Using controller-utils to get workloads (#1012)

* Using controller-utils to get workloads

* Code cleanup

checks/metadataAndInstanceMismatched.yaml

@@ -1,5 +1,5 @@
-successMessage: Label app.kubernetes.io/name matches metadata.name
-failureMessage: Label app.kubernetes.io/name must match metadata.name
+successMessage: Label app.kubernetes.io/instance matches metadata.name
+failureMessage: Label app.kubernetes.io/instance must match metadata.name
 category: Reliability
 target: Controller
 schema:
@@ -12,7 +12,7 @@ schema:
       properties:
         labels:
           type: object
-          required: ["app.kubernetes.io/name"]
+          required: ["app.kubernetes.io/instance"]
           properties:
-            app.kubernetes.io/name:
+            app.kubernetes.io/instance:
               const: "{{ .metadata.name }}"

checks/topologySpreadConstraint.yaml

@@ -2,6 +2,10 @@ successMessage: Pod has a valid topology spread constraint
 failureMessage: Pod should be configured with a valid topology spread constraint
 category: Reliability
 target: PodSpec
+controllers:
+  exclude:
+  - Job
+  - CronJob
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -10,12 +14,4 @@ schema:
   properties:
     topologySpreadConstraints:
       type: array
-      items:
-        type: object
-        properties:
-          topologyKey:
-            anyOf:
-              - type: string
-                const: "kubernetes.io/hostname"
-              - type: string
-                const: "topology.kubernetes.io/zone"
+      minItems: 1

cmd/polaris/audit.go

@@ -49,7 +49,8 @@ var (
 	resourceToAudit     string
 	useColor            bool
 	helmChart           string
-	helmValues          string
+	helmValues          []string
+	helmSkipTests       bool
 	checks              []string
 	auditNamespace      string
 	severityLevel       string
@@ -71,7 +72,8 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
-	auditCmd.PersistentFlags().StringVar(&helmValues, "helm-values", "", "Optional flag to add helm values")
+	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
+	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
 	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
 	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
 	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
@@ -110,7 +112,7 @@ var auditCmd = &cobra.Command{
 		}
 		if helmChart != "" {
 			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
 			if err != nil {
 				logrus.Errorf("Couldn't process helm chart: %v", err)
 				os.Exit(1)
@@ -196,7 +198,7 @@ var auditCmd = &cobra.Command{
 }
 
 // ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
+func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
 	cmd := exec.Command("helm", "dependency", "update", helmChart)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -214,8 +216,12 @@ func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
 		"--output-dir",
 		dir,
 	}
-	if helmValues != "" {
-		params = append(params, "--values", helmValues)
+	for _, v := range helmValues {
+		params = append(params, "--values", v)
+	}
+
+	if helmSkipTests {
+		params = append(params, "--skip-tests")
 	}
 
 	cmd = exec.Command("helm", params...)

docs/changelog.md

@@ -6,6 +6,9 @@ meta:
 
 ---
 
+## Unreleased
+* Change `metadataAndNameMismatched` to `metadataAndInstanceMismatched`
+
 ## 8.1.1
 * Add category for `metadataAndNameMismatched`.
 * Fix category for `priorityClassNotSet`.

docs/checks/reliability.md

@@ -17,7 +17,7 @@ key | default | description
 `priorityClassNotSet` | `warning` | Fails when a priorityClassName is not set for a pod.
 `deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
 `missingPodDisruptionBudget` | `warning` | Fails when PDB is missing.
-`metadataAndNameMismatched` | `warning` | Fails when label `app.kubernetes.io/name` and `metadata.name` mismatch
+`metadataAndInstanceMismatched` | `warning` | Fails when label `app.kubernetes.io/instance` and `metadata.name` mismatch
 `topologySpreadConstraint` | `warning` | Fails when there is no topology spread constraint on the pod
 
 ## Background
@@ -70,4 +70,4 @@ spec:
 - [Kubernetes Docs: Configure Liveness and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
 - [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
 - [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)
-- [Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
+- [Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)

docs/cli.md

@@ -9,14 +9,18 @@ meta:
 # top-level commands
 audit
       Runs a one-time audit.
+auth
+      Authenticate polaris with Fairwinds Insights
 dashboard
       Runs the webserver for Polaris dashboard.
+fix
+      Fix Infrastructure as code files.
 help
       Prints help, if you give it a command then it will print help for that command. Same as -h
 version
       Prints the version of Polaris
 webhook
-      Runs the webhook webserver
+      Runs the webhook webserver.
 
 # global flags
 -c, --config string                    Location of Polaris configuration file.
@@ -25,6 +29,7 @@ webhook
     --disallow-config-exemptions       Disallow exemptions set within the configuration file.
     --disallow-annotation-exemptions   Disallow any exemption defined as a controller annotation.
     --kubeconfig string                Paths to a kubeconfig. Only required if out-of-cluster.
+    --insights-host string             Fairwinds Insights host URL. (default "https://insights.fairwinds.com")
     --log-level string                 Logrus log level. (default "info")
 
 # dashboard flags
@@ -38,12 +43,14 @@ webhook
 
 # audit flags
     --audit-path string               If specified, audits one or more YAML files instead of a cluster.
-    --checks stringArray              Optional flag to specify specific checks to check
+    --checks strings                  Optional flag to specify specific checks to check
+    --cluster-name string             Set --cluster-name to a descriptive name for the cluster you're auditing
     --color                           Whether to use color in pretty format. (default true)
     --display-name string             An optional identifier for the audit.
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
     --helm-chart string               Will fill out Helm template
     --helm-values string              Optional flag to add helm values
+    --helm-skip-tests bool            Corresponds to --skip-tests of helm template
 -h, --help                            help for audit
     --namespace string                Namespace to audit. Only applies to in-cluster audits
     --only-show-failed-tests          If specified, audit output will only show failed tests.
@@ -56,9 +63,21 @@ webhook
     --skip-ssl-validation             Skip https certificate verification
     --upload-insights                 Upload scan results to Fairwinds Insights
 
+# fix flags
+    --checks strings      Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations
+    --files-path string   mutate and fix one or more YAML files in a specified folder
+-h, --help                help for fix
+    --template            set to true when modifyng a YAML template, like a Helm chart (experimental)
+
+
 # webhook flags
     --disable-webhook-config-installer   disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.
 -h, --help                               help for webhook
 -p, --port int                           Port for the dashboard webserver. (default 9876)
-```
 
+# auth sub-commands
+  login       Authenticate polaris with Fairwinds Insights.
+  logout      Log out of a Fairwinds Insights.
+  status      View authentication status.
+  token       Print the auth token gh is configured to use.
+```

examples/config-full.yaml

@@ -9,7 +9,7 @@ checks:
   topologySpreadConstraint: warning
   pdbDisruptionsIsZero: warning
   missingPodDisruptionBudget: warning
-  metadataAndNameMismatched: warning
+  metadataAndInstanceMismatched: warning
 
   # efficiency
   cpuRequestsMissing: warning

examples/config.yaml

@@ -6,7 +6,7 @@ checks:
   pullPolicyNotAlways: warning
   readinessProbeMissing: warning
   livenessProbeMissing: warning
-  metadataAndNameMismatched: warning
+  metadataAndInstanceMismatched: warning
   pdbDisruptionsIsZero: warning
   missingPodDisruptionBudget: warning
   topologySpreadConstraint: warning

go.mod

@@ -17,7 +17,7 @@ require (
 	gomodules.xyz/jsonpatch/v2 v2.3.0
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.27.3
-	k8s.io/apimachinery v0.27.3
+	k8s.io/apimachinery v0.27.4
 	k8s.io/client-go v0.27.3
 	sigs.k8s.io/controller-runtime v0.15.0
 	sigs.k8s.io/yaml v1.3.0

go.sum

@@ -777,8 +777,8 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
 k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
 k8s.io/apiextensions-apiserver v0.27.2 h1:iwhyoeS4xj9Y7v8YExhUwbVuBhMr3Q4bd/laClBV6Bo=
-k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
-k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
+k8s.io/apimachinery v0.27.4 h1:CdxflD4AF61yewuid0fLl6bM4a3q04jWel0IlP+aYjs=
+k8s.io/apimachinery v0.27.4/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
 k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
 k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
 k8s.io/component-base v0.27.2 h1:neju+7s/r5O4x4/txeUONNTS9r1HsPbyoPBAtHsDCpo=

pkg/config/checks.go

@@ -55,7 +55,7 @@ var (
 		// Other checks
 		"tlsSettingsMissing",
 		"pdbDisruptionsIsZero",
-		"metadataAndNameMismatched",
+		"metadataAndInstanceMismatched",
 		"missingPodDisruptionBudget",
 		"missingNetworkPolicy",
 		"sensitiveConfigmapContent",

pkg/config/schema.go

@@ -143,6 +143,9 @@ func (max resourceMaximum) Validate(path string, data interface{}, errs *[]jsons
 }
 
 func parseQuantity(i interface{}) (resource.Quantity, *[]jsonschema.ValError) {
+	if resNum, ok := i.(float64); ok {
+		i = fmt.Sprintf("%f", resNum)
+	}
 	resStr, ok := i.(string)
 	if !ok {
 		return resource.Quantity{}, &[]jsonschema.ValError{

pkg/kube/resources.go

@@ -26,6 +26,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/fairwindsops/controller-utils/pkg/controller"
 	conf "github.com/fairwindsops/polaris/pkg/config"
 
 	"github.com/sirupsen/logrus"
@@ -33,7 +34,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	k8sYaml "k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/client-go/dynamic"
@@ -297,13 +297,6 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
-	logrus.Info("Loading pods")
-	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
-	if err != nil {
-		logrus.Errorf("Error fetching Pods: %v", err)
-		return nil, err
-	}
-
 	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
@@ -358,17 +351,24 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			kubernetesResources = append(kubernetesResources, res)
 		}
 	}
-
-	objectCache := map[string]unstructured.Unstructured{}
-
 	logrus.Info("Loading controllers")
-	controllers, err := LoadControllers(ctx, pods.Items, dynamic, restMapper, objectCache)
+	client := controller.Client{
+		Context:    ctx,
+		Dynamic:    dynamic,
+		RESTMapper: restMapper,
+	}
+	topControllers, err := client.GetAllTopControllersSummary("")
 	if err != nil {
-		logrus.Errorf("Error loading controllers from pods: %v", err)
-		return nil, err
+		return nil, fmt.Errorf("error while getting all TopControllers: %v", err)
+	}
+	for _, workload := range topControllers {
+		topController := workload.TopController
+		workloadObj, err := NewGenericResourceFromUnstructured(topController, nil)
+		if err != nil {
+			return nil, fmt.Errorf("could not parse workload %v: %w", workload, err)
+		}
+		kubernetesResources = append(kubernetesResources, workloadObj)
 	}
-	// resources loaded from custom checks can also contain controllers and thus would be added twice to the provider
-	kubernetesResources = deduplicateControllers(append(kubernetesResources, controllers...))
 
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
@@ -377,49 +377,6 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	return &provider, nil
 }
 
-// LoadControllers loads a list of controllers from the kubeResources Pods
-func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClient dynamic.Interface, restMapperPointer meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
-	interfaces := []GenericResource{}
-	deduped := map[string]*corev1.Pod{}
-	for idx, pod := range pods {
-		owners := pod.ObjectMeta.OwnerReferences
-		if len(owners) == 0 {
-			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = &pods[idx]
-			continue
-		}
-		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = &pods[idx]
-	}
-	for key, pod := range deduped {
-		logrus.Debugf("Resolving controller from pod %s", key)
-		workload, err := ResolveControllerFromPod(ctx, *pod, dynamicClient, restMapperPointer, objectCache)
-		if err != nil {
-			return nil, err
-		}
-		interfaces = append(interfaces, workload)
-	}
-	return interfaces, nil
-}
-
-// Because the controllers with an Owner take on the name of the Owner, this eliminates any duplicates.
-// In cases like CronJobs older children can hang around, so this takes the most recent.
-func deduplicateControllers(inputResources []GenericResource) []GenericResource {
-	controllerMap := make(map[string]GenericResource)
-	for _, controller := range inputResources {
-		key := controller.ObjectMeta.GetNamespace() + "/" + controller.Kind + "/" + controller.ObjectMeta.GetName()
-		oldController, ok := controllerMap[key]
-		if !ok || controller.ObjectMeta.GetCreationTimestamp().Time.After(oldController.ObjectMeta.GetCreationTimestamp().Time) {
-			controllerMap[key] = controller
-		}
-	}
-	results := make([]GenericResource, len(controllerMap))
-	idx := 0
-	for _, controller := range controllerMap {
-		results[idx] = controller
-		idx++
-	}
-	return results
-}
-
 func (resources *ResourceProvider) addResourcesFromReader(reader io.Reader) error {
 	contents, err := io.ReadAll(reader)
 	if err != nil {

test/checks/metadataAndInstanceMismatched/failure.yaml

@@ -3,7 +3,7 @@ kind: Pod
 metadata:
   name: nginx
   labels:
-    app.kubernetes.io/name: not-nginx
+    app.kubernetes.io/instance: not-nginx
 spec:
   containers:
   - name: nginx

test/checks/metadataAndInstanceMismatched/success.yaml

@@ -3,7 +3,7 @@ kind: Pod
 metadata:
   name: nginx
   labels:
-    app.kubernetes.io/name: nginx
+    app.kubernetes.io/instance: nginx
 spec:
   containers:
   - name: nginx

test/checks/resourceRange/check.yaml

@@ -0,0 +1,32 @@
+containers:
+  exclude:
+  - initContainer
+successMessage: Resource limits are within the required range
+failureMessage: Resource limits should be within the required range
+category: Resources
+target: Container
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required:
+  - resources
+  properties:
+    resources:
+      type: object
+      required:
+      - limits
+      properties:
+        limits:
+          type: object
+          required:
+          - memory
+          - cpu
+          properties:
+            memory:
+              type: string
+              resourceMinimum: 100Mi # 104857600 bytes
+              resourceMaximum: 6G
+            cpu:
+              type: string
+              resourceMinimum: 100m
+              resourceMaximum: "2"

test/checks/resourceRange/failure.cpu-number.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    resources:
+      limits:
+        memory: 250Mi
+        cpu: 0.05

test/checks/resourceRange/failure.mem-number.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    resources:
+      limits:
+        memory: 104857599
+        cpu: 1

test/checks/resourceRange/success.cpu-number.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    resources:
+      limits:
+        memory: 250Mi
+        cpu: 1.5

test/checks/resourceRange/success.mem-number.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    resources:
+      limits:
+        memory: 104857600
+        cpu: 1

test/checks/topologySpreadConstraint/failure.empty.yaml

@@ -19,10 +19,7 @@ spec:
         app.kubernetes.io/name: basic-demo
         app.kubernetes.io/instance: demo
     spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: farglebargle
-          whenUnsatisfiable: ScheduleAnyway
+      topologySpreadConstraints: []
       containers:
         - name: basic-demo
           image: "quay.io/fairwinds/docker-demo:latest"

test/checks/topologySpreadConstraint/success.yaml

@@ -21,8 +21,13 @@ spec:
     spec:
       topologySpreadConstraints:
         - maxSkew: 1
-          topologyKey: "topology.kubernetes.io/zone"
-          whenUnsatisfiable: ScheduleAnyway
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: foo
+          matchLabelKeys:
+            - pod-template-hash
       containers:
         - name: basic-demo
           image: "quay.io/fairwinds/docker-demo:latest"