Update missingPodDisruptionBudget.yaml

CODEOWNERS

@@ -1,2 +1,2 @@
 ## DO NOT EDIT - Managed by Terraform
-* @rbren @sudermanjr
+* @rbren @mggude

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.19
+FROM alpine:3.18
 
 LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
       org.opencontainers.image.vendor="FairwindsOps, Inc." \

checks/clusterrolebindingClusterAdmin.yaml

@@ -37,10 +37,10 @@ schemaString: |
                 const: "cluster-admin"
 additionalSchemaStrings:
   rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # Do not alert on default ClusterRoleBindings.
     {{ if (ne .roleRef.name "view") }}
     {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # Do not alert on default ClusterRoleBindings.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/missingPodDisruptionBudget.yaml

@@ -29,7 +29,7 @@ additionalSchemaStrings:
             properties:
               matchLabels:
                 type: object
-                anyOf:
+                allOf:
                 {{ range $key, $value := .metadata.labels }}
                 - properties:
                     "{{ $key }}":

checks/rolebindingClusterAdminClusterRole.yaml

@@ -45,10 +45,10 @@ schemaString: |
                 const: "cluster-admin"
 additionalSchemaStrings:
   rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
     {{ if eq .roleRef.kind "ClusterRole" }}
     {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/rolebindingClusterRolePodExecAttach.yaml

@@ -43,10 +43,10 @@ schemaString: |
               minLength: 1
 additionalSchemaStrings:
   rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
     {{ if eq .roleRef.kind "ClusterRole" }}
     {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

checks/rolebindingRolePodExecAttach.yaml

@@ -46,10 +46,10 @@ schemaString: |
               minLength: 1
 additionalSchemaStrings:
   rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
     {{ if eq .roleRef.kind "Role" }}
     {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
     required: ["metadata", "rules"]
     allOf:
       - properties:

cmd/polaris/audit.go

@@ -57,7 +57,6 @@ var (
 	skipSslValidation   bool
 	uploadInsights      bool
 	clusterName         string
-	quiet               bool
 )
 
 func init() {
@@ -81,7 +80,6 @@ func init() {
 	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
 	auditCmd.PersistentFlags().BoolVar(&uploadInsights, "upload-insights", false, "Upload scan results to Fairwinds Insights")
 	auditCmd.PersistentFlags().StringVar(&clusterName, "cluster-name", "", "Set --cluster-name to a descriptive name for the cluster you're auditing")
-	auditCmd.PersistentFlags().BoolVar(&quiet, "quiet", false, "Suppress the 'upload to Insights' prompt.")
 }
 
 var auditCmd = &cobra.Command{
@@ -183,10 +181,8 @@ var auditCmd = &cobra.Command{
 			os.Stderr.WriteString(fmt.Sprintf("\n\n%s/orgs/%s/clusters/%s/action-items\n\n", insightsHost, auth.Organization, clusterName))
 		} else {
 			outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests, severityLevel)
-			if !quiet {
-				os.Stderr.WriteString("\n\n🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:")
-				os.Stderr.WriteString("\n\n❯ polaris " + strings.Join(os.Args[1:], " ") + " --upload-insights --cluster-name=my-cluster\n\n")
-			}
+			os.Stderr.WriteString("\n\n🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:")
+			os.Stderr.WriteString("\n\n❯ polaris " + strings.Join(os.Args[1:], " ") + " --upload-insights --cluster-name=my-cluster\n\n")
 		}
 
 		summary := auditData.GetSummary()

docs/cli.md

@@ -56,7 +56,6 @@ webhook
     --only-show-failed-tests          If specified, audit output will only show failed tests.
     --output-file string              Destination file for audit results.
     --output-url string               Destination URL to send audit results.
-    --quiet                           Suppress the 'upload to Insights' prompt.
     --resource string                 Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.
     --set-exit-code-below-score int   Set an exit code of 4 when the score is below this threshold (1-100).
     --set-exit-code-on-danger         Set an exit code of 3 when the audit contains danger-level issues.
@@ -82,9 +81,3 @@ webhook
   status      View authentication status.
   token       Print the auth token gh is configured to use.
 ```
-
-#### Suppressing 'upload to Insights' output
-
-When running the `polaris audit` subcommand, you can suppress the following output using the `--quiet flag`:
-
-> 🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:

go.mod

@@ -4,7 +4,6 @@ go 1.20
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/fairwindsops/controller-utils v0.3.0
 	github.com/fairwindsops/insights-plugins/plugins/workloads v0.0.0-20230601204422-5c789e15990c
 	github.com/fatih/color v1.15.0
 	github.com/gobuffalo/packr/v2 v2.8.3
@@ -31,6 +30,7 @@ require (
 	github.com/emicklei/go-restful/v3 v3.10.1 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
+	github.com/fairwindsops/controller-utils v0.3.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect

pkg/kube/resources.go

@@ -26,7 +26,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/fairwindsops/controller-utils/pkg/controller"
 	conf "github.com/fairwindsops/polaris/pkg/config"
 
 	"github.com/sirupsen/logrus"
@@ -34,6 +33,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	k8sYaml "k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/client-go/dynamic"
@@ -297,6 +297,13 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
+	logrus.Info("Loading pods")
+	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
+	if err != nil {
+		logrus.Errorf("Error fetching Pods: %v", err)
+		return nil, err
+	}
+
 	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
@@ -351,24 +358,17 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			kubernetesResources = append(kubernetesResources, res)
 		}
 	}
+
+	objectCache := map[string]unstructured.Unstructured{}
+
 	logrus.Info("Loading controllers")
-	client := controller.Client{
-		Context:    ctx,
-		Dynamic:    dynamic,
-		RESTMapper: restMapper,
-	}
-	topControllers, err := client.GetAllTopControllersSummary("")
+	controllers, err := LoadControllers(ctx, pods.Items, dynamic, restMapper, objectCache)
 	if err != nil {
-		return nil, fmt.Errorf("error while getting all TopControllers: %v", err)
-	}
-	for _, workload := range topControllers {
-		topController := workload.TopController
-		workloadObj, err := NewGenericResourceFromUnstructured(topController, nil)
-		if err != nil {
-			return nil, fmt.Errorf("could not parse workload %v: %w", workload, err)
-		}
-		kubernetesResources = append(kubernetesResources, workloadObj)
+		logrus.Errorf("Error loading controllers from pods: %v", err)
+		return nil, err
 	}
+	// resources loaded from custom checks can also contain controllers and thus would be added twice to the provider
+	kubernetesResources = deduplicateControllers(append(kubernetesResources, controllers...))
 
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
@@ -377,6 +377,49 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	return &provider, nil
 }
 
+// LoadControllers loads a list of controllers from the kubeResources Pods
+func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClient dynamic.Interface, restMapperPointer meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
+	interfaces := []GenericResource{}
+	deduped := map[string]*corev1.Pod{}
+	for idx, pod := range pods {
+		owners := pod.ObjectMeta.OwnerReferences
+		if len(owners) == 0 {
+			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = &pods[idx]
+			continue
+		}
+		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = &pods[idx]
+	}
+	for key, pod := range deduped {
+		logrus.Debugf("Resolving controller from pod %s", key)
+		workload, err := ResolveControllerFromPod(ctx, *pod, dynamicClient, restMapperPointer, objectCache)
+		if err != nil {
+			return nil, err
+		}
+		interfaces = append(interfaces, workload)
+	}
+	return interfaces, nil
+}
+
+// Because the controllers with an Owner take on the name of the Owner, this eliminates any duplicates.
+// In cases like CronJobs older children can hang around, so this takes the most recent.
+func deduplicateControllers(inputResources []GenericResource) []GenericResource {
+	controllerMap := make(map[string]GenericResource)
+	for _, controller := range inputResources {
+		key := controller.ObjectMeta.GetNamespace() + "/" + controller.Kind + "/" + controller.ObjectMeta.GetName()
+		oldController, ok := controllerMap[key]
+		if !ok || controller.ObjectMeta.GetCreationTimestamp().Time.After(oldController.ObjectMeta.GetCreationTimestamp().Time) {
+			controllerMap[key] = controller
+		}
+	}
+	results := make([]GenericResource, len(controllerMap))
+	idx := 0
+	for _, controller := range controllerMap {
+		results[idx] = controller
+		idx++
+	}
+	return results
+}
+
 func (resources *ResourceProvider) addResourcesFromReader(reader io.Reader) error {
 	contents, err := io.ReadAll(reader)
 	if err != nil {

test/checks/rolebindingClusterAdminClusterRole/success.role_with_no_cluster_roles.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-  labels:
-    role: service
-    tier: backend
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-rules:
-  - apiGroups: [""]
-    resources: [services]
-    verbs: [get, list]
----
-# check when there are no cluster roles present
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test
-roleRef:
-  kind: Role
-  name: test
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: test

test/checks/rolebindingClusterRolePodExecAttach/success.role_with_no_cluster_roles.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-  labels:
-    role: service
-    tier: backend
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-rules:
-  - apiGroups: [""]
-    resources: [services]
-    verbs: [get, list]
----
-# check when there are no cluster roles present
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test
-roleRef:
-  kind: Role
-  name: test
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: test

test/checks/rolebindingRolePodExecAttach/success.role_with_no_cluster_roles.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-  labels:
-    role: service
-    tier: backend
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-rules:
-  - apiGroups: [""]
-    resources: [services]
-    verbs: [get, list]
----
-# check when there are no cluster roles present
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test
-roleRef:
-  kind: Role
-  name: test
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: test