add severities

README.md

@@ -38,8 +38,9 @@ and network with fellow Kubernetes users.
 or
 [join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
 
-<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
-  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
+<a href="https://insights.fairwinds.com/auth/register/">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png"
+  alt="Love Fairwinds Open Source? Automate Fairwinds Open Source for free with Fairwinds Insights. Click to learn more" />
 </a>
 
 ## Other Projects from Fairwinds

docs/checks/security.md

@@ -22,6 +22,19 @@ key | default | description
 `hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
 `hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
 `tlsSettingsMissing` | `warning` | Fails when an Ingress lacks TLS settings.
+`automountServiceAccountToken` | `ignore` | Fails if service account tokens are automounted to pods
+`clusterrolePodExecAttach` | `warning` | Fails if a ClusterRole is able to exec into pods
+`clusterrolebindingClusterAdmin` | `warning` | Fails if a ClusterRoleBinding is attached to the admin role
+`clusterrolebindingPodExecAttach` | `warning` | Fails if a ClusterRoleBinding is able to exec into pods
+`rolePodExecAttach` | `warning` | Fails if a Role is able to exec into pods
+`rolebindingClusterAdminClusterRole` | `warning` | Fails if a RoleBinding is attached to the cluster admin role
+`rolebindingClusterAdminRole` | `warning` | Fails if a RoleBinding is attached to the admin role
+`rolebindingClusterRolePodExecAttach` | `warning` | Fails if a RoleBinding is able to exec into pods in any namespace
+`rolebindingRolePodExecAttach` | `warning` | Fails if a RoleBinding is able to exec into pods in its namespace
+`linuxHardening` | `warning` | Fails if one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are not used to limit unwanted privileges
+`missingNetworkPolicy` | `warning` | Fails if a controller lacks a corresponding NetworkPolicy
+`sensitiveConfigmapContent` | `warning` | Fails if a ConfigMap contains a likely password or secret
+`sensitiveContainerEnvVar` | `warning` | Fails if a controller has an environment variable hard-coded to a likely password or secret
 
 ## Background