add cpuLimitsRange

CODEOWNERS

@@ -1,2 +1,2 @@
 ## DO NOT EDIT - Managed by Terraform
-* @rbren @sudermanjr
+* @rbren @mggude

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.19
+FROM alpine:3.18
 
 LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
       org.opencontainers.image.vendor="FairwindsOps, Inc." \

checks/clusterrolebindingClusterAdmin.yaml

@@ -37,10 +37,10 @@ schemaString: |
                 const: "cluster-admin"
 additionalSchemaStrings:
   rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # Do not alert on default ClusterRoleBindings.
     {{ if (ne .roleRef.name "view") }}
     {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # Do not alert on default ClusterRoleBindings.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/cpuLimitsRange.yaml

@@ -0,0 +1,25 @@
+successMessage: CPU limits are within the required range
+failureMessage: CPU limits should be within the required range
+category: Efficiency
+target: Container
+containers:
+  exclude:
+  - initContainer
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required:
+  - resources
+  properties:
+    resources:
+      type: object
+      required:
+      - limits
+      properties:
+        limits:
+          required:
+          - cpu
+          properties:
+            cpu:
+              resourceMinimum: 200m
+              resourceMaximum: "2"

checks/rolebindingClusterAdminClusterRole.yaml

@@ -45,10 +45,10 @@ schemaString: |
                 const: "cluster-admin"
 additionalSchemaStrings:
   rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
     {{ if eq .roleRef.kind "ClusterRole" }}
     {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/rolebindingClusterRolePodExecAttach.yaml

@@ -43,10 +43,10 @@ schemaString: |
               minLength: 1
 additionalSchemaStrings:
   rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
     {{ if eq .roleRef.kind "ClusterRole" }}
     {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/rolebindingRolePodExecAttach.yaml

@@ -46,10 +46,10 @@ schemaString: |
               minLength: 1
 additionalSchemaStrings:
   rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
     {{ if eq .roleRef.kind "Role" }}
     {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/topologySpreadConstraint.yaml

@@ -2,10 +2,6 @@ successMessage: Pod has a valid topology spread constraint
 failureMessage: Pod should be configured with a valid topology spread constraint
 category: Reliability
 target: PodSpec
-controllers:
-  exclude:
-  - Job
-  - CronJob
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -14,4 +10,12 @@ schema:
   properties:
     topologySpreadConstraints:
       type: array
-      minItems: 1
+      items:
+        type: object
+        properties:
+          topologyKey:
+            anyOf:
+              - type: string
+                const: "kubernetes.io/hostname"
+              - type: string
+                const: "topology.kubernetes.io/zone"

cmd/polaris/audit.go

@@ -50,14 +50,12 @@ var (
 	useColor            bool
 	helmChart           string
 	helmValues          []string
-	helmSkipTests       bool
 	checks              []string
 	auditNamespace      string
 	severityLevel       string
 	skipSslValidation   bool
 	uploadInsights      bool
 	clusterName         string
-	quiet               bool
 )
 
 func init() {
@@ -74,14 +72,12 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
 	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
-	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
 	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
 	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
 	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
 	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
 	auditCmd.PersistentFlags().BoolVar(&uploadInsights, "upload-insights", false, "Upload scan results to Fairwinds Insights")
 	auditCmd.PersistentFlags().StringVar(&clusterName, "cluster-name", "", "Set --cluster-name to a descriptive name for the cluster you're auditing")
-	auditCmd.PersistentFlags().BoolVar(&quiet, "quiet", false, "Suppress the 'upload to Insights' prompt.")
 }
 
 var auditCmd = &cobra.Command{
@@ -114,7 +110,7 @@ var auditCmd = &cobra.Command{
 		}
 		if helmChart != "" {
 			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)
 			if err != nil {
 				logrus.Errorf("Couldn't process helm chart: %v", err)
 				os.Exit(1)
@@ -183,10 +179,8 @@ var auditCmd = &cobra.Command{
 			os.Stderr.WriteString(fmt.Sprintf("\n\n%s/orgs/%s/clusters/%s/action-items\n\n", insightsHost, auth.Organization, clusterName))
 		} else {
 			outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests, severityLevel)
-			if !quiet {
-				os.Stderr.WriteString("\n\n🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:")
-				os.Stderr.WriteString("\n\n❯ polaris " + strings.Join(os.Args[1:], " ") + " --upload-insights --cluster-name=my-cluster\n\n")
-			}
+			os.Stderr.WriteString("\n\n🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:")
+			os.Stderr.WriteString("\n\n❯ polaris " + strings.Join(os.Args[1:], " ") + " --upload-insights --cluster-name=my-cluster\n\n")
 		}
 
 		summary := auditData.GetSummary()
@@ -202,7 +196,7 @@ var auditCmd = &cobra.Command{
 }
 
 // ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
+func ProcessHelmTemplates(helmChart string, helmValues []string) (string, error) {
 	cmd := exec.Command("helm", "dependency", "update", helmChart)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -224,10 +218,6 @@ func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests b
 		params = append(params, "--values", v)
 	}
 
-	if helmSkipTests {
-		params = append(params, "--skip-tests")
-	}
-
 	cmd = exec.Command("helm", params...)
 	output, err = cmd.CombinedOutput()
 

docs/cli.md

@@ -50,13 +50,11 @@ webhook
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
     --helm-chart string               Will fill out Helm template
     --helm-values string              Optional flag to add helm values
-    --helm-skip-tests bool            Corresponds to --skip-tests of helm template
 -h, --help                            help for audit
     --namespace string                Namespace to audit. Only applies to in-cluster audits
     --only-show-failed-tests          If specified, audit output will only show failed tests.
     --output-file string              Destination file for audit results.
     --output-url string               Destination URL to send audit results.
-    --quiet                           Suppress the 'upload to Insights' prompt.
     --resource string                 Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.
     --set-exit-code-below-score int   Set an exit code of 4 when the score is below this threshold (1-100).
     --set-exit-code-on-danger         Set an exit code of 3 when the audit contains danger-level issues.
@@ -83,8 +81,3 @@ webhook
   token       Print the auth token gh is configured to use.
 ```
 
-#### Suppressing 'upload to Insights' output
-
-When running the `polaris audit` subcommand, you can suppress the following output using the `--quiet flag`:
-
-> 🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:

go.mod

@@ -4,7 +4,6 @@ go 1.20
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/fairwindsops/controller-utils v0.3.0
 	github.com/fairwindsops/insights-plugins/plugins/workloads v0.0.0-20230601204422-5c789e15990c
 	github.com/fatih/color v1.15.0
 	github.com/gobuffalo/packr/v2 v2.8.3
@@ -31,6 +30,7 @@ require (
 	github.com/emicklei/go-restful/v3 v3.10.1 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
+	github.com/fairwindsops/controller-utils v0.3.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect

pkg/config/checks.go

@@ -38,6 +38,7 @@ var (
 		"memoryRequestsMissing",
 		"cpuLimitsMissing",
 		"cpuRequestsMissing",
+		"cpuLimitsRange",
 		"readinessProbeMissing",
 		"livenessProbeMissing",
 		"pullPolicyNotAlways",

pkg/config/schema.go

@@ -143,9 +143,6 @@ func (max resourceMaximum) Validate(path string, data interface{}, errs *[]jsons
 }
 
 func parseQuantity(i interface{}) (resource.Quantity, *[]jsonschema.ValError) {
-	if resNum, ok := i.(float64); ok {
-		i = fmt.Sprintf("%f", resNum)
-	}
 	resStr, ok := i.(string)
 	if !ok {
 		return resource.Quantity{}, &[]jsonschema.ValError{

pkg/kube/resources.go

@@ -26,7 +26,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/fairwindsops/controller-utils/pkg/controller"
 	conf "github.com/fairwindsops/polaris/pkg/config"
 
 	"github.com/sirupsen/logrus"
@@ -34,6 +33,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	k8sYaml "k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/client-go/dynamic"
@@ -297,6 +297,13 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
+	logrus.Info("Loading pods")
+	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
+	if err != nil {
+		logrus.Errorf("Error fetching Pods: %v", err)
+		return nil, err
+	}
+
 	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
@@ -351,24 +358,17 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			kubernetesResources = append(kubernetesResources, res)
 		}
 	}
+
+	objectCache := map[string]unstructured.Unstructured{}
+
 	logrus.Info("Loading controllers")
-	client := controller.Client{
-		Context:    ctx,
-		Dynamic:    dynamic,
-		RESTMapper: restMapper,
-	}
-	topControllers, err := client.GetAllTopControllersSummary("")
+	controllers, err := LoadControllers(ctx, pods.Items, dynamic, restMapper, objectCache)
 	if err != nil {
-		return nil, fmt.Errorf("error while getting all TopControllers: %v", err)
-	}
-	for _, workload := range topControllers {
-		topController := workload.TopController
-		workloadObj, err := NewGenericResourceFromUnstructured(topController, nil)
-		if err != nil {
-			return nil, fmt.Errorf("could not parse workload %v: %w", workload, err)
-		}
-		kubernetesResources = append(kubernetesResources, workloadObj)
+		logrus.Errorf("Error loading controllers from pods: %v", err)
+		return nil, err
 	}
+	// resources loaded from custom checks can also contain controllers and thus would be added twice to the provider
+	kubernetesResources = deduplicateControllers(append(kubernetesResources, controllers...))
 
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
@@ -377,6 +377,49 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	return &provider, nil
 }
 
+// LoadControllers loads a list of controllers from the kubeResources Pods
+func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClient dynamic.Interface, restMapperPointer meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
+	interfaces := []GenericResource{}
+	deduped := map[string]*corev1.Pod{}
+	for idx, pod := range pods {
+		owners := pod.ObjectMeta.OwnerReferences
+		if len(owners) == 0 {
+			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = &pods[idx]
+			continue
+		}
+		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = &pods[idx]
+	}
+	for key, pod := range deduped {
+		logrus.Debugf("Resolving controller from pod %s", key)
+		workload, err := ResolveControllerFromPod(ctx, *pod, dynamicClient, restMapperPointer, objectCache)
+		if err != nil {
+			return nil, err
+		}
+		interfaces = append(interfaces, workload)
+	}
+	return interfaces, nil
+}
+
+// Because the controllers with an Owner take on the name of the Owner, this eliminates any duplicates.
+// In cases like CronJobs older children can hang around, so this takes the most recent.
+func deduplicateControllers(inputResources []GenericResource) []GenericResource {
+	controllerMap := make(map[string]GenericResource)
+	for _, controller := range inputResources {
+		key := controller.ObjectMeta.GetNamespace() + "/" + controller.Kind + "/" + controller.ObjectMeta.GetName()
+		oldController, ok := controllerMap[key]
+		if !ok || controller.ObjectMeta.GetCreationTimestamp().Time.After(oldController.ObjectMeta.GetCreationTimestamp().Time) {
+			controllerMap[key] = controller
+		}
+	}
+	results := make([]GenericResource, len(controllerMap))
+	idx := 0
+	for _, controller := range controllerMap {
+		results[idx] = controller
+		idx++
+	}
+	return results
+}
+
 func (resources *ResourceProvider) addResourcesFromReader(reader io.Reader) error {
 	contents, err := io.ReadAll(reader)
 	if err != nil {

test/checks/cpuLimitsRange/failure.number.yaml

@@ -10,5 +10,5 @@ spec:
     image: nginx
     resources:
       limits:
-        memory: 250Mi
-        cpu: 1.5
+        memory: 128Mi
+        cpu: 5

test/checks/cpuLimitsRange/success.number.yaml

@@ -10,5 +10,5 @@ spec:
     image: nginx
     resources:
       limits:
-        memory: 104857600
+        memory: 128Mi
         cpu: 1

test/checks/resourceRange/check.yaml

@@ -1,32 +0,0 @@
-containers:
-  exclude:
-  - initContainer
-successMessage: Resource limits are within the required range
-failureMessage: Resource limits should be within the required range
-category: Resources
-target: Container
-schema:
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  required:
-  - resources
-  properties:
-    resources:
-      type: object
-      required:
-      - limits
-      properties:
-        limits:
-          type: object
-          required:
-          - memory
-          - cpu
-          properties:
-            memory:
-              type: string
-              resourceMinimum: 100Mi # 104857600 bytes
-              resourceMaximum: 6G
-            cpu:
-              type: string
-              resourceMinimum: 100m
-              resourceMaximum: "2"

test/checks/resourceRange/failure.cpu-number.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx
-  labels:
-    app.kubernetes.io/name: nginx
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    resources:
-      limits:
-        memory: 250Mi
-        cpu: 0.05

test/checks/resourceRange/failure.mem-number.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx
-  labels:
-    app.kubernetes.io/name: nginx
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    resources:
-      limits:
-        memory: 104857599
-        cpu: 1

test/checks/rolebindingClusterAdminClusterRole/success.role_with_no_cluster_roles.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-  labels:
-    role: service
-    tier: backend
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-rules:
-  - apiGroups: [""]
-    resources: [services]
-    verbs: [get, list]
----
-# check when there are no cluster roles present
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test
-roleRef:
-  kind: Role
-  name: test
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: test

test/checks/rolebindingClusterRolePodExecAttach/success.role_with_no_cluster_roles.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-  labels:
-    role: service
-    tier: backend
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-rules:
-  - apiGroups: [""]
-    resources: [services]
-    verbs: [get, list]
----
-# check when there are no cluster roles present
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test
-roleRef:
-  kind: Role
-  name: test
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: test

test/checks/rolebindingRolePodExecAttach/success.role_with_no_cluster_roles.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-  labels:
-    role: service
-    tier: backend
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-rules:
-  - apiGroups: [""]
-    resources: [services]
-    verbs: [get, list]
----
-# check when there are no cluster roles present
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test
-roleRef:
-  kind: Role
-  name: test
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: test

test/checks/topologySpreadConstraint/failure.invalidtopologykey.yaml

@@ -19,7 +19,10 @@ spec:
         app.kubernetes.io/name: basic-demo
         app.kubernetes.io/instance: demo
     spec:
-      topologySpreadConstraints: []
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: farglebargle
+          whenUnsatisfiable: ScheduleAnyway
       containers:
         - name: basic-demo
           image: "quay.io/fairwinds/docker-demo:latest"

test/checks/topologySpreadConstraint/success.yaml

@@ -21,13 +21,8 @@ spec:
     spec:
       topologySpreadConstraints:
         - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app: foo
-          matchLabelKeys:
-            - pod-template-hash
+          topologyKey: "topology.kubernetes.io/zone"
+          whenUnsatisfiable: ScheduleAnyway
       containers:
         - name: basic-demo
           image: "quay.io/fairwinds/docker-demo:latest"