add debug

Merge branch 'master' into rb/fix-webhook
fix mutate test
2026-08-29 22:17:16 +00:00 · 2022-12-13 08:53:47 -05:00 · 2022-12-13 08:50:46 -05:00 · 2022-11-30 16:17:57 -05:00 · 2022-11-29 15:37:05 -05:00 · 2022-11-29 12:38:13 -05:00
138 changed files with 3339 additions and 4367 deletions
@@ -1,7 +1,7 @@
 version: 2.1

 orbs:
-  rok8s: fairwinds/rok8s-scripts@12
+  rok8s: fairwinds/rok8s-scripts@11
  oss-docs: fairwinds/oss-docs@0

 executors:
@@ -44,20 +44,20 @@ references:
        sudo apt-get install -yqq jq git

        echo "Installing KIND"
-        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.19.0/kind-linux-amd64
+        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.14.0/kind-linux-amd64
        chmod 0755 kind-linux-amd64
        sudo mv kind-linux-amd64 /usr/local/bin/kind
        kind version

        echo "Installing Kubectl"
-        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.25.10/bin/linux/amd64/kubectl
+        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.21.12/bin/linux/amd64/kubectl
        chmod 0755 kubectl
        sudo mv kubectl /usr/local/bin/
        kubectl version --client


        echo "Creating Kubernetes Cluster with Kind"
-        kind create cluster --wait=90s --image kindest/node:v1.25.9@sha256:c08d6c52820aa42e533b70bce0c2901183326d86dcdcbedecc9343681db45161
+        kind create cluster --wait=90s --image kindest/node:v1.21.12
        docker ps -a

        kubectl version
@@ -68,17 +68,18 @@ references:
        ./get_helm.sh

        echo "Installing cert-manager"
+        kubectl create namespace cert-manager
        helm repo add jetstack https://charts.jetstack.io
        helm repo update
        echo "Helm install"
-        helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait --create-namespace
+        helm install cert-manager jetstack/cert-manager --namespace cert-manager --version 0.16.1 --set "installCRDs=true" --wait
        echo "Install cert-manager successful"

  test_binary_dashboard: &test_binary_dashboard
    run:
      name: Test Dashboard
      command: |
-        go run main.go dashboard --port 3000 --audit-path ./pkg/config/examples &
+        go run main.go dashboard --port 3000 --audit-path ./examples &
        sleep 30
        curl -f http://localhost:3000 > /dev/null
        curl -f http://localhost:3000/health > /dev/null
@@ -103,10 +104,10 @@ references:
      command: |
        apk --update add curl yq
        cd /tmp
-        curl -LO https://releases.hashicorp.com/vault/1.13.2/vault_1.13.2_linux_amd64.zip
-        sha256sum vault_1.13.2_linux_amd64.zip | grep f7930279de8381de7c532164b4a4408895d9606c0d24e2e9d2f9acb5dfe99b3c
-        unzip vault_1.13.2_linux_amd64.zip
+        curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+        unzip vault_1.9.3_linux_amd64.zip
        mv vault /usr/bin/vault
+
 jobs:
  test_k8s:
    working_directory: ~/polaris
@@ -114,7 +115,6 @@ jobs:
    executor: vm
    steps:
      - checkout
-      - *set_environment_variables
      - *install_k8s
      - *test_k8s

@@ -128,6 +128,16 @@ jobs:
      - run: go test ./... -coverprofile=coverage.txt -covermode=count
      - *test_binary_dashboard

+  insights:
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
+    steps:
+      - checkout
+      - setup_remote_docker
+      - run:
+          name: Insights CI
+          command: curl -L https://insights.fairwinds.com/v0/insights-ci.sh | bash
+
  build_and_push:
    working_directory: /go/src/github.com/fairwindsops/polaris/
    resource_class: large
@@ -136,7 +146,7 @@ jobs:
      # The goreleaser image tag determins the version of Go.
      # Manually check goreleaser images for their version of Go.
      # Ref: https://hub.docker.com/r/goreleaser/goreleaser/tags
-      - image: goreleaser/goreleaser:v1.18.2
+      - image: goreleaser/goreleaser:v1.11.4
    steps:
      - checkout
      - setup_remote_docker:
@@ -147,7 +157,7 @@ jobs:
      - rok8s/get_vault_env:
          vault_path: repo/polaris/env
      - *set_environment_variables
-      - run: docker login quay.io -u="${FAIRWINDS_QUAY_USER}" -p="${FAIRWINDS_QUAY_TOKEN}"
+      - run: docker login quay.io -u="${fairwinds_quay_user}" -p="${fairwinds_quay_token}"
      - install_goreleaser_dependencies
      - run: scripts/goreleaser.sh

@@ -162,6 +172,16 @@ workflows:
              only: /.*/
      - build_and_push:
          context: org-global
+          requires:
+            - test
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+            tags:
+              ignore: /^testing-.*/
+      - insights:
+          requires:
+            - build_and_push
          filters:
            branches:
              ignore: /pull\/[0-9]+/
@@ -1,6 +1,6 @@
 # The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action

-FROM alpine:3.17
+FROM alpine:3.10

 RUN	apk add --no-cache \
  bash \
@@ -17,4 +17,4 @@ mkdir polaris
 tar -xzf $TARGET_FILE -C polaris
 rm $TARGET_FILE
 echo "polaris" >> $GITHUB_PATH
-echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT
+echo "::set-output name=version::$INPUT_VERSION"
@@ -7,7 +7,7 @@ jobs:
  build-int:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
      - name: Setup polaris
        uses: ./.github/actions/setup-polaris
        with:
@@ -18,7 +18,7 @@ jobs:
  build-ext:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
      - name: Setup polaris
        uses: fairwindsops/polaris/.github/actions/setup-polaris@master
        with:
@@ -23,6 +23,7 @@ Tiltfile
 main
 .DS_Store

+*-packr.go
 dist
 .vscode

@@ -11,6 +11,7 @@ env:
 before:
  hooks:
    - go mod download
+    - ./scripts/install-and-run-packr2.sh
 builds:
  - id: polaris
    ldflags:
@@ -1,2 +1,2 @@
 ## DO NOT EDIT - Managed by Terraform
-* @rbren @sudermanjr
+* @rbren @mggude
@@ -1,14 +1,4 @@
-FROM alpine:3.19
-
-LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
-      org.opencontainers.image.vendor="FairwindsOps, Inc." \
-      org.opencontainers.image.title="polaris" \
-      org.opencontainers.image.description="Polaris is a cli tool to help discover deprecated apiVersions in Kubernetes" \
-      org.opencontainers.image.documentation="https://polaris.docs.fairwinds.com/" \
-      org.opencontainers.image.source="https://github.com/FairwindsOps/polaris" \
-      org.opencontainers.image.url="https://github.com/FairwindsOps/polaris" \
-      org.opencontainers.image.licenses="Apache License 2.0"
-
+FROM alpine:3.17
 WORKDIR /usr/local/bin
 RUN apk -U upgrade
 RUN apk --no-cache add ca-certificates
@@ -38,9 +38,8 @@ and network with fellow Kubernetes users.
 or
 [join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!

-<a href="https://insights.fairwinds.com/auth/register/">
-  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png"
-  alt="Love Fairwinds Open Source? Automate Fairwinds Open Source for free with Fairwinds Insights. Click to learn more" />
+<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
 </a>

 ## Other Projects from Fairwinds
@@ -56,9 +55,9 @@ Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_
 If you're interested in running Polaris in multiple clusters,
 tracking the results over time, integrating with Slack, Datadog, and Jira,
 or unlocking other functionality, check out
-[Fairwinds Insights](https://fairwinds.com/pricing),
+[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris),
 a platform for auditing and enforcing policy in Kubernetes clusters.

-<a href="https://fairwinds.com/pricing">
+<a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
 </a>
@@ -5,6 +5,7 @@ target: PodSpec
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
+  required: ["serviceAccountName"]
  properties:
    serviceAccountName:
      type: string
@@ -14,11 +15,12 @@ schema:
        const: true
 additionalSchemaStrings:
  ServiceAccount: |
-    {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
    type: object
    required:
      - metadata
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
      - automountServiceAccountToken
+      {{ end }}
    properties:
      metadata:
        type: object
@@ -32,4 +34,3 @@ additionalSchemaStrings:
        type: boolean
        const: false
      {{ end }}
-    {{ end }}
@@ -37,10 +37,9 @@ schemaString: |
                const: "cluster-admin"
 additionalSchemaStrings:
  rbac.authorization.k8s.io/ClusterRole: |
-    {{ if (ne .roleRef.name "view") }}
-    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # Do not alert on default ClusterRoleBindings.
    type: object
+    # Do not alert on default ClusterRoleBindings.
+    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -87,4 +86,3 @@ additionalSchemaStrings:
                            - "patch"
                            - "delete"
    {{ end }}
-    {{ end }}
@@ -37,7 +37,6 @@ additionalSchemaStrings:
  rbac.authorization.k8s.io/ClusterRole: |
    type: object
    # Do not alert on default ClusterRoleBindings.
-    {{ if (ne .roleRef.name "view") }}
    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
@@ -81,4 +80,3 @@ additionalSchemaStrings:
                        - const: 'get'
                        - const: 'create'
    {{ end }}
-    {{ end }}
@@ -28,4 +28,4 @@ schema:

 mutations:
  - op: remove
-    path: /securityContext/capabilities/add
+    path: /securityContext/capabilities
@@ -1,6 +1,5 @@
-successMessage: Label app.kubernetes.io/instance matches metadata.name
-failureMessage: Label app.kubernetes.io/instance must match metadata.name
-category: Reliability
+successMessage: Label app.kubernetes.io/name matches metadata.name
+failureMessage: Label app.kubernetes.io/name must match metadata.name
 target: Controller
 schema:
  '$schema': http://json-schema.org/draft-07/schema
@@ -12,7 +11,7 @@ schema:
      properties:
        labels:
          type: object
-          required: ["app.kubernetes.io/instance"]
+          required: ["app.kubernetes.io/name"]
          properties:
-            app.kubernetes.io/instance:
+            app.kubernetes.io/name:
              const: "{{ .metadata.name }}"
@@ -9,18 +9,12 @@ schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
-    spec:
+    metadata:
      type: object
      properties:
-        template:
+        labels:
          type: object
-          properites:
-            metadata:
-              type: object
-              properties:
-                labels:
-                  type: object
-                  minProperties: 1
+          minProperties: 1
 additionalSchemaStrings:
  policy/PodDisruptionBudget: |
    type: object
@@ -36,7 +30,7 @@ additionalSchemaStrings:
              matchLabels:
                type: object
                anyOf:
-                {{ range $key, $value := .spec.template.metadata.labels }}
+                {{ range $key, $value := .metadata.labels }}
                - properties:
                    "{{ $key }}":
                      type: string
@@ -1,6 +1,6 @@
 successMessage: Priority class has been set
 failureMessage: Priority class should be set
-category: Reliability
+category: Security
 target: PodSpec
 schema:
  '$schema': http://json-schema.org/draft-07/schema
@@ -45,10 +45,10 @@ schemaString: |
                const: "cluster-admin"
 additionalSchemaStrings:
  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "ClusterRole" }}
    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -43,10 +43,10 @@ schemaString: |
              minLength: 1
 additionalSchemaStrings:
  rbac.authorization.k8s.io/ClusterRole: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "ClusterRole" }}
    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -46,10 +46,10 @@ schemaString: |
              minLength: 1
 additionalSchemaStrings:
  rbac.authorization.k8s.io/Role: |
+    type: object
+    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "Role" }}
    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -10,9 +10,7 @@ schemaString: |
      type: array
      items:
        type: object
-        anyOf:
-          - not:
-              required: ["value"]
+        oneOf:
          - required: ["name", "value"]
            properties:
              name:
@@ -17,21 +17,14 @@ package cmd
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
 	"os/exec"
-	"strings"

-	workloads "github.com/fairwindsops/insights-plugins/plugins/workloads"
-	workloadsPkg "github.com/fairwindsops/insights-plugins/plugins/workloads/pkg"
-
-	"github.com/fairwindsops/polaris/pkg/auth"
 	cfg "github.com/fairwindsops/polaris/pkg/config"
-	"github.com/fairwindsops/polaris/pkg/insights"
 	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
@@ -49,15 +42,9 @@ var (
 	resourceToAudit     string
 	useColor            bool
 	helmChart           string
-	helmValues          []string
-	helmSkipTests       bool
+	helmValues          string
 	checks              []string
 	auditNamespace      string
-	severityLevel       string
-	skipSslValidation   bool
-	uploadInsights      bool
-	clusterName         string
-	quiet               bool
 )

 func init() {
@@ -73,15 +60,9 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
-	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
-	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
+	auditCmd.PersistentFlags().StringVar(&helmValues, "helm-values", "", "Optional flag to add helm values")
 	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
 	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
-	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
-	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
-	auditCmd.PersistentFlags().BoolVar(&uploadInsights, "upload-insights", false, "Upload scan results to Fairwinds Insights")
-	auditCmd.PersistentFlags().StringVar(&clusterName, "cluster-name", "", "Set --cluster-name to a descriptive name for the cluster you're auditing")
-	auditCmd.PersistentFlags().BoolVar(&quiet, "quiet", false, "Suppress the 'upload to Insights' prompt.")
 }

 var auditCmd = &cobra.Command{
@@ -114,32 +95,14 @@ var auditCmd = &cobra.Command{
 		}
 		if helmChart != "" {
 			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)
 			if err != nil {
-				logrus.Errorf("Couldn't process helm chart: %v", err)
+				logrus.Infof("Couldn't process helm chart: %v", err)
 				os.Exit(1)
 			}
 		}
-		if uploadInsights && len(clusterName) == 0 {
-			logrus.Error("cluster-name is required when using --upload-insights")
-			os.Exit(1)
-		}
-		if uploadInsights {
-			if auditPath != "" {
-				logrus.Errorf("upload-insights and audit-path are not supported when used simultaneously")
-				os.Exit(1)
-			}
-			if !auth.IsLoggedIn() {
-				err := auth.HandleLogin(insightsHost)
-				if err != nil {
-					logrus.Errorf("error handling logging: %v", err)
-					os.Exit(1)
-				}
-			}
-		}

-		ctx := context.TODO()
-		k, err := kube.CreateResourceProvider(ctx, auditPath, resourceToAudit, config)
+		k, err := kube.CreateResourceProvider(context.TODO(), auditPath, resourceToAudit, config)
 		if err != nil {
 			logrus.Errorf("Error fetching Kubernetes resources %v", err)
 			os.Exit(1)
@@ -151,43 +114,7 @@ var auditCmd = &cobra.Command{
 			os.Exit(1)
 		}

-		if uploadInsights {
-			auth, err := auth.GetAuth(insightsHost)
-			if err != nil {
-				logrus.Errorf("getting auth: %v", err)
-				os.Exit(1)
-			}
-			// fetch workloads using workload plugin... or should we adapt the workloads from above?
-			dynamicClient, restMapper, clientSet, host, err := kube.GetKubeClient(ctx, "")
-			if err != nil {
-				logrus.Errorf("getting the kubernetes client: %v", err)
-				os.Exit(1)
-			}
-			k8sResources, err := workloadsPkg.CreateResourceProviderFromAPI(ctx, dynamicClient, restMapper, clientSet, host)
-			if err != nil {
-				logrus.Errorf("creating resource provider: %v", err)
-				os.Exit(1)
-			}
-
-			insightsClient := insights.NewHTTPClient(insightsHost, auth.Organization, auth.Token)
-			insightsReporter := insights.NewInsightsReporter(insightsClient)
-			wr := insights.WorkloadsReport{Version: workloads.Version, Payload: *k8sResources}
-			pr := insights.PolarisReport{Version: version, Payload: auditData}
-			logrus.Infof("Uploading to Fairwinds Insights organization '%s/%s'...", auth.Organization, clusterName)
-			err = insightsReporter.ReportAuditToFairwindsInsights(clusterName, wr, pr)
-			if err != nil {
-				logrus.Errorf("reporting audit file to insights: %v", err)
-				os.Exit(1)
-			}
-			os.Stderr.WriteString("\n\nSuccess! You can see your results at:")
-			os.Stderr.WriteString(fmt.Sprintf("\n\n%s/orgs/%s/clusters/%s/action-items\n\n", insightsHost, auth.Organization, clusterName))
-		} else {
-			outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests, severityLevel)
-			if !quiet {
-				os.Stderr.WriteString("\n\n🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:")
-				os.Stderr.WriteString("\n\n❯ polaris " + strings.Join(os.Args[1:], " ") + " --upload-insights --cluster-name=my-cluster\n\n")
-			}
-		}
+		outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests)

 		summary := auditData.GetSummary()
 		score := summary.GetScore()
@@ -202,7 +129,7 @@ var auditCmd = &cobra.Command{
 }

 // ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
+func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
 	cmd := exec.Command("helm", "dependency", "update", helmChart)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -216,16 +143,12 @@ func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests b
 	}
 	params := []string{
 		"template", helmChart,
-		"--generate-name",
+		helmChart,
 		"--output-dir",
 		dir,
 	}
-	for _, v := range helmValues {
-		params = append(params, "--values", v)
-	}
-
-	if helmSkipTests {
-		params = append(params, "--skip-tests")
+	if helmValues != "" {
+		params = append(params, "--values", helmValues)
 	}

 	cmd = exec.Command("helm", params...)
@@ -238,20 +161,10 @@ func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests b
 	return dir, nil
 }

-func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFormat string, useColor bool, onlyShowFailedTests bool, severityLevel string) {
+func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFormat string, useColor bool, onlyShowFailedTests bool) {
 	if onlyShowFailedTests {
 		auditData = auditData.RemoveSuccessfulResults()
 	}
-
-	if severityLevel != "" {
-		switch severityLevel {
-		case "danger":
-			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityDanger)
-		case "warning":
-			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityWarning)
-		}
-	}
-
 	var outputBytes []byte
 	var err error
 	if outputFormat == "score" {
@@ -289,13 +202,9 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 			} else {
 				req.Header.Set("Content-Type", "text/plain")
 			}
-
 			client := &http.Client{}
-			if skipSslValidation {
-				transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
-				client = &http.Client{Transport: transport}
-			}
 			resp, err := client.Do(req)
+
 			if err != nil {
 				logrus.Errorf("Error making request for output: %v", err)
 				os.Exit(1)
@@ -314,7 +223,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 		}

 		if outputFile != "" {
-			err := os.WriteFile(outputFile, outputBytes, 0644)
+			err := os.WriteFile(outputFile, []byte(outputBytes), 0644)
 			if err != nil {
 				logrus.Errorf("Error writing output to file: %v", err)
 				os.Exit(1)
@@ -1,81 +0,0 @@
-package cmd
-
-import (
-	"github.com/fairwindsops/polaris/pkg/auth"
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	rootCmd.AddCommand(authCmd)
-	authCmd.AddCommand(loginCmd)
-	authCmd.AddCommand(logoutCmd)
-	authCmd.AddCommand(statusCmd)
-	authCmd.AddCommand(tokenCmd)
-}
-
-var authCmd = &cobra.Command{
-	Use:   "auth",
-	Short: "Authenticate polaris with Fairwinds Insights",
-	Long:  `Authenticate polaris with Fairwinds Insights so better experience`,
-}
-
-var loginCmd = &cobra.Command{
-	Use:   "login",
-	Short: "Authenticate polaris with Fairwinds Insights.",
-	Long:  `Authenticate polaris with Fairwinds Insights.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.HandleLogin(insightsHost)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
-
-var logoutCmd = &cobra.Command{
-	Use:   "logout",
-	Short: "Log out of a Fairwinds Insights.",
-	Long:  `Log out of a Fairwinds Insights.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.HandleLogout()
-		if err != nil {
-			logrus.Fatal(err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
-
-var statusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "View authentication status.",
-	Long:  `View authentication status.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.PrintStatus(insightsHost)
-		if err != nil {
-			logrus.Fatalf("printing status: %v", err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
-
-var tokenCmd = &cobra.Command{
-	Use:   "token",
-	Short: "Print the auth token gh is configured to use.",
-	Long:  `Print the auth token gh is configured to use.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.PrintToken()
-		if err != nil {
-			logrus.Fatalf("printing token: %v", err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
@@ -54,11 +54,7 @@ var dashboardCmd = &cobra.Command{
 			auditData := validator.ReadAuditFromFile(loadAuditFile)
 			auditDataPtr = &auditData
 		}
-		router, err := dashboard.GetRouter(config, auditPath, serverPort, basePath, auditDataPtr)
-		if err != nil {
-			logrus.Fatalf("error creating router: %v", err)
-		}
-
+		router := dashboard.GetRouter(config, auditPath, serverPort, basePath, auditDataPtr)
 		router.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
 			w.Write([]byte("OK"))
 		})
@@ -15,17 +15,26 @@
 package cmd

 import (
-	"errors"
+	"fmt"
 	"os"
+	"path/filepath"
+	"strings"

-	"github.com/fairwindsops/polaris/pkg/fix"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )

+const templateLineMarker = "# POLARIS_FIX_TMPL"
+const templateOpenMarker = "POLARIS_OPEN_TMPL"
+const templateCloseMarker = "POLARIS_CLOSE_TMPL"
+
 var (
 	filesPath   string
 	checksToFix []string
+	fixAll      bool
 	isTemplate  bool
 )

@@ -43,14 +52,145 @@ var fixCommand = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		logrus.Debug("Setting up controller manager")

-		err := fix.Execute(config, filesPath, isTemplate, checksToFix...)
+		if filesPath == "" {
+			logrus.Error("Please specify a files-path flag")
+			cmd.Help()
+			os.Exit(1)
+		}
+		var yamlFiles []string
+		fileInfo, err := os.Stat(filesPath)
 		if err != nil {
-			if errors.Is(err, fix.ErrFilesPathRequired) {
-				logrus.Error("Please specify a files-path flag")
-				cmd.Help()
+			logrus.Error(err)
+			os.Exit(1)
+		}
+		if fileInfo.IsDir() {
+			baseDir := filesPath
+			if !strings.HasSuffix(filesPath, "/") {
+				baseDir = baseDir + "/"
+			}
+			yamlFiles, err = getYamlFiles(baseDir)
+			if err != nil {
+				logrus.Error(err)
 				os.Exit(1)
 			}
-			logrus.Fatal(err)
+		} else {
+			yamlFiles = append(yamlFiles, filesPath)
 		}
+
+		if len(checksToFix) > 0 {
+			if len(checksToFix) == 1 && checksToFix[0] == "all" {
+				allchecks := []string{}
+				for key := range config.Checks {
+					allchecks = append(allchecks, key)
+				}
+				config.Mutations = allchecks
+			} else if len(checksToFix) == 0 && checksToFix[0] == "none" {
+				config.Mutations = nil
+			} else {
+				config.Mutations = checksToFix
+			}
+		}
+
+		for _, fullFilePath := range yamlFiles {
+			yamlContent, err := os.ReadFile(fullFilePath)
+			if err != nil {
+				logrus.Fatalf("Error reading file with file path %s: %v", fullFilePath, err)
+			}
+
+			if err != nil {
+				logrus.Fatalf("Error marshalling %s: %v", fullFilePath, err)
+			}
+
+			if isTemplate {
+				yamlContent = []byte(detemplate(string(yamlContent)))
+			}
+			kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
+			results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
+			if err != nil {
+				logrus.Fatalf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+			}
+			allMutations := mutation.GetMutationsFromResults(results)
+
+			updatedYamlContent := ""
+			if len(allMutations) > 0 {
+				for _, resources := range kubeResources.Resources {
+					for _, resource := range resources {
+						key := fmt.Sprintf("%s/%s/%s", resource.Kind, resource.Resource.GetName(), resource.Resource.GetNamespace())
+						mutations := allMutations[key]
+						mutatedYamlContent, err := mutation.ApplyAllMutations(string(resource.OriginalObjectYAML), mutations)
+						if err != nil {
+							logrus.Errorf("Error applying schema mutations to the resource %s: %v", key, err)
+							os.Exit(1)
+						}
+						if updatedYamlContent != "" {
+							updatedYamlContent += "\n---\n"
+						}
+						updatedYamlContent += mutatedYamlContent
+					}
+				}
+			}
+
+			if isTemplate {
+				updatedYamlContent = retemplate(updatedYamlContent)
+			}
+
+			if updatedYamlContent != "" {
+				err = os.WriteFile(fullFilePath, []byte(updatedYamlContent), 0644)
+				if err != nil {
+					logrus.Fatalf("Error writing output to file: %v", err)
+				}
+			}
+		}
+
 	},
 }
+
+func detemplate(content string) string {
+	lines := strings.Split(content, "\n")
+	for idx, line := range lines {
+		lines[idx] = detemplateLine(line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+func retemplate(content string) string {
+	lines := strings.Split(content, "\n")
+	for idx, line := range lines {
+		lines[idx] = retemplateLine(line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+func detemplateLine(line string) string {
+	if !strings.HasPrefix(strings.TrimSpace(line), "{{") {
+		line = strings.ReplaceAll(line, "{", templateOpenMarker)
+		line = strings.ReplaceAll(line, "}", templateCloseMarker)
+		return line
+	}
+	tmplStart := strings.Index(line, "{{")
+	newLine := line[:tmplStart] + templateLineMarker + line[tmplStart:]
+	return newLine
+}
+
+func retemplateLine(line string) string {
+	if !strings.Contains(line, templateLineMarker) {
+		line = strings.ReplaceAll(line, templateOpenMarker, "{")
+		line = strings.ReplaceAll(line, templateCloseMarker, "}")
+		return line
+	}
+	return strings.Replace(line, templateLineMarker, "", 1)
+}
+
+func getYamlFiles(rootpath string) ([]string, error) {
+	var list []string
+	err := filepath.Walk(rootpath, func(path string, info os.FileInfo, err error) error {
+		if info.IsDir() {
+			return nil
+		}
+		if filepath.Ext(path) == ".yaml" || filepath.Ext(path) == ".yml" {
+			list = append(list, path)
+		}
+		return nil
+	})
+	return list, err
+}
@@ -16,25 +16,18 @@ package cmd

 import (
 	"os"
-	"strings"

 	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )

-var (
-	configPath                   string
-	disallowExemptions           bool
-	disallowConfigExemptions     bool
-	disallowAnnotationExemptions bool
-	fixChecks                    bool
-	logLevel                     string
-	auditPath                    string
-	displayName                  string
-	kubeContext                  string
-	insightsHost                 string
-)
+var configPath string
+var disallowExemptions, disallowConfigExemptions, disallowAnnotationExemptions, fixChecks bool
+var logLevel string
+var auditPath string
+var displayName string
+var kubeContext string

 var (
 	version string
@@ -48,7 +41,6 @@ func init() {
 	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level to be output (trace, debug, info, warning, error, fatal, panic).")
-	rootCmd.PersistentFlags().StringVar(&insightsHost, "insights-host", "https://insights.fairwinds.com", "Fairwinds Insights host URL")
 }

 var config conf.Configuration
@@ -84,11 +76,6 @@ var rootCmd = &cobra.Command{
 		}
 		os.Exit(1)
 	},
-	PersistentPostRun: func(cmd *cobra.Command, args []string) {
-		if !strings.HasPrefix(cmd.Use, "audit") {
-			os.Stderr.WriteString("\n\nWant more? Automate Polaris for free with Fairwinds Insights!\n🚀 https://fairwinds.com/insights-signup/polaris 🚀 \n")
-		}
-	},
 }

 // Execute the stuff
@@ -31,7 +31,4 @@ var versionCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		fmt.Println("Polaris version:" + version)
 	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
 }
@@ -24,7 +24,6 @@ import (
 	k8sConfig "sigs.k8s.io/controller-runtime/pkg/client/config"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
 )

 var webhookPort int
@@ -52,12 +51,6 @@ var webhookCmd = &cobra.Command{
 		mgr, err := manager.New(k8sConfig.GetConfigOrDie(), manager.Options{
 			CertDir: certDir,
 			Port:    webhookPort,
-			WebhookServer: webhook.NewServer(webhook.Options{
-				CertDir:  certDir,
-				Port:     webhookPort,
-				CertName: "tls.crt",
-				KeyName:  "tls.key",
-			}),
 		})
 		if err != nil {
 			logrus.Errorf("Unable to set up overall controller manager: %v", err)
@@ -68,6 +61,9 @@ var webhookCmd = &cobra.Command{
 		if os.IsNotExist(err) {
 			panic("Cert does not exist")
 		}
+		server := mgr.GetWebhookServer()
+		server.CertName = "tls.crt"
+		server.KeyName = "tls.key"

 		if !enableMutations && !enableValidations {
 			logrus.Errorf("One of --mutate or --validate must be set to true")
@@ -75,10 +71,10 @@ var webhookCmd = &cobra.Command{
 		}

 		if enableValidations {
-			fwebhook.NewValidateWebhook(mgr, config)
+			fwebhook.NewValidateWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
 		}
 		if enableMutations {
-			fwebhook.NewMutateWebhook(mgr, config)
+			fwebhook.NewMutateWebhook(mgr, fwebhook.Mutator{Config: config, Client: mgr.GetClient()})
 		}
 		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
 		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
@@ -27,3 +27,26 @@ new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
 j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
 })(window,document,'script','dataLayer','GTM-TM95WXQ');
+
+!function() {
+  var t = window.driftt = window.drift = window.driftt || [];
+  if (!t.init) {
+    if (t.invoked) return void (window.console && console.error && console.error("Drift snippet included twice."));
+    t.invoked = !0, t.methods = [ "identify", "config", "track", "reset", "debug", "show", "ping", "page", "hide", "off", "on" ],
+    t.factory = function(e) {
+      return function() {
+        var n = Array.prototype.slice.call(arguments);
+        return n.unshift(e), t.push(n), t;
+      };
+    }, t.methods.forEach(function(e) {
+      t[e] = t.factory(e);
+    }), t.load = function(t) {
+      var e = 3e5, n = Math.ceil(new Date() / e) * e, o = document.createElement("script");
+      o.type = "text/javascript", o.async = !0, o.crossorigin = "anonymous", o.src = "https://js.driftt.com/include/" + n + "/" + t + ".js";
+      var i = document.getElementsByTagName("script")[0];
+      i.parentNode.insertBefore(o, i);
+    };
+  }
+}();
+drift.SNIPPET_VERSION = '0.3.1';
+drift.load('dp7v3zbc7xhm');
@@ -53,30 +53,9 @@ This means Polaris will remediate the issue it finds, rather than rejecting
 the deployment.

 To enable the mutating webhook, add `--set webhook.mutate=true` to your
-Helm installation command.
+Helm instlallation command.

-The following default checks currently have mutation support enabled:
-* `hostPIDSet`
-* `hostNetworkSet`
-* `hostIPCSet`
-* `priorityClassNotSet`
-* `hostPortSet`
-* `pullPolicyNotAlways`
-* `deploymentMissingReplicas`
-* `dangerousCapabilities`
-* `cpuLimitsMissing`
-* `memoryLimitsMissing`
-* `livenessProbeMissing`
-* `memoryRequestsMissing`
-* `cpuRequestsMissing`
-* `runAsPrivileged`
-* `readinessProbeMissing`
-* `privilegeEscalationAllowed`
-* `notReadOnlyRootFilesystem`
-* `insecureCapabilities`
-* `runAsRootAllowed`
-
-If you'd like to
+By default, the only mutation enabled is `pullPolicyNotAlways`. If you'd like to
 enable other mutations, you can set the `webhook.mutations` flag.


@@ -5,44 +5,6 @@ meta:
    content: "Fairwinds Polaris | Changelog"

 ---
-
-## Unreleased
-* Change `metadataAndNameMismatched` to `metadataAndInstanceMismatched`
-
-## 8.1.1
-* Add category for `metadataAndNameMismatched`.
-* Fix category for `priorityClassNotSet`.
-
-## 8.1.0
-* Add `insights-host` global flag to configure Fairwinds Insights host (defaults to `https://insights.fairwinds.com`).
-* Add new `auth` sub-commands be able to authenticate on Polaris using Fairwinds Insights credentials
-  - `login` - login using Fairwinds Insights credentials via the web interface or provide a token
-  - `logout` - logout from Fairwinds Insights
-  - `status` - show relevant information regarding login state
-  - `token` - prints the token from local storage
-* Add new `audit` flags to be able to upload Workloads and Polaris results to Fairwinds Insights
-  - `upload-insights` - indicates that the results should be uploaded to Fairwinds Insights. (defaults to `false`)
-  - `cluster-name`  - cluster name that the results belongs to. Creates the cluster if it does not exist. (required if `upload-insights` is used) 
-
-
-## 8.0.0
-* Change default severity from `ignore` to `warning` for `priorityClassNotSet`, `metadataAndNameMismatched`, `missingPodDisruptionBudget`, `automountServiceAccountToken`, `missingNetworkPolicy` checks.
-* Change default severity from `warning` to `danger` for `sensitiveContainerEnvVar`, `sensitiveConfigmapContent`, `clusterrolePodExecAttach`, `rolePodExecAttach`, `clusterrolebindingPodExecAttach`, `rolebindingClusterRolePodExecAttach`, `rolebindingRolePodExecAttach`,`clusterrolebindingClusterAdmin`,`rolebindingClusterAdminClusterRole`,`rolebindingClusterAdminRole` checks.
-
-## 7.4.0
-* Skip https certificate verification (#920)
-
-## 7.3.0
-* Add a check for `topologySpreadConstraint` (#879)
-
-## 7.2.0
-* Enable new RBAC / sensitive content / Pod exec checks, add `hasPrefix` and `hasSuffix` functions to the GO template, exempt `system:` name prefixes for RBAC checks, sensitive content checks ignore `valueFrom`, (#832)
-
-## 7.1.0
-* Let Polaris modify YAML without losing comments/formatting (#821)
-* Add checks for RBAC allowing exec or attaching to a Pod (#820)
-* Add `clusterrolebindingClusterAdmin`, `rolebindingClusterAdminRole`, and `rolebindingClusterAdminClusterRole` checks + schema tests (#823)
-
 ## 7.0.2
 * Fixes for pretty CLI output
 * Some new checks (disabled by default)
@@ -195,7 +157,7 @@ JSON schema (see changes to `./checks/multipleReplicasForDeployment.yaml`)
 * Docker image now includes the default config

 ### Breaking Changes
-* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/examples) for examples of the new formats.
+* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/examples) for examples of the new formats.
    * removed config-level configuration for checks like max/min memory settings
    * changed severity `error` to `danger`
 * Breaking changes to the CLI
@@ -14,55 +14,22 @@ key | default | description
 `livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
 `tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
 `pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
-`priorityClassNotSet` | `warning` | Fails when a priorityClassName is not set for a pod.
+`priorityClassNotSet` | `ignore` | Fails when a priorityClassName is not set for a pod.
 `deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
-`missingPodDisruptionBudget` | `warning` | Fails when PDB is missing.
-`metadataAndInstanceMismatched` | `warning` | Fails when label `app.kubernetes.io/instance` and `metadata.name` mismatch
-`topologySpreadConstraint` | `warning` | Fails when there is no topology spread constraint on the pod
+`missingPodDisruptionBudget` | `ignore` 

 ## Background

-### Liveness and Readiness Probes
 Readiness and liveness probes can help maintain the health of applications running inside Kubernetes. By default, Kubernetes only knows whether or not a process is running, not if it's healthy. Properly configured readiness and liveness probes will also be able to ensure the health of an application.

 Readiness probes are designed to ensure that an application has reached a "ready" state. In many cases there is a period of time between when a webserver process starts and when it is ready to receive traffic. A readiness probe can ensure the traffic is not sent to a pod until it is actually ready to receive traffic.

 Liveness probes are designed to ensure that an application stays in a healthy state. When a liveness probe fails, the pod will be restarted.

-### Image Pull Policy
 Docker's `latest` tag is applied by default to images where a tag hasn't been specified. Not specifying a specific version of an image can lead to a wide variety of problems. The underlying image could include unexpected breaking changes that break your application whenever the latest image is pulled. Reusing the same tag for multiple versions of an image can lead to different nodes in the same cluster having different versions of an image, even if the tag is identical.

 Related to that, relying on cached versions of a Docker image can become a security vulnerability. By default, an image will be pulled if it isn't already cached on the node attempting to run it. This can result in variations in images that are running per node, or potentially provide a way to gain access to an image without having direct access to the ImagePullSecret. With that in mind, it's often better to ensure the a pod has `pullPolicy: Always` specified, so images are always pulled directly from their source.

-### Topology Spread Constraints
-
-By default, the Kubernetes scheduler uses a bin-packing algorithm to fit as many pods as possible into a cluster. The scheduler prefers a more evenly distributed general node load to app replicas precisely spread across nodes. Therefore, by default, multi-replica is not guaranteed to be spread across multiple availability zones. Kubernetes provides topologySpreadConstraint configuration in order to better ensure pod spread across multiple AZs and/or Hosts.
-
-Example of a topologySpreadConstraint spreading across zones:
-
-```
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: demo-basic-demo
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: basic-demo
-      app.kubernetes.io/instance: demo
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: basic-demo
-        app.kubernetes.io/instance: demo
-    spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: "topology.kubernetes.io/zone"
-          whenUnsatisfiable: ScheduleAnyway
-```
-
-
 ## Further Reading

 - [What's Wrong With The Docker :latest Tag?](https://vsupalov.com/docker-latest-tag/)
@@ -70,4 +37,3 @@ spec:
 - [Kubernetes Docs: Configure Liveness and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
 - [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
 - [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)
- [Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
@@ -11,30 +11,17 @@ for privilege escalation.

 key | default | description
 ----|---------|------------
-`automountServiceAccountToken` | `warning` | Fails when `automountServiceAccountToken` is automounted.
 `hostIPCSet` | `danger` | Fails when `hostIPC` attribute is configured.
 `hostPIDSet` | `danger` | Fails when `hostPID` attribute is configured.
-`linuxHardening` | `danger` | Fails when neither `AppArmor`, `Seccomp`, `SELinux`, or dropping Linux Capabilities is in use.
 `notReadOnlyRootFilesystem` | `warning` | Fails when `securityContext.readOnlyRootFilesystem` is not true.
 `privilegeEscalationAllowed` | `danger` | Fails when `securityContext.allowPrivilegeEscalation` is true.
 `runAsRootAllowed` | `warning` | Fails when `securityContext.runAsNonRoot` is not true.
 `runAsPrivileged` | `danger` | Fails when `securityContext.privileged` is true.
-`insecureCapabilities` | `warning` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks/insecureCapabilities.yaml)
-`dangerousCapabilities` | `danger` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks/dangerousCapabilities.yaml)
+`insecureCapabilities` | `warning` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/checks/insecureCapabilities.yaml)
+`dangerousCapabilities` | `danger` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/checks/dangerousCapabilities.yaml)
 `hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
 `hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
 `tlsSettingsMissing` | `warning` | Fails when an Ingress lacks TLS settings.
-`sensitiveContainerEnvVar` | `danger` | Fails when the container sets potentially sensitive environment variables.
-`sensitiveConfigmapContent` | `danger` | Fails when potentially sensitive content is detected in the ConfigMap keys or values.
-`missingNetworkPolicy` | `warning`
-`clusterrolePodExecAttach` | `danger` | Fails when the ClusterRole allows Pods/exec or pods/attach.
-`rolePodExecAttach` | `danger` | Fails when the Role allows Pods/exec or pods/attach.
-`clusterrolebindingPodExecAttach` | `danger` | Fails when the ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
-`rolebindingRolePodExecAttach` | `danger` | Fails when the RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist.
-`rolebindingClusterRolePodExecAttach` | `danger` | Fails when the RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
-`clusterrolebindingClusterAdmin` | `danger` | Fails when the ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
-`rolebindingClusterAdminClusterRole` | `danger` | Fails when the RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
-`rolebindingClusterAdminRole` | `danger` | Fails when the RoleBinding references a Role with wildcard permissions.

 ## Background

@@ -9,18 +9,14 @@ meta:
 # top-level commands
 audit
      Runs a one-time audit.
-auth
-      Authenticate polaris with Fairwinds Insights
 dashboard
      Runs the webserver for Polaris dashboard.
-fix
-      Fix Infrastructure as code files.
 help
      Prints help, if you give it a command then it will print help for that command. Same as -h
 version
      Prints the version of Polaris
 webhook
-      Runs the webhook webserver.
+      Runs the webhook webserver

 # global flags
 -c, --config string                    Location of Polaris configuration file.
@@ -29,7 +25,6 @@ webhook
    --disallow-config-exemptions       Disallow exemptions set within the configuration file.
    --disallow-annotation-exemptions   Disallow any exemption defined as a controller annotation.
    --kubeconfig string                Paths to a kubeconfig. Only required if out-of-cluster.
-    --insights-host string             Fairwinds Insights host URL. (default "https://insights.fairwinds.com")
    --log-level string                 Logrus log level. (default "info")

 # dashboard flags
@@ -43,48 +38,24 @@ webhook

 # audit flags
    --audit-path string               If specified, audits one or more YAML files instead of a cluster.
-    --checks strings                  Optional flag to specify specific checks to check
-    --cluster-name string             Set --cluster-name to a descriptive name for the cluster you're auditing
+    --checks stringArray              Optional flag to specify specific checks to check
    --color                           Whether to use color in pretty format. (default true)
    --display-name string             An optional identifier for the audit.
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
    --helm-chart string               Will fill out Helm template
    --helm-values string              Optional flag to add helm values
-    --helm-skip-tests bool            Corresponds to --skip-tests of helm template
 -h, --help                            help for audit
    --namespace string                Namespace to audit. Only applies to in-cluster audits
    --only-show-failed-tests          If specified, audit output will only show failed tests.
    --output-file string              Destination file for audit results.
    --output-url string               Destination URL to send audit results.
-    --quiet                           Suppress the 'upload to Insights' prompt.
    --resource string                 Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.
    --set-exit-code-below-score int   Set an exit code of 4 when the score is below this threshold (1-100).
    --set-exit-code-on-danger         Set an exit code of 3 when the audit contains danger-level issues.
-    --severity string                 Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)
-    --skip-ssl-validation             Skip https certificate verification
-    --upload-insights                 Upload scan results to Fairwinds Insights
-
-# fix flags
-    --checks strings      Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations
-    --files-path string   mutate and fix one or more YAML files in a specified folder
-h, --help                help for fix
-    --template            set to true when modifyng a YAML template, like a Helm chart (experimental)
-

 # webhook flags
    --disable-webhook-config-installer   disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.
 -h, --help                               help for webhook
 -p, --port int                           Port for the dashboard webserver. (default 9876)
-
-# auth sub-commands
-  login       Authenticate polaris with Fairwinds Insights.
-  logout      Log out of a Fairwinds Insights.
-  status      View authentication status.
-  token       Print the auth token gh is configured to use.
 ```

-#### Suppressing 'upload to Insights' output
-
-When running the `polaris audit` subcommand, you can suppress the following output using the `--quiet flag`:
-
-> 🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:
@@ -49,7 +49,8 @@ kind create cluster --wait=90s --image kindest/node:v1.15.11 --name polaris-test
 docker build -t quay.io/fairwinds/polaris:debug . # or use your own registry
 docker push quay.io/fairwinds/polaris:debug
 helm repo add jetstack https://charts.jetstack.io
- helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait
+kubectl create ns cert-manager
+helm install cert-manager jetstack/cert-manager --namespace cert-manager --version 0.16.1 --set "installCRDs=true" --wait
 POLARIS_IMAGE=quay.io/fairwinds/polaris:debug ./test/webhook_test.sh
 ```
 to avoid the final cleanup for debugging purposes, you can run
@@ -5,7 +5,7 @@ meta:
 ---
 # Configuration

-The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/pkg/config/default.yaml).
+The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/examples/config.yaml).

 You can customize the configuration to do things like:
 * Turn checks [on and off](checks.md)
@@ -7,7 +7,7 @@ meta:

 If you'd like to create your own checks, you can use [JSON Schema](https://json-schema.org/).
 This is how built-in Polaris checks are defined as well - you can see all the built-in checks
-in the [checks folder](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks) for examples.
+in the [checks folder](https://github.com/FairwindsOps/polaris/tree/master/checks) for examples.

 If you write a check that could be useful for others, feel free to open a PR to add it in!

@@ -6,17 +6,11 @@ checks:
  pullPolicyNotAlways: warning
  readinessProbeMissing: warning
  livenessProbeMissing: warning
-  topologySpreadConstraint: warning
-  pdbDisruptionsIsZero: warning
-  missingPodDisruptionBudget: warning
-  metadataAndInstanceMismatched: warning
-
  # efficiency
  cpuRequestsMissing: warning
  cpuLimitsMissing: warning
  memoryRequestsMissing: warning
  memoryLimitsMissing: warning
-
  # security
  automountServiceAccountToken: warning
  hostIPCSet: danger
@@ -31,7 +25,6 @@ checks:
  insecureCapabilities: warning
  hostNetworkSet: danger
  hostPortSet: warning
-  tlsSettingsMissing: warning
  sensitiveContainerEnvVar: danger
  sensitiveConfigmapContent: danger
  clusterrolePodExecAttach: danger
@@ -46,6 +39,7 @@ checks:
  resourceLimits: warning
  imageRegistry: danger

+  
 exemptions:
  - controllerNames:
    - my-network-controller
@@ -1,28 +1,26 @@
 checks:
  # reliability
  deploymentMissingReplicas: warning
-  priorityClassNotSet: warning
+  priorityClassNotSet: ignore
  tagNotSpecified: danger
  pullPolicyNotAlways: warning
  readinessProbeMissing: warning
  livenessProbeMissing: warning
-  metadataAndInstanceMismatched: warning
+  metadataAndNameMismatched: ignore
  pdbDisruptionsIsZero: warning
-  missingPodDisruptionBudget: warning
-  topologySpreadConstraint: warning
+  missingPodDisruptionBudget: ignore

  # efficiency
  cpuRequestsMissing: warning
  cpuLimitsMissing: warning
  memoryRequestsMissing: warning
  memoryLimitsMissing: warning
-  
  # security
-  automountServiceAccountToken: warning
+  automountServiceAccountToken: ignore
  hostIPCSet: danger
  hostPIDSet: danger
  linuxHardening: warning
-  missingNetworkPolicy: warning
+  missingNetworkPolicy: ignore
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
  runAsRootAllowed: danger
@@ -32,16 +30,17 @@ checks:
  hostNetworkSet: danger
  hostPortSet: warning
  tlsSettingsMissing: warning
-  sensitiveContainerEnvVar: danger
-  sensitiveConfigmapContent: danger
-  clusterrolePodExecAttach: danger
-  rolePodExecAttach: danger
-  clusterrolebindingPodExecAttach: danger
-  rolebindingClusterRolePodExecAttach: danger
-  rolebindingRolePodExecAttach: danger
-  clusterrolebindingClusterAdmin: danger
-  rolebindingClusterAdminClusterRole: danger
-  rolebindingClusterAdminRole: danger
+  # These are initially warning and will later be promoted to danger.
+  sensitiveContainerEnvVar: warning
+  sensitiveConfigmapContent: warning
+  clusterrolePodExecAttach: warning
+  rolePodExecAttach: warning
+  clusterrolebindingPodExecAttach: warning
+  rolebindingClusterRolePodExecAttach: warning
+  rolebindingRolePodExecAttach: warning
+  clusterrolebindingClusterAdmin: warning
+  rolebindingClusterAdminClusterRole: warning
+  rolebindingClusterAdminRole: warning


 mutations:
@@ -1,81 +1,95 @@
 module github.com/fairwindsops/polaris

-go 1.20
+go 1.19

 require (
-	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/fairwindsops/controller-utils v0.3.0
-	github.com/fairwindsops/insights-plugins/plugins/workloads v0.0.0-20230601204422-5c789e15990c
-	github.com/fatih/color v1.15.0
+	github.com/fatih/color v1.13.0
+	github.com/gobuffalo/packr/v2 v2.8.3
 	github.com/gorilla/mux v1.8.0
-	github.com/pkg/errors v0.9.1
-	github.com/qri-io/jsonschema v0.1.2
-	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cobra v1.8.0
-	github.com/stretchr/testify v1.8.4
-	github.com/thoas/go-funk v0.9.3
-	gomodules.xyz/jsonpatch/v2 v2.3.0
+	github.com/qri-io/jsonschema v0.1.1
+	github.com/sirupsen/logrus v1.9.0
+	github.com/spf13/cobra v1.6.1
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/testify v1.8.1
+	github.com/thoas/go-funk v0.9.2
+	golang.org/x/text v0.4.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.29.0
-	k8s.io/apimachinery v0.29.0
-	k8s.io/client-go v0.29.0
-	sigs.k8s.io/controller-runtime v0.15.0
+	k8s.io/api v0.25.3
+	k8s.io/apimachinery v0.25.3
+	k8s.io/client-go v0.25.3
+	sigs.k8s.io/controller-runtime v0.13.0
 	sigs.k8s.io/yaml v1.3.0
 )

 require (
+	github.com/pkg/errors v0.9.1
+	gomodules.xyz/jsonpatch/v2 v2.2.0
+)
+
+require (
+	cloud.google.com/go/compute v1.10.0 // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.1 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
-	github.com/go-logr/logr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/gobuffalo/logger v1.0.7 // indirect
+	github.com/gobuffalo/packd v1.0.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/gnostic v0.6.9 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
+	github.com/karrick/godirwalk v1.17.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/markbates/errx v1.1.0 // indirect
+	github.com/markbates/oncer v1.0.0 // indirect
+	github.com/markbates/safe v1.0.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.15.1 // indirect
-	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/prometheus/client_golang v1.13.0 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.37.0 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/qri-io/jsonpointer v0.1.1 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/oauth2 v0.10.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/crypto v0.0.0-20221012134737-56aed061732a // indirect
+	golang.org/x/net v0.0.0-20221017152216-f25eb7ecb193 // indirect
+	golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783 // indirect
+	golang.org/x/sys v0.1.0 // indirect
+	golang.org/x/term v0.0.0-20221017184919-83659145692c // indirect
+	golang.org/x/time v0.1.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/component-base v0.27.2 // indirect
-	k8s.io/klog/v2 v2.110.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	k8s.io/component-base v0.25.3 // indirect
+	k8s.io/klog/v2 v2.80.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
+	k8s.io/utils v0.0.0-20221012122500-cfd413dd9e85 // indirect
+	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )
@@ -1,53 +0,0 @@
-package auth
-
-import (
-	"errors"
-	"io"
-	"os"
-
-	"github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v3"
-)
-
-var userHomeDir string
-var polarisHostsFilepath string
-
-var ErrNotLoggedIn = errors.New("not logged in")
-
-func init() {
-	var err error
-	userHomeDir, err = os.UserHomeDir()
-	if err != nil {
-		logrus.Fatalf("reading user home dir: %v", err)
-	}
-	polarisHostsFilepath = userHomeDir + "/.config/polaris/hosts.yaml"
-}
-
-func readPolarisHostsFile() (map[string]Host, error) {
-	f, err := os.Open(polarisHostsFilepath)
-	if err != nil {
-		return nil, err
-	}
-	b, err := io.ReadAll(f)
-	if err != nil {
-		return nil, err
-	}
-
-	content := map[string]Host{}
-	err = yaml.Unmarshal(b, &content)
-	return content, err
-}
-
-func GetAuth(insightsHost string) (*Host, error) {
-	hosts, err := readPolarisHostsFile()
-	if err != nil {
-		return nil, err
-	}
-	if len(hosts) == 0 {
-		return nil, ErrNotLoggedIn
-	}
-	if h, ok := hosts[insightsHost]; ok {
-		return &h, nil
-	}
-	return nil, ErrNotLoggedIn
-}
@@ -1,45 +0,0 @@
-package auth
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"runtime"
-	"strings"
-
-	"github.com/sirupsen/logrus"
-)
-
-// openBrowser opens up the provided URL in a browser
-func openBrowser(url string) error {
-	var cmd *exec.Cmd
-	switch runtime.GOOS {
-	case "openbsd":
-		fallthrough
-	case "linux":
-		cmd = exec.Command("xdg-open", url)
-	case "darwin":
-		cmd = exec.Command("open", url)
-	case "windows":
-		r := strings.NewReplacer("&", "^&")
-		cmd = exec.Command("cmd", "/c", "start", r.Replace(url))
-	}
-	if cmd != nil {
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-		err := cmd.Start()
-		if err != nil {
-			logrus.Printf("Failed to open browser due to error %v", err)
-			return fmt.Errorf("Failed to open browser: " + err.Error())
-		}
-		err = cmd.Wait()
-		if err != nil {
-			logrus.Printf("Failed to wait for open browser command to finish due to error %v", err)
-			return fmt.Errorf("Failed to wait for open browser command to finish: " + err.Error())
-		}
-		return nil
-	} else {
-		return errors.New("unsupported platform")
-	}
-}
@@ -1,291 +0,0 @@
-package auth
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/fairwindsops/polaris/pkg/insights"
-	"github.com/gorilla/mux"
-	"github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v3"
-)
-
-const loginPath = "/auth/login"
-const registerPath = "/auth/register"
-
-const (
-	loginUsingBrowser          = "Login with a web browser"
-	pasteAnAuthenticationToken = "Paste an authentication token"
-)
-
-type paramsOrError struct {
-	token        string
-	user         string
-	organization string
-	err          error
-}
-
-type Host struct {
-	Token        string `yaml:"token"`
-	User         string `yaml:"user"`
-	Organization string `yaml:"organization"`
-}
-
-var paramsOrErrorChan = make(chan paramsOrError)
-
-func HandleLogin(insightsHost string) error {
-	if _, err := os.Stat(polarisHostsFilepath); err == nil {
-		content, err := readPolarisHostsFile()
-		if err != nil {
-			return fmt.Errorf("reading polaris hosts file: %w", err)
-		}
-
-		if len(content) > 0 {
-			if h, ok := content[insightsHost]; ok {
-				c := insights.NewHTTPClient(insightsHost, h.Organization, h.Token)
-				isValid, err := c.IsTokenValid()
-				if err != nil {
-					return err
-				}
-				if isValid {
-					var reAuthenticate bool
-					err = survey.AskOne(&survey.Confirm{Message: fmt.Sprintf("You're already logged into %s. Do you want to re-authenticate?", insightsHost)}, &reAuthenticate)
-					if err != nil {
-						return fmt.Errorf("prompting re-authenticate: %w", err)
-					}
-					if !reAuthenticate {
-						// bail-out
-						return nil
-					}
-				}
-			}
-		}
-	}
-
-	selection := &survey.Select{
-		Message: "How would you like to authenticate Polaris?",
-		Options: []string{loginUsingBrowser, pasteAnAuthenticationToken},
-		Default: loginUsingBrowser,
-	}
-
-	var answer string
-	err := survey.AskOne(selection, &answer)
-	if err != nil {
-		return fmt.Errorf("asking how to authenticate: %w", err)
-	}
-
-	var user, token, organization string
-	if answer == loginUsingBrowser {
-		listener, err := net.Listen("tcp", "localhost:0")
-		if err != nil {
-			panic(err)
-		}
-		localServerPort := listener.Addr().(*net.TCPAddr).Port
-		url := fmt.Sprintf(insightsHost + registerPath + "?source=polaris&callbackUrl=" + fmt.Sprintf("http://localhost:%d/auth/login/callback", localServerPort))
-		err = openBrowser(url)
-		if err != nil {
-			logrus.Warnf("could not open browser: %v", err)
-			logrus.Infoln("paste the link below into your browser:")
-			os.Stdout.Write([]byte(url + "\n"))
-		}
-
-		var router *mux.Router
-		go func() {
-			router = mux.NewRouter()
-			router.HandleFunc("/auth/login/callback", callbackHandler(insightsHost, localServerPort))
-			if err := http.Serve(listener, router); err != nil {
-				paramsOrErrorChan <- paramsOrError{err: fmt.Errorf("starting the local http server: %w", err)}
-			}
-		}()
-
-		// wait the browser to callback the local server
-		paramOrError := <-paramsOrErrorChan
-
-		if paramOrError.err != nil {
-			return paramOrError.err
-		}
-
-		user = paramOrError.user
-		organization = paramOrError.organization
-		token = paramOrError.token
-	} else {
-		var answer string
-		var bot bot
-		err := survey.AskOne(&survey.Password{Message: "Paste your authentication token:"}, &answer, survey.WithValidator(validateToken(insightsHost, &bot)))
-		if err != nil {
-			return fmt.Errorf("asking how to authenticate: %w", err)
-		}
-		token = answer
-		user = bot.Name
-		organization = bot.Organization
-	}
-
-	polarisCfgDir := filepath.Join(userHomeDir, ".config", "polaris")
-	err = os.MkdirAll(polarisCfgDir, os.ModePerm)
-	if err != nil {
-		return fmt.Errorf("creating polaris config dir: %w", err)
-	}
-
-	content := map[string]Host{insightsHost: {Token: token, User: user, Organization: organization}}
-	b, err := yaml.Marshal(content)
-	if err != nil {
-		return fmt.Errorf("marshalling yaml data: %w", err)
-	}
-
-	err = os.WriteFile(polarisHostsFilepath, b, os.ModePerm)
-	if err != nil {
-		return fmt.Errorf("writing data to file: %w", err)
-	}
-
-	logrus.Debugf("hosts file has been saved")
-
-	fmt.Println("✓ Authentication complete.")
-	fmt.Printf("✓ Logged in organization %s as %s.\n", organization, user)
-	return nil
-}
-
-func fetchAuthToken(insightsHost, organization, code string) (string, error) {
-	authTokenURL := fmt.Sprintf("%s/v0/organizations/%s/auth/token", insightsHost, organization)
-	body := map[string]any{"grantType": "authorization_code", "code": code}
-	b, err := json.Marshal(body)
-	if err != nil {
-		return "", err
-	}
-
-	r, err := http.NewRequest("POST", authTokenURL, bytes.NewBuffer(b))
-	if err != nil {
-		return "", err
-	}
-	r.Header.Add("Content-Type", "application/json")
-
-	res, err := http.DefaultClient.Do(r)
-	if err != nil {
-		return "", err
-	}
-	defer res.Body.Close()
-
-	if res.StatusCode < 200 || res.StatusCode >= 400 {
-		return "", fmt.Errorf("expected 200 OK - received %s", res.Status)
-	}
-
-	var rBody map[string]any
-	err = json.NewDecoder(res.Body).Decode(&rBody)
-	if err != nil {
-		return "", err
-	}
-
-	token, ok := rBody["accessToken"].(string)
-	if !ok {
-		return "", fmt.Errorf("unable to parse accessToken from response body: %v", rBody)
-	}
-
-	return token, nil
-}
-
-func callbackHandler(insightsHost string, localServerPort int) func(w http.ResponseWriter, r *http.Request) {
-	return func(w http.ResponseWriter, r *http.Request) {
-		// checks for error in the params
-		errMsg := r.URL.Query().Get("error")
-		if len(errMsg) > 0 {
-			errDescriptionMsg := r.URL.Query().Get("error_description")
-			fmt.Fprintf(w, "unable to perform integration: %s - %s", errMsg, errDescriptionMsg)
-			paramsOrErrorChan <- paramsOrError{err: fmt.Errorf("%s - %s", errMsg, errDescriptionMsg)}
-			return
-		}
-
-		var err error
-		code := r.URL.Query().Get("code")
-		if len(code) == 0 {
-			err = errors.New("code query param is required in callback")
-		}
-		user := r.URL.Query().Get("user")
-		if len(user) == 0 {
-			err = errors.New("user query param is required in callback")
-		}
-		organization := r.URL.Query().Get("organization")
-		if len(organization) == 0 {
-			err = errors.New("organization query param is required in callback")
-		}
-		token, err := fetchAuthToken(insightsHost, organization, code)
-		if err != nil {
-			err = fmt.Errorf("fetching auth token: %w", err)
-		}
-		if err != nil {
-			fmt.Fprintf(w, "unable to perform integration: %v", err)
-			paramsOrErrorChan <- paramsOrError{err: err}
-			return
-		}
-
-		fmt.Fprint(w, "Polaris and Fairwinds Insights integration has finished successfully, your credentials are set! You can safely close this tab now.")
-		paramsOrErrorChan <- paramsOrError{token: token, user: user, organization: organization}
-		return
-	}
-}
-
-func validateToken(insightsHost string, bot *bot) func(args any) error {
-	return func(args any) error {
-		token, ok := args.(string)
-		if !ok {
-			return errors.New("casting token to string")
-		}
-		if len(strings.TrimSpace(token)) <= 0 {
-			return errors.New("token is required")
-		}
-		return fetchOrganizationBot(insightsHost, token, bot)
-	}
-}
-
-type bot struct {
-	ID           int
-	Organization string
-	Name         string
-	Role         string
-	AuthToken    string
-	CreatedAt    time.Time
-}
-
-func fetchOrganizationBot(insightsHost, authToken string, bot *bot) error {
-	authTokenURL := fmt.Sprintf("%s/v0/bots/from-request", insightsHost)
-	r, err := http.NewRequest("GET", authTokenURL, nil)
-	if err != nil {
-		return err
-	}
-	r.Header.Add("Content-Type", "application/json")
-	r.Header.Add("Authorization", "Bearer "+authToken)
-
-	res, err := http.DefaultClient.Do(r)
-	if err != nil {
-		return err
-	}
-	defer res.Body.Close()
-
-	if res.StatusCode < 200 || res.StatusCode >= 400 {
-		return fmt.Errorf("expected 200 (OK) - received %d", res.StatusCode)
-	}
-
-	err = json.NewDecoder(res.Body).Decode(bot)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func IsLoggedIn() bool {
-	if _, err := os.Stat(polarisHostsFilepath); err == nil {
-		content, err := readPolarisHostsFile()
-		if err != nil {
-			return false
-		}
-		return len(content) > 0
-	}
-	return false
-}
@@ -1,35 +0,0 @@
-package auth
-
-import (
-	"fmt"
-	"os"
-)
-
-func HandleLogout() error {
-	if !IsLoggedIn() {
-		fmt.Println("not logged in to Fairwinds Insights")
-		return nil
-	}
-	err := performLogout()
-	if err != nil {
-		return fmt.Errorf("performing logout: %v", err)
-	}
-	fmt.Println("✓ Logged out of Fairwinds Insights")
-	return nil
-}
-
-func performLogout() error {
-	content, err := readPolarisHostsFile()
-	if err != nil {
-		return nil
-	}
-
-	if len(content) > 0 {
-		err = os.WriteFile(polarisHostsFilepath, []byte("{}"), os.ModePerm)
-		if err != nil {
-			return fmt.Errorf("writing data to file: %w", err)
-		}
-		return nil
-	}
-	return nil
-}
@@ -1,46 +0,0 @@
-package auth
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/fairwindsops/polaris/pkg/insights"
-)
-
-func PrintStatus(insightsHost string) error {
-	if content, err := readPolarisHostsFile(); err == nil {
-		if len(content) > 0 {
-			if h, ok := content[insightsHost]; ok {
-				c := insights.NewHTTPClient(insightsHost, h.Organization, h.Token)
-				isValid, err := c.IsTokenValid()
-				if err != nil {
-					return err
-				}
-				if !isValid {
-					fmt.Println("✕ Your token is no longer valid. Run polaris auth login to authenticate.")
-					return nil
-				}
-				fmt.Printf("✓ Logged in to %s as %s\n", insightsHost, h.User)
-				fmt.Printf("✓ Token: %s\n", hideToken(h.Token, 3))
-				return nil
-			}
-		}
-		fmt.Printf("✕ No authentication found for host %s. Run polaris auth login to authenticate.\n", insightsHost)
-		return nil
-	}
-	fmt.Println("You are not logged into Fairwinds Insights. Run polaris auth login to authenticate.")
-	return nil
-}
-
-func hideToken(token string, hideAfter int) string {
-	var i int
-	return strings.Map(func(r rune) rune {
-		defer func() {
-			i++
-		}()
-		if i > hideAfter {
-			return []rune("*")[0]
-		}
-		return r
-	}, token)
-}
@@ -1,20 +0,0 @@
-package auth
-
-import "fmt"
-
-func PrintToken() error {
-	if content, err := readPolarisHostsFile(); err == nil {
-		if len(content) > 0 {
-			for k, h := range content {
-				if len(content) == 1 {
-					fmt.Println(h.Token)
-				} else {
-					fmt.Printf("%s: %s\n", k, h.Token)
-				}
-			}
-			return nil
-		}
-	}
-	fmt.Println("no oauth token")
-	return nil
-}
@@ -15,13 +15,14 @@
 package config

 import (
-	"embed"
-	"fmt"
-
+	"github.com/gobuffalo/packr/v2"
 	"github.com/sirupsen/logrus"
 )

 var (
+	// BuiltInChecks contains the checks that come pre-installed w/ Polaris
+	BuiltInChecks = map[string]SchemaCheck{}
+	schemaBox     = (*packr.Box)(nil)
 	// We explicitly set the order to avoid thrash in the
 	// tests as we migrate toward JSON schema
 	checkOrder = []string{
@@ -32,7 +33,6 @@ var (
 		"hostPIDSet",
 		"hostNetworkSet",
 		"automountServiceAccountToken",
-		"topologySpreadConstraint",
 		// Container checks
 		"memoryLimitsMissing",
 		"memoryRequestsMissing",
@@ -55,7 +55,7 @@ var (
 		// Other checks
 		"tlsSettingsMissing",
 		"pdbDisruptionsIsZero",
-		"metadataAndInstanceMismatched",
+		"metadataAndNameMismatched",
 		"missingPodDisruptionBudget",
 		"missingNetworkPolicy",
 		"sensitiveConfigmapContent",
@@ -68,17 +68,12 @@ var (
 		"rolebindingClusterAdminClusterRole",
 		"rolebindingClusterAdminRole",
 	}
-
-	// BuiltInChecks contains the checks that come pre-installed w/ Polaris
-	BuiltInChecks = map[string]SchemaCheck{}
-
-	//go:embed all:checks
-	checksFS embed.FS
 )

 func init() {
+	schemaBox = packr.New("Schemas", "../../checks")
 	for _, checkID := range checkOrder {
-		contents, err := checksFS.ReadFile(fmt.Sprintf("checks/%s.yaml", checkID))
+		contents, err := schemaBox.Find(checkID + ".yaml")
 		if err != nil {
 			panic(err)
 		}
@@ -1,17 +0,0 @@
-successMessage: Pod has a valid topology spread constraint
-failureMessage: Pod should be configured with a valid topology spread constraint
-category: Reliability
-target: PodSpec
-controllers:
-  exclude:
-  - Job
-  - CronJob
-schema:
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  required:
-    - topologySpreadConstraints
-  properties:
-    topologySpreadConstraints:
-      type: array
-      minItems: 1
@@ -1,16 +0,0 @@
-package config
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestRequiredFieldsOnBuiltInChecks(t *testing.T) {
-	for _, v := range BuiltInChecks {
-		assert.NotEmpty(t, v.SuccessMessage)
-		assert.NotEmpty(t, v.FailureMessage)
-		assert.NotEmpty(t, v.Category)
-		assert.NotEmpty(t, v.Target)
-	}
-}
@@ -16,7 +16,6 @@ package config

 import (
 	"bytes"
-	_ "embed"
 	"errors"
 	"fmt"
 	"io"
@@ -24,6 +23,7 @@ import (
 	"os"
 	"strings"

+	"github.com/gobuffalo/packr/v2"
 	"k8s.io/apimachinery/pkg/util/yaml"
 )

@@ -49,15 +49,21 @@ type Exemption struct {
 	Namespace       string   `json:"namespace"`
 }

-//go:embed default.yaml
-var defaultConfig []byte
+var configBox = (*packr.Box)(nil)
+
+func getConfigBox() *packr.Box {
+	if configBox == (*packr.Box)(nil) {
+		configBox = packr.New("Config", "../../examples")
+	}
+	return configBox
+}

 // ParseFile parses config from a file.
 func ParseFile(path string) (Configuration, error) {
 	var rawBytes []byte
 	var err error
 	if path == "" {
-		rawBytes = defaultConfig
+		rawBytes, err = getConfigBox().Find("config.yaml")
 	} else if strings.HasPrefix(path, "https://") || strings.HasPrefix(path, "http://") {
 		// path is a url
 		response, err2 := http.Get(path)
@@ -143,9 +143,6 @@ func (max resourceMaximum) Validate(path string, data interface{}, errs *[]jsons
 }

 func parseQuantity(i interface{}) (resource.Quantity, *[]jsonschema.ValError) {
-	if resNum, ok := i.(float64); ok {
-		i = fmt.Sprintf("%f", resNum)
-	}
 	resStr, ok := i.(string)
 	if !ok {
 		return resource.Quantity{}, &[]jsonschema.ValError{
@@ -239,15 +236,11 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
 		if err != nil {
 			return nil, err
 		}
-		templated := w.String()
-		if strings.TrimSpace(templated) == "" {
-			continue
-		}

 		if kind == "" {
-			newCheck.SchemaString = templated
+			newCheck.SchemaString = w.String()
 		} else {
-			newCheck.AdditionalSchemaStrings[kind] = templated
+			newCheck.AdditionalSchemaStrings[kind] = w.String()
 		}
 	}

@@ -16,10 +16,8 @@ package dashboard

 import (
 	"bytes"
-	"embed"
 	"encoding/json"
 	"html/template"
-	"io/fs"
 	"net/http"
 	"net/url"
 	"path"
@@ -28,6 +26,7 @@ import (
 	"github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
+	packr "github.com/gobuffalo/packr/v2"
 	"github.com/gorilla/mux"
 	"github.com/sirupsen/logrus"
 )
@@ -48,12 +47,27 @@ const (
 )

 var (
-	//go:embed all:templates
-	templatesFS embed.FS
-	//go:embed all:assets
-	assetsFS embed.FS
+	templateBox = (*packr.Box)(nil)
+	assetBox    = (*packr.Box)(nil)
+	markdownBox = (*packr.Box)(nil)
 )

+// GetAssetBox returns a binary-friendly set of assets packaged from disk
+func GetAssetBox() *packr.Box {
+	if assetBox == (*packr.Box)(nil) {
+		assetBox = packr.New("Assets", "assets")
+	}
+	return assetBox
+}
+
+// GetTemplateBox returns a binary-friendly set of templates for rendering the dash
+func GetTemplateBox() *packr.Box {
+	if templateBox == (*packr.Box)(nil) {
+		templateBox = packr.New("Templates", "templates")
+	}
+	return templateBox
+}
+
 // templateData is passed to the dashboard HTML template
 type templateData struct {
 	BasePath          string
@@ -89,8 +103,9 @@ func GetBaseTemplate(name string) (*template.Template, error) {
 }

 func parseTemplateFiles(tmpl *template.Template, templateFileNames []string) (*template.Template, error) {
+	templateBox := GetTemplateBox()
 	for _, fname := range templateFileNames {
-		templateFile, err := templatesFS.ReadFile("templates/" + fname)
+		templateFile, err := templateBox.Find(fname)
 		if err != nil {
 			return nil, err
 		}
@@ -140,15 +155,9 @@ func stripUnselectedNamespaces(data *validator.AuditData, selectedNamespaces []s
 }

 // GetRouter returns a mux router serving all routes necessary for the dashboard
-func GetRouter(c config.Configuration, auditPath string, port int, basePath string, auditData *validator.AuditData) (*mux.Router, error) {
+func GetRouter(c config.Configuration, auditPath string, port int, basePath string, auditData *validator.AuditData) *mux.Router {
 	router := mux.NewRouter().PathPrefix(basePath).Subrouter()
-
-	assetsSubFS, err := fs.Sub(assetsFS, "assets")
-	if err != nil {
-		return nil, err
-	}
-
-	fileServer := http.FileServer(http.FS(assetsSubFS))
+	fileServer := http.FileServer(GetAssetBox())
 	router.PathPrefix("/static/").Handler(http.StripPrefix(path.Join(basePath, "/static/"), fileServer))

 	router.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
@@ -156,7 +165,7 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 	})

 	router.HandleFunc("/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
-		favicon, err := assetsFS.ReadFile("assets/favicon-32x32.png")
+		favicon, err := GetAssetBox().Find("favicon-32x32.png")
 		if err != nil {
 			logrus.Errorf("Error getting favicon: %v", err)
 			http.Error(w, "Error getting favicon", http.StatusInternalServerError)
@@ -226,7 +235,7 @@ func GetRouter(c config.Configuration, auditPath string, port int, basePath stri
 		}

 	})
-	return router, nil
+	return router
 }

 // MainHandler gets template data and renders the dashboard with it.
@@ -5,7 +5,6 @@
        <a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris" target="_blank">
          <img class="fw-logo" src="static/images/white_logo_fairwinds.svg" alt="Fairwinds" />
        </a>
-        <div style="color: white;"> Want more? Automate Polaris with <a href="https://www.fairwinds.com/insights-signup/polaris"><strong>Fairwinds Insights</strong></a></div>
        <div class="right-section p-0 d-flex justify-content-between">
          <a href="https://github.com/FairwindsOps" target="_blank">
            <img class="gh-logo" src="static/images/white_icon_github.svg" alt="Github" />
@@ -1,159 +0,0 @@
-package fix
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/fairwindsops/polaris/pkg/config"
-	"github.com/fairwindsops/polaris/pkg/kube"
-	"github.com/fairwindsops/polaris/pkg/mutation"
-	"github.com/fairwindsops/polaris/pkg/validator"
-)
-
-const templateLineMarker = "# POLARIS_FIX_TMPL"
-const templateOpenMarker = "POLARIS_OPEN_TMPL"
-const templateCloseMarker = "POLARIS_CLOSE_TMPL"
-
-var ErrFilesPathRequired = errors.New("files-path flag is required")
-
-func Execute(config config.Configuration, filesPath string, isTemplate bool, checksToFix ...string) error {
-	if filesPath == "" {
-		return ErrFilesPathRequired
-	}
-
-	var yamlFiles []string
-	fileInfo, err := os.Stat(filesPath)
-	if err != nil {
-		return fmt.Errorf("error getting file info: %v", err)
-	}
-	if fileInfo.IsDir() {
-		baseDir := filesPath
-		if !strings.HasSuffix(filesPath, "/") {
-			baseDir = baseDir + "/"
-		}
-		yamlFiles, err = getYamlFiles(baseDir)
-		if err != nil {
-			return fmt.Errorf("error getting yaml files from directory: %v", err)
-		}
-	} else {
-		yamlFiles = append(yamlFiles, filesPath)
-	}
-
-	if len(checksToFix) > 0 {
-		if len(checksToFix) == 1 && checksToFix[0] == "all" {
-			allchecks := []string{}
-			for key := range config.Checks {
-				allchecks = append(allchecks, key)
-			}
-			config.Mutations = allchecks
-		} else if len(checksToFix) == 0 && checksToFix[0] == "none" {
-			config.Mutations = nil
-		} else {
-			config.Mutations = checksToFix
-		}
-	}
-
-	for _, fullFilePath := range yamlFiles {
-		yamlContent, err := os.ReadFile(fullFilePath)
-		if err != nil {
-			return fmt.Errorf("error reading file with file path %s: %v", fullFilePath, err)
-		}
-
-		if isTemplate {
-			yamlContent = []byte(detemplate(string(yamlContent)))
-		}
-		kubeResources, err := kube.CreateResourceProviderFromYaml(string(yamlContent))
-		if err != nil {
-			return fmt.Errorf("error creating resource provider from yaml: %v", err)
-		}
-		results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
-		if err != nil {
-			return fmt.Errorf("error applying schema check to the resources %s: %v", fullFilePath, err)
-		}
-		allMutations := mutation.GetMutationsFromResults(results)
-
-		updatedYamlContent := ""
-		if len(allMutations) > 0 {
-			for _, resources := range kubeResources.Resources {
-				for _, resource := range resources {
-					key := fmt.Sprintf("%s/%s/%s", resource.Kind, resource.Resource.GetName(), resource.Resource.GetNamespace())
-					mutations := allMutations[key]
-					mutatedYamlContent, err := mutation.ApplyAllMutations(string(resource.OriginalObjectYAML), mutations)
-					if err != nil {
-						return fmt.Errorf("error applying schema mutations to the resource %s: %v", key, err)
-					}
-					if updatedYamlContent != "" {
-						updatedYamlContent += "\n---\n"
-					}
-					updatedYamlContent += mutatedYamlContent
-				}
-			}
-		}
-
-		if isTemplate {
-			updatedYamlContent = retemplate(updatedYamlContent)
-		}
-
-		if updatedYamlContent != "" {
-			err = os.WriteFile(fullFilePath, []byte(updatedYamlContent), 0644)
-			if err != nil {
-				return fmt.Errorf("error writing output to file: %v", err)
-			}
-		}
-	}
-
-	return nil
-}
-
-func detemplate(content string) string {
-	lines := strings.Split(content, "\n")
-	for idx, line := range lines {
-		lines[idx] = detemplateLine(line)
-	}
-	return strings.Join(lines, "\n")
-}
-
-func retemplate(content string) string {
-	lines := strings.Split(content, "\n")
-	for idx, line := range lines {
-		lines[idx] = retemplateLine(line)
-	}
-	return strings.Join(lines, "\n")
-}
-
-func detemplateLine(line string) string {
-	if !strings.HasPrefix(strings.TrimSpace(line), "{{") {
-		line = strings.ReplaceAll(line, "{", templateOpenMarker)
-		line = strings.ReplaceAll(line, "}", templateCloseMarker)
-		return line
-	}
-	tmplStart := strings.Index(line, "{{")
-	newLine := line[:tmplStart] + templateLineMarker + line[tmplStart:]
-	return newLine
-}
-
-func retemplateLine(line string) string {
-	if !strings.Contains(line, templateLineMarker) {
-		line = strings.ReplaceAll(line, templateOpenMarker, "{")
-		line = strings.ReplaceAll(line, templateCloseMarker, "}")
-		return line
-	}
-	return strings.Replace(line, templateLineMarker, "", 1)
-}
-
-func getYamlFiles(rootpath string) ([]string, error) {
-	var list []string
-	err := filepath.Walk(rootpath, func(path string, info os.FileInfo, err error) error {
-		if info.IsDir() {
-			return nil
-		}
-		if filepath.Ext(path) == ".yaml" || filepath.Ext(path) == ".yml" {
-			list = append(list, path)
-		}
-		return nil
-	})
-	return list, err
-}
@@ -1,200 +0,0 @@
-package insights
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-
-	"github.com/sirupsen/logrus"
-)
-
-type cluster struct {
-	Name         string `json:"Name"`
-	AuthToken    string `json:"AuthToken"`
-	Organization string `json:"Organization"`
-	Status       string `json:"Status"`
-}
-
-type reportJob struct {
-	ID            int    `json:"id"`
-	Status        string `json:"status"`
-	TimeTakenInMs int    `json:"timeTaken"`
-}
-
-type Client interface {
-	UpsertCluster(clusterName string) (*cluster, error)
-	SendReport(cluster cluster, reportType, reportVersion string, payload []byte) (*reportJob, error)
-	GetReportJob(clusterName string, reportJobID int) (*reportJob, error)
-	IsTokenValid() (bool, error)
-}
-
-type HTTPClient struct {
-	insightsHost string
-	organization string
-	token        string
-}
-
-func NewHTTPClient(host, organization, token string) Client {
-	return HTTPClient{host, organization, token}
-}
-
-func (ic HTTPClient) UpsertCluster(clusterName string) (*cluster, error) {
-	clusterURL := fmt.Sprintf("%s/v0/organizations/%s/clusters/%s?showToken=true", ic.insightsHost, ic.organization, clusterName)
-	req, err := http.NewRequest("GET", clusterURL, nil)
-	if err != nil {
-		return nil, fmt.Errorf("building request for fetching cluster: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+ic.token)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("making request fetching cluster: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if isSuccessful2XX(resp.StatusCode) {
-		// cluster already created
-		logrus.Infof("cluster %q found...", clusterName)
-		body, err := io.ReadAll(resp.Body)
-		if err != nil {
-			return nil, fmt.Errorf("reading response body: %w", err)
-		}
-		var c cluster
-		err = json.Unmarshal(body, &c)
-		if err != nil {
-			return nil, fmt.Errorf("unmarshaling response body: %w", err)
-		}
-		return &c, nil
-	} else {
-		logrus.Warnf("not able to fetch cluster, expected 2xx - received %d, will try to create", resp.StatusCode)
-	}
-
-	logrus.Infof("cluster %q not found... creating..", clusterName)
-
-	req, err = http.NewRequest("POST", clusterURL, nil)
-	if err != nil {
-		return nil, fmt.Errorf("building request for creating cluster: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+ic.token)
-	resp, err = http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("making request for creating cluster: %w", err)
-	}
-	defer resp.Body.Close()
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("reading response body: %w", err)
-	}
-
-	if !isSuccessful2XX(resp.StatusCode) {
-		return nil, fmt.Errorf("creating cluster, expected 200 OK received %s: %v", resp.Status, string(body))
-	}
-
-	var c cluster
-	err = json.Unmarshal(body, &c)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshaling response body: %w", err)
-	}
-
-	logrus.Infof("cluster %q created...", clusterName)
-	return &c, nil
-}
-
-func (ic HTTPClient) SendReport(cluster cluster, reportType, reportVersion string, payload []byte) (*reportJob, error) {
-	uploadReportURL := fmt.Sprintf("%s/v0/organizations/%s/clusters/%s/data/%s", ic.insightsHost, ic.organization, cluster.Name, reportType)
-	req, err := http.NewRequest("POST", uploadReportURL, bytes.NewBuffer(payload))
-	if err != nil {
-		return nil, fmt.Errorf("building request for output: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+cluster.AuthToken)
-	req.Header.Set("X-Fairwinds-Report-Version", reportVersion)
-	req.Header.Set("X-Fairwinds-Report-Priority", "4") // should have higher priority than the default 5
-	req.Header.Set("X-Fairwinds-Agent-Version", "")
-	req.Header.Set("X-Fairwinds-Agent-Chart-Version", "")
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("making request for output: %w", err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("reading response body: %w", err)
-	}
-	if !isSuccessful2XX(resp.StatusCode) {
-		return nil, fmt.Errorf("sending %s report, expected 200 OK received %s: %v", reportType, resp.Status, string(body))
-	}
-
-	var rj reportJob
-	err = json.Unmarshal(body, &rj)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshaling response body: %w", err)
-	}
-	logrus.Debugf("%s report sent to fairwinds insights", reportType)
-
-	return &rj, nil
-}
-
-func isSuccessful2XX(statusCode int) bool {
-	return statusCode >= 200 && statusCode < 300
-}
-
-func (ic HTTPClient) GetReportJob(clusterName string, reportJobID int) (*reportJob, error) {
-	reportJobsURL := fmt.Sprintf("%s/v0/organizations/%s/clusters/%s/report-jobs/%d", ic.insightsHost, ic.organization, clusterName, reportJobID)
-	req, err := http.NewRequest("GET", reportJobsURL, nil)
-	if err != nil {
-		return nil, fmt.Errorf("building request for fetching report-job: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+ic.token)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("making request fetching report-job: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if !isSuccessful2XX(resp.StatusCode) {
-		return nil, fmt.Errorf("fetching report-job, expected 200 OK received %s", resp.Status)
-	}
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("reading response body: %w", err)
-	}
-	var rj reportJob
-	err = json.Unmarshal(body, &rj)
-	if err != nil {
-		return nil, fmt.Errorf("unmarshaling response body: %w", err)
-	}
-	return &rj, nil
-}
-
-// IsTokenValid checks if the token is valid by fetching the organization
-func (ic HTTPClient) IsTokenValid() (bool, error) {
-	organizationURL := fmt.Sprintf("%s/v0/organizations/%s", ic.insightsHost, ic.organization)
-	req, err := http.NewRequest("GET", organizationURL, nil)
-	if err != nil {
-		return false, fmt.Errorf("building request for fetching organization: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+ic.token)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return false, fmt.Errorf("making request fetching organization: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if isSuccessful2XX(resp.StatusCode) {
-		return true, nil // token is valid
-	}
-
-	if resp.StatusCode == http.StatusNotFound || resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
-		return false, nil // token is invalid
-	}
-
-	// unexpected error
-	return false, fmt.Errorf("fetching organization, expected 200 OK - received %s", resp.Status)
-}
@@ -1,89 +0,0 @@
-package insights
-
-import (
-	"encoding/json"
-	"fmt"
-	"time"
-
-	workloads "github.com/fairwindsops/insights-plugins/plugins/workloads/pkg"
-	"github.com/fairwindsops/polaris/pkg/validator"
-	"github.com/sirupsen/logrus"
-)
-
-type insightsReporter struct {
-	client Client
-}
-
-func NewInsightsReporter(client Client) *insightsReporter {
-	return &insightsReporter{
-		client: client,
-	}
-}
-
-type WorkloadsReport struct {
-	Version string
-	Payload workloads.ClusterWorkloadReport
-}
-
-type PolarisReport struct {
-	Version string
-	Payload validator.AuditData
-}
-
-// ReportAuditToFairwindsInsights report audit to insights
-// 1 - check if cluster exists, otherwise create it
-// 2 - send workload report
-// 3 - send polaris report
-// 4 - checks if report job is completed for 3 minutes
-// 5 - display link to Fairwinds Insights
-func (ir insightsReporter) ReportAuditToFairwindsInsights(clusterName string, wr WorkloadsReport, pr PolarisReport) error {
-	cluster, err := ir.client.UpsertCluster(clusterName)
-	if err != nil {
-		return err
-	}
-	workloadsPayload, err := json.MarshalIndent(wr.Payload, "", "  ")
-	if err != nil {
-		return fmt.Errorf("marshaling data: %w", err)
-	}
-	_, err = ir.client.SendReport(*cluster, "workloads", wr.Version, workloadsPayload)
-	if err != nil {
-		return err
-	}
-
-	polarisPayload, err := json.MarshalIndent(pr.Payload, "", "  ")
-	if err != nil {
-		return fmt.Errorf("marshaling data: %w", err)
-	}
-	reportJob, err := ir.client.SendReport(*cluster, "polaris", pr.Version, polarisPayload)
-	if err != nil {
-		return err
-	}
-
-	success, err := verifyReportJobCompletion(&ir, cluster.Name, reportJob.ID)
-	if err != nil {
-		return err
-	}
-
-	if !success {
-		return fmt.Errorf("timed out waiting for report job to complete")
-	}
-	return nil
-}
-
-// verifyReportJobCompletion checks Insights for reportJob completion (timeout after 3 minutes)
-func verifyReportJobCompletion(ir *insightsReporter, clusterName string, reportJobID int) (bool, error) {
-	defer func() { fmt.Println() }()
-	logrus.Println("Processing (this usually takes 1-3 minutes)...")
-	for i := 0; i < 60; i++ {
-		reportJob, err := ir.client.GetReportJob(clusterName, reportJobID)
-		if err != nil {
-			return false, err
-		}
-		if reportJob.Status == "completed" {
-			return true, nil
-		}
-		fmt.Print(".")
-		time.Sleep(3 * time.Second)
-	}
-	return false, nil
-}
@@ -139,7 +139,7 @@ func NewGenericResourceFromBytes(contentBytes []byte) (GenericResource, error) {
 }

 // ResolveControllerFromPod builds a new workload for a given Pod
-func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient dynamic.Interface, restMapper meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
+func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
 	workload, err := resolveControllerFromPod(ctx, podResource, dynamicClient, restMapper, objectCache)
 	if err != nil {
 		return workload, err
@@ -150,7 +150,7 @@ func ResolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, err
 }

-func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient dynamic.Interface, restMapper meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
+func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) (GenericResource, error) {
 	podWorkload, err := NewGenericResourceFromPod(podResource, nil)
 	if err != nil {
 		return podWorkload, err
@@ -217,7 +217,7 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	return workload, nil
 }

-func cacheSingleObject(ctx context.Context, apiVersion, kind, namespace, name string, dynamicClient dynamic.Interface, restMapper meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+func cacheSingleObject(ctx context.Context, apiVersion, kind, namespace, name string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
 	logrus.Debugf("Caching a single %s", kind)
 	object, err := getObject(ctx, namespace, kind, apiVersion, name, dynamicClient, restMapper)
 	if err != nil {
@@ -230,16 +230,16 @@ func cacheSingleObject(ctx context.Context, apiVersion, kind, namespace, name st
 	return nil
 }

-func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamicClient dynamic.Interface, restMapper meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
+func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) error {
 	logrus.Debugf("Caching all %s", kind)
 	fqKind := schema.FromAPIVersionAndKind(apiVersion, kind)
-	mapping, err := restMapper.RESTMapping(fqKind.GroupKind(), fqKind.Version)
+	mapping, err := (*restMapper).RESTMapping(fqKind.GroupKind(), fqKind.Version)
 	if err != nil {
 		logrus.Warnf("Error retrieving mapping of API %s and Kind %s because of error: %v", apiVersion, kind, err)
 		return err
 	}

-	objects, err := dynamicClient.Resource(mapping.Resource).Namespace("").List(ctx, kubeAPIMetaV1.ListOptions{})
+	objects, err := (*dynamicClient).Resource(mapping.Resource).Namespace("").List(ctx, kubeAPIMetaV1.ListOptions{})
 	if err != nil {
 		logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 		return err
@@ -252,13 +252,13 @@ func cacheAllObjectsOfKind(ctx context.Context, apiVersion, kind string, dynamic
 	return nil
 }

-func getObject(ctx context.Context, namespace, kind, version, name string, dynamicClient dynamic.Interface, restMapper meta.RESTMapper) (*unstructured.Unstructured, error) {
+func getObject(ctx context.Context, namespace, kind, version, name string, dynamicClient *dynamic.Interface, restMapper *meta.RESTMapper) (*unstructured.Unstructured, error) {
 	fqKind := schema.FromAPIVersionAndKind(version, kind)
-	mapping, err := restMapper.RESTMapping(fqKind.GroupKind(), fqKind.Version)
+	mapping, err := (*restMapper).RESTMapping(fqKind.GroupKind(), fqKind.Version)
 	if err != nil {
 		return nil, err
 	}
-	object, err := dynamicClient.Resource(mapping.Resource).Namespace(namespace).Get(ctx, name, kubeAPIMetaV1.GetOptions{})
+	object, err := (*dynamicClient).Resource(mapping.Resource).Namespace(namespace).Get(ctx, name, kubeAPIMetaV1.GetOptions{})
 	return object, err
 }

@@ -26,7 +26,6 @@ import (
 	"strings"
 	"time"

-	"github.com/fairwindsops/controller-utils/pkg/controller"
 	conf "github.com/fairwindsops/polaris/pkg/config"

 	"github.com/sirupsen/logrus"
@@ -34,12 +33,12 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	k8sYaml "k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	_ "k8s.io/client-go/plugin/pkg/client/auth" // Required for other auth providers like GKE.
-	"k8s.io/client-go/rest"
 	"k8s.io/client-go/restmapper"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 )
@@ -146,13 +145,20 @@ func CreateResourceProvider(ctx context.Context, directory, workload string, c c

 // CreateResourceProviderFromResource creates a new ResourceProvider that just contains one workload
 func CreateResourceProviderFromResource(ctx context.Context, workload string) (*ResourceProvider, error) {
-	dynamicClient, restMapper, clientSet, _, err := GetKubeClient(ctx, "")
+	kubeConf, configError := config.GetConfig()
+	if configError != nil {
+		logrus.Errorf("Error fetching KubeConfig: %v", configError)
+		return nil, configError
+	}
+	kube, err := kubernetes.NewForConfig(kubeConf)
 	if err != nil {
+		logrus.Errorf("Error creating Kubernetes client: %v", err)
 		return nil, err
 	}
-	serverVersion, err := clientSet.Discovery().ServerVersion()
+	serverVersion, err := kube.Discovery().ServerVersion()
 	if err != nil {
-		return nil, fmt.Errorf("Error fetching Cluster API version: %w", err)
+		logrus.Errorf("Error fetching Cluster API version: %v", err)
+		return nil, err
 	}
 	resources := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, "Resource", workload)

@@ -165,14 +171,28 @@ func CreateResourceProviderFromResource(ctx context.Context, workload string) (*
 	version := parts[2]
 	name := parts[3]

-	obj, err := getObject(ctx, namespace, kind, version, name, dynamicClient, restMapper)
+	dynamicInterface, err := dynamic.NewForConfig(kubeConf)
 	if err != nil {
-		return nil, fmt.Errorf("Could not find workload %s: %w", workload, err)
+		logrus.Errorf("Error connecting to dynamic interface: %v", err)
+		return nil, err
+	}
+	groupResources, err := restmapper.GetAPIGroupResources(kube.Discovery())
+	if err != nil {
+		logrus.Errorf("Error getting API Group resources: %v", err)
+		return nil, err
+	}
+	restMapper := restmapper.NewDiscoveryRESTMapper(groupResources)
+	obj, err := getObject(ctx, namespace, kind, version, name, &dynamicInterface, &restMapper)
+	if err != nil {
+		logrus.Errorf("Could not find workload %s: %v", workload, err)
+		return nil, err
 	}
 	workloadObj, err := NewGenericResourceFromUnstructured(*obj, nil)
 	if err != nil {
-		return nil, fmt.Errorf("Could not parse workload %s: %w", workload, err)
+		logrus.Errorf("Could not parse workload %s: %v", workload, err)
+		return nil, err
 	}
+
 	resources.Resources.addResource(workloadObj)
 	return &resources, nil
 }
@@ -215,52 +235,34 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 }

 // CreateResourceProviderFromYaml returns a new ResourceProvider using the yaml
-func CreateResourceProviderFromYaml(yamlContent string) (*ResourceProvider, error) {
+func CreateResourceProviderFromYaml(yamlContent string) *ResourceProvider {
 	resources := newResourceProvider("unknown", "Content", "unknown")
-	err := resources.addResourcesFromYaml(string(yamlContent))
-	if err != nil {
-		return nil, err
-	}
-	return &resources, nil
+	resources.addResourcesFromYaml(string(yamlContent))
+	return &resources
 }

 // CreateResourceProviderFromCluster creates a new ResourceProvider using live data from a cluster
 func CreateResourceProviderFromCluster(ctx context.Context, c conf.Configuration) (*ResourceProvider, error) {
-	dynamicClient, _, clientSet, clusterHost, err := GetKubeClient(ctx, c.KubeContext)
+	kubeConf, configError := config.GetConfigWithContext(c.KubeContext)
+	if configError != nil {
+		logrus.Errorf("Error fetching KubeConfig: %v", configError)
+		return nil, configError
+	}
+	api, err := kubernetes.NewForConfig(kubeConf)
 	if err != nil {
+		logrus.Errorf("Error creating Kubernetes client: %v", err)
 		return nil, err
 	}
-	return CreateResourceProviderFromAPI(ctx, clientSet, clusterHost, dynamicClient, c)
-}
-
-func GetKubeClient(ctx context.Context, kubeContext string) (dynamic.Interface, meta.RESTMapper, kubernetes.Interface, string, error) {
-	var kubeConf *rest.Config
-	var err error
-	if len(kubeContext) > 0 {
-		kubeConf, err = config.GetConfigWithContext(kubeContext)
-	} else {
-		kubeConf, err = config.GetConfig()
-	}
+	dynamicInterface, err := dynamic.NewForConfig(kubeConf)
 	if err != nil {
-		return nil, nil, nil, "", fmt.Errorf("Error fetching KubeConfig: %v", err)
+		logrus.Errorf("Error connecting to dynamic interface: %v", err)
+		return nil, err
 	}
-	clientSet, err := kubernetes.NewForConfig(kubeConf)
-	if err != nil {
-		return nil, nil, nil, "", fmt.Errorf("Error creating Kubernetes client: %v", err)
-	}
-	dynamicClient, err := dynamic.NewForConfig(kubeConf)
-	if err != nil {
-		return nil, nil, nil, "", fmt.Errorf("Error connecting to dynamic interface: %v", err)
-	}
-	resources, err := restmapper.GetAPIGroupResources(clientSet.Discovery())
-	if err != nil {
-		return nil, nil, nil, "", fmt.Errorf("Error getting API Group resources: %v", err)
-	}
-	return dynamicClient, restmapper.NewDiscoveryRESTMapper(resources), clientSet, kubeConf.Host, nil
+	return CreateResourceProviderFromAPI(ctx, api, kubeConf.Host, &dynamicInterface, c)
 }

 // CreateResourceProviderFromAPI creates a new ResourceProvider from an existing k8s interface
-func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interface, clusterName string, dynamic dynamic.Interface, c conf.Configuration) (*ResourceProvider, error) {
+func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interface, clusterName string, dynamic *dynamic.Interface, c conf.Configuration) (*ResourceProvider, error) {
 	listOpts := metav1.ListOptions{}
 	serverVersion, err := kube.Discovery().ServerVersion()
 	if err != nil {
@@ -300,6 +302,13 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 		namespaces = nsList
 	}
+	logrus.Info("Loading pods")
+	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
+	if err != nil {
+		logrus.Errorf("Error fetching Pods: %v", err)
+		return nil, err
+	}
+
 	logrus.Info("Setting up restmapper")
 	resources, err := restmapper.GetAPIGroupResources(kube.Discovery())
 	if err != nil {
@@ -334,18 +343,14 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	var kubernetesResources []GenericResource
 	for _, kind := range additionalKinds {
 		groupKind := parseGroupKind(maybeTransformKindIntoGroupKind(string(kind)))
-		mapping, err := restMapper.RESTMapping(groupKind)
+		mapping, err := (restMapper).RESTMapping(groupKind)
 		if err != nil {
 			logrus.Warnf("Error retrieving mapping of Kind %s because of error: %v", kind, err)
 			return nil, err
 		}
-		if c.Namespace != "" && mapping.Scope.Name() != meta.RESTScopeNameNamespace {
-			logrus.Infof("Skipping %s because of auditing specific namespace", mapping.GroupVersionKind)
-			continue
-		}

 		logrus.Info("Loading " + kind)
-		objects, err := dynamic.Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
+		objects, err := (*dynamic).Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 			return nil, err
@@ -358,24 +363,17 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			kubernetesResources = append(kubernetesResources, res)
 		}
 	}
+
+	objectCache := map[string]unstructured.Unstructured{}
+
 	logrus.Info("Loading controllers")
-	client := controller.Client{
-		Context:    ctx,
-		Dynamic:    dynamic,
-		RESTMapper: restMapper,
-	}
-	topControllers, err := client.GetAllTopControllersSummary("")
+	controllers, err := LoadControllers(ctx, pods.Items, dynamic, &restMapper, objectCache)
 	if err != nil {
-		return nil, fmt.Errorf("error while getting all TopControllers: %v", err)
-	}
-	for _, workload := range topControllers {
-		topController := workload.TopController
-		workloadObj, err := NewGenericResourceFromUnstructured(topController, nil)
-		if err != nil {
-			return nil, fmt.Errorf("could not parse workload %v: %w", workload, err)
-		}
-		kubernetesResources = append(kubernetesResources, workloadObj)
+		logrus.Errorf("Error loading controllers from pods: %v", err)
+		return nil, err
 	}
+	// resources loaded from custom checks can also contain controllers and thus would be added twice to the provider
+	kubernetesResources = deduplicateControllers(append(kubernetesResources, controllers...))

 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
@@ -384,6 +382,49 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 	return &provider, nil
 }

+// LoadControllers loads a list of controllers from the kubeResources Pods
+func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClientPointer *dynamic.Interface, restMapperPointer *meta.RESTMapper, objectCache map[string]unstructured.Unstructured) ([]GenericResource, error) {
+	interfaces := []GenericResource{}
+	deduped := map[string]*corev1.Pod{}
+	for idx, pod := range pods {
+		owners := pod.ObjectMeta.OwnerReferences
+		if len(owners) == 0 {
+			deduped[pod.ObjectMeta.Namespace+"/Pod/"+pod.ObjectMeta.Name] = &pods[idx]
+			continue
+		}
+		deduped[pod.ObjectMeta.Namespace+"/"+owners[0].Kind+"/"+owners[0].Name] = &pods[idx]
+	}
+	for key, pod := range deduped {
+		logrus.Debugf("Resolving controller from pod %s", key)
+		workload, err := ResolveControllerFromPod(ctx, *pod, dynamicClientPointer, restMapperPointer, objectCache)
+		if err != nil {
+			return nil, err
+		}
+		interfaces = append(interfaces, workload)
+	}
+	return interfaces, nil
+}
+
+// Because the controllers with an Owner take on the name of the Owner, this eliminates any duplicates.
+// In cases like CronJobs older children can hang around, so this takes the most recent.
+func deduplicateControllers(inputResources []GenericResource) []GenericResource {
+	controllerMap := make(map[string]GenericResource)
+	for _, controller := range inputResources {
+		key := controller.ObjectMeta.GetNamespace() + "/" + controller.Kind + "/" + controller.ObjectMeta.GetName()
+		oldController, ok := controllerMap[key]
+		if !ok || controller.ObjectMeta.GetCreationTimestamp().Time.After(oldController.ObjectMeta.GetCreationTimestamp().Time) {
+			controllerMap[key] = controller
+		}
+	}
+	results := make([]GenericResource, len(controllerMap))
+	idx := 0
+	for _, controller := range controllerMap {
+		results[idx] = controller
+		idx++
+	}
+	return results
+}
+
 func (resources *ResourceProvider) addResourcesFromReader(reader io.Reader) error {
 	contents, err := io.ReadAll(reader)
 	if err != nil {
@@ -17,7 +17,6 @@ package kube
 import (
 	"bytes"
 	"context"
-	"fmt"
 	"os"
 	"testing"
 	"time"
@@ -48,8 +47,8 @@ func TestGetResourcesFromPath(t *testing.T) {
 			namespaceCount[controller.ObjectMeta.GetNamespace()]++
 		}
 	}
-	assert.Equal(t, 10, provider.Resources.GetLength())
-	assert.Equal(t, 9, namespaceCount[""])
+	assert.Equal(t, 11, provider.Resources.GetLength())
+	assert.Equal(t, 10, namespaceCount[""])
 	assert.Equal(t, 1, namespaceCount["two"])
 }

@@ -65,8 +64,8 @@ func TestGetMultipleResourceFromSingleFile(t *testing.T) {

 	assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")

-	assert.Equal(t, 1, len(resources.Resources["apps/Deployment"]), "Should have one controller")
-	assert.Equal(t, "dashboard", resources.Resources["apps/Deployment"][0].PodSpec.Containers[0].Name)
+	assert.Equal(t, 1, len(resources.Resources["extensions/Deployment"]), "Should have one controller")
+	assert.Equal(t, "dashboard", resources.Resources["extensions/Deployment"][0].PodSpec.Containers[0].Name)

 	assert.Equal(t, 2, len(resources.Namespaces), "Should have a namespace")
 	assert.Equal(t, "polaris", resources.Namespaces[0].ObjectMeta.Name)
@@ -88,8 +87,8 @@ func TestAddResourcesFromReader(t *testing.T) {

 	assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")

-	assert.Equal(t, 1, len(resources.Resources["apps/Deployment"]), "Should have one controller")
-	assert.Equal(t, "dashboard", resources.Resources["apps/Deployment"][0].PodSpec.Containers[0].Name)
+	assert.Equal(t, 1, len(resources.Resources["extensions/Deployment"]), "Should have one controller")
+	assert.Equal(t, "dashboard", resources.Resources["extensions/Deployment"][0].PodSpec.Containers[0].Name)

 	assert.Equal(t, 2, len(resources.Namespaces), "Should have a namespace")
 	assert.Equal(t, "polaris", resources.Namespaces[0].ObjectMeta.Name)
@@ -147,30 +146,26 @@ func TestGetResourceFromAPI(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, tt.clusterName, dynamicInterface, tt.config)
+			resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, tt.clusterName, &dynamicInterface, tt.config)

 			if tt.wantErr {
 				assert.Error(t, err)
 			} else {
-				if assert.NoError(t, err) {
-					assert.Equal(t, tt.want.SourceType, resources.SourceType)
-					assert.Equal(t, tt.want.SourceName, resources.SourceName)
-					assert.IsType(t, tt.want.CreationTime, resources.CreationTime)
-					assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
-					for k, v := range resources.Resources {
-						fmt.Println("cont", k, v)
-					}
-					assert.Equal(t, 5, len(resources.Resources), "Should have 5 controllers")
+				assert.NoError(t, err)
+				assert.Equal(t, tt.want.SourceType, resources.SourceType)
+				assert.Equal(t, tt.want.SourceName, resources.SourceName)
+				assert.IsType(t, tt.want.CreationTime, resources.CreationTime)
+				assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
+				assert.Equal(t, 5, len(resources.Resources), "Should have 5 controllers")

-					for _, controllers := range resources.Resources {
-						for _, ctrl := range controllers {
-							expectedNames[ctrl.ObjectMeta.GetName()] = true
-						}
-					}
-					for name, val := range expectedNames {
-						assert.Equal(t, true, val, name)
+				for _, controllers := range resources.Resources {
+					for _, ctrl := range controllers {
+						expectedNames[ctrl.ObjectMeta.GetName()] = true
 					}
 				}
+				for name, val := range expectedNames {
+					assert.Equal(t, true, val, name)
+				}
 			}
 		})
 	}
@@ -1,4 +1,4 @@
-apiVersion: batch/v1
+apiVersion: batch/v1beta1
 kind: CronJob
 metadata:
  name: test
@@ -1,4 +1,4 @@
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: test-deployment
@@ -1,4 +1,4 @@
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  name: test-deployment-2
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 1
+  selector:
+    app: test
+  template:
+    metadata:
+      name: test
+      labels:
+        app: test
+    spec:
+      containers:
+      - name: test
+        image: busybox
+        command: ["tail"]
+        args: ["-f", "/dev/null"]
@@ -6,7 +6,7 @@ metadata:
  name: polaris
 ---
 # Source: polaris/templates/dashboard.deployment.yaml
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
  annotations:
@@ -1,5 +1,5 @@
 --
 # Source: polaris/templates/dashboard.deployment.yaml
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: Deployment
 ::::
@@ -182,9 +182,6 @@ func addOrReplaceValue(node *yaml.Node, splits []string, value *yaml.Node) error
 	}
 	for _, node := range nodes {
 		if node.Kind == yaml.ScalarNode {
-			if value.LineComment == "" {
-				value.LineComment = node.LineComment // keep the original comment if override is not provided
-			}
 			// Overwrite an existing scalar value with a new value (whatever kind).
 			*node = *value
 		} else if node.Kind == yaml.MappingNode && value.Kind == yaml.MappingNode {
@@ -25,15 +25,14 @@ var testCases = []struct {
 	mutated  string
 	patch    config.Mutation
 	message  string
-}{
-	{
-		original: oldYaml,
-		patch: config.Mutation{
-			Op:    "add",
-			Value: "Denver",
-			Path:  "/pets/0/owners/*/location",
-		},
-		mutated: `pets:
+}{{
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "Denver",
+		Path:  "/pets/0/owners/*/location",
+	},
+	mutated: `pets:
  - name: fido
    owners:
      - name: Alice
@@ -44,27 +43,27 @@ var testCases = []struct {
        location: Denver
  - name: scooby
 `,
-	}, {
-		original: oldYaml,
-		patch: config.Mutation{
-			Op:   "remove",
-			Path: "/pets/0/owners/*/aliases",
-		},
-		mutated: `pets:
+}, {
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:   "remove",
+		Path: "/pets/0/owners/*/aliases",
+	},
+	mutated: `pets:
  - name: fido
    owners:
      - name: Alice
      - name: Bob
  - name: scooby
 `,
-	}, {
-		original: oldYaml,
-		patch: config.Mutation{
-			Op:    "add",
-			Value: "rob",
-			Path:  "/pets/0/owners/*/aliases/-",
-		},
-		mutated: `pets:
+}, {
+	original: oldYaml,
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "rob",
+		Path:  "/pets/0/owners/*/aliases/-",
+	},
+	mutated: `pets:
  - name: fido
    owners:
      - name: Alice
@@ -76,23 +75,23 @@ var testCases = []struct {
          - rob
  - name: scooby
 `,
-	}, {
-		original: `
+}, {
+	original: `
 pets:
  - name: fido
 `,
-		patch: config.Mutation{
-			Op:    "add",
-			Value: "Alice",
-			Path:  "/pets/0/owners/0/name",
-		},
-		mutated: `pets:
+	patch: config.Mutation{
+		Op:    "add",
+		Value: "Alice",
+		Path:  "/pets/0/owners/0/name",
+	},
+	mutated: `pets:
  - name: fido
    owners:
      - name: Alice
 `,
-	}, {
-		original: `
+}, {
+	original: `
 obj:
  foo:
    bar:
@@ -100,89 +99,54 @@ obj:
      - b
  baz: quux
 `,
-		patch: config.Mutation{
-			Op: "replace",
-			Value: map[string]interface{}{
-				"bar": []string{"c", "d"},
-			},
-			Path: "/obj/foo",
+	patch: config.Mutation{
+		Op: "replace",
+		Value: map[string]interface{}{
+			"bar": []string{"c", "d"},
 		},
-		mutated: `
-obj:
+		Path: "/obj/foo",
+	},
+	mutated: `obj:
  foo:
    bar:
      - c
      - d
  baz: quux
 `,
-	}, {
-		original: `foo: bar`,
-		patch: config.Mutation{
-			Op:      "replace",
-			Value:   "baz",
-			Path:    "/foo",
-			Comment: "# We set this to baz",
+}, {
+	original: `
+foo: bar
+`,
+	patch: config.Mutation{
+		Op:      "replace",
+		Value:   "baz",
+		Path:    "/foo",
+		Comment: "# We set this to baz",
+	},
+	mutated: `
+foo: baz # We set this to baz
+`,
+	message: "Expected a comment to appear",
+}, {
+	original: `
+foo: bar
+`,
+	patch: config.Mutation{
+		Op: "add",
+		Value: map[string]interface{}{
+			"baz": "quux",
 		},
-		mutated: `foo: baz # We set this to baz`,
-		message: "Expected a comment to appear",
-	}, {
-		original: `foo: bar`,
-		patch: config.Mutation{
-			Op: "add",
-			Value: map[string]interface{}{
-				"baz": "quux",
-			},
-			Path:    "/extra",
-			Comment: "# These are extra things",
-		},
-		mutated: `
+		Path:    "/extra",
+		Comment: "# These are extra things",
+	},
+	mutated: `
 foo: bar
 extra:
  # These are extra things
  baz: quux
 `,
-		message: "Expected a comment to appear next to an object",
-	},
-	{
-		original: `
-foo: bar
-`,
-		patch: config.Mutation{
-			Op: "replace",
-			Value: map[string]interface{}{
-				"baz": "quux",
-			},
-			Path:    "/extra",
-			Comment: "# These are extra things",
-		},
-		mutated: `
-foo: bar
-extra:
-  # These are extra things
-  baz: quux
-`,
-		message: "Expected a comment to appear next to an object",
-	}, {
-		original: `foo: bar # we should keep this comment`,
-		patch: config.Mutation{
-			Op:    "replace",
-			Value: "baz",
-			Path:  "/foo",
-		},
-		mutated: `foo: baz # we should keep this comment`,
-		message: "Expected a comment to be kept",
-	}, {
-		original: `foo: bar # we should override this comment`,
-		patch: config.Mutation{
-			Op:      "replace",
-			Value:   "baz",
-			Path:    "/foo",
-			Comment: "override",
-		},
-		mutated: `foo: baz # override`,
-		message: "Expected a comment to overridden",
-	},
-}
+	message: "Expected a comment to appear next to an object",
+}}

 func TestApplyAllMutations(t *testing.T) {
 	for _, tc := range testCases {
@@ -96,7 +96,7 @@ func TestControllerLevelChecks(t *testing.T) {

 	res, err := kube.CreateResourceProviderFromPath("../kube/test_files/test_1")
 	assert.Equal(t, nil, err, "Error should be nil")
-	assert.Equal(t, 10, res.Resources.GetLength())
+	assert.Equal(t, 11, res.Resources.GetLength())
 	testResources(res)

 	replicaSpec := map[string]interface{}{"replicas": 2}
@@ -109,7 +109,7 @@ func TestControllerLevelChecks(t *testing.T) {
 	two := int32(2)
 	d2.Spec.Replicas = &two
 	k8s, dynamicClient := test.SetupTestAPI(&d1, &p1, &d2, &p2)
-	res, err = kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", dynamicClient, conf.Configuration{})
+	res, err = kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", &dynamicClient, conf.Configuration{})
 	assert.Equal(t, err, nil, "error should be nil")
 	assert.Equal(t, 2, res.Resources.GetLength(), "Should have two controllers")
 	testResources(res)
@@ -33,7 +33,7 @@ func TestGetTemplateData(t *testing.T) {
 	}

 	k8s, dynamicClient := test.SetupTestAPI(test.GetMockControllers("test")...)
-	resources, err := kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", dynamicClient, c)
+	resources, err := kube.CreateResourceProviderFromAPI(context.Background(), k8s, "test", &dynamicClient, c)
 	assert.Equal(t, err, nil, "error should be nil")
 	assert.Equal(t, 5, len(resources.Resources))

@@ -53,26 +53,6 @@ type AuditData struct {
 	Score                uint
 }

-// FilterResultsBySeverityLevel includes results according to the provided severity level:
-// 'danger' is the least verbose, 'warning' is medium verbosity, default behavior will
-// include all results, which currently also includes 'ignore'
-func (res AuditData) FilterResultsBySeverityLevel(severityLevel config.Severity) AuditData {
-	resCopy := res
-	resCopy.Results = []Result{}
-
-	filteredResults := funk.Map(res.Results, func(auditDataResult Result) Result {
-		return auditDataResult.filterResultsBySeverityLevel(severityLevel)
-	}).([]Result)
-
-	for _, result := range filteredResults {
-		if result.isNotEmpty() {
-			resCopy.Results = append(resCopy.Results, result)
-		}
-	}
-
-	return resCopy
-}
-
 // RemoveSuccessfulResults removes all tests that have passed
 func (res AuditData) RemoveSuccessfulResults() AuditData {
 	resCopy := res
@@ -128,25 +108,6 @@ func (res ResultSet) removeSuccessfulResults() ResultSet {
 	return newResults
 }

-func (res ResultSet) filterResultsBySeverityLevel(severityLevel config.Severity) ResultSet {
-	newResults := ResultSet{}
-	for k, resultMessage := range res {
-		switch severityLevel {
-		case config.SeverityDanger:
-			if resultMessage.Severity == config.SeverityDanger {
-				newResults[k] = resultMessage
-			}
-		case config.SeverityWarning:
-			if resultMessage.Severity == config.SeverityDanger || resultMessage.Severity == config.SeverityWarning {
-				newResults[k] = resultMessage
-			}
-		default:
-			return res
-		}
-	}
-	return newResults
-}
-
 // Result provides results for a Kubernetes object
 type Result struct {
 	Name        string
@@ -167,16 +128,6 @@ func (res Result) removeSuccessfulResults() Result {
 	return resCopy
 }

-func (res Result) filterResultsBySeverityLevel(severityLevel config.Severity) Result {
-	resCopy := res
-	resCopy.Results = res.Results.filterResultsBySeverityLevel(severityLevel)
-	if res.PodResult != nil {
-		podCopy := res.PodResult.filterResultsBySeverityLevel(severityLevel)
-		resCopy.PodResult = &podCopy
-	}
-	return resCopy
-}
-
 func (res Result) isNotEmpty() bool {
 	if res.PodResult != nil {
 		return res.PodResult.isNotEmpty()
@@ -200,15 +151,6 @@ func (res PodResult) removeSuccessfulResults() PodResult {
 	return resCopy
 }

-func (res PodResult) filterResultsBySeverityLevel(severityLevel config.Severity) PodResult {
-	resCopy := PodResult{}
-	resCopy.Results = res.Results.filterResultsBySeverityLevel(severityLevel)
-	resCopy.ContainerResults = funk.Map(res.ContainerResults, func(containerResult ContainerResult) ContainerResult {
-		return containerResult.filterResultsBySeverityLevel(severityLevel)
-	}).([]ContainerResult)
-	return resCopy
-}
-
 func (res PodResult) isNotEmpty() bool {
 	for _, cr := range res.ContainerResults {
 		if cr.isNotEmpty() {
@@ -230,12 +172,6 @@ func (res ContainerResult) removeSuccessfulResults() ContainerResult {
 	return resCopy
 }

-func (res ContainerResult) filterResultsBySeverityLevel(severityLevel config.Severity) ContainerResult {
-	resCopy := res
-	resCopy.Results = res.Results.filterResultsBySeverityLevel(severityLevel)
-	return resCopy
-}
-
 func (res ContainerResult) isNotEmpty() bool {
 	return res.Results.isNotEmpty()
 }
@@ -35,7 +35,7 @@ import (
 type schemaTestCase struct {
 	Target           config.TargetKind
 	Resource         kube.GenericResource
-	IsInitContainer  bool
+	IsInitContianer  bool
 	Container        *corev1.Container
 	ResourceProvider *kube.ResourceProvider
 }
@@ -80,7 +80,7 @@ func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCas
 	if !conf.IsActionable(check.ID, test.Resource.ObjectMeta, containerName) {
 		return nil, nil
 	}
-	if !check.IsActionable(test.Target, test.Resource.Kind, test.IsInitContainer) {
+	if !check.IsActionable(test.Target, test.Resource.Kind, test.IsInitContianer) {
 		return nil, nil
 	}
 	templateInput, err := getTemplateInput(test)
@@ -306,7 +306,7 @@ func applyContainerSchemaChecks(conf *config.Configuration, resources *kube.Reso
 		ResourceProvider: resources,
 		Resource:         controller,
 		Container:        container,
-		IsInitContainer:  isInit,
+		IsInitContianer:  isInit,
 	}
 	return applySchemaChecks(conf, test)
 }
@@ -408,13 +408,15 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes

 	}
 	result := makeResult(conf, check, passes, issues)
-	if funk.Contains(conf.Mutations, checkID) && len(check.Mutations) > 0 {
-		mutations := funk.Map(check.Mutations, func(mutation config.Mutation) config.Mutation {
-			mutationCopy := deepCopyMutation(mutation)
-			mutationCopy.Path = prefix + mutationCopy.Path
-			return mutationCopy
-		}).([]config.Mutation)
-		result.Mutations = mutations
+	if !passes {
+		if funk.Contains(conf.Mutations, checkID) && len(check.Mutations) > 0 {
+			mutations := funk.Map(check.Mutations, func(mutation config.Mutation) config.Mutation {
+				mutationCopy := deepCopyMutation(mutation)
+				mutationCopy.Path = prefix + mutationCopy.Path
+				return mutationCopy
+			}).([]config.Mutation)
+			result.Mutations = mutations
+		}
 	}
 	return &result, nil
 }
@@ -21,7 +21,6 @@ import (
 	"github.com/fairwindsops/polaris/pkg/mutation"
 	"github.com/sirupsen/logrus"
 	"gomodules.xyz/jsonpatch/v2"
-	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -36,66 +35,45 @@ type Mutator struct {
 	decoder *admission.Decoder
 }

+var _ admission.Handler = &Mutator{}
+
 // NewMutateWebhook creates a mutating admission webhook for the apiType.
-func NewMutateWebhook(mgr manager.Manager, c config.Configuration) {
+func NewMutateWebhook(mgr manager.Manager, mutator Mutator) {
 	path := "/mutate"

-	mutator := Mutator{
-		Client:  mgr.GetClient(),
-		decoder: admission.NewDecoder(runtime.NewScheme()),
-		Config:  c,
-	}
 	mgr.GetWebhookServer().Register(path, &webhook.Admission{Handler: &mutator})
 }

 func (m *Mutator) mutate(req admission.Request) ([]jsonpatch.Operation, error) {
 	results, kubeResources, err := GetValidatedResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
 	if err != nil {
-		logrus.Errorf("Error while validating resource: %v", err)
 		return nil, err
 	}
-	if results == nil {
-		logrus.Infof("Not mutating owned pod")
-		return nil, nil
-	}
 	patches := mutation.GetMutationsFromResult(results)
 	originalYaml, err := yaml.JSONToYAML(kubeResources.OriginalObjectJSON)
 	if err != nil {
-		logrus.Errorf("Failed to convert JSON to YAML: %v", err)
 		return nil, err
 	}
 	mutatedYamlStr, err := mutation.ApplyAllMutations(string(originalYaml), patches)
 	if err != nil {
-		logrus.Errorf("Failed to apply mutations: %v", err)
 		return nil, err
 	}
-
-	mutatedJson, err := yaml.YAMLToJSON([]byte(mutatedYamlStr))
+	mutatedJSONStr, err := yaml.YAMLToJSON([]byte(mutatedYamlStr))
 	if err != nil {
-		logrus.Errorf("Failed to convert YAML to JSON: %v", err)
 		return nil, err
 	}
-
-	ops, err := jsonpatch.CreatePatch(kubeResources.OriginalObjectJSON, mutatedJson)
-	if err != nil {
-		logrus.Errorf("Failed to create patch from mutation: %v", err)
-		return nil, err
-	}
-	return ops, nil
+	return jsonpatch.CreatePatch(kubeResources.OriginalObjectJSON, []byte(mutatedJSONStr))
 }

 // Handle for Validator to run validation checks.
 func (m *Mutator) Handle(ctx context.Context, req admission.Request) admission.Response {
-	logrus.Info("Starting mutation request")
+	logrus.Info("Starting request")
 	patches, err := m.mutate(req)
 	if err != nil {
-		logrus.Errorf("Error while getting mutations: %v", err)
 		return admission.Errored(403, err)
 	}
 	if patches == nil {
-		logrus.Infof("No patches generated")
 		return admission.Allowed("Allowed")
 	}
-	logrus.Infof("Generated %d patches", len(patches))
 	return admission.Patched("", patches...)
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Robert Brennan	aa0fa876d1	add debug	2022-12-13 08:53:47 -05:00
Robert Brennan	feb0ed681a	Merge branch 'master' into rb/fix-webhook	2022-12-13 08:50:46 -05:00
Robert Brennan	870ad9114b	fix mutate test	2022-11-30 16:17:57 -05:00
Robert Brennan	f872aee25c	fix test	2022-11-29 15:37:05 -05:00
Robert Brennan	f080ba55a8	fix mutations	2022-11-29 12:38:13 -05:00
Robert Brennan	1866a9649b	fix test	2022-11-29 12:24:44 -05:00
Robert Brennan	a809875682	add webhook test	2022-11-29 12:08:06 -05:00