OriginalObjectYAML = contentBytes
 		resources.Resources.addResource(workload)
 	} else {
 		newResource, err := NewGenericResourceFromBytes(contentBytes)
@@ -475,3 +489,45 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 	}
 	return err
 }
+
+// SerializePodSpec converts a typed PodSpec into a map[string]interface{}
+func SerializePodSpec(pod *corev1.PodSpec) (map[string]interface{}, error) {
+	podJSON, err := json.Marshal(pod)
+	if err != nil {
+		return nil, err
+	}
+	podMap := make(map[string]interface{})
+	err = json.Unmarshal(podJSON, &podMap)
+	if err != nil {
+		return nil, err
+	}
+	return podMap, nil
+}
+
+// SerializePod converts a typed Pod into a map[string]interface{}
+func SerializePod(pod *corev1.Pod) (map[string]interface{}, error) {
+	podJSON, err := json.Marshal(pod)
+	if err != nil {
+		return nil, err
+	}
+	podMap := make(map[string]interface{})
+	err = json.Unmarshal(podJSON, &podMap)
+	if err != nil {
+		return nil, err
+	}
+	return podMap, nil
+}
+
+// SerializeContainer converts a typed Container into a map[string]interface{}
+func SerializeContainer(container *corev1.Container) (map[string]interface{}, error) {
+	containerJSON, err := json.Marshal(container)
+	if err != nil {
+		return nil, err
+	}
+	containerMap := make(map[string]interface{})
+	err = json.Unmarshal(containerJSON, &containerMap)
+	if err != nil {
+		return nil, err
+	}
+	return containerMap, nil
+}

pkg/kube/resources_test.go

@@ -17,7 +17,7 @@ package kube
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
+	"os"
 	"testing"
 	"time"
 
@@ -78,7 +78,7 @@ func TestGetMultipleResourceFromBadFile(t *testing.T) {
 }
 
 func TestAddResourcesFromReader(t *testing.T) {
-	contents, err := ioutil.ReadFile("./test_files/test_2/multi.yaml")
+	contents, err := os.ReadFile("./test_files/test_2/multi.yaml")
 	assert.NoError(t, err)
 	reader := bytes.NewBuffer(contents)
 	resources := newResourceProvider("unknown", "Path", "-")
@@ -146,7 +146,7 @@ func TestGetResourceFromAPI(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, tt.clusterName, &dynamicInterface, tt.config)
+			resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, tt.clusterName, dynamicInterface, tt.config)
 
 			if tt.wantErr {
 				assert.Error(t, err)

pkg/mutation/mutate.go

@@ -1,118 +1,435 @@
 package mutation
 
 import (
-	"bufio"
-	"encoding/json"
+	"bytes"
 	"fmt"
+	"regexp"
+	"strconv"
 	"strings"
 
-	jsonpatchV5 "github.com/evanphx/json-patch/v5"
+	"github.com/sirupsen/logrus"
+	yaml "gopkg.in/yaml.v3"
+
 	"github.com/fairwindsops/polaris/pkg/config"
-	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
-	"github.com/thoas/go-funk"
-	"gomodules.xyz/jsonpatch/v2"
+	"github.com/pkg/errors"
 )
 
-// ApplyAllSchemaMutations applies available mutation to a single resource
-func ApplyAllSchemaMutations(conf *config.Configuration, resourceProvider *kube.ResourceProvider, resource kube.GenericResource, mutations []jsonpatch.Operation) (kube.GenericResource, error) {
-	resByte := resource.OriginalObjectJSON
-	var jsonByte []byte
-	mutationByte, err := json.Marshal(mutations)
+const (
+	strTag  = "!!str"
+	seqTag  = "!!seq"
+	mapTag  = "!!map"
+	intTag  = "!!int"
+	boolTag = "!!bool"
+)
+
+// ApplyAllMutations applies available mutation to a single resource
+func ApplyAllMutations(manifest string, mutations []config.Mutation) (string, error) {
+	var mutated string
+	var doc yaml.Node
+	err := yaml.Unmarshal([]byte(manifest), &doc)
 	if err != nil {
-		return resource, err
+		return mutated, err
 	}
 
-	patch, err := jsonpatchV5.DecodePatch(mutationByte)
-	if err != nil {
-		return resource, err
-	}
-	jsonByte, err = patch.ApplyWithOptions(resByte, &jsonpatchV5.ApplyOptions{
-		AllowMissingPathOnRemove: true,
-		EnsurePathExistsOnAdd: true,
-	})
-	if err != nil {
-		return resource, err
-	}
-	mutated, err := kube.NewGenericResourceFromBytes(jsonByte)
-	if err != nil {
-		return resource, err
+	for _, patch := range mutations {
+		splits := getSplitFromPath(patch.Path)
+		valueNode, err := getNodeFromValue(patch.Value, patch.Comment)
+		if err != nil {
+			return mutated, err
+		}
+		switch patch.Op {
+		case "add", "replace":
+			err = addOrReplaceValue(&doc, splits, valueNode)
+			if err != nil {
+				return mutated, err
+			}
+		case "remove":
+			// ignore error if the value specified does not exists
+			_ = removeNodes(&doc, splits)
+		}
 	}
 
-	return mutated, nil
+	buf := bytes.Buffer{}
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	err = enc.Encode(&doc)
+	if err != nil {
+		return mutated, err
+	}
+	err = enc.Close()
+	if err != nil {
+		return mutated, err
+	}
+
+	return buf.String(), nil
 }
 
-// GetMutationsAndCommentsFromResults returns all mutations from results
-func GetMutationsAndCommentsFromResults(results []validator.Result) ([]config.MutationComment, map[string][]jsonpatch.Operation) {
-	allMutationsFromResults := make(map[string][]jsonpatch.Operation)
-	comments := []config.MutationComment{}
+// GetMutationsFromResults returns all mutations from results
+func GetMutationsFromResults(results []validator.Result) map[string][]config.Mutation {
+	allMutationsFromResults := make(map[string][]config.Mutation)
 	for _, result := range results {
 		key := fmt.Sprintf("%s/%s/%s", result.Kind, result.Name, result.Namespace)
-
-		mutations, resultsComments := GetMutationsAndCommentsFromResult(&result)
+		mutations := GetMutationsFromResult(&result)
 		allMutationsFromResults[key] = mutations
-		comments = append(comments, resultsComments...)
-
 	}
-	return comments, allMutationsFromResults
+	return allMutationsFromResults
 }
 
-// GetMutationsAndCommentsFromResult returns all mutations from single result
-func GetMutationsAndCommentsFromResult(result *validator.Result) ([]jsonpatch.Operation, []config.MutationComment) {
-	mutations := []jsonpatch.Operation{}
-	comments := []config.MutationComment{}
+// GetMutationsFromResult returns all mutations from single result
+func GetMutationsFromResult(result *validator.Result) []config.Mutation {
+	mutations := []config.Mutation{}
 	for _, resultMessage := range result.Results {
 		if len(resultMessage.Mutations) > 0 {
 			mutations = append(mutations, resultMessage.Mutations...)
 		}
-		if len(resultMessage.Comments) > 0 {
-			comments = append(comments, resultMessage.Comments...)
-		}
 	}
 
-	for _, resultMessage := range result.PodResult.Results {
-		if len(resultMessage.Mutations) > 0 {
-			mutations = append(mutations, resultMessage.Mutations...)
-		}
-		if len(resultMessage.Comments) > 0 {
-			comments = append(comments, resultMessage.Comments...)
-		}
-	}
-
-	for _, containerResult := range result.PodResult.ContainerResults {
-		for _, resultMessage := range containerResult.Results {
+	if result.PodResult != nil {
+		for _, resultMessage := range result.PodResult.Results {
 			if len(resultMessage.Mutations) > 0 {
 				mutations = append(mutations, resultMessage.Mutations...)
 			}
-			if len(resultMessage.Comments) > 0 {
-				comments = append(comments, resultMessage.Comments...)
+		}
+
+		for _, containerResult := range result.PodResult.ContainerResults {
+			for _, resultMessage := range containerResult.Results {
+				if len(resultMessage.Mutations) > 0 {
+					mutations = append(mutations, resultMessage.Mutations...)
+				}
 			}
 		}
 	}
 
-	return mutations, comments
+	return mutations
 }
 
-// UpdateMutatedContentWithComments Updates mutated object with comments
-func UpdateMutatedContentWithComments(yamlContent string, comments []config.MutationComment) string {
-	var lines []string
-	scanner := bufio.NewScanner(strings.NewReader(yamlContent))
-	scanner.Split(bufio.ScanLines)
-	for scanner.Scan() {
-		line := scanner.Text()
-		lines = append(lines, line)
-	}
-	commentMap := funk.Map(comments, func(c config.MutationComment) (string, string) {
-		return c.Find, c.Comment
-	}).(map[string]string)
-	fileContent := ""
-	for _, line := range lines {
-		comment, ok := commentMap[strings.TrimSpace(line)]
-		if ok {
-			line += (" #" + comment)
+func createPathAndFindNodes(node *yaml.Node, selectors []string, create bool) ([]*yaml.Node, error) {
+	var nodes []*yaml.Node
+	currentSelector := selectors[0]
+	isLastSelector := len(selectors) == 1
+	// array[N] or array[*] selectors.
+	if i := strings.LastIndex(currentSelector, "["); i > 0 && strings.HasSuffix(currentSelector, "]") {
+		arrayIndex := currentSelector[i+1 : len(currentSelector)-1]
+		currentSelector = currentSelector[:i]
+		if checkIfNodeExistedInContent(node.Content, currentSelector) || !create {
+			return findArrayNodes(selectors, currentSelector, node, nodes, arrayIndex, create)
+		}
+		index, err := strconv.Atoi(arrayIndex)
+		if err != nil {
+			if arrayIndex != "-" {
+				return nil, errors.Wrapf(err, "can't parse array index from %v/%v/", currentSelector, arrayIndex)
+			}
+			// if index provided is greater than or less than 0 for an empty array should throw an exception
+		} else if index != 0 {
+			return nil, errors.Errorf("array index (%s) does not exists because array (%s) does not exists", arrayIndex, currentSelector)
+		}
+		// default to zero since no node is present.
+		selectorsToCreateNodes := []string{currentSelector, "0"}
+		if len(selectors) > 1 {
+			selectorsToCreateNodes = append(selectorsToCreateNodes, selectors[1:]...)
+			return createNonExistingPath(selectorsToCreateNodes, node), nil
 		}
-		fileContent += line
-		fileContent += "\n"
 	}
-	return fileContent
+	if currentSelector == "-" {
+		if isLastSelector {
+			return []*yaml.Node{node}, nil
+		}
+		_, err := createPathAndFindNodes(node, selectors[1:], create)
+		if err != nil {
+			return nil, err
+		}
+	}
+	switch node.Kind {
+	case yaml.MappingNode:
+		for i := 0; i < len(node.Content); i += 2 {
+			// Does the current key match the selector?
+			if node.Content[i].Value == currentSelector {
+				// Found last key, return its value.
+				if !isLastSelector {
+					// Match the rest of the selector path, ie. go deeper
+					// in to the value node.
+					return createPathAndFindNodes(node.Content[i+1], selectors[1:], create)
+				}
+				return []*yaml.Node{node.Content[i+1]}, nil
+			}
+		}
+	case yaml.ScalarNode:
+		// Overwrite any existing nodes.
+		node.Kind = yaml.MappingNode
+		node.Tag = mapTag
+		node.Value = ""
+	case yaml.SequenceNode:
+		return nil, errors.Errorf("parent node is array, use /*/ or /0/../%v/ instead of .%v to access its item(s) first", len(node.Content)-1, currentSelector)
+
+	default:
+		return nil, errors.Errorf("parent node is of unknown kind %v", node.Kind)
+	}
+	if !create {
+		return nil, errors.Errorf("failed to match %s", strings.Join(selectors, "/"))
+	}
+
+	return createNonExistingPath(selectors, node), nil
+}
+
+func addOrReplaceValue(node *yaml.Node, splits []string, value *yaml.Node) error {
+	if len(node.Content) == 0 {
+		return errors.New("No content in node")
+	}
+	nodes, err := createPathAndFindNodes(node.Content[0], splits, true)
+	if err != nil {
+		return err
+	}
+	for _, node := range nodes {
+		if node.Kind == yaml.ScalarNode {
+			// Overwrite an existing scalar value with a new value (whatever kind).
+			*node = *value
+		} else if node.Kind == yaml.MappingNode && value.Kind == yaml.MappingNode {
+			// Append new values onto an existing map node.
+			if len(value.Content) < 2 {
+				logrus.Error("Found a mapping node without enough content")
+				continue
+			}
+			mapKey := value.Content[0].Value
+			found := false
+			for idx, subNode := range node.Content {
+				if idx%2 != 0 {
+					continue
+				}
+				if subNode.Value == mapKey {
+					found = true
+					node.Content[idx+1] = value.Content[1]
+				}
+			}
+			if !found {
+				node.Content = append(value.Content, node.Content...)
+			}
+		} else if node.Kind == yaml.MappingNode && node.Content == nil {
+			// Overwrite a new map node we created in createPathAndFindNodes(), as confirmed
+			// by the nil check (the node.Content wouldn't be nil otherwise).
+			*node = *value
+		} else if node.Kind == yaml.SequenceNode && value.Kind == yaml.SequenceNode {
+			// Append new values onto an existing array node.
+			node.Content = append(node.Content, value.Content...)
+		} else if node.Kind == yaml.SequenceNode && value.Kind == yaml.ScalarNode {
+			// Append new value onto an existing array node.
+			node.Content = append(node.Content, value)
+		} else {
+			return errors.Errorf("can't overwrite %v value (line: %v, column: %v) with %v value", node.Tag, node.Line, node.Column, value.Tag)
+		}
+	}
+
+	return nil
+}
+
+func getNodeFromValue(value interface{}, comment string) (*yaml.Node, error) {
+	bytes, err := yaml.Marshal(value)
+	if err != nil {
+		return nil, err
+	}
+	var doc yaml.Node
+	err = yaml.Unmarshal(bytes, &doc)
+	if err != nil {
+		return nil, err
+	}
+	if len(doc.Content) == 0 {
+		return nil, errors.New("Generated an empty YAML document")
+	}
+	if doc.Content[0].Kind == yaml.MappingNode {
+		doc.Content[0].Content[0].HeadComment = comment
+	} else {
+		doc.Content[0].LineComment = comment
+	}
+	return doc.Content[0], nil
+}
+
+func removeNodes(doc *yaml.Node, selectors []string) error {
+	err := removeMatchingNode(doc.Content[0], selectors)
+	if err != nil {
+		return errors.Wrapf(err, "failed to match %q", strings.Join(selectors, "/"))
+	}
+
+	return nil
+}
+
+func removeMatchingNode(node *yaml.Node, selectors []string) error {
+	currentSelector := selectors[0]
+	lastSelector := len(selectors) == 1
+	if i := strings.LastIndex(currentSelector, "["); i > 0 && strings.HasSuffix(currentSelector, "]") {
+		arrayIndex := currentSelector[i+1 : len(currentSelector)-1]
+		currentSelector = currentSelector[:i]
+
+		index, err := strconv.Atoi(arrayIndex)
+		if err != nil {
+			if arrayIndex == "*" {
+				index = -1
+			} else {
+				return errors.Wrapf(err, "can't parse array index from %v/%v/", currentSelector, arrayIndex)
+			}
+		} else if index < 0 {
+			return errors.Wrapf(err, "array index can't be negative %v/%v/", currentSelector, arrayIndex)
+		}
+		// Go into array node(s).
+		arrayNodes, err := createPathAndFindNodes(node, []string{currentSelector}, false)
+		if err != nil {
+			return errors.Errorf("can't find %v", currentSelector)
+		}
+		for _, arrayNode := range arrayNodes {
+			if arrayNode.Kind != yaml.SequenceNode {
+				return errors.Errorf("%v is not an array", currentSelector)
+			}
+			if index >= len(arrayNode.Content) {
+				return errors.Errorf("%v array doesn't have index %v", currentSelector, index)
+			}
+
+			var visitArrayNodes []*yaml.Node
+			if index >= 0 { // array[N]
+				visitArrayNodes = []*yaml.Node{arrayNode.Content[index]}
+			} else { // array[*]
+				visitArrayNodes = arrayNode.Content
+			}
+			for _, node := range visitArrayNodes {
+				lastSelector := len(selectors) == 1
+				if !lastSelector {
+					removeMatchingNode(node, selectors[1:])
+				}
+			}
+		}
+	}
+
+	// Iterate over the keys (the slice is key/value pairs).
+	for i := 0; i < len(node.Content); i += 2 {
+		if node.Content[i].Value == currentSelector {
+			// Key matches the selector.
+			if !lastSelector {
+				// Try to match the rest of the selector path in the value.
+				return removeMatchingNode(node.Content[i+1], selectors[1:])
+			}
+
+			node.Content[i] = nil   // Delete key.
+			node.Content[i+1] = nil // Delete value.
+			node.Content = append(node.Content[:i], node.Content[i+2:]...)
+			return nil
+		}
+	}
+
+	return errors.Errorf("can't find %q", strings.Join(selectors, "."))
+}
+
+func getSplitFromPath(path string) []string {
+	var digitStarCheck = regexp.MustCompile(`^[0-9*]+$`)
+	splits := strings.Split(path, "/")
+	var formatedSplit []string
+	for _, key := range splits {
+		if key == "" {
+			continue
+		}
+		if digitStarCheck.MatchString(key) {
+			lastElementIdx := len(formatedSplit) - 1
+			lastElement := formatedSplit[lastElementIdx]
+			lastElement = fmt.Sprintf("%s[%s]", lastElement, key)
+			formatedSplit[lastElementIdx] = lastElement
+			continue
+		}
+		formatedSplit = append(formatedSplit, key)
+	}
+	return formatedSplit
+}
+
+func findArrayNodes(selectors []string, currentSelector string, node *yaml.Node, nodes []*yaml.Node, arrayIndex string, create bool) ([]*yaml.Node, error) {
+
+	index, err := strconv.Atoi(arrayIndex)
+	if err != nil {
+		if arrayIndex == "*" {
+			index = -1
+		} else {
+			return nil, errors.Wrapf(err, "can't parse array index from %v/%v/", currentSelector, arrayIndex)
+		}
+	} else if index < 0 {
+		return nil, errors.Wrapf(err, "array index can't be negative %v/%v/", currentSelector, arrayIndex)
+	}
+	// Go into array node(s).
+	arrayNodes, err := createPathAndFindNodes(node, []string{currentSelector}, create)
+	if err != nil {
+		return nil, errors.Errorf("can't find %v", currentSelector)
+	}
+	for _, arrayNode := range arrayNodes {
+		if arrayNode.Kind != yaml.SequenceNode {
+			return nil, errors.Errorf("%v is not an array", currentSelector)
+		}
+		if index >= len(arrayNode.Content) {
+			return nil, errors.Errorf("%v array doesn't have index %v", currentSelector, index)
+		}
+
+		var visitArrayNodes []*yaml.Node
+		if index >= 0 { // array[N]
+			visitArrayNodes = []*yaml.Node{arrayNode.Content[index]}
+		} else { // array[*]
+			visitArrayNodes = arrayNode.Content
+		}
+
+		for i, node := range visitArrayNodes {
+			if len(selectors) == 1 {
+				// Last selector, use this as final node.
+				nodes = append(nodes, node)
+			} else {
+				// Go deeper into a specific array.
+				deeperNodes, err := createPathAndFindNodes(node, selectors[1:], create)
+				if err != nil {
+					return nil, errors.Wrapf(err, "failed to go deeper into %v/%v/", currentSelector, i)
+				}
+				nodes = append(nodes, deeperNodes...)
+			}
+		}
+	}
+	return nodes, nil
+}
+
+func checkIfNodeExistedInContent(nodes []*yaml.Node, currentSelector string) bool {
+	for i := 0; i < len(nodes); i += 2 {
+		// Does the current key match the selector?
+		if nodes[i].Value == currentSelector {
+			return true
+		}
+	}
+
+	return false
+}
+
+func createNonExistingPath(selectors []string, node *yaml.Node) []*yaml.Node {
+	var digitDashCheck = regexp.MustCompile(`^[0-9-]+$`)
+	// Create the rest of the selector path.
+	for idx, selector := range selectors {
+		if digitDashCheck.MatchString(selector) {
+			continue
+		}
+		kind, tag := yaml.MappingNode, mapTag
+		// if the next selector is "-" then current selector is sequence/slice/array
+		if idx < len(selectors)-1 && digitDashCheck.MatchString(selectors[idx+1]) {
+			kind, tag = yaml.SequenceNode, seqTag
+		}
+		var newNode = yaml.Node{
+			Content: []*yaml.Node{
+				{
+					Kind:  yaml.ScalarNode,
+					Tag:   strTag,
+					Value: selector,
+				},
+				{
+					Kind: kind,
+					Tag:  tag,
+				},
+			},
+		}
+		// if previous node is array/sequenceNode append a node rather than appending contents
+		if node.Kind == yaml.SequenceNode {
+			newNode.Kind = kind
+			node.Content = append(node.Content, &newNode)
+		} else {
+			node.Content = append(node.Content, newNode.Content...)
+		}
+		node = newNode.Content[len(newNode.Content)-1]
+	}
+	return []*yaml.Node{node}
+
 }

pkg/mutation/mutate_test.go

@@ -0,0 +1,157 @@
+package mutation
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/fairwindsops/polaris/pkg/config"
+)
+
+var oldYaml = `
+pets:
+  - name: fido
+    owners:
+      - name: Alice
+      - name: Bob
+        aliases:
+        - Robert
+  - name: scooby
+`
+
+var testCases = []struct {
+	original string
+	mutated  string
+	patch    config.Mutation
+	message  string
+}{{
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "Denver",
+		Path:  "/pets/0/owners/*/location",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+        location: Denver
+      - name: Bob
+        aliases:
+          - Robert
+        location: Denver
+  - name: scooby
+`,
+}, {
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:   "remove",
+		Path: "/pets/0/owners/*/aliases",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+      - name: Bob
+  - name: scooby
+`,
+}, {
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "rob",
+		Path:  "/pets/0/owners/*/aliases/-",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+        aliases:
+          - rob
+      - name: Bob
+        aliases:
+          - Robert
+          - rob
+  - name: scooby
+`,
+}, {
+	original: `
+pets:
+  - name: fido
+`,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "Alice",
+		Path:  "/pets/0/owners/0/name",
+	},
+	mutated: `pets:
+  - name: fido
+    owners:
+      - name: Alice
+`,
+}, {
+	original: `
+obj:
+  foo:
+    bar:
+      - a
+      - b
+  baz: quux
+`,
+	patch: config.Mutation{
+		Op: "replace",
+		Value: map[string]interface{}{
+			"bar": []string{"c", "d"},
+		},
+		Path: "/obj/foo",
+	},
+	mutated: `obj:
+  foo:
+    bar:
+      - c
+      - d
+  baz: quux
+`,
+}, {
+	original: `
+foo: bar
+`,
+	patch: config.Mutation{
+		Op:      "replace",
+		Value:   "baz",
+		Path:    "/foo",
+		Comment: "# We set this to baz",
+	},
+	mutated: `
+foo: baz # We set this to baz
+`,
+	message: "Expected a comment to appear",
+}, {
+	original: `
+foo: bar
+`,
+	patch: config.Mutation{
+		Op: "add",
+		Value: map[string]interface{}{
+			"baz": "quux",
+		},
+		Path:    "/extra",
+		Comment: "# These are extra things",
+	},
+	mutated: `
+foo: bar
+extra:
+  # These are extra things
+  baz: quux
+`,
+	message: "Expected a comment to appear next to an object",
+}}
+
+func TestApplyAllMutations(t *testing.T) {
+	for _, tc := range testCases {
+		mutated, err := ApplyAllMutations(tc.original, []config.Mutation{tc.patch})
+		assert.NoError(t, err)
+		assert.EqualValues(t, strings.TrimSpace(tc.mutated), strings.TrimSpace(mutated), tc.message)
+	}
+}

pkg/validator/controller_test.go

@@ -109,7 +109,7 @@ func TestControllerLevelChecks(t *testing.T) {
 	two := int32(2)
 	d2.Spec.Replicas = &two
 	k8s, dynamicClient := test.SetupTestAPI(&d1, &p1, &d2, &p2)
-	res, err = kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", &dynamicClient, conf.Configuration{})
+	res, err = kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", dynamicClient, conf.Configuration{})
 	assert.Equal(t, err, nil, "error should be nil")
 	assert.Equal(t, 2, res.Resources.GetLength(), "Should have two controllers")
 	testResources(res)

pkg/validator/fullaudit.go

@@ -18,7 +18,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"time"
 
@@ -62,7 +61,7 @@ func RunAudit(config conf.Configuration, kubeResources *kube.ResourceProvider) (
 // ReadAuditFromFile reads the data from a past audit stored in a JSON or YAML file.
 func ReadAuditFromFile(fileName string) AuditData {
 	auditData := AuditData{}
-	oldFileBytes, err := ioutil.ReadFile(fileName)
+	oldFileBytes, err := os.ReadFile(fileName)
 	if err != nil {
 		logrus.Errorf("Unable to read contents of loaded file: %v", err)
 		os.Exit(1)

pkg/validator/fullaudit_test.go

@@ -33,7 +33,7 @@ func TestGetTemplateData(t *testing.T) {
 	}
 
 	k8s, dynamicClient := test.SetupTestAPI(test.GetMockControllers("test")...)
-	resources, err := kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", &dynamicClient, c)
+	resources, err := kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", dynamicClient, c)
 	assert.Equal(t, err, nil, "error should be nil")
 	assert.Equal(t, 5, len(resources.Resources))
 

pkg/validator/output.go

@@ -16,11 +16,11 @@ package validator
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/fatih/color"
 	"github.com/thoas/go-funk"
-	"gomodules.xyz/jsonpatch/v2"
 
 	"github.com/fairwindsops/polaris/pkg/config"
 )
@@ -53,12 +53,21 @@ type AuditData struct {
 	Score                uint
 }
 
-// RemoveSuccessfulResults remove all test that have passed.
+// RemoveSuccessfulResults removes all tests that have passed
 func (res AuditData) RemoveSuccessfulResults() AuditData {
 	resCopy := res
-	resCopy.Results = funk.Map(res.Results, func(auditDataResult Result) Result {
+	resCopy.Results = []Result{}
+
+	filteredResults := funk.Map(res.Results, func(auditDataResult Result) Result {
 		return auditDataResult.removeSuccessfulResults()
 	}).([]Result)
+
+	for _, result := range filteredResults {
+		if result.isNotEmpty() {
+			resCopy.Results = append(resCopy.Results, result)
+		}
+	}
+
 	return resCopy
 }
 
@@ -79,13 +88,16 @@ type ResultMessage struct {
 	Success   bool
 	Severity  config.Severity
 	Category  string
-	Mutations []jsonpatch.Operation
-	Comments  []config.MutationComment
+	Mutations []config.Mutation
 }
 
 // ResultSet contiains the results for a set of checks
 type ResultSet map[string]ResultMessage
 
+func (res ResultSet) isNotEmpty() bool {
+	return len(res) > 0
+}
+
 func (res ResultSet) removeSuccessfulResults() ResultSet {
 	newResults := ResultSet{}
 	for k, resultMessage := range res {
@@ -116,6 +128,13 @@ func (res Result) removeSuccessfulResults() Result {
 	return resCopy
 }
 
+func (res Result) isNotEmpty() bool {
+	if res.PodResult != nil {
+		return res.PodResult.isNotEmpty()
+	}
+	return res.Results.isNotEmpty()
+}
+
 // PodResult provides a list of validation messages for each pod.
 type PodResult struct {
 	Name             string
@@ -132,6 +151,15 @@ func (res PodResult) removeSuccessfulResults() PodResult {
 	return resCopy
 }
 
+func (res PodResult) isNotEmpty() bool {
+	for _, cr := range res.ContainerResults {
+		if cr.isNotEmpty() {
+			return true
+		}
+	}
+	return res.Results.isNotEmpty()
+}
+
 // ContainerResult provides a list of validation messages for each container.
 type ContainerResult struct {
 	Name    string
@@ -144,6 +172,10 @@ func (res ContainerResult) removeSuccessfulResults() ContainerResult {
 	return resCopy
 }
 
+func (res ContainerResult) isNotEmpty() bool {
+	return res.Results.isNotEmpty()
+}
+
 func fillString(id string, l int) string {
 	for len(id) < l {
 		id += " "
@@ -154,7 +186,7 @@ func fillString(id string, l int) string {
 // GetPrettyOutput returns a human-readable string
 func (res AuditData) GetPrettyOutput(useColor bool) string {
 	color.NoColor = !useColor
-	str := titleColor.Sprint(fmt.Sprintf("\n\nPolaris audited %s %s at %s\n", res.SourceType, res.SourceName, res.AuditTime))
+	str := titleColor.Sprint(fmt.Sprintf("Polaris audited %s %s at %s\n", res.SourceType, res.SourceName, res.AuditTime))
 	str += color.CyanString(fmt.Sprintf("    Nodes: %d | Namespaces: %d | Controllers: %d\n", res.ClusterInfo.Nodes, res.ClusterInfo.Namespaces, res.ClusterInfo.Controllers))
 	str += color.GreenString(fmt.Sprintf("    Final score: %d\n", res.Score))
 	str += "\n"
@@ -183,7 +215,7 @@ func (res Result) GetPrettyOutput() string {
 func (res PodResult) GetPrettyOutput() string {
 	str := res.Results.GetPrettyOutput()
 	for _, cont := range res.ContainerResults {
-		str += cont.GetPrettyOutput() + "\n"
+		str += cont.GetPrettyOutput()
 	}
 	return str
 }
@@ -211,7 +243,7 @@ func (res ResultSet) GetPrettyOutput() string {
 			}
 		}
 		if color.NoColor {
-			status = status[2:] // remove emoji
+			status = strings.Fields(status)[1] // remove emoji
 		}
 		str += fmt.Sprintf("%s%s %s\n", indent, checkColor.Sprint(fillString(msg.ID, minIDLength-len(indent))), status)
 		str += fmt.Sprintf("%s    %s - %s\n", indent, msg.Category, msg.Message)

pkg/validator/polaris_template_variable_test.go

@@ -0,0 +1,50 @@
+// Copyright 2019 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package validator
+
+import (
+	"testing"
+
+	conf "github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/test"
+	"github.com/stretchr/testify/require"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestGetTemplateInputReturnsPolarisSubKeys(t *testing.T) {
+	pod := test.MockPod() // Includes a container, required by GetPodSpec
+	pod.Spec.NodeName = "testNodeName"
+	pod.ObjectMeta.Name = "testpod"
+	genRes, err := kube.NewGenericResourceFromPod(pod, pod)
+	require.NoError(t, err, "creating new generic resource from a pod")
+	schemaTest := schemaTestCase{
+		Target:   conf.TargetPodSpec, // ends up being set in the case of target: PodTemplate
+		Resource: genRes,
+	}
+
+	templateInput, err := getTemplateInput(schemaTest)
+	require.NoError(t, err, "getting template input from a generic resource")
+	require.NotNil(t, templateInput)
+	nodeName, ok, err := unstructured.NestedString(templateInput, "Polaris", "PodSpec", "nodeName")
+	require.NoError(t, err, "getting Polaris.PodSpec.nodeName from template input")
+	require.True(t, ok, "getting Polaris.PodSpec.nodeName from template input")
+	require.Equal(t, "testNodeName", nodeName, "the nodeName from template output")
+	podName, ok, err := unstructured.NestedString(templateInput, "Polaris", "PodTemplate", "metadata", "name")
+	require.NoError(t, err, "getting Polaris.PodTemplate.metadata.name from template input")
+	require.True(t, ok, "getting Polaris.PodTemplate.metadata.name from template input")
+	require.Equal(t, "testpod", podName, "the pod from template input")
+}

pkg/validator/schema.go

@@ -24,9 +24,9 @@ import (
 	"github.com/qri-io/jsonschema"
 	"github.com/sirupsen/logrus"
 	"github.com/thoas/go-funk"
-	"gomodules.xyz/jsonpatch/v2"
 	corev1 "k8s.io/api/core/v1"
 	metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
 	"github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
@@ -40,6 +40,25 @@ type schemaTestCase struct {
 	ResourceProvider *kube.ResourceProvider
 }
 
+// ShortString supplies some fields of a schemaTestCase suitable for brief
+// output.
+func (s schemaTestCase) ShortString() string {
+	var msg strings.Builder
+	targetStr := s.Target
+	if targetStr != "" {
+		msg.WriteString(fmt.Sprintf("target=%s, ", targetStr))
+	}
+	ns := s.Resource.ObjectMeta.GetNamespace()
+	if ns != "" {
+		msg.WriteString(fmt.Sprintf("namespace=%s, ", ns))
+	}
+	msg.WriteString(fmt.Sprintf("resource=%s/%s", s.Resource.Kind, s.Resource.ObjectMeta.GetName()))
+	if s.Target == config.TargetContainer {
+		msg.WriteString(fmt.Sprintf(", container=%s", s.Container.Name))
+	}
+	return msg.String()
+}
+
 func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCase) (*config.SchemaCheck, error) {
 	if !conf.DisallowExemptions &&
 		!conf.DisallowAnnotationExemptions &&
@@ -64,13 +83,56 @@ func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCas
 	if !check.IsActionable(test.Target, test.Resource.Kind, test.IsInitContianer) {
 		return nil, nil
 	}
-	checkPtr, err := check.TemplateForResource(test.Resource.Resource.Object)
+	templateInput, err := getTemplateInput(test)
+	if err != nil {
+		return nil, err
+	}
+	checkPtr, err := check.TemplateForResource(templateInput)
 	if err != nil {
 		return nil, err
 	}
 	return checkPtr, nil
 }
 
+// getTemplateInput augments a schemaTestCase.Resource.Resource.Object with
+// Polaris built-in variables. The result can be used as input for
+// CheckSchema.TemplateForResource().
+func getTemplateInput(test schemaTestCase) (map[string]interface{}, error) {
+	templateInput := test.Resource.Resource.Object
+	if templateInput == nil {
+		return nil, nil
+	}
+	if test.Target == config.TargetPodSpec || test.Target == config.TargetContainer {
+		podSpecMap, err := kube.SerializePodSpec(test.Resource.PodSpec)
+		if err != nil {
+			return nil, err
+		}
+		err = unstructured.SetNestedMap(templateInput, podSpecMap, "Polaris", "PodSpec")
+		if err != nil {
+			return nil, err
+		}
+		podTemplateMap, ok := test.Resource.PodTemplate.(map[string]interface{})
+		if ok {
+			err := unstructured.SetNestedMap(templateInput, podTemplateMap, "Polaris", "PodTemplate")
+			if err != nil {
+				return nil, err
+			}
+		}
+		if test.Target == config.TargetContainer {
+			containerMap, err := kube.SerializeContainer(test.Container)
+			if err != nil {
+				return nil, err
+			}
+			err = unstructured.SetNestedMap(templateInput, containerMap, "Polaris", "Container")
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	logrus.Debugf("the go template input for schema test-case %s is: %v", test.ShortString(), templateInput)
+	return templateInput, nil
+}
+
 func makeResult(conf *config.Configuration, check *config.SchemaCheck, passes bool, issues []jsonschema.ValError) ResultMessage {
 	details := []string{}
 	for _, issue := range issues {
@@ -112,6 +174,9 @@ func hasExemptionAnnotation(objMeta metaV1.Object, checkID string) bool {
 // ApplyAllSchemaChecksToResourceProvider applies all available checks to a ResourceProvider
 func ApplyAllSchemaChecksToResourceProvider(conf *config.Configuration, resourceProvider *kube.ResourceProvider) ([]Result, error) {
 	results := []Result{}
+	if resourceProvider == nil {
+		return nil, errors.New("No resource provider set, cannot apply schema checks")
+	}
 	for _, resources := range resourceProvider.Resources {
 		kindResults, err := ApplyAllSchemaChecksToAllResources(conf, resourceProvider, resources)
 		if err != nil {
@@ -130,7 +195,9 @@ func ApplyAllSchemaChecksToAllResources(conf *config.Configuration, resourceProv
 		if err != nil {
 			return results, err
 		}
-		results = append(results, result)
+		if result.Kind != "" && result.Name != "" {
+			results = append(results, result)
+		}
 	}
 	return results, nil
 }
@@ -288,6 +355,9 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	} else if check.Target == config.TargetPodSpec {
 		passes, issues, err = check.CheckPodSpec(test.Resource.PodSpec)
 		prefix = getJSONSchemaPrefix(test.Resource.Kind)
+	} else if check.Target == config.TargetPodTemplate {
+		passes, issues, err = check.CheckPodTemplate(test.Resource.PodTemplate)
+		prefix = getJSONSchemaPrefix(test.Resource.Kind)
 	} else if check.Target == config.TargetContainer {
 		containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
 			return value.Name == test.Container.Name
@@ -307,13 +377,17 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 		if !passes {
 			break
 		}
+		if test.ResourceProvider == nil {
+			logrus.Warnf("No ResourceProvider available, check %s will not work in this context (e.g. admission control)", checkID)
+			break
+		}
 		resources := test.ResourceProvider.Resources[groupkind]
 		namespace := test.Resource.ObjectMeta.GetNamespace()
 		if test.Resource.Kind == "Namespace" {
 			namespace = test.Resource.ObjectMeta.GetName()
 		}
 		resources = funk.Filter(resources, func(res kube.GenericResource) bool {
-			return res.ObjectMeta.GetNamespace() == namespace
+			return res.ObjectMeta.GetNamespace() == "" || res.ObjectMeta.GetNamespace() == namespace
 		}).([]kube.GenericResource)
 		objects := funk.Map(resources, func(res kube.GenericResource) interface{} {
 			return res.Resource.Object
@@ -323,16 +397,25 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 			return nil, err
 		}
 	}
+	if len(issues) > 0 {
+		issueMessages := make([]string, len(issues))
+		for i, issue := range issues {
+			issueMessages[i] = issue.Message
+		}
+		logrus.Debugf("there were %d issue(s) validating the schema for test-case %s: %v", len(issueMessages), test.ShortString(), issueMessages)
+	} else {
+		logrus.Debugf("there were no issues validating the schema for test-case %s", test.ShortString())
+
+	}
 	result := makeResult(conf, check, passes, issues)
 	if !passes {
 		if funk.Contains(conf.Mutations, checkID) && len(check.Mutations) > 0 {
-			mutations := funk.Map(check.Mutations, func(mutation jsonpatch.Operation) jsonpatch.Operation {
+			mutations := funk.Map(check.Mutations, func(mutation config.Mutation) config.Mutation {
 				mutationCopy := deepCopyMutation(mutation)
 				mutationCopy.Path = prefix + mutationCopy.Path
 				return mutationCopy
-			}).([]jsonpatch.Operation)
+			}).([]config.Mutation)
 			result.Mutations = mutations
-			result.Comments = check.Comments
 		}
 	}
 	return &result, nil
@@ -347,11 +430,12 @@ func getSortedKeys(m map[string]config.Severity) []string {
 	return keys
 }
 
-func deepCopyMutation(source jsonpatch.Operation) jsonpatch.Operation {
-	destination := jsonpatch.Operation{
-		Operation: source.Operation,
-		Path:      source.Path,
-		Value:     source.Value,
+func deepCopyMutation(source config.Mutation) config.Mutation {
+	destination := config.Mutation{
+		Op:      source.Op,
+		Path:    source.Path,
+		Value:   source.Value,
+		Comment: source.Comment,
 	}
 	return destination
 }
@@ -364,8 +448,6 @@ func getJSONSchemaPrefix(kind string) (prefix string) {
 	} else if (kind == "Deployment") || (kind == "DaemonSet") ||
 		(kind == "StatefulSet") || (kind == "Job") || (kind == "ReplicationController") {
 		prefix = "/spec/template/spec"
-	} else {
-		logrus.Warningf("Mutation for this this resource (%s) is not supported", kind)
 	}
 	return prefix
 }

pkg/webhook/mutate.go

@@ -25,6 +25,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+	"sigs.k8s.io/yaml"
 )
 
 // Mutator mutate k8s resources.
@@ -44,12 +45,20 @@ func NewMutateWebhook(mgr manager.Manager, mutator Mutator) {
 }
 
 func (m *Mutator) mutate(req admission.Request) ([]jsonpatch.Operation, error) {
-	results, err := GetValidatedResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
+	results, kubeResources, err := GetValidatedResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
 	if err != nil {
 		return nil, err
 	}
-	patches, _ := mutation.GetMutationsAndCommentsFromResult(results)
-	return patches, nil
+	patches := mutation.GetMutationsFromResult(results)
+	originalYaml, err := yaml.JSONToYAML(kubeResources.OriginalObjectJSON)
+	if err != nil {
+		return nil, err
+	}
+	mutatedYamlStr, err := mutation.ApplyAllMutations(string(originalYaml), patches)
+	if err != nil {
+		return nil, err
+	}
+	return jsonpatch.CreatePatch(originalYaml, []byte(mutatedYamlStr))
 }
 
 // Handle for Validator to run validation checks.

pkg/webhook/webhook.go

@@ -54,43 +54,42 @@ func NewValidateWebhook(mgr manager.Manager, validator Validator) {
 	mgr.GetWebhookServer().Register(path, &webhook.Admission{Handler: &validator})
 }
 
-func (v *Validator) handleInternal(req admission.Request) (*validator.Result, error) {
+func (v *Validator) handleInternal(req admission.Request) (*validator.Result, kube.GenericResource, error) {
 	return GetValidatedResults(req.AdmissionRequest.Kind.Kind, v.decoder, req, v.Config)
 }
 
 // GetValidatedResults returns the validated results.
-func GetValidatedResults(kind string, decoder *admission.Decoder, req admission.Request, config config.Configuration) (*validator.Result, error) {
+func GetValidatedResults(kind string, decoder *admission.Decoder, req admission.Request, config config.Configuration) (*validator.Result, kube.GenericResource, error) {
 	var controller kube.GenericResource
 	var err error
 	if kind == "Pod" {
 		pod := corev1.Pod{}
 		err := decoder.Decode(req, &pod)
 		if err != nil {
-			return nil, err
+			return nil, controller, err
 		}
 		if len(pod.ObjectMeta.OwnerReferences) > 0 {
 			logrus.Infof("Allowing owned pod %s/%s to pass through webhook", pod.ObjectMeta.Namespace, pod.ObjectMeta.Name)
-			return nil, nil
+			return nil, controller, nil
 		}
 		controller, err = kube.NewGenericResourceFromPod(pod, pod)
 	} else {
 		controller, err = kube.NewGenericResourceFromBytes(req.Object.Raw)
 	}
 	if err != nil {
-		return nil, err
+		return nil, controller, err
 	}
-	// TODO: consider enabling multi-resource checks
 	controllerResult, err := validator.ApplyAllSchemaChecks(&config, nil, controller)
 	if err != nil {
-		return nil, err
+		return nil, controller, err
 	}
-	return &controllerResult, nil
+	return &controllerResult, controller, nil
 }
 
 // Handle for Validator to run validation checks.
 func (v *Validator) Handle(ctx context.Context, req admission.Request) admission.Response {
 	logrus.Info("Starting request")
-	result, err := v.handleInternal(req)
+	result, _, err := v.handleInternal(req)
 	if err != nil {
 		logrus.Errorf("Error validating request: %v", err)
 		return admission.Errored(http.StatusBadRequest, err)

scripts/goreleaser.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env sh
+# Wrap goreleaser by using envsubst on .goreleaser.yml,
+# and creating a temporary git tag.
+
+function cleanup {
+  if [ "${CIRCLE_TAG}" == "" ] ; then
+    echo "${this_script} deleting git tag ${temporary_git_tag} for goreleaser"
+    unset GORELEASER_CURRENT_TAG
+    git tag -d ${temporary_git_tag}
+  fi
+}
+
+set -eE # errexit and errtrace
+trap 'cleanup' ERR
+this_script="$(basename $0)"
+hash envsubst
+hash goreleaser
+if [ "${TMPDIR}" == "" ] ; then
+  export TMPDIR="/tmp"
+  echo "${this_script} temporarily set the TMPDIR environment variable to ${TMPDIR}, used for a temporary GOBIN environment variable"
+fi
+
+export skip_feature_docker_tags=false
+export skip_release=true
+if [ "${CIRCLE_TAG}" == "" ] ; then
+  # Create a temporary tag for goreleaser, incrementing the last tag.
+  last_git_tag="$(git describe --tags --abbrev=0 2>/dev/null)"
+  if [ "${last_git_tag}" == "" ] ; then
+    echo "${this_script} is unable to determine the last git tag so a temporary tag can be created, using: git describe --tags --abbrev=0"
+    exit 1
+  fi
+  if [ "$(git config user.email)" == "" ] ; then
+    # git will use this env var as its user.email.
+    # git tag -m is used in case tags are manually pushed by accident,
+    # however git tag -m requires an email.
+    export EMAIL='goreleaser_ci@fairwinds.com'
+    echo "${this_script} using ${EMAIL} temporarily as the git user.email"
+  fi
+  temporary_git_tag=$(echo "${last_git_tag}" | awk -F. '{$NF = $NF + 1;} 1' | sed 's/ /./g')-rc
+  echo "${this_script} creating temporary git tag ${temporary_git_tag} for goreleaser, the last real tag is ${last_git_tag}"
+  # The -f is included to overwrite existing tags, perhaps from previous CI jobs.
+  git tag -f -m "temporary local tag for goreleaser" ${temporary_git_tag}
+  export GORELEASER_CURRENT_TAG=${temporary_git_tag}
+  # Use an adjusted git feature branch name as a docker tag.
+  export feature_docker_tag=$(echo "${CIRCLE_BRANCH:0:26}" | sed 's/[^a-zA-Z0-9]/-/g' | sed 's/-\+$//')
+  echo "${this_script} also using docker tag ${feature_docker_tag} since ${CIRCLE_BRANCH} is a feature branch"
+else
+  export GORELEASER_CURRENT_TAG=${CIRCLE_TAG}
+  echo "${this_script} setting skip_release to false, and skip_feature_docker_tags to true,  because CIRCLE_TAG is set"
+  export skip_feature_docker_tags=true
+  export skip_release=false
+fi
+
+echo "${this_script} using git tag ${GORELEASER_CURRENT_TAG}"
+# Only substitute specific variables, as goreleaser uses shell variable syntax
+# for its `signs` section `signature` and `artifact` variables.
+cat .goreleaser.yml.envsubst |envsubst '${skip_release} ${skip_feature_docker_tags} ${feature_docker_tag}' >.goreleaser.yml
+goreleaser $@
+if [ $? -eq 0 ] ; then
+  echo "${this_script} removing the temporary .goreleaser.yml since goreleaser was successful"
+  rm .goreleaser.yml # Keep git clean for additional goreleaser runs
+fi
+cleanup

scripts/install-and-run-packr2.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+set -e
+# Install packr2 and generate packr boxes for Polaris.
+# IDeally this script is called with $GOBIN already set to a temporary
+# directory, where packr2 will be installed.
+if [ "x${GOBIN}" != "x" ] ; then
+  PATH=$GOBIN:$PATH
+fi
+go install github.com/gobuffalo/packr/v2/packr2@latest
+packr2

test/checks/automountServiceAccountToken/failure.all_true.yaml

@@ -0,0 +1,19 @@
+# This fails because automounting is true for both the pod and ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: true
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: true

test/checks/automountServiceAccountToken/failure.pod_true_serviceaccount_false.yaml

@@ -0,0 +1,19 @@
+# This fails because automounting is true for the pod, overriding the ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: true
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: false

test/checks/automountServiceAccountToken/failure.uses_defaults.yaml

@@ -0,0 +1,17 @@
+# This fails because automounting is not disabled anywhere.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test

test/checks/automountServiceAccountToken/success.pod.yaml

@@ -0,0 +1,19 @@
+# This succeeds because automounting is disabled at the pod.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: false
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+

test/checks/automountServiceAccountToken/success.pod_and_serviceaccount.yaml

@@ -0,0 +1,19 @@
+# This succeeds because automounting is disabled at the pod and ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: false
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: false

test/checks/automountServiceAccountToken/success.pod_false_serviceaccount_true.yaml

@@ -0,0 +1,19 @@
+# This succeeds because automounting is disabled at the pod, overriding the ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  automountServiceAccountToken: false
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: true

test/checks/automountServiceAccountToken/success.serviceaccount.yaml

@@ -0,0 +1,18 @@
+# This succeeds because automounting is disabled at the ServiceAccount.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  serviceAccountName: test
+  containers:
+  - name: nginx
+    image: nginx
+    ports:
+    - containerPort: 80
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+automountServiceAccountToken: false

test/checks/clusterrolePodExecAttach/failure.all_wildcards.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole apiGroups, resources, and verbs are all * which allows pods/exec|attach.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/failure.attach_explicit.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.attach_using_verb_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach using all verbs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/failure.create_attach_and_exec_using_resource_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach|exec using all resources.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "*" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.create_attach_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/attach" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.create_exec_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/exec" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.exec_explicit.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ create ]

test/checks/clusterrolePodExecAttach/failure.exec_verb_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec using all verbs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/failure.get_attach_and_exec_using_resource_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach|exec using all resources.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "*" ]
+    verbs: [ get ]

test/checks/clusterrolePodExecAttach/failure.get_attach_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/attach using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/attach" ]
+    verbs: [ get ]

test/checks/clusterrolePodExecAttach/failure.get_exec_using_apigroup_wildcard.yaml

@@ -0,0 +1,9 @@
+# This fails because the ClusterRole allows pods/exec using all apiGroups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "pods/exec" ]
+    verbs: [ get ]

test/checks/clusterrolePodExecAttach/success.allow_unrelated_perms.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole does not allow pods/exec|attach.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ get, create ]

test/checks/clusterrolePodExecAttach/success.attach_wrong_verb.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole allows pods/attach but with a safe verb.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ list ]

test/checks/clusterrolePodExecAttach/success.defaultclusterrole_admin.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole is an expected default one (by name).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: admin
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/attach" ]
+    verbs: [ "create" ]

test/checks/clusterrolePodExecAttach/success.defaultclusterrole_clusteradmin.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole is an expected default one (by name).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-admin
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ "create" ]

test/checks/clusterrolePodExecAttach/success.exec_wrong_verb.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the ClusterRole allows pods/exec but with a safe verb.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods/exec" ]
+    verbs: [ list ]

test/checks/clusterrolePodExecAttach/success.gce_calico_clusterrole.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the clusterRole is an exempt name `gce:podsecuritypolicy:calico-sa`
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gce:podsecuritypolicy:calico-sa
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "*" ]

test/checks/clusterrolePodExecAttach/success.system_prefix.yaml

@@ -0,0 +1,9 @@
+# This succeeds because the clusterRole has an exempt `system:` prefix.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "*" ]

test/checks/clusterrolebindingClusterAdmin/failure.all_verbs.yaml

@@ -0,0 +1,33 @@
+# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards and all verbs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "get", "list", "watch", "create", "update", "patch", "delete" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser
+---
+# This Role exists so there is at least one Role for the additionalSchema to find.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: not-used
+  namespace: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ list ]

test/checks/clusterrolebindingClusterAdmin/failure.all_verbs_different_order.yaml

@@ -0,0 +1,33 @@
+# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards and all verbs (in different order from failure.all_verbs.yaml).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test
+rules:
+  - apiGroups: [ "*" ]
+    resources: [ "*" ]
+    verbs: [ "get", "list", "delete", "update", "create", "patch", "watch" ]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: testuser
+---
+# This Role exists so there is at least one Role for the additionalSchema to find.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: not-used
+  namespace: test
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "pods" ]
+    verbs: [ list ]