[CI] rebuild website

2026-08-23 22:26:34 +00:00 · 2021-01-15 18:56:47 +00:00
552 changed files with 16182 additions and 41344 deletions
@@ -1,25 +1,10 @@
 version: 2.1

-orbs:
-  rok8s: fairwinds/rok8s-scripts@12
-  oss-docs: fairwinds/oss-docs@0
-
 executors:
  vm:
    machine:
      enabled: true

-commands:
-  install_goreleaser_dependencies:
-    description: Installs dependencies for CI scripts
-    steps:
-    - run: apk update
-    # gettext provides envsubst
-    - run: apk add gettext
-    # Register other docker platforms, to build arm64.
-    # This shouldn't be needed, why TBD.
-    - run: docker run --privileged --rm tonistiigi/binfmt --install all
-
 references:
  set_environment_variables: &set_environment_variables
    run:
@@ -32,8 +17,6 @@ references:
        echo 'export PUSH_ALL_VERSION_TAGS=true' >> ${BASH_ENV}
        echo 'export GOPROXY=https://proxy.golang.org' >> ${BASH_ENV}
        echo 'export GO111MODULE=on' >> ${BASH_ENV}
-        echo 'export GOFLAGS=-mod=mod' >> ${BASH_ENV}
-        echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV

  install_k8s: &install_k8s
    run:
@@ -44,20 +27,20 @@ references:
        sudo apt-get install -yqq jq git

        echo "Installing KIND"
-        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.19.0/kind-linux-amd64
+        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.8.1/kind-linux-amd64
        chmod 0755 kind-linux-amd64
        sudo mv kind-linux-amd64 /usr/local/bin/kind
        kind version

        echo "Installing Kubectl"
-        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.25.10/bin/linux/amd64/kubectl
+        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.18.6/bin/linux/amd64/kubectl
        chmod 0755 kubectl
        sudo mv kubectl /usr/local/bin/
        kubectl version --client


        echo "Creating Kubernetes Cluster with Kind"
-        kind create cluster --wait=90s --image kindest/node:v1.25.9@sha256:c08d6c52820aa42e533b70bce0c2901183326d86dcdcbedecc9343681db45161
+        kind create cluster --wait=90s --image kindest/node:v1.15.11
        docker ps -a

        kubectl version
@@ -68,17 +51,28 @@ references:
        ./get_helm.sh

        echo "Installing cert-manager"
+        kubectl create namespace cert-manager
        helm repo add jetstack https://charts.jetstack.io
        helm repo update
        echo "Helm install"
-        helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait --create-namespace
+        helm install cert-manager jetstack/cert-manager --namespace cert-manager --version 0.16.1 --set "installCRDs=true" --wait
        echo "Install cert-manager successful"

+  # Test scripts
+  update_coverage: &update_coverage
+    run:
+      name: Update Coverage
+      command: |
+        if [[ -z $CIRCLE_PR_NUMBER ]]; then
+          bash <(curl -s https://codecov.io/bash)
+        else
+          echo "Skipping coverage for forked PR"
+        fi
  test_binary_dashboard: &test_binary_dashboard
    run:
      name: Test Dashboard
      command: |
-        go run main.go dashboard --port 3000 --audit-path ./pkg/config/examples &
+        go run main.go dashboard --port 3000 --audit-path ./examples &
        sleep 30
        curl -f http://localhost:3000 > /dev/null
        curl -f http://localhost:3000/health > /dev/null
@@ -97,88 +91,149 @@ references:
          echo "Skipping Kubernetes tests for forked PR"
        fi

-  install_vault_alpine: &install_vault_alpine
+  # Release scripts
+  install_goreleaser: &install_goreleaser
    run:
-      name: install hashicorp vault
+      name: Install GoReleaser
      command: |
-        apk --update add curl yq
-        cd /tmp
-        curl -LO https://releases.hashicorp.com/vault/1.13.2/vault_1.13.2_linux_amd64.zip
-        sha256sum vault_1.13.2_linux_amd64.zip | grep f7930279de8381de7c532164b4a4408895d9606c0d24e2e9d2f9acb5dfe99b3c
-        unzip vault_1.13.2_linux_amd64.zip
-        mv vault /usr/bin/vault
+        curl -fsSLo goreleaser.deb https://github.com/goreleaser/goreleaser/releases/download/v0.131.1/goreleaser_amd64.deb
+        echo "640790dcbfa864f26de4c26c2d491f293a64525c8c6641c5bbdec7136b38977e goreleaser.deb" | sha256sum -c -
+        sudo dpkg -i goreleaser.deb
+        rm goreleaser.deb
+
+  docker_build: &docker_build
+    run:
+      name: Docker login and build
+      command: |
+        docker-pull -f .circleci/build.config
+        docker-build -f .circleci/build.config
+
+  docker_build_and_push: &docker_build_and_push
+    run:
+      name: Docker login, build, and push
+      command: |
+        docker-pull -f .circleci/build.config
+        docker-build -f .circleci/build.config
+        docker login quay.io -u="${fairwinds_quay_user}" -p="${fairwinds_quay_token}"
+        docker-push -f .circleci/build.config
+
+  release_deploy_configs: &release_deploy_configs
+    run:
+      name: Release deploy configs
+      command: |
+        upload_url=$(curl --silent https://api.github.com/repos/FairwindsOps/polaris/releases/latest | grep upload_url)
+        upload_url=$(echo $upload_url | sed -e 's/.*\(https.*\){.*$/\1/')
+        curl -X POST "$upload_url?name=dashboard.yaml" --data-binary "@./deploy/dashboard.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
+        curl -X POST "$upload_url?name=webhook.yaml" --data-binary "@./deploy/webhook.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
+
 jobs:
+  build:
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
+    steps:
+      - checkout
+      - setup_remote_docker
+      - *set_environment_variables
+      - *docker_build
+
+  push:
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
+    steps:
+      - checkout
+      - setup_remote_docker
+      - *set_environment_variables
+      - *docker_build_and_push
+
  test_k8s:
    working_directory: ~/polaris
    resource_class: medium
    executor: vm
    steps:
      - checkout
-      - *set_environment_variables
      - *install_k8s
      - *test_k8s

  test:
+    working_directory: /go/src/github.com/fairwindsops/polaris/
    docker:
-      - image: cimg/go:1.19
+      - image: circleci/golang:1.13
    steps:
      - checkout
      - *set_environment_variables
-      - run: go vet ./...
-      - run: go test ./... -coverprofile=coverage.txt -covermode=count
+      - run: go get -u golang.org/x/lint/golint
+      - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
+      - run: go list ./... | grep -v vendor | xargs go vet
+      - run: go test ./pkg/... -coverprofile=coverage.txt -covermode=count
+      - run: go run main.go audit --audit-path ./deploy --set-exit-code-below-score 100 --set-exit-code-on-danger
+      - *update_coverage
      - *test_binary_dashboard

-  build_and_push:
+  release_binary:
    working_directory: /go/src/github.com/fairwindsops/polaris/
-    resource_class: large
-    shell: /bin/bash
    docker:
-      # The goreleaser image tag determins the version of Go.
-      # Manually check goreleaser images for their version of Go.
-      # Ref: https://hub.docker.com/r/goreleaser/goreleaser/tags
-      - image: goreleaser/goreleaser:v1.18.2
+      - image: circleci/golang:1.13
    steps:
      - checkout
-      - setup_remote_docker:
-          version: 20.10.11
-      - *install_vault_alpine
-      - rok8s/get_vault_env:
-          vault_path: repo/global/env
-      - rok8s/get_vault_env:
-          vault_path: repo/polaris/env
+      - setup_remote_docker
      - *set_environment_variables
-      - run: docker login quay.io -u="${FAIRWINDS_QUAY_USER}" -p="${FAIRWINDS_QUAY_TOKEN}"
-      - install_goreleaser_dependencies
-      - run: scripts/goreleaser.sh
+      - *install_goreleaser
+      - run: go get -u github.com/gobuffalo/packr/v2/packr2
+      - run: git checkout -- . # FIXME: the go get makes the directory dirty
+      - run: packr2
+      - run: goreleaser
+      - *release_deploy_configs
+
+  release_images:
+    working_directory: /go/src/github.com/fairwindsops/polaris/
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
+    steps:
+      - checkout
+      - setup_remote_docker
+      - *set_environment_variables
+      - *docker_build_and_push

 workflows:
  version: 2

+  build:
+    jobs:
+      - test
+      - build:
+          requires:
+            - test
+      - push:
+          context: org-global
+          requires:
+            - build
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+      - test_k8s:
+          requires:
+            - push
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+
  release:
    jobs:
-      - test:
-          filters:
-            tags:
-              only: /.*/
-      - build_and_push:
+      - release_binary:
          context: org-global
          filters:
            branches:
-              ignore: /pull\/[0-9]+/
+              ignore: /.*/
+            # Testing tags are reserved for testing circle test + build steps
            tags:
              ignore: /^testing-.*/
-      - test_k8s:
+      - release_images:
          requires:
-            - build_and_push
-          filters:
-            branches:
-              ignore: /pull\/[0-9]+/
-            tags:
-              ignore: /^testing-.*/
-      - oss-docs/publish-docs:
-          repository: polaris
+            - release_binary
+          context: org-global
          filters:
            branches:
              ignore: /.*/
+            # Testing tags are reserved for testing circle test + build steps
            tags:
              ignore: /^testing-.*/
@@ -1,58 +0,0 @@
-name: Bug Report
-description: File a bug report
-labels: [bug, triage]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this bug report! Please fill the form below.
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened?
-      description: What happened?
-    validations:
-      required: true
-  - type: textarea
-    id: expected
-    attributes:
-      label: What did you expect to happen?
-      description: What is the expected or desired behavior?
-    validations:
-      required: true
-  - type: textarea
-    id: reproducible
-    attributes:
-      label: How can we reproduce this?
-      description: Please share the steps that we can take to reproduce this. Also include any relevant configuration.
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: The version of the tool that you are using. If a helm chart, please share the name of the chart.
-    validations:
-      required: true
-  - type: checkboxes
-    id: search
-    attributes:
-      label: Search
-      options:
-        - label: I did search for other open and closed issues before opening this.
-          required: true
-  - type: checkboxes
-    id: terms
-    attributes:
-      label: Code of Conduct
-      description: By submitting this issue, you agree to follow the CODE_OF_CONDUCT in this repository.
-      options:
-        - label: I agree to follow this project's Code of Conduct
-          required: true
-  - type: textarea
-    id: ctx
-    attributes:
-      label: Additional context
-      description: Anything else you would like to add
-    validations:
-      required: false
@@ -0,0 +1,58 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+---
+name: Bug report
+about: Let us know about an unexpected error, a crash, or an incorrect behavior.
+
+---
+### Installation Process
+<!--- 
+Did you install polaris on your local machine, or in a kubernetes cluster? Did you use kubectl, helm, brew, a GitHub release, or the source code? Let us know below. 
+--> 
+
+### Polaris Version
+<!---
+If you are using polaris locally, run `polaris --version` to show the version, and paste the result between the ``` marks below.
+
+If you are not running the latest version of Polaris, please try upgrading because your issue may have already been fixed.
+-->
+
+```
+...
+```
+
+### Expected Behavior
+<!--
+What should have happened?
+-->
+
+### Actual Behavior
+<!--
+What actually happened?
+-->
+
+### Steps to Reproduce
+<!--
+Please list the full steps required to reproduce the issue, for example:
+1. `polaris --audit --output-format score`
+-->
+
+### Additional Context
+<!--
+Are there anything atypical about your situation that we should know? 
+-->
+
+### References
+<!--
+Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:
+
+- #6017
+
+-->
@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ''
-labels: [triage, enhancement]
+labels: ''
 assignees: ''

 ---
@@ -2,7 +2,9 @@
 name: Other
 about: For misc. tasks like research or continued conversation
 title: ''
-labels: [triage]
+labels: ''
 assignees: ''

 ---
+
+
@@ -1,15 +0,0 @@
-# The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action
-
-FROM alpine:3.17
-
-RUN	apk add --no-cache \
-  bash \
-  ca-certificates \
-  curl \
-  wget \
-  tar \
-  jq
-
-COPY get_polaris.sh /get_polaris.sh
-
-ENTRYPOINT ["/get_polaris.sh"]
@@ -1,22 +0,0 @@
-name: 'Install polaris'
-description: 'Download a specific polaris version'
-
-inputs:
-  version:
-    description: 'version of polaris'
-    required: true
-    default: 'latest'
-
-runs:
-  using: 'docker'
-  image: './Dockerfile'
-  args:
-    - ${{ inputs.version }}
-
-outputs:
-  version:
-    description: 'Version of polaris installed'
-
-branding:
-  icon: 'download-cloud'
-  color: 'gray-dark'
@@ -1,20 +0,0 @@
-#!/bin/bash
-if [[ -z "$INPUT_VERSION" ]]; then
-  echo "Missing polaris version information"
-  exit 1
-fi
-POLARIS_URL=https://github.com/FairwindsOps/polaris/releases/download/$INPUT_VERSION/polaris_linux_amd64.tar.gz
-polaris version | grep "$INPUT_VERSION" &> /dev/null
-if [ $? == 0 ]; then
-   echo "Polaris $INPUT_VERSION is already installed! Exiting gracefully."
-   exit 0
-else
-  echo "Installing polaris to path from " $POLARIS_URL
-fi
-TARGET_FILE="polaris.tar.gz"
-curl -LJ -o $TARGET_FILE $POLARIS_URL
-mkdir polaris
-tar -xzf $TARGET_FILE -C polaris
-rm $TARGET_FILE
-echo "polaris" >> $GITHUB_PATH
-echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT
@@ -1,20 +0,0 @@
-## DO NOT EDIT - Managed by Terraform
-version: 2
-updates:
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "npm"
-    directory: "/docs"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 0
-    ignore:
-      - dependency-name: "*"
-
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
@@ -1,14 +0,0 @@
-
-This PR fixes #
-
-## Checklist
-* [ ] I have signed the CLA
-* [ ] I have updated/added any relevant documentation
-
-## Description
-### What's the goal of this PR?
-
-### What changes did you make?
-
-### What alternative solution should we consider, if any?
-
@@ -0,0 +1,40 @@
+# This file is generated from FairwindsOps/documentation-template
+# DO NOT EDIT MANUALLY
+
+name: Build Website
+
+on:
+  push:
+    branches: [ master ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [14.x]
+    defaults:
+      run:
+        working-directory: ./docs-md
+    env:
+        CI: true
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+    - run: npm ci
+    - name: Build site
+      run: npm run build
+    - name: Check links
+      run: npm run check-links
+    - name: Push changes
+      run: |
+        username="GitHub Actions"
+        git config user.email "opensource@fairwinds.com"
+        git config user.name $username
+        git add ../docs/
+        git commit -m "[CI] rebuild website"
+        git push -u origin +master:website
@@ -1,18 +0,0 @@
-name: 'Close stale issues and PRs'
-on:
-  schedule:
-    - cron: '32 1 * * *'
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v4
-        with:
-          exempt-issue-labels: pinned
-          stale-pr-label: stale
-          stale-issue-label: stale
@@ -1,27 +0,0 @@
-name: Test setup-polaris
-on:
-  pull_request:
-    branches: [ master ]
-
-jobs:
-  build-int:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup polaris
-        uses: ./.github/actions/setup-polaris
-        with:
-          version: 4.2.0
-      - name: Use command
-        run: polaris version
-
-  build-ext:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup polaris
-        uses: fairwindsops/polaris/.github/actions/setup-polaris@master
-        with:
-          version: 4.2.0
-      - name: Use command
-        run: polaris version
@@ -1,8 +1,4 @@
-# goreleaser is run via a wrapper that creates .goreleaser.yml from .goreleaser.yml.envsubst
-.goreleaser.yml
-# dist
-# # Binaries for programs and plugins
-.go-version
+# Binaries for programs and plugins
 *.exe
 *.exe~
 *.dll
@@ -23,10 +19,10 @@ Tiltfile
 main
 .DS_Store

+*-packr.go
 dist
 .vscode

 *-test.yaml

 node_modules
-/dist
@@ -0,0 +1,30 @@
+checksum:
+  name_template: 'checksums.txt'
+changelog:
+  sort: asc
+  filters:
+    exclude:
+    - '^docs:'
+    - '^test:'
+builds:
+  - id: watcher
+    env:
+      - CGO_ENABLED=0
+      - GO111MODULE=on
+    goarch:
+      - amd64
+      - arm
+      - arm64
+      - 386
+    goarm:
+      - 6
+      - 7
+brews:
+  - name: polaris
+    github:
+      owner: FairwindsOps
+      name: homebrew-tap
+    folder: Formula
+    description: Open Source Best Practices for Kubernetes
+    test: |
+      system "#{bin}/polaris version"
@@ -1,112 +0,0 @@
-checksum:
-  name_template: 'checksums.txt'
-changelog:
-  sort: asc
-  filters:
-    exclude:
-    - '^docs:'
-    - '^test:'
-env:
-  - GOBIN={{ .Env.TMPDIR }}/go-bin
-before:
-  hooks:
-    - go mod download
-builds:
-  - id: polaris
-    ldflags:
-      - -X main.Version={{.Version}} -X main.Commit={{.Commit}} -s -w
-    env:
-      - CGO_ENABLED=0
-      - GO111MODULE=on
-    goos:
-      - linux
-      - darwin
-      - windows
-    goarch:
-      - amd64
-      - arm
-      - arm64
-    goarm:
-      - 6
-      - 7
-archives:
-  - id: polaris
-    builds: ["polaris"]
-    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
-signs:
- cmd: cosign
-  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
-  artifacts: checksum
-release:
-  # This is replaced using `envsubst`, depending on the git branch.
-  disable: ${skip_release}
-  prerelease: auto
-  footer: |
-    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
-
-    ```
-    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
-    ```
-brews:
-  - name: polaris
-    # This is replaced using `envsubst`, depending on the git branch.
-    skip_upload: ${skip_release}
-    tap:
-      owner: FairwindsOps
-      name: homebrew-tap
-    folder: Formula
-    description: Open Source Best Practices for Kubernetes
-    test: |
-      system "#{bin}/polaris version"
-dockers:
-  # There are multiple images to match the `--platform` docker build flag with
-  # combinations of `GOOS`, `GOARCH`, and `GOARM`
- image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  use: buildx
-  build_flag_templates:
-  - "--platform=linux/amd64"
- image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
-  use: buildx
-  goarch: arm64
-  goos: linux
-  build_flag_templates:
-  - "--platform=linux/arm64"
-docker_manifests:
-# Create DOcker manifests that make multiple architectures available within a tag,
-# and provide partial-version tags like 2, and 2.2.
- name_template: quay.io/fairwinds/polaris:{{ .FullCommit }}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Env.feature_docker_tag }}
-  # This is replaced using `envsubst`, depending on the git branch.
-  skip_push: ${skip_feature_docker_tags}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:latest
-  # This is replaced using `envsubst`, depending on the git branch.
-  skip_push: ${skip_release}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Tag }}
-  # This is replaced using `envsubst`, depending on the git branch.
-  skip_push: ${skip_release}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Major }}
-  # This is replaced using `envsubst`, depending on the git branch.
-  skip_push: ${skip_release}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
- name_template: quay.io/fairwinds/polaris:{{ .Major }}.{{ .Minor }}
-  # This is replaced using `envsubst`, depending on the git branch.
-  skip_push: ${skip_release}
-  image_templates:
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-amd64"
-  - "quay.io/fairwinds/polaris:{{ .FullCommit }}-arm64"
@@ -1,24 +0,0 @@
-header:
-  license:
-    spdx-id: Apache-2.0
-    copyright-owner: 'FairwindsOps, Inc.'
-  content: |
-    // Copyright 2019 FairwindsOps Inc
-    //
-    // Licensed under the Apache License, Version 2.0 (the "License");
-    // you may not use this file except in compliance with the License.
-    // You may obtain a copy of the License at
-    //
-    //     http://www.apache.org/licenses/LICENSE-2.0
-    //
-    // Unless required by applicable law or agreed to in writing, software
-    // distributed under the License is distributed on an "AS IS" BASIS,
-    // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    // See the License for the specific language governing permissions and
-    // limitations under the License.
-  paths:
-    - '**/*.go'
-  comment: on-failure
-dependency:
-  files:
-    - go.mod
@@ -1,2 +1 @@
-## DO NOT EDIT - Managed by Terraform
-* @rbren @sudermanjr
+* @rbren @makoscafee @jordandoig @baderbuddy @shaswa
@@ -1,74 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, gender identity and expression, level of experience,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or
-advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic
-  address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at opensource@fairwinds.com. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
-
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/
@@ -1,21 +1,27 @@
-FROM alpine:3.19
+FROM golang:1.13 AS build-env
+WORKDIR /go/src/github.com/fairwindsops/polaris/

-LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
-      org.opencontainers.image.vendor="FairwindsOps, Inc." \
-      org.opencontainers.image.title="polaris" \
-      org.opencontainers.image.description="Polaris is a cli tool to help discover deprecated apiVersions in Kubernetes" \
-      org.opencontainers.image.documentation="https://polaris.docs.fairwinds.com/" \
-      org.opencontainers.image.source="https://github.com/FairwindsOps/polaris" \
-      org.opencontainers.image.url="https://github.com/FairwindsOps/polaris" \
-      org.opencontainers.image.licenses="Apache License 2.0"
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
+ENV CGO_ENABLED=0
+ENV GOOS=linux
+ENV GOARCH=amd64

+COPY go.mod .
+COPY go.sum .
+RUN go mod download
+RUN go get -u github.com/gobuffalo/packr/v2/packr2
+
+COPY . .
+RUN packr2 build -a -o polaris *.go
+
+FROM alpine:3.10
 WORKDIR /usr/local/bin
-RUN apk -U upgrade
 RUN apk --no-cache add ca-certificates

 RUN addgroup -S polaris && adduser -u 1200 -S polaris -G polaris
 USER 1200
-COPY polaris .
+COPY --from=build-env /go/src/github.com/fairwindsops/polaris/polaris .

 WORKDIR /opt/app

@@ -1,64 +1,66 @@
 <div align="center" class="no-border">
  <img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
  <br>
-  <h3>Polaris is an open source policy engine for Kubernetes</h3>
-  <a href="https://github.com/FairwindsOps/polaris/releases">
-    <img src="https://img.shields.io/github/v/release/FairwindsOps/polaris">
+  <h3>Best Practices for Kubernetes Workload Configuration</h3>
+  <a href="https://github.com/FairwindsOps/polaris">
+    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.0.0&color=239922">
  </a>
  <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
    <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
  </a>
-  <a href="https://circleci.com/gh/FairwindsOps/polaris">
+  <a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
    <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
  </a>
-  <a href="https://insights.fairwinds.com/gh/FairwindsOps/polaris">
-    <img src="https://insights.fairwinds.com/v0/gh/FairwindsOps/polaris/badge.svg">
-  </a>
 </div>

-Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.
+Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
+Kubernetes pods and controllers are configured using best practices, helping you avoid
+problems in the future. Polaris can be run in a few different modes:

 Polaris can be run in three different modes:
-* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard) - Validate Kubernetes resources against policy-as-code.
-* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller) - Automatically reject or modify workloads that don't adhere to your organization's policies.
-* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code) - Incorporate policy-as-code into the CI/CD process to test local YAML files.
+* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard), so you can audit what's running inside your cluster.
+* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
+* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
+
 <p align="center">
  <img src="https://polaris.docs.fairwinds.com/img/architecture.svg" alt="Polaris Architecture" width="550"/>
 </p>

+**Want to learn more?** Reach out on [the Slack channel](https://fairwindscommunity.slack.com/messages/polaris) ([request invite](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)), send an email to `opensource@fairwinds.com`, or join us for [office hours on Zoom](https://fairwindscommunity.slack.com/messages/office-hours)
+
+
 ## Documentation
 Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)

-<!-- Begin boilerplate -->
-## Join the Fairwinds Open Source Community
+## Integration with Fairwinds Insights
+<p align="center">
+  <img src="https://polaris.docs.fairwinds.com/img/FW_Insights_Polaris.svg" alt="Fairwinds Insights" width="550"/>
+</p>

-The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap,
-and network with fellow Kubernetes users.
-[Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)
-or
-[join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
+[Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
+is a platform for auditing Kubernetes clusters and enforcing policy. If you'd like to:
+* manage Polaris across a fleet of clusters
+* track findings over time
+* send results to services like Slack and Datadog
+* add additional checks from tools like
+[Trivy](https://github.com/aquasecurity/trivy),
+[Goldilocks](https://github.com/FairwindsOps/goldilocks/), and
+[OPA](https://www.openpolicyagent.org)

-<a href="https://insights.fairwinds.com/auth/register/">
-  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png"
-  alt="Love Fairwinds Open Source? Automate Fairwinds Open Source for free with Fairwinds Insights. Click to learn more" />
-</a>
+you can sign up for a [free account here](https://insights.fairwinds.com?source=polaris).

-## Other Projects from Fairwinds
+## Contributing
+PRs welcome! Check out the [Contributing Guidelines](https://polaris.docs.fairwinds.com/contributing) and [Code of Conduct](https://polaris.docs.fairwinds.com/code-of-conduct) for more information.

-Enjoying Polaris? Check out some of our other projects:
-* [Goldilocks](https://github.com/FairwindsOps/Goldilocks) - Right-size your Kubernetes Deployments by compare your memory and CPU settings against actual usage
-* [Pluto](https://github.com/FairwindsOps/Pluto) - Detect Kubernetes resources that have been deprecated or removed in future versions
-* [Nova](https://github.com/FairwindsOps/Nova) - Check to see if any of your Helm charts have updates available
-* [rbac-manager](https://github.com/FairwindsOps/rbac-manager) - Simplify the management of RBAC in your Kubernetes clusters
+## Further Information
+A history of changes to this project can be viewed in the [Changelog](https://polaris.docs.fairwinds.com/changelog)

-Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris)
-## Fairwinds Insights
-If you're interested in running Polaris in multiple clusters,
-tracking the results over time, integrating with Slack, Datadog, and Jira,
-or unlocking other functionality, check out
-[Fairwinds Insights](https://fairwinds.com/pricing),
-a platform for auditing and enforcing policy in Kubernetes clusters.
+If you'd like to learn more about Polaris, or if you'd like to speak with
+a Kubernetes expert, you can contact `info@fairwinds.com` or [visit our website](https://fairwinds.com)
+
+---
+
+<p align="center">
+  <img src="https://polaris.docs.fairwinds.com/img/dashboard-screenshot.png" alt="Polaris Dashboard" width="550"/>
+</p>

-<a href="https://fairwinds.com/pricing">
-  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
-</a>
@@ -25,8 +25,3 @@ schema:
              type: string
              not:
                const: ''
-mutations:
-  - op: add
-    path: /resources/limits/cpu
-    value: 100m
-    comment: "TODO: Set this to the maximum amount of CPU you want your workload to use"
@@ -25,8 +25,3 @@ schema:
              type: string
              not:
                const: ''
-mutations:
-  - op: add
-    path: /resources/requests/cpu
-    value: 100m
-    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"
@@ -14,18 +14,12 @@ schema:
          properties:
            add:
              type: array
-              allOf:
-                - not:
-                    contains:
-                      pattern: '^(?i)ALL$'
-                - not:
-                    contains:
-                      pattern: '^(?i)SYS_ADMIN$'
-                - not:
-                    contains:
-                      pattern: '^(?i)NET_ADMIN$'
-
-
-mutations:
-  - op: remove
-    path: /securityContext/capabilities/add
+              not:
+                contains:
+                  const: ALL
+              not:
+                contains:
+                  const: SYS_ADMIN
+              not:
+                contains:
+                  const: NET_ADMIN
@@ -1,7 +1,7 @@
 successMessage: Host IPC is not configured
 failureMessage: Host IPC should not be configured
 category: Security
-target: PodSpec
+target: Pod
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
@@ -9,6 +9,3 @@ schema:
    hostIPC:
      not:
        const: true
-mutations:
-  - op: remove
-    path: /hostIPC
@@ -1,7 +1,7 @@
 successMessage: Host network is not configured
 failureMessage: Host network should not be configured
 category: Security
-target: PodSpec
+target: Pod
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
@@ -9,6 +9,3 @@ schema:
    hostNetwork:
      not:
        const: true
-mutations:
-  - op: remove
-    path: /hostNetwork
@@ -1,7 +1,7 @@
 successMessage: Host PID is not configured
 failureMessage: Host PID should not be configured
 category: Security
-target: PodSpec
+target: Pod
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
@@ -9,6 +9,3 @@ schema:
    hostPID:
      not:
        const: true
-mutations:
-  - op: remove
-    path: /hostPID
@@ -13,6 +13,3 @@ schema:
        properties:
          hostPort:
            const: 0
-mutations:
-  - op: remove
-    path: /ports/*/hostPort
@@ -0,0 +1,31 @@
+successMessage: Container does not have any insecure capabilities
+failureMessage: Container should not have insecure capabilities
+category: Security
+target: Container
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    securityContext:
+      type: object
+      properties:
+        capabilities:
+          type: object
+          properties:
+            add:
+              enum:
+              - CHOWN
+              - DAC_OVERRIDE
+              - FSETID
+              - FOWNER
+              - MKNOD
+              - NET_RAW
+              - SETGID
+              - SETUID
+              - SETFCAP
+              - SETPCAP
+              - NET_BIND_SERVICE
+              - SYS_CHROOT
+              - KILL
+              - AUDIT_WRITE
+
@@ -19,8 +19,3 @@ schema:
      type: object
      not:
        const: null
-mutations:
-  - op: add
-    path: /livenessProbe
-    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
-    comment: "TODO: Change the livenessProbe setting to reflect your application's health"
@@ -25,8 +25,3 @@ schema:
              type: string
              not:
                const: ''
-mutations:
-  - op: add
-    path: /resources/limits/memory
-    value: "512Mi"
-    comment: "TODO: Set this to the maximum amount of memory you want your workload to use"
@@ -25,8 +25,3 @@ schema:
              type: string
              not:
                const: ''
-mutations:
-  - op: add
-    path: /resources/requests/memory
-    value: "512Mi"
-    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"
@@ -19,7 +19,3 @@ schema:
        replicas:
          type: integer
          minimum: 2
-mutations:
-  - op: add
-    path: /spec/replicas
-    value: 3
@@ -0,0 +1,16 @@
+successMessage: Filesystem is read only
+failureMessage: Filesystem should be read only
+category: Security
+target: Container
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required:
+  - securityContext
+  properties:
+    securityContext:
+      required:
+      - readOnlyRootFilesystem
+      properties:
+        readOnlyRootFilesystem:
+          const: true
@@ -1,13 +1,9 @@
 successMessage: Priority class has been set
 failureMessage: Priority class should be set
-category: Reliability
-target: PodSpec
+category: Security
+target: Pod
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - priorityClassName
-mutations:
-  - op: add
-    path: /priorityClassName
-    value: high-priority
@@ -0,0 +1,13 @@
+successMessage: Privilege escalation not allowed
+failureMessage: Privilege escalation should not be allowed
+category: Security
+target: Container
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    securityContext:
+      properties:
+        allowPrivilegeEscalation:
+          not:
+            const: true
@@ -9,7 +9,3 @@ schema:
  properties:
    imagePullPolicy:
      const: Always
-mutations:
-  - op: add
-    path: /imagePullPolicy
-    value: Always
@@ -19,8 +19,3 @@ schema:
      type: object
      not:
        const: null
-mutations:
-  - op: add
-    path: /readinessProbe
-    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
-    comment: "TODO: Change the readinessProbe setting to reflect your application's readiness to serve traffic"
@@ -0,0 +1,13 @@
+successMessage: Not running as privileged
+failureMessage: Should not be running as privileged
+category: Security
+target: Container
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    securityContext:
+      properties:
+        privileged:
+          not:
+            const: true
@@ -2,7 +2,7 @@ successMessage: Is not allowed to run as root
 failureMessage: Should not be allowed to run as root
 category: Security
 target: Container
-schemaTarget: PodSpec
+schemaTarget: Pod
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  definitions:
@@ -50,7 +50,3 @@ schema:
          properties:
            securityContext:
              $ref: "#/definitions/goodSecurityContext"
-mutations:
-  - op: add
-    path: /securityContext/runAsNonRoot
-    value: true
@@ -1,7 +1,7 @@
 successMessage: Ingress has TLS configured
 failureMessage: Ingress does not have TLS configured
 category: Security
-target: networking.k8s.io/Ingress
+target: Ingress
 schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
@@ -17,21 +17,13 @@ package cmd
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net/http"
 	"os"
-	"os/exec"
-	"strings"

-	workloads "github.com/fairwindsops/insights-plugins/plugins/workloads"
-	workloadsPkg "github.com/fairwindsops/insights-plugins/plugins/workloads/pkg"
-
-	"github.com/fairwindsops/polaris/pkg/auth"
-	cfg "github.com/fairwindsops/polaris/pkg/config"
-	"github.com/fairwindsops/polaris/pkg/insights"
+	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
@@ -39,49 +31,23 @@ import (
 	"sigs.k8s.io/yaml"
 )

-var (
-	setExitCode         bool
-	onlyShowFailedTests bool
-	minScore            int
-	auditOutputURL      string
-	auditOutputFile     string
-	auditOutputFormat   string
-	resourceToAudit     string
-	useColor            bool
-	helmChart           string
-	helmValues          []string
-	helmSkipTests       bool
-	checks              []string
-	auditNamespace      string
-	severityLevel       string
-	skipSslValidation   bool
-	uploadInsights      bool
-	clusterName         string
-	quiet               bool
-)
+var setExitCode bool
+var minScore int
+var auditOutputURL string
+var auditOutputFile string
+var auditOutputFormat string
+var resourceToAudit string

 func init() {
 	rootCmd.AddCommand(auditCmd)
 	auditCmd.PersistentFlags().StringVar(&auditPath, "audit-path", "", "If specified, audits one or more YAML files instead of a cluster.")
 	auditCmd.PersistentFlags().BoolVar(&setExitCode, "set-exit-code-on-danger", false, "Set an exit code of 3 when the audit contains danger-level issues.")
-	auditCmd.PersistentFlags().BoolVar(&onlyShowFailedTests, "only-show-failed-tests", false, "If specified, audit output will only show failed tests.")
 	auditCmd.PersistentFlags().IntVar(&minScore, "set-exit-code-below-score", 0, "Set an exit code of 4 when the score is below this threshold (1-100).")
 	auditCmd.PersistentFlags().StringVar(&auditOutputURL, "output-url", "", "Destination URL to send audit results.")
 	auditCmd.PersistentFlags().StringVar(&auditOutputFile, "output-file", "", "Destination file for audit results.")
-	auditCmd.PersistentFlags().StringVarP(&auditOutputFormat, "format", "f", "json", "Output format for results - json, yaml, pretty, or score.")
-	auditCmd.PersistentFlags().BoolVar(&useColor, "color", true, "Whether to use color in pretty format.")
+	auditCmd.PersistentFlags().StringVarP(&auditOutputFormat, "format", "f", "json", "Output format for results - json, yaml, or score.")
 	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
-	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
-	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
-	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
-	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
-	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
-	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
-	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
-	auditCmd.PersistentFlags().BoolVar(&uploadInsights, "upload-insights", false, "Upload scan results to Fairwinds Insights")
-	auditCmd.PersistentFlags().StringVar(&clusterName, "cluster-name", "", "Set --cluster-name to a descriptive name for the cluster you're auditing")
-	auditCmd.PersistentFlags().BoolVar(&quiet, "quiet", false, "Suppress the 'upload to Insights' prompt.")
 }

 var auditCmd = &cobra.Command{
@@ -92,102 +58,8 @@ var auditCmd = &cobra.Command{
 		if displayName != "" {
 			config.DisplayName = displayName
 		}
-		if len(checks) > 0 {
-			targetChecks := make(map[string]bool)
-			for _, check := range checks {
-				targetChecks[check] = true
-			}
-			for key := range config.Checks {
-				if isTarget := targetChecks[key]; !isTarget {
-					config.Checks[key] = cfg.SeverityIgnore
-				}
-			}
-		}
-		if auditNamespace != "" {
-			if helmChart != "" {
-				logrus.Warn("--namespace and --helm-chart are mutually exclusive. --namespace will be ignored.")
-			}
-			if auditPath != "" {
-				logrus.Warn("--namespace and --audit-path are mutually exclusive. --namespace will be ignored.")
-			}
-			config.Namespace = auditNamespace
-		}
-		if helmChart != "" {
-			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
-			if err != nil {
-				logrus.Errorf("Couldn't process helm chart: %v", err)
-				os.Exit(1)
-			}
-		}
-		if uploadInsights && len(clusterName) == 0 {
-			logrus.Error("cluster-name is required when using --upload-insights")
-			os.Exit(1)
-		}
-		if uploadInsights {
-			if auditPath != "" {
-				logrus.Errorf("upload-insights and audit-path are not supported when used simultaneously")
-				os.Exit(1)
-			}
-			if !auth.IsLoggedIn() {
-				err := auth.HandleLogin(insightsHost)
-				if err != nil {
-					logrus.Errorf("error handling logging: %v", err)
-					os.Exit(1)
-				}
-			}
-		}

-		ctx := context.TODO()
-		k, err := kube.CreateResourceProvider(ctx, auditPath, resourceToAudit, config)
-		if err != nil {
-			logrus.Errorf("Error fetching Kubernetes resources %v", err)
-			os.Exit(1)
-		}
-
-		auditData, err := validator.RunAudit(config, k)
-		if err != nil {
-			logrus.Errorf("Error while running audit on resources: %v", err)
-			os.Exit(1)
-		}
-
-		if uploadInsights {
-			auth, err := auth.GetAuth(insightsHost)
-			if err != nil {
-				logrus.Errorf("getting auth: %v", err)
-				os.Exit(1)
-			}
-			// fetch workloads using workload plugin... or should we adapt the workloads from above?
-			dynamicClient, restMapper, clientSet, host, err := kube.GetKubeClient(ctx, "")
-			if err != nil {
-				logrus.Errorf("getting the kubernetes client: %v", err)
-				os.Exit(1)
-			}
-			k8sResources, err := workloadsPkg.CreateResourceProviderFromAPI(ctx, dynamicClient, restMapper, clientSet, host)
-			if err != nil {
-				logrus.Errorf("creating resource provider: %v", err)
-				os.Exit(1)
-			}
-
-			insightsClient := insights.NewHTTPClient(insightsHost, auth.Organization, auth.Token)
-			insightsReporter := insights.NewInsightsReporter(insightsClient)
-			wr := insights.WorkloadsReport{Version: workloads.Version, Payload: *k8sResources}
-			pr := insights.PolarisReport{Version: version, Payload: auditData}
-			logrus.Infof("Uploading to Fairwinds Insights organization '%s/%s'...", auth.Organization, clusterName)
-			err = insightsReporter.ReportAuditToFairwindsInsights(clusterName, wr, pr)
-			if err != nil {
-				logrus.Errorf("reporting audit file to insights: %v", err)
-				os.Exit(1)
-			}
-			os.Stderr.WriteString("\n\nSuccess! You can see your results at:")
-			os.Stderr.WriteString(fmt.Sprintf("\n\n%s/orgs/%s/clusters/%s/action-items\n\n", insightsHost, auth.Organization, clusterName))
-		} else {
-			outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests, severityLevel)
-			if !quiet {
-				os.Stderr.WriteString("\n\n🚀 Upload your Polaris findings to Fairwinds Insights to see remediation advice, add teammates, integrate with Slack or Jira, and more:")
-				os.Stderr.WriteString("\n\n❯ polaris " + strings.Join(os.Args[1:], " ") + " --upload-insights --cluster-name=my-cluster\n\n")
-			}
-		}
+		auditData := runAndReportAudit(cmd.Context(), config, auditPath, resourceToAudit, auditOutputFile, auditOutputURL, auditOutputFormat)

 		summary := auditData.GetSummary()
 		score := summary.GetScore()
@@ -201,69 +73,29 @@ var auditCmd = &cobra.Command{
 	},
 }

-// ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
-	cmd := exec.Command("helm", "dependency", "update", helmChart)
-	output, err := cmd.CombinedOutput()
+func runAndReportAudit(ctx context.Context, c conf.Configuration, auditPath, workload, outputFile, outputURL, outputFormat string) validator.AuditData {
+	// Create a kubernetes client resource provider
+	k, err := kube.CreateResourceProvider(ctx, auditPath, workload)
 	if err != nil {
-		logrus.Error(string(output))
-		return "", err
+		logrus.Errorf("Error fetching Kubernetes resources %v", err)
+		os.Exit(1)
 	}
-
-	dir, err := os.MkdirTemp("", "*")
-	if err != nil {
-		return "", err
-	}
-	params := []string{
-		"template", helmChart,
-		"--generate-name",
-		"--output-dir",
-		dir,
-	}
-	for _, v := range helmValues {
-		params = append(params, "--values", v)
-	}
-
-	if helmSkipTests {
-		params = append(params, "--skip-tests")
-	}
-
-	cmd = exec.Command("helm", params...)
-	output, err = cmd.CombinedOutput()
+	var auditData validator.AuditData
+	auditData, err = validator.RunAudit(c, k)

 	if err != nil {
-		logrus.Error(string(output))
-		return "", err
-	}
-	return dir, nil
-}
-
-func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFormat string, useColor bool, onlyShowFailedTests bool, severityLevel string) {
-	if onlyShowFailedTests {
-		auditData = auditData.RemoveSuccessfulResults()
-	}
-
-	if severityLevel != "" {
-		switch severityLevel {
-		case "danger":
-			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityDanger)
-		case "warning":
-			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityWarning)
-		}
+		logrus.Errorf("Error while running audit on resources: %v", err)
+		os.Exit(1)
 	}

 	var outputBytes []byte
-	var err error
 	if outputFormat == "score" {
 		outputBytes = []byte(fmt.Sprintf("%d\n", auditData.GetSummary().GetScore()))
 	} else if outputFormat == "yaml" {
-		var jsonBytes []byte
-		jsonBytes, err = json.Marshal(auditData)
+		jsonBytes, err := json.Marshal(auditData)
 		if err == nil {
 			outputBytes, err = yaml.JSONToYAML(jsonBytes)
 		}
-	} else if outputFormat == "pretty" {
-		outputBytes = []byte(auditData.GetPrettyOutput(useColor))
 	} else {
 		outputBytes, err = json.MarshalIndent(auditData, "", "  ")
 	}
@@ -289,13 +121,9 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 			} else {
 				req.Header.Set("Content-Type", "text/plain")
 			}
-
 			client := &http.Client{}
-			if skipSslValidation {
-				transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
-				client = &http.Client{Transport: transport}
-			}
 			resp, err := client.Do(req)
+
 			if err != nil {
 				logrus.Errorf("Error making request for output: %v", err)
 				os.Exit(1)
@@ -303,7 +131,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor

 			defer resp.Body.Close()

-			body, err := io.ReadAll(resp.Body)
+			body, err := ioutil.ReadAll(resp.Body)

 			if err != nil {
 				logrus.Errorf("Error reading response: %v", err)
@@ -314,11 +142,12 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 		}

 		if outputFile != "" {
-			err := os.WriteFile(outputFile, outputBytes, 0644)
+			err := ioutil.WriteFile(outputFile, []byte(outputBytes), 0644)
 			if err != nil {
 				logrus.Errorf("Error writing output to file: %v", err)
 				os.Exit(1)
 			}
 		}
 	}
+	return auditData
 }
@@ -1,81 +0,0 @@
-package cmd
-
-import (
-	"github.com/fairwindsops/polaris/pkg/auth"
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	rootCmd.AddCommand(authCmd)
-	authCmd.AddCommand(loginCmd)
-	authCmd.AddCommand(logoutCmd)
-	authCmd.AddCommand(statusCmd)
-	authCmd.AddCommand(tokenCmd)
-}
-
-var authCmd = &cobra.Command{
-	Use:   "auth",
-	Short: "Authenticate polaris with Fairwinds Insights",
-	Long:  `Authenticate polaris with Fairwinds Insights so better experience`,
-}
-
-var loginCmd = &cobra.Command{
-	Use:   "login",
-	Short: "Authenticate polaris with Fairwinds Insights.",
-	Long:  `Authenticate polaris with Fairwinds Insights.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.HandleLogin(insightsHost)
-		if err != nil {
-			logrus.Fatal(err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
-
-var logoutCmd = &cobra.Command{
-	Use:   "logout",
-	Short: "Log out of a Fairwinds Insights.",
-	Long:  `Log out of a Fairwinds Insights.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.HandleLogout()
-		if err != nil {
-			logrus.Fatal(err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
-
-var statusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "View authentication status.",
-	Long:  `View authentication status.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.PrintStatus(insightsHost)
-		if err != nil {
-			logrus.Fatalf("printing status: %v", err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
-
-var tokenCmd = &cobra.Command{
-	Use:   "token",
-	Short: "Print the auth token gh is configured to use.",
-	Long:  `Print the auth token gh is configured to use.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		err := auth.PrintToken()
-		if err != nil {
-			logrus.Fatalf("printing token: %v", err)
-		}
-	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
-}
@@ -27,12 +27,10 @@ import (
 var serverPort int
 var basePath string
 var loadAuditFile string
-var listeningAddress string

 func init() {
 	rootCmd.AddCommand(dashboardCmd)
 	dashboardCmd.PersistentFlags().IntVarP(&serverPort, "port", "p", 8080, "Port for the dashboard webserver.")
-	dashboardCmd.PersistentFlags().StringVar(&listeningAddress, "listening-address", "", "Listening Address for the dashboard webserver.")
 	dashboardCmd.PersistentFlags().StringVar(&basePath, "base-path", "/", "Path on which the dashboard is served.")
 	dashboardCmd.PersistentFlags().StringVar(&loadAuditFile, "load-audit-file", "", "Runs the dashboard with data saved from a past audit.")
 	dashboardCmd.PersistentFlags().StringVar(&auditPath, "audit-path", "", "If specified, audits one or more YAML files instead of a cluster.")
@@ -54,17 +52,13 @@ var dashboardCmd = &cobra.Command{
 			auditData := validator.ReadAuditFromFile(loadAuditFile)
 			auditDataPtr = &auditData
 		}
-		router, err := dashboard.GetRouter(config, auditPath, serverPort, basePath, auditDataPtr)
-		if err != nil {
-			logrus.Fatalf("error creating router: %v", err)
-		}
-
+		router := dashboard.GetRouter(config, auditPath, serverPort, basePath, auditDataPtr)
 		router.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
 			w.Write([]byte("OK"))
 		})
 		http.Handle("/", router)

 		logrus.Infof("Starting Polaris dashboard server on port %d", serverPort)
-		logrus.Fatal(http.ListenAndServe(fmt.Sprintf("%s:%d", listeningAddress, serverPort), nil))
+		logrus.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", serverPort), nil))
 	},
 }
@@ -1,56 +0,0 @@
-// Copyright 2020 FairwindsOps Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package cmd
-
-import (
-	"errors"
-	"os"
-
-	"github.com/fairwindsops/polaris/pkg/fix"
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-var (
-	filesPath   string
-	checksToFix []string
-	isTemplate  bool
-)
-
-func init() {
-	rootCmd.AddCommand(fixCommand)
-	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
-	fixCommand.PersistentFlags().BoolVar(&isTemplate, "template", false, "set to true when modifyng a YAML template, like a Helm chart (experimental)")
-	fixCommand.PersistentFlags().StringSliceVar(&checksToFix, "checks", []string{}, "Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations")
-}
-
-var fixCommand = &cobra.Command{
-	Use:   "fix",
-	Short: "Fix Infrastructure as code files.",
-	Long:  `Fix Infrastructure as code files.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		logrus.Debug("Setting up controller manager")
-
-		err := fix.Execute(config, filesPath, isTemplate, checksToFix...)
-		if err != nil {
-			if errors.Is(err, fix.ErrFilesPathRequired) {
-				logrus.Error("Please specify a files-path flag")
-				cmd.Help()
-				os.Exit(1)
-			}
-			logrus.Fatal(err)
-		}
-	},
-}
@@ -15,26 +15,20 @@
 package cmd

 import (
+	"flag"
 	"os"
-	"strings"

 	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 )

-var (
-	configPath                   string
-	disallowExemptions           bool
-	disallowConfigExemptions     bool
-	disallowAnnotationExemptions bool
-	fixChecks                    bool
-	logLevel                     string
-	auditPath                    string
-	displayName                  string
-	kubeContext                  string
-	insightsHost                 string
-)
+var configPath string
+var disallowExemptions bool
+var logLevel string
+var auditPath string
+var displayName string

 var (
 	version string
@@ -43,12 +37,10 @@ var (
 func init() {
 	// Flags
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "Location of Polaris configuration file.")
-	rootCmd.PersistentFlags().StringVarP(&kubeContext, "context", "x", "", "Set the kube context.")
-	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
-	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
-	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
-	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level to be output (trace, debug, info, warning, error, fatal, panic).")
-	rootCmd.PersistentFlags().StringVar(&insightsHost, "insights-host", "https://insights.fairwinds.com", "Fairwinds Insights host URL")
+	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any exemptions from configuration file.")
+	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level.")
+	flag.Parse()
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
 }

 var config conf.Configuration
@@ -71,10 +63,10 @@ var rootCmd = &cobra.Command{
 			os.Exit(1)
 		}

-		config.DisallowExemptions = disallowExemptions
-		config.DisallowConfigExemptions = disallowConfigExemptions
-		config.DisallowAnnotationExemptions = disallowAnnotationExemptions
-		config.KubeContext = kubeContext
+		if disallowExemptions {
+			config.DisallowExemptions = true
+		}
+
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		logrus.Error("You must specify a sub-command.")
@@ -84,11 +76,6 @@ var rootCmd = &cobra.Command{
 		}
 		os.Exit(1)
 	},
-	PersistentPostRun: func(cmd *cobra.Command, args []string) {
-		if !strings.HasPrefix(cmd.Use, "audit") {
-			os.Stderr.WriteString("\n\nWant more? Automate Polaris for free with Fairwinds Insights!\n🚀 https://fairwinds.com/insights-signup/polaris 🚀 \n")
-		}
-	},
 }

 // Execute the stuff
@@ -31,7 +31,4 @@ var versionCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		fmt.Println("Polaris version:" + version)
 	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
 }
@@ -16,6 +16,7 @@ package cmd

 import (
 	"os"
+	"time"

 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -24,22 +25,15 @@ import (
 	k8sConfig "sigs.k8s.io/controller-runtime/pkg/client/config"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
 )

 var webhookPort int
 var disableWebhookConfigInstaller bool
-var enableMutations bool
-var enableValidations bool
-var certDir string

 func init() {
 	rootCmd.AddCommand(webhookCmd)
 	webhookCmd.PersistentFlags().IntVarP(&webhookPort, "port", "p", 9876, "Port for the dashboard webserver.")
-	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "Disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
-	webhookCmd.PersistentFlags().BoolVar(&enableValidations, "validate", true, "Enable the validating webhook to reject workloads with issues")
-	webhookCmd.PersistentFlags().BoolVar(&enableMutations, "mutate", false, "Enable the mutating webhook to modify workloads with issues")
-	webhookCmd.PersistentFlags().StringVar(&certDir, "cert-dir", "/opt/cert", "Directory in which tls certificate is located")
+	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
 }

 var webhookCmd = &cobra.Command{
@@ -50,36 +44,27 @@ var webhookCmd = &cobra.Command{
 		logrus.Debug("Setting up controller manager")

 		mgr, err := manager.New(k8sConfig.GetConfigOrDie(), manager.Options{
-			CertDir: certDir,
+			CertDir: "/opt/cert",
 			Port:    webhookPort,
-			WebhookServer: webhook.NewServer(webhook.Options{
-				CertDir:  certDir,
-				Port:     webhookPort,
-				CertName: "tls.crt",
-				KeyName:  "tls.key",
-			}),
 		})
 		if err != nil {
 			logrus.Errorf("Unable to set up overall controller manager: %v", err)
 			os.Exit(1)
 		}

-		_, err = os.Stat(certDir + "/tls.crt")
+		_, err = os.Stat("/opt/cert/tls.crt")
 		if os.IsNotExist(err) {
+			time.Sleep(time.Second * 10)
 			panic("Cert does not exist")
 		}
+		server := mgr.GetWebhookServer()
+		server.CertName = "tls.crt"
+		server.KeyName = "tls.key"

-		if !enableMutations && !enableValidations {
-			logrus.Errorf("One of --mutate or --validate must be set to true")
-			os.Exit(1)
-		}
+		// Iterate all the configurations supported controllers to scan and register them for webhooks
+		// Should only register controllers that are configured to be scanned
+		fwebhook.NewWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})

-		if enableValidations {
-			fwebhook.NewValidateWebhook(mgr, config)
-		}
-		if enableMutations {
-			fwebhook.NewMutateWebhook(mgr, config)
-		}
 		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
 		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
 			logrus.Errorf("Error starting manager: %v", err)
@@ -0,0 +1,2 @@
+coverage:
+  range: 50...80
@@ -0,0 +1,146 @@
+---
+# Source: polaris/templates/0-namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: polaris
+---
+# Source: polaris/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: polaris
+  namespace: polaris
+  labels:
+    app: polaris
+---
+# Source: polaris/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: polaris
+  labels:
+    app: polaris
+rules:
+  # required by controller-runtime code doing a cluster wide lookup
+  # when it seems namespace would suffice
+  - apiGroups:
+      - ''
+    resources:
+      - 'nodes'
+    verbs:
+      - 'get'
+      - 'list'
+---
+# Source: polaris/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: polaris-view
+  labels:
+    app: polaris
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+  - kind: ServiceAccount
+    name: polaris
+    namespace: polaris
+---
+# Source: polaris/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: polaris
+  labels:
+    app: polaris
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: polaris
+subjects:
+  - kind: ServiceAccount
+    name: polaris
+    namespace: polaris
+---
+# Source: polaris/templates/dashboard.service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: polaris-dashboard
+  namespace: polaris
+  labels:
+    app: polaris
+  annotations:
+spec:
+  ports:
+  - name: http-dashboard
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: polaris
+    component: dashboard
+  type: ClusterIP
+---
+# Source: polaris/templates/dashboard.deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: polaris-dashboard
+  namespace: polaris
+  labels:
+    app: polaris
+    component: dashboard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: polaris
+      component: dashboard
+  template:
+    metadata:
+      labels:
+        app: polaris
+        component: dashboard
+    spec:
+      containers:
+      - command:
+        - polaris
+        - dashboard
+        image: 'quay.io/fairwinds/polaris:3.0'
+        imagePullPolicy: 'Always'
+        name: dashboard
+        ports:
+        - containerPort: 8080
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 20
+        resources:
+          limits:
+            cpu: 150m
+            memory: 512Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+              - ALL
+      serviceAccountName: polaris
+      nodeSelector:
+      tolerations:
@@ -0,0 +1,262 @@
+---
+# Source: polaris/templates/0-namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: polaris
+---
+# Source: polaris/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: polaris
+  namespace: polaris
+  labels:
+    app: polaris
+---
+# Source: polaris/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: polaris
+  labels:
+    app: polaris
+rules:
+  # required by controller-runtime code doing a cluster wide lookup
+  # when it seems namespace would suffice
+  - apiGroups:
+      - ''
+    resources:
+      - 'nodes'
+    verbs:
+      - 'get'
+      - 'list'
+---
+# Source: polaris/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: polaris-view
+  labels:
+    app: polaris
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+  - kind: ServiceAccount
+    name: polaris
+    namespace: polaris
+---
+# Source: polaris/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: polaris
+  labels:
+    app: polaris
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: polaris
+subjects:
+  - kind: ServiceAccount
+    name: polaris
+    namespace: polaris
+---
+# Source: polaris/templates/webhook.service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: polaris-webhook
+  namespace: polaris
+  labels:
+    app: polaris
+spec:
+  ports:
+  - name: webhook
+    port: 443
+    protocol: TCP
+    targetPort: 9876
+  selector:
+    app: polaris
+    component: webhook
+  type: ClusterIP
+---
+# Source: polaris/templates/webhook.deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: polaris-webhook
+  namespace: polaris
+  labels:
+    app: polaris
+    component: webhook
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: polaris
+      component: webhook
+  template:
+    metadata:
+      labels:
+        app: polaris
+        component: webhook
+    spec:
+      containers:
+        - name: webhook
+          command:
+            - polaris
+            - webhook
+          image: 'quay.io/fairwinds/polaris:3.0'
+          imagePullPolicy: 'Always'
+          ports:
+            - containerPort: 9876
+          # These are fairly useless readiness/liveness probes for now
+          # Follow this issue for potential improvements:
+          # https://github.com/kubernetes-sigs/controller-runtime/issues/356
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - ps -ef | grep polaris
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - ps -ef | grep polaris
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            limits:
+              cpu: 100m
+              memory: 128Mi
+            requests:
+              cpu: 100m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: secret
+              mountPath: /opt/cert/
+              readOnly: true
+            - name: cr-logs
+              mountPath: /tmp/
+              readOnly: false
+      serviceAccountName:  polaris
+      nodeSelector:
+      tolerations:
+      volumes:
+        - name: secret
+          secret:
+            secretName: polaris
+        - name: cr-logs
+          emptyDir: {}
+---
+# Source: polaris/templates/webhook.cert.yaml
+apiVersion: cert-manager.io/v1alpha2
+kind: Certificate
+metadata:
+  name: polaris-cert
+  namespace: polaris
+  labels:
+    app: polaris
+spec:
+  commonName: polaris-webhook.polaris.svc
+  dnsNames:
+  - polaris-webhook.polaris.svc
+  - polaris-webhook.polaris
+  - polaris-webhook
+  - polaris-webhook.polaris.svc.
+  issuerRef:
+    kind: Issuer
+    name: polaris-selfsigned
+  secretName: polaris
+---
+# Source: polaris/templates/webhook.cert.yaml
+apiVersion: cert-manager.io/v1alpha2
+kind: Issuer
+metadata:
+  name: polaris-selfsigned
+  namespace: polaris
+spec:
+  selfSigned: {}
+---
+# Source: polaris/templates/webhook.configuration.yaml
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: polaris-webhook
+  annotations:
+    cert-manager.io/inject-ca-from: polaris/polaris-cert
+webhooks:
+- admissionReviewVersions:
+  - v1beta1
+  clientConfig:
+    service:
+      name: polaris-webhook
+      namespace: polaris
+      path: /validate
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Exact
+  name: polaris.fairwinds.com
+  namespaceSelector:
+    
+    matchExpressions:
+    - key: control-plane
+      operator: DoesNotExist
+  objectSelector:
+    
+    {}
+  rules:
+  - apiGroups:
+    - apps
+    apiVersions:
+    - v1
+    - v1beta1
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - daemonsets
+    - deployments
+    - statefulsets
+    scope: Namespaced
+  - apiGroups:
+    - batch
+    apiVersions:
+    - v1
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - jobs
+    - cronjobs
+    scope: Namespaced
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - pods
+    - replicationcontrollers
+    scope: Namespaced
+  sideEffects: None
+  timeoutSeconds: 10
@@ -33,13 +33,6 @@ module.exports = {
          "/infrastructure-as-code",
        ],
      },
-      {
-        title: "Usage",
-        collapsable: false,
-        children: [
-          "/cli",
-        ],
-      },
      {
        title: "Customization",
        collapsable: false,
@@ -38,11 +38,11 @@ const baseConfig = {
  head: [
    ['link', { rel: 'icon', href: '/favicon.png' }],
    ['script', { src: '/scripts/modify.js' }],
-    ['script', { src: '/scripts/marketing.js' }],
+    ['script', { src: '/scripts/leadlander.js' }],
  ],
  themeConfig: {
    docsRepo: "",
-    docsDir: 'docs',
+    docsDir: 'docs-md',
    editLinks: true,
    editLinkText: "Help us improve this page",
    logo: '/img/fairwinds-logo.svg',
@@ -0,0 +1,12 @@
+/*
+ * This file is generated from FairwindsOps/documentation-template
+ * DO NOT EDIT MANUALLY
+ */
+
+var llcookieless = true;
+var sf14gv = 32793;
+(function() {
+  var sf14g = document.createElement('script');
+  sf14g.src = 'https://lltrck.com/lt-v2.min.js';
+  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(sf14g, s);
+})();
@@ -23,13 +23,6 @@
  color: $successColor;
 }

-blockquote {
-  border-left: 0.2rem solid $warningColor;
-}
-blockquote p {
-  color: $warningColor;
-}
-
 .theme-default-content:not(.custom),
 .page-nav,
 .page-edit,
@@ -3,7 +3,7 @@
  <br>
  <h3>Best Practices for Kubernetes Workload Configuration</h3>
  <a href="https://github.com/FairwindsOps/polaris">
-    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.1.6&color=239922">
+    <img src="https://img.shields.io/static/v1.svg?label=Version&message=3.0.0&color=239922">
  </a>
  <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
    <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
@@ -11,14 +11,11 @@
  <a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
    <img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
  </a>
-  <a href="https://insights.fairwinds.com/gh/FairwindsOps/polaris">
-    <img src="https://insights.fairwinds.com/v0/gh/FairwindsOps/polaris/badge.svg">
-  </a>
 </div>

 Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
 Kubernetes pods and controllers are configured using best practices, helping you avoid
-problems in the future.
+problems in the future. Polaris can be run in a few different modes:

 Polaris can be run in three different modes:
 * As a [dashboard](/dashboard), so you can audit what's running inside your cluster.
@@ -38,7 +35,7 @@ Polaris can be run in three different modes:
  <img src="/img/FW_Insights_Polaris.svg" alt="Fairwinds Insights" width="550"/>
 </p>

-[Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
+[Fairwinds Insights](https://www.fairwinds.com/insights?utm_campaign=Hosted%20Polaris%20&utm_source=polaris&utm_term=polaris&utm_content=polaris)
 is a platform for auditing Kubernetes clusters and enforcing policy. If you'd like to:
 * manage Polaris across a fleet of clusters
 * track findings over time
@@ -1,12 +1,4 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Documentation: Polaris can be run as an admission controller that acts as a validating webhook."
---
 # Admission Controller
-> Want to manage the Admission Controller across multiple clusters? Check out
-> [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
-
 Polaris can be run as an admission controller that acts as a validating webhook.
 This accepts the same configuration as the dashboard, and can run the same validations.

@@ -25,10 +17,15 @@ If you don't use cert-manager, you'll need to:
 * Create a TLS secret in your cluster with a valid certificate that uses that CA
 * Pass the name of that secret with the webhook.secretName parameter.

+### kubectl
+```bash
+kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/webhook.yaml
+```
+
 ### Helm
 ```bash
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable
-helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris --create-namespace \
+helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris \
  --set webhook.enable=true --set dashboard.enable=false
 ```

@@ -45,38 +42,3 @@ output unless we are rejecting a workload altogether.
 This means that any checks with a severity of `warning` will still pass webhook validation,
 and the only evidence of that warning will either be in the Polaris dashboard or the
 Polaris webhook logs. This will change in a future version of Kubernetes.
-
-## Mutating Webhook
-By default, the Admission Controller is just pass/fail, but
-Polaris can also operate as a mutating webhook for many of the issues it checks for.
-This means Polaris will remediate the issue it finds, rather than rejecting
-the deployment.
-
-To enable the mutating webhook, add `--set webhook.mutate=true` to your
-Helm installation command.
-
-The following default checks currently have mutation support enabled:
-* `hostPIDSet`
-* `hostNetworkSet`
-* `hostIPCSet`
-* `priorityClassNotSet`
-* `hostPortSet`
-* `pullPolicyNotAlways`
-* `deploymentMissingReplicas`
-* `dangerousCapabilities`
-* `cpuLimitsMissing`
-* `memoryLimitsMissing`
-* `livenessProbeMissing`
-* `memoryRequestsMissing`
-* `cpuRequestsMissing`
-* `runAsPrivileged`
-* `readinessProbeMissing`
-* `privilegeEscalationAllowed`
-* `notReadOnlyRootFilesystem`
-* `insecureCapabilities`
-* `runAsRootAllowed`
-
-If you'd like to
-enable other mutations, you can set the `webhook.mutations` flag.
-
-
@@ -0,0 +1,148 @@
+---
+sidebarDepth: 0
+---
+## 3.0.0
+* **Breaking** - fixed inconsistency in how controller-level checks are handled
+Custom checks with `target: Controller` should remove `Object` from the top-level of the
+JSON schema (see changes to `./checks/multipleReplicasForDeployment.yaml`)
+
+## 2.0.1
+* Fixed Polaris deployment process
+
+## 2.0.0
+* Standardize categories of checks into Security, Reliability, and Efficiency
+* Changes to the dashboard UI
+* Update controller-runtime
+
+## 1.2.1
+* Update date on dashboard footer
+
+## 1.2.0
+* Add ability to audit a single workload
+* Enable `pullPolicyAlways` by default
+* Fix for finding parent resources
+
+## 1.1.1
+* Show controller checks on dashboard
+* Fix for orphaned pods w/ controller checks
+
+## 1.1.0
+* Add namespace filter in UI
+* Add priorityClass check
+* Support reading from STDIN
+* Ensure severity is set for all custom checks
+* Support audit files which use \r or \r\n as newline character
+* Add option to exempt an entire controller from checks via config file
+* Fixed case where parent resources trigger error
+* Fixed UI zero-state
+
+## 1.0.3
+* Fixed case where parent resources trigger error
+* Fixed dashboard link when `--base-path` is set
+
+## 1.0.2
+* Fixed case where custom CRDs are not covered by RBAC
+
+## 1.0.1
+* Added ARM binaries to releases
+
+## 1.0.0
+### New Features
+* Added support for custom checks using JSON Schema
+* Added support for arbitrary controllers, rather than a pre-configured set
+    * removed support for `controllers_to_scan` in config
+* Added the ability to exempt a particular controller from a particular check.
+* Docker image now includes the default config
+
+### Breaking Changes
+* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/examples) for examples of the new formats.
+    * removed config-level configuration for checks like max/min memory settings
+    * changed severity `error` to `danger`
+* Breaking changes to the CLI
+    * CLI flag `--set-exit-code-on-error` is now `--set-exit-code-on-danger`
+    * Flags `--version`, `--dashboard`, `--webhook`, and `--audit` are now arguments
+    * Port flags are now just `--port`
+
+## 0.6.0
+* Fixed webhook support in Kubernetes 1.16
+  * this also removes support for 1.8
+* Added support for exemptions via controller annotations
+
+## 0.5.2
+* Fixed missing success messages for resource requests/limits
+
+## 0.5.1
+* Added a few more exemptions
+* Started checking exemptions based on controller name prefix
+* `runAsUser != 0` now passes the `runAsNonRoot` check
+
+## 0.5.0
+* Added `--load-audit-file` flag to run the dashboard from an existing audit
+* Added an `ID` field to each check in the output
+* Skip health checks for jobs, cronjobs, initcontainers
+* Added support for exemptions
+* Fixed dashboard base path option
+
+## 0.4.0
+* Added additional Pod Controllers to scan PodSpec (`jobs`, `cronjobs`, `daemonsets`, `replicationcontrollers`)
+
+## 0.3.1
+* Changed dashboard branding to refer to new org name Fairwinds
+
+## 0.3.0
+* Added `--set-exit-code-on-error` and `--set-exit-code-below-score` flags to better support CI/CD
+
+## 0.2.1
+* [Fix](https://github.com/FairwindsOps/polaris/issues/146): Fixed logic on RunAsNonRoot check to incorporate settings in podSpec
+
+## 0.2.0
+* Added `--output-format` flag for better CI/CD support
+* Added `--display-name` flag
+* Added support for StatefulSets
+* Show error message if no kubeconfig is set
+
+## 0.1.5
+* [Fix](https://github.com/FairwindsOps/polaris/issues/125): ignore limits/requests for initContainers
+* [Fix](https://github.com/FairwindsOps/polaris/issues/132): support custom base path
+
+## 0.1.4
+* [Fix](https://github.com/FairwindsOps/polaris/issues/116): details pages getting template errors
+* [Fix](https://github.com/FairwindsOps/polaris/issues/114): support all auth providers
+* [Fix](https://github.com/FairwindsOps/polaris/issues/112): Ignore readiness probe for initContainers
+
+## 0.1.3
+* [Fix](https://github.com/FairwindsOps/polaris/issues/109): dashboard not updating when running persistently
+
+## 0.1.2
+* Stored all third-party assets (e.g. Charts.js) to local files to support offline dashboard viewing
+* Fix: custom configs in `ConfigMap` not respected
+
+## 0.1.1
+* [Fix](https://github.com/FairwindsOps/polaris/issues/93): missing `config.yaml` and dashboard assets in binary releases
+* Added some tests and better error handling
+
+## 0.1.0
+* Dashboard fully functional
+* Validating webhook functional, but still considered beta
+* Checks:
+  * Health
+    * readiness probe missing
+    * liveness probe missing
+  * Images
+    * tag not specified
+    * pull policy not always
+  * Networking
+    * host network set
+    * host port set
+  * Resources
+    * cpu/memory requests missing
+    * cpu/memory limits missing
+    * cpu/memory ranges exceeded
+  * Security
+    * security capabilities
+    * host IPC set
+    * host PID set
+    * not read-only fs
+    * privilege escalation allowed
+    * run as root allowed
+    * run as privileged
@@ -1,8 +1,3 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Ensure that CPU and memory settings are configured, so that Kubernetes can schedule your workload effectively"
---
 # Efficiency

 These checks ensure that CPU and memory settings are configured, so that
@@ -14,10 +9,10 @@ To simplify ensure that these values have been set, the following attributes are

 key | default | description
 ----|---------|------------
-`cpuRequestsMissing` | `warning` | Fails when `resources.requests.cpu` attribute is not configured.
-`memoryRequestsMissing` | `warning` | Fails when `resources.requests.memory` attribute is not configured.
-`cpuLimitsMissing` | `warning` | Fails when `resources.limits.cpu` attribute is not configured.
-`memoryLimitsMissing` | `warning` | Fails when `resources.limits.memory` attribute is not configured.
+`resources.cpuRequestsMissing` | `warning` | Fails when `resources.requests.cpu` attribute is not configured.
+`resources.memoryRequestsMissing` | `warning` | Fails when `resources.requests.memory` attribute is not configured.
+`resources.cpuLimitsMissing` | `warning` | Fails when `resources.limits.cpu` attribute is not configured.
+`resources.memoryLimitsMissing` | `warning` | Fails when `resources.limits.memory` attribute is not configured.

 ## Background

@@ -1,8 +1,3 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Make sure your Kubernetes workloads are always available, and are running the correct image."
---
 # Reliability

 These checks help to make sure your workloads are always available,
@@ -10,61 +5,25 @@ and are running the correct image.

 key | default | description
 ----|---------|------------
-`readinessProbeMissing` | `warning` | Fails when a readiness probe is not configured for a pod.
-`livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
-`tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
-`pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
-`priorityClassNotSet` | `warning` | Fails when a priorityClassName is not set for a pod.
-`deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
-`missingPodDisruptionBudget` | `warning` | Fails when PDB is missing.
-`metadataAndInstanceMismatched` | `warning` | Fails when label `app.kubernetes.io/instance` and `metadata.name` mismatch
-`topologySpreadConstraint` | `warning` | Fails when there is no topology spread constraint on the pod
-`hpaMaxAvailability` | `warning` | Fails when `maxAvailable` lesser or equal than `minAvailable` (if defined) for a HorizontalPodAutoscaler
-`hpaMinAvailability` | `warning` | Fails when `minAvailable` (if defined) lesser or equal to one for a HorizontalPodAutoscaler
+`reliability.readinessProbeMissing` | `warning` | Fails when a readiness probe is not configured for a pod.
+`reliability.livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
+`reliability.tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
+`reliability.pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
+`reliability.priorityClassNotSet` | `ignore` | Fails when a priorityClassName is not set for a pod.
+`reliability.multipleReplicasForDeployment` | `ignore` | Fails when there is only one replica for a deployment.

 ## Background

-### Liveness and Readiness Probes
 Readiness and liveness probes can help maintain the health of applications running inside Kubernetes. By default, Kubernetes only knows whether or not a process is running, not if it's healthy. Properly configured readiness and liveness probes will also be able to ensure the health of an application.

 Readiness probes are designed to ensure that an application has reached a "ready" state. In many cases there is a period of time between when a webserver process starts and when it is ready to receive traffic. A readiness probe can ensure the traffic is not sent to a pod until it is actually ready to receive traffic.

 Liveness probes are designed to ensure that an application stays in a healthy state. When a liveness probe fails, the pod will be restarted.

-### Image Pull Policy
 Docker's `latest` tag is applied by default to images where a tag hasn't been specified. Not specifying a specific version of an image can lead to a wide variety of problems. The underlying image could include unexpected breaking changes that break your application whenever the latest image is pulled. Reusing the same tag for multiple versions of an image can lead to different nodes in the same cluster having different versions of an image, even if the tag is identical.

 Related to that, relying on cached versions of a Docker image can become a security vulnerability. By default, an image will be pulled if it isn't already cached on the node attempting to run it. This can result in variations in images that are running per node, or potentially provide a way to gain access to an image without having direct access to the ImagePullSecret. With that in mind, it's often better to ensure the a pod has `pullPolicy: Always` specified, so images are always pulled directly from their source.

-### Topology Spread Constraints
-
-By default, the Kubernetes scheduler uses a bin-packing algorithm to fit as many pods as possible into a cluster. The scheduler prefers a more evenly distributed general node load to app replicas precisely spread across nodes. Therefore, by default, multi-replica is not guaranteed to be spread across multiple availability zones. Kubernetes provides topologySpreadConstraint configuration in order to better ensure pod spread across multiple AZs and/or Hosts.
-
-Example of a topologySpreadConstraint spreading across zones:
-
-```
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: demo-basic-demo
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: basic-demo
-      app.kubernetes.io/instance: demo
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: basic-demo
-        app.kubernetes.io/instance: demo
-    spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: "topology.kubernetes.io/zone"
-          whenUnsatisfiable: ScheduleAnyway
-```
-
-
 ## Further Reading

 - [What's Wrong With The Docker :latest Tag?](https://vsupalov.com/docker-latest-tag/)
@@ -72,4 +31,3 @@ spec:
 - [Kubernetes Docs: Configure Liveness and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
 - [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
 - [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)
- [Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
@@ -0,0 +1,37 @@
+# Security
+
+These checks are related to security concerns. Workloads that fail these
+checks may make your cluster more vulnerable, often by introducing a path
+for privilege escalation.
+
+key | default | description
+----|---------|------------
+`security.hostIPCSet` | `danger` | Fails when `hostIPC` attribute is configured.
+`security.hostPIDSet` | `danger` | Fails when `hostPID` attribute is configured.
+`security.notReadOnlyRootFilesystem` | `warning` | Fails when `securityContext.readOnlyRootFilesystem` is not true.
+`security.privilegeEscalationAllowed` | `danger` | Fails when `securityContext.allowPrivilegeEscalation` is true.
+`security.runAsRootAllowed` | `warning` | Fails when `securityContext.runAsNonRoot` is not true.
+`security.runAsPrivileged` | `danger` | Fails when `securityContext.privileged` is true.
+`security.insecureCapabilities` | `warning` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/checks/insecureCapabilities.yaml)
+`security.dangerousCapabilities` | `danger` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/checks/dangerousCapabilities.yaml)
+`security.hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
+`security.hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
+
+## Background
+
+Securing workloads in Kubernetes is an important part of overall cluster security. The overall goal should be to ensure that containers are running with as minimal privileges as possible. This includes avoiding privilege escalation, not running containers with a root user, not giving excessive access to the host network, and using read only file systems wherever possible.
+
+A pod running with the `hostNetwork` attribute enabled will have access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. There are certain examples where setting `hostNetwork` to true is required, such as deploying a networking plugin like Flannel.
+
+Setting the `hostPort` attribute on a container will ensure that it is accessible on that specific port on each node it is deployed to. Unfortunately when this is specified, it limits where a pod can actually be scheduled in a cluster.
+
+Much of this configuration can be found in the `securityContext` attribute for both Kubernetes pods and containers. Where configuration is available at both a pod and container level, Polaris validates both.
+
+## Further Reading
+- [Kubernetes Docs: Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+- [KubeCon 2018 Keynote: Running with Scissors](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
+- [Kubernetes Security Book](https://kubernetes-security.info/)
+- [Kubernetes Docs: Set capabilities for a Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container)
+- [Linux Programmer's Manual: Capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html)
+- [Kubernetes Docs: Configuration Best Practices](https://kubernetes.io/docs/concepts/configuration/overview/#services)
+- [Accessing Kubernetes Pods from Outside of the Cluster](http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster/)
@@ -0,0 +1,66 @@
+#### CLI Options
+
+```
+# top-level commands
+audit
+      Runs a one-time audit.
+dashboard
+      Runs the webserver for Polaris dashboard.
+help
+      Prints help, if you give it a command then it will print help for that command. Same as -h
+version
+      Prints the version of Polaris
+webhook
+      Runs the webhook webserver
+
+# high-level flags
+-c, --config string
+      Location of Polaris configuration file
+--disallow-exemptions
+      Disallow any exemptions from configuration file.
+-h, --help
+      Help for Polaris (same as help command)
+--kubeconfig string
+      Path to a kubeconfig. Only required if out-of-cluster.
+--log-level string
+      Logrus log level (default "info")
+--master string
+      The address of the Kubernetes API server. Overrides any value in kubeconfig. Only required if out-of-cluster.
+
+# dashboard flags
+--audit-path string
+      If specified, audits one or more YAML files instead of a cluster
+--base-path string
+      Path on which the dashboard is served (default "/")
+--display-name string
+      An optional identifier for the audit
+--load-audit-file string
+      Runs the dashboard with data saved from a past audit.
+-p, --port int
+      Port for the dashboard webserver (default 8080)
+
+# audit flags
+--audit-path string
+      If specified, audits one or more YAML files instead of a cluster
+--resource string
+      If specified, audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend
+--display-name string
+      An optional identifier for the audit
+--format string
+      Output format for results - json, yaml, or score (default "json")
+--output-file string
+      Destination file for audit results
+--output-url string
+      Destination URL to send audit results
+--set-exit-code-below-score int
+      Set an exit code of 4 when the score is below this threshold (1-100)
+--set-exit-code-on-danger
+      Set an exit code of 3 when the audit contains danger-level issues.
+
+# webhook flags
+--disable-webhook-config-installer
+      disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping
+-p, --port int
+      Port for the webhook webserver (default 9876)
+```
+
@@ -1,8 +1,3 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Contribution Code of Conduct"
---
 # Code of Conduct

 ## Our Pledge
@@ -1,8 +1,3 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Contribution Guidelines"
---
 # Contributing

 Issues, whether bugs, tasks, or feature requests are essential for keeping Polaris great. We believe it should be as easy as possible to contribute changes that get things working in your environment. There are a few guidelines that we need contributors to follow so that we can keep on top of things.
@@ -37,25 +32,12 @@ We label issues with the ["good first issue" tag](https://github.com/FairwindsOp

 The following commands are all required to pass as part of Polaris testing:

-```bash
+```
 go list ./... | grep -v vendor | xargs golint -set_exit_status
 go list ./... | grep -v vendor | xargs go vet
 go test ./pkg/... -v -coverprofile cover.out
 ```

-### Webhook tests
-```bash
-kind create cluster --wait=90s --image kindest/node:v1.15.11 --name polaris-test
-docker build -t quay.io/fairwinds/polaris:debug . # or use your own registry
-docker push quay.io/fairwinds/polaris:debug
-helm repo add jetstack https://charts.jetstack.io
- helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait
-POLARIS_IMAGE=quay.io/fairwinds/polaris:debug ./test/webhook_test.sh
-```
-to avoid the final cleanup for debugging purposes, you can run
-```bash
-SKIP_FINAL_CLEANUP=true IMAGE_TAG=debug ./test/webhook_test.sh
-```
 ## Creating a New Issue

 If you've encountered an issue that is not already reported, please create a [new issue](https://github.com/FairwindsOps/polaris/issues), choose `Bug Report`, `Feature Request` or `Misc.` and follow the instructions in the template. 
@@ -72,7 +54,50 @@ Each new pull request should:
 - Be up to date and/or rebased on the master branch

 ## Creating a new release
-To create a new release, simply tag this repo with the new version.

-For major and minor releases, don't forget to update the Helm chart at
-https://github.com/FairwindsOps/charts
+### Patch releases
+Patch releases only need to change this repo. The Helm chart and deploy scripts
+will automatically pull in the latest changes.
+
+If the release involves changes to anything in the `deploy/` folder (e.g. new RBAC permissions),
+it needs to be a minor or major release in order to prevent breaking the Helm chart.
+
+1. Create a PR for this repo
+    1. Bump the version number in:
+        1. main.go
+        2. README.md
+    2. Update CHANGELOG.md
+    3. Merge your PR
+2. Tag the latest branch for this repo
+    1. Pull the latest commit for the `master` branch (which you just merged in your PR)
+    2. Run `git tag $VERSION && git push --tags`
+    3. Make sure CircleCI runs successfully for the new tag - this will push images to quay.io and create a release in GitHub
+        1. If CircleCI fails, check with Codeowners ASAP
+
+### Minor/Major releases
+Minor and major releases need to change both this repository and the
+[Helm chart repo](https://github.com/FairwindsOps/charts/).
+
+The steps are:
+1. Modify the [Helm chart](https://github.com/FairwindsOps/charts/stable/polaris)
+    1. Clone the helm charts repo
+        1. `git clone https://github.com/FairwindsOps/charts`
+        2. `git checkout -b yourname/update-polaris`
+    1. Bump the version number in `stable/polaris/Chart.yaml`
+    2. Make any necessary changes to the chart to support the new version of Polaris (e.g. new RBAC permissions)
+    3. **Don't merge yet!**
+2. Create a PR for this repo
+    1. Create a new branch named `yourname/update-version`
+    2. Bump the version number in:
+        1. main.go
+        2. README.md
+    3. Regenerate the deployment files. Assuming you've cloned the charts repo to `~/git/charts`:
+        1. `CHARTS_DIR=~/git/charts ./scripts/generate-deployment-files.sh`
+    4. Update CHANGELOG.md
+    5. Merge your PR
+3. Tag the latest branch for this repo
+    1. Pull the latest for the `master` branch
+    2. Run `git tag $VERSION && git push --tags`
+    3. Make sure CircleCI runs successfully for the new tag - this will push images to quay.io and create a release in GitHub
+        1. If CircleCI fails, check with Codeowners ASAP
+4. Create and merge a PR for your changes to the Helm chart
@@ -1,8 +1,3 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Documentation on setting checks by severity "
---
 # Check Settings
 Each check can be assigned a `severity`. Only checks with a severity of `danger` or `warning` will be validated. The results of these validations are visible on the dashboard. In the case of the validating webhook, only failures with a severity of `danger` will result in a change being rejected.

@@ -1,11 +1,6 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Learn about Polaris defaults and how to customize configurations. "
---
 # Configuration

-The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/pkg/config/default.yaml).
+The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/examples/config.yaml).

 You can customize the configuration to do things like:
 * Turn checks [on and off](checks.md)
@@ -0,0 +1,39 @@
+# Custom Checks
+If you'd like to create your own checks, you can use [JSON Schema](https://json-schema.org/). For example,
+to disallow images from quay.io:
+
+```yaml
+checks:
+  imageRegistry: warning
+customChecks:
+  imageRegistry:
+    successMessage: Image comes from allowed registries
+    failureMessage: Image should not be from disallowed registry
+    category: Images
+    target: Container # target can be "Container" or "Pod"
+    schema:
+      '$schema': http://json-schema.org/draft-07/schema
+      type: object
+      properties:
+        image:
+          type: string
+          not:
+            pattern: ^quay.io
+```
+
+Schemas can also be specified as JSON strings instead of YAML, for easier copy/pasting:
+```yaml
+customChecks:
+  foo:
+    jsonSchema: |
+      {
+        "$schema": "http://json-schema.org/draft-07/schema",
+        "type": "object"
+      }
+```
+
+We extend JSON Schema with `resourceMinimum` and `resourceMaximum` fields to help compare memory and CPU resource
+strings like `1000m` and `1G`. You can see an example in [the extended config](https://github.com/FairwindsOps/polaris/tree/master/examples/config-full.yaml)
+
+There are additional examples in the [checks folder](https://github.com/FairwindsOps/polaris/tree/master/checks).
+
@@ -1,8 +1,3 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Exemptions"
---
 # Exemptions
 Sometimes a workload really does need to do things that Polaris considers insecure. For instance,
 many of the `kube-system` workloads need to run as root, or need access to the host network. In these
@@ -1,13 +1,5 @@
---
-meta:
-  - name: description
-    content: "Fairwinds Polaris | Ways to run Polaris | The Polaris dashboard can be installed on a cluster using kubectl or Helm"
---
 # Dashboard

-> Want to see Polaris results for all your clusters in a single dashboard? Check out
-> [Fairwinds Insights](https://www.fairwinds.com/fairwinds-polaris-upgrade)
-
 The Polaris dashboard can be installed on a cluster using kubectl or Helm. It
 can also be run locally, connecting to your cluster using the credentials stored in your `KUBECONFIG`.

@@ -16,10 +8,15 @@ don't conform to best practices.

 ## Installation

+### kubectl
+```bash
+kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/dashboard.yaml
+kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
+```
 ### Helm
 ```bash
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable
-helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris --create-namespace
+helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris
 kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
 ```

@@ -0,0 +1,29 @@
+# Infrastructure as Code
+Polaris can be used on the command line to audit local Kubernetes manifests stored in YAML files.
+This is particularly helpful for running Polaris against your infrastructure-as-code as part of a
+CI/CD pipeline. Use the available [command line flags](#running-in-a-ci-pipeline)
+to cause CI/CD to fail if your Polaris score drops below a certain threshold, or if any danger-level issues arise.
+
+
+## Install the CLI
+To run Polaris against your YAML manifests, e.g. as part of a Continuous Integration process,
+you'll need to install the CLI.
+
+Binary releases can be downloaded from the [releases page](https://github.com/fairwindsops/polaris/releases)
+or can be installed with [Homebrew](https://brew.sh/):
+```bash
+brew tap FairwindsOps/tap
+brew install FairwindsOps/tap/polaris
+polaris version
+```
+
+## Running in a CI pipeline
+You can tell the CLI to set an exit code if it detects certain issues with your
+YAML files.
+For example, to fail if polaris detects *any* danger-level issues, or if the score drops below 90%:
+```bash
+polaris audit --audit-path ./deploy/ \
+  --set-exit-code-on-danger \
+  --set-exit-code-below-score 90
+```
+
@@ -1,36 +1,36 @@
 {
-  "author": "",
-  "bugs": {
-    "url": "https://github.com/FairwindsOps/insights-docs/issues"
-  },
-  "dependencies": {
-    "vuepress-plugin-check-md": "0.0.2"
-  },
+  "name": "fairwinds-docs-template",
+  "version": "0.0.1",
  "description": "A repository with a Vuepress template for Fairwinds projects",
-  "devDependencies": {
-    "vuepress": "^1.9.7",
-    "vuepress-plugin-clean-urls": "^1.1.1",
-    "vuepress-plugin-redirect": "^1.2.5"
-  },
+  "main": "index.js",
  "directories": {
    "doc": "docs"
  },
-  "homepage": "https://github.com/FairwindsOps/insights-docs#readme",
-  "license": "MIT",
-  "main": "index.js",
-  "name": "fairwinds-docs-template",
+  "scripts": {
+    "check-links": "vuepress check-md",
+    "build": "npm run build:readme && npm run build:docs && npm run reset-cname",
+    "build:readme": "cat ../README.md | grep -v 'ocumentation' | sed \"s/https:\\/\\/\\w\\+.docs.fairwinds.com//g\" > README.md",
+    "build:docs": "vuepress build -d ../docs/ && touch ../docs/CNAME && git checkout -- ../docs/CNAME",
+    "reset-cname": "touch ../docs/CNAME && git checkout -- ../docs/CNAME",
+    "serve": "vuepress dev --port 3003",
+    "vuepress": "vuepress"
+  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/FairwindsOps/insights-docs.git"
  },
-  "scripts": {
-    "build": "npm run build:readme && npm run build:docs",
-    "build:docs": "vuepress build -d ../dist/",
-    "build:metadata": "cat main-metadata.md > README.md || true",
-    "build:readme": "npm run build:metadata && cat ../README.md | grep -v 'ocumentation' | sed \"s/https:\\/\\/\\w\\+.docs.fairwinds.com//g\" >> README.md",
-    "check-links": "vuepress check-md",
-    "serve": "npm run build:readme && vuepress dev --port 3003",
-    "vuepress": "vuepress"
+  "author": "",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/FairwindsOps/insights-docs/issues"
  },
-  "version": "0.0.1"
+  "homepage": "https://github.com/FairwindsOps/insights-docs#readme",
+  "devDependencies": {
+    "vuepress": "^1.4.0",
+    "vuepress-plugin-clean-urls": "^1.1.1",
+    "vuepress-plugin-redirect": "^1.2.3"
+  },
+  "dependencies": {
+    "vuepress-plugin-check-md": "0.0.2"
+  }
 }
@@ -1,29 +0,0 @@
-/*
- * This file is generated from FairwindsOps/documentation-template
- * DO NOT EDIT MANUALLY
- */
-
-var llcookieless = true;
-var sf14gv = 32793;
-(function() {
-  var sf14g = document.createElement('script');
-  sf14g.src = 'https://lltrck.com/lt-v2.min.js';
-  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(sf14g, s);
-})();
-
-!function(f,b,e,v,n,t,s)
-{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
-n.callMethod.apply(n,arguments):n.queue.push(arguments)};
-if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
-n.queue=[];t=b.createElement(e);t.async=!0;
-t.src=v;s=b.getElementsByTagName(e)[0];
-s.parentNode.insertBefore(t,s)}(window,document,'script',
-'https://connect.facebook.net/en_US/fbevents.js');
-fbq('init', '521127644762074');
-fbq('track', 'PageView');
-
-(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
-new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
-j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
-'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
-})(window,document,'script','dataLayer','GTM-TM95WXQ');
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>Fairwinds Polaris Documentation</title>
+    <meta name="generator" content="VuePress 1.7.1">
+    <link rel="icon" href="/favicon.png">
+    <script src="/scripts/modify.js"></script>
+    <script src="/scripts/leadlander.js"></script>
+    <meta name="description" content="Documentation for Fairwinds Polaris - audit and enforce Kubernetes best practices for your workloads">
+    
+    <link rel="preload" href="/assets/css/0.styles.c6ec4974.css" as="style"><link rel="preload" href="/assets/js/app.6b0e26a9.js" as="script"><link rel="preload" href="/assets/js/7.42b765bd.js" as="script"><link rel="prefetch" href="/assets/js/10.8f3ba484.js"><link rel="prefetch" href="/assets/js/11.02b42cad.js"><link rel="prefetch" href="/assets/js/12.cff53a60.js"><link rel="prefetch" href="/assets/js/13.8b1bb030.js"><link rel="prefetch" href="/assets/js/14.c5858427.js"><link rel="prefetch" href="/assets/js/15.12d7f7e2.js"><link rel="prefetch" href="/assets/js/16.d0080f81.js"><link rel="prefetch" href="/assets/js/17.9419cb3d.js"><link rel="prefetch" href="/assets/js/18.0feba80b.js"><link rel="prefetch" href="/assets/js/19.9fe045af.js"><link rel="prefetch" href="/assets/js/2.a4557b55.js"><link rel="prefetch" href="/assets/js/20.f0ee04bc.js"><link rel="prefetch" href="/assets/js/21.568e8e94.js"><link rel="prefetch" href="/assets/js/22.d16ea382.js"><link rel="prefetch" href="/assets/js/3.dd1730de.js"><link rel="prefetch" href="/assets/js/4.1ad697cf.js"><link rel="prefetch" href="/assets/js/5.34cb651b.js"><link rel="prefetch" href="/assets/js/6.776e9a4b.js"><link rel="prefetch" href="/assets/js/8.107f906c.js"><link rel="prefetch" href="/assets/js/9.fa586f8c.js">
+    <link rel="stylesheet" href="/assets/css/0.styles.c6ec4974.css">
+  </head>
+  <body>
+    <div id="app" data-server-rendered="true"><div class="theme-container"><div class="theme-default-content"><h1>404</h1> <blockquote>That's a Four-Oh-Four.</blockquote> <a href="/" class="router-link-active">
+      Take me home.
+    </a></div></div><div class="global-ui"></div></div>
+    <script src="/assets/js/app.6b0e26a9.js" defer></script><script src="/assets/js/7.42b765bd.js" defer></script>
+  </body>
+</html>
@@ -0,0 +1 @@
+polaris.docs.fairwinds.com
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>Admission Controller | Fairwinds Polaris Documentation</title>
+    <meta name="generator" content="VuePress 1.7.1">
+    <link rel="icon" href="/favicon.png">
+    <script src="/scripts/modify.js"></script>
+    <script src="/scripts/leadlander.js"></script>
+    <meta name="description" content="Documentation for Fairwinds Polaris - audit and enforce Kubernetes best practices for your workloads">
+    
+    <link rel="preload" href="/assets/css/0.styles.c6ec4974.css" as="style"><link rel="preload" href="/assets/js/app.6b0e26a9.js" as="script"><link rel="preload" href="/assets/js/3.dd1730de.js" as="script"><link rel="preload" href="/assets/js/2.a4557b55.js" as="script"><link rel="preload" href="/assets/js/9.fa586f8c.js" as="script"><link rel="prefetch" href="/assets/js/10.8f3ba484.js"><link rel="prefetch" href="/assets/js/11.02b42cad.js"><link rel="prefetch" href="/assets/js/12.cff53a60.js"><link rel="prefetch" href="/assets/js/13.8b1bb030.js"><link rel="prefetch" href="/assets/js/14.c5858427.js"><link rel="prefetch" href="/assets/js/15.12d7f7e2.js"><link rel="prefetch" href="/assets/js/16.d0080f81.js"><link rel="prefetch" href="/assets/js/17.9419cb3d.js"><link rel="prefetch" href="/assets/js/18.0feba80b.js"><link rel="prefetch" href="/assets/js/19.9fe045af.js"><link rel="prefetch" href="/assets/js/20.f0ee04bc.js"><link rel="prefetch" href="/assets/js/21.568e8e94.js"><link rel="prefetch" href="/assets/js/22.d16ea382.js"><link rel="prefetch" href="/assets/js/4.1ad697cf.js"><link rel="prefetch" href="/assets/js/5.34cb651b.js"><link rel="prefetch" href="/assets/js/6.776e9a4b.js"><link rel="prefetch" href="/assets/js/7.42b765bd.js"><link rel="prefetch" href="/assets/js/8.107f906c.js">
+    <link rel="stylesheet" href="/assets/css/0.styles.c6ec4974.css">
+  </head>
+  <body>
+    <div id="app" data-server-rendered="true"><div class="theme-container"><header class="navbar"><div class="sidebar-button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" role="img" viewBox="0 0 448 512" class="icon"><path fill="currentColor" d="M436 124H12c-6.627 0-12-5.373-12-12V80c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12z"></path></svg></div> <a href="/" class="home-link router-link-active"><img src="/img/fairwinds-logo.svg" alt="Fairwinds Polaris Documentation" class="logo"> <span class="site-name can-hide">Fairwinds Polaris Documentation</span></a> <div class="links"><div class="search-box"><input aria-label="Search" autocomplete="off" spellcheck="false" value=""> <!----></div> <nav class="nav-links can-hide"><div class="nav-item"><a href="https://github.com/FairwindsOps/polaris" target="_blank" rel="noopener noreferrer" class="nav-link external">
+  View on GitHub
+  <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></div> <!----></nav></div></header> <div class="sidebar-mask"></div> <aside class="sidebar"><nav class="nav-links"><div class="nav-item"><a href="https://github.com/FairwindsOps/polaris" target="_blank" rel="noopener noreferrer" class="nav-link external">
+  View on GitHub
+  <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></div> <!----></nav>  <ul class="sidebar-links"><li><section class="sidebar-group depth-0"><a href="/" class="sidebar-heading clickable router-link-active"><span>Polaris</span> <!----></a> <ul class="sidebar-links sidebar-group-items"><li><a href="/changelog/" class="sidebar-link">Changelog</a></li><li><a href="/code-of-conduct/" class="sidebar-link">Code of Conduct</a></li><li><a href="/contributing/" class="sidebar-link">Contributing</a></li></ul></section></li><li><section class="sidebar-group depth-0"><p class="sidebar-heading open"><span>Ways to Run Polaris</span> <!----></p> <ul class="sidebar-links sidebar-group-items"><li><a href="/dashboard/" class="sidebar-link">Dashboard</a></li><li><a href="/admission-controller/" aria-current="page" class="active sidebar-link">Admission Controller</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/admission-controller/#installation" class="sidebar-link">Installation</a></li><li class="sidebar-sub-header"><a href="/admission-controller/#workload-types" class="sidebar-link">Workload Types</a></li><li class="sidebar-sub-header"><a href="/admission-controller/#warnings" class="sidebar-link">Warnings</a></li></ul></li><li><a href="/infrastructure-as-code/" class="sidebar-link">Infrastructure as Code</a></li></ul></section></li><li><section class="sidebar-group depth-0"><p class="sidebar-heading"><span>Customization</span> <!----></p> <ul class="sidebar-links sidebar-group-items"><li><a href="/customization/configuration/" class="sidebar-link">Configuration</a></li><li><a href="/customization/checks/" class="sidebar-link">Check Settings</a></li><li><a href="/customization/custom-checks/" class="sidebar-link">Custom Checks</a></li><li><a href="/customization/exemptions/" class="sidebar-link">Exemptions</a></li></ul></section></li><li><section class="sidebar-group depth-0"><p class="sidebar-heading"><span>Checks</span> <!----></p> <ul class="sidebar-links sidebar-group-items"><li><a href="/checks/security/" class="sidebar-link">Security</a></li><li><a href="/checks/efficiency/" class="sidebar-link">Efficiency</a></li><li><a href="/checks/reliability/" class="sidebar-link">Reliability</a></li></ul></section></li></ul> </aside> <main class="page"> <div class="theme-default-content content__default"><h1 id="admission-controller"><a href="#admission-controller" class="header-anchor">#</a> Admission Controller</h1> <p>Polaris can be run as an admission controller that acts as a validating webhook.
+This accepts the same configuration as the dashboard, and can run the same validations.</p> <p>The webhook will reject any workloads that trigger a danger-level check.
+This is indicative of the greater goal of Polaris, not just to encourage better
+configuration through dashboard visibility, but to actually enforce it with this webhook.</p> <p>Note that Polaris will not alter your workloads, only block workloads that don't conform to the configured policies.</p> <h2 id="installation"><a href="#installation" class="header-anchor">#</a> Installation</h2> <p>A valid TLS certificate is required for the Polaris Validating Webhook. If you have cert-manager installed in your cluster then the install methods below will work.</p> <p>If you don't use cert-manager, you'll need to:</p> <ul><li>Supply a CA Bundle with the <code>webhook.caBundle</code></li> <li>Create a TLS secret in your cluster with a valid certificate that uses that CA</li> <li>Pass the name of that secret with the webhook.secretName parameter.</li></ul> <h3 id="kubectl"><a href="#kubectl" class="header-anchor">#</a> kubectl</h3> <div class="language-bash extra-class"><pre class="language-bash"><code>kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/webhook.yaml
+</code></pre></div><h3 id="helm"><a href="#helm" class="header-anchor">#</a> Helm</h3> <div class="language-bash extra-class"><pre class="language-bash"><code>helm repo <span class="token function">add</span> fairwinds-stable https://charts.fairwinds.com/stable
+helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris <span class="token punctuation">\</span>
+  --set webhook.enable<span class="token operator">=</span>true --set dashboard.enable<span class="token operator">=</span>false
+</code></pre></div><h2 id="workload-types"><a href="#workload-types" class="header-anchor">#</a> Workload Types</h2> <p>The webhook comes with built-in support for a handful of known controller types,
+such as Deployments, Jobs, and DaemonSets. To add new controller types,
+you can set <code>webhook.rules</code> in the
+<a href="https://github.com/FairwindsOps/charts/tree/master/stable/polaris" target="_blank" rel="noopener noreferrer">Helm chart<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></p> <h2 id="warnings"><a href="#warnings" class="header-anchor">#</a> Warnings</h2> <p>Unfortunately we have not found a way to display warnings as part of <code>kubectl</code>
+output unless we are rejecting a workload altogether.</p> <p>This means that any checks with a severity of <code>warning</code> will still pass webhook validation,
+and the only evidence of that warning will either be in the Polaris dashboard or the
+Polaris webhook logs. This will change in a future version of Kubernetes.</p></div> <footer class="page-edit"><div class="edit-link"><a href="https://github.com/FairwindsOps/polaris/edit/master/docs-md/admission-controller.md" target="_blank" rel="noopener noreferrer">Help us improve this page</a> <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></div> <!----></footer> <div class="page-nav"><p class="inner"><span class="prev">
+      ←
+      <a href="/dashboard/" class="prev">
+        Dashboard
+      </a></span> <span class="next"><a href="/infrastructure-as-code/">
+        Infrastructure as Code
+      </a>
+      →
+    </span></p></div> <div class="custom-footer"><div class="left-footer"><a href="https://fairwinds.com" target="_blank">Learn more about Fairwinds</a> <a href="https://fairwinds.com/insights" target="_blank">Try Fairwinds Insights</a></div> <div class="right-footer"><a href="https://www.fairwinds.com/privacy-policy" target="_blank">Privacy Policy</a></div></div></main></div><div class="global-ui"></div></div>
+    <script src="/assets/js/app.6b0e26a9.js" defer></script><script src="/assets/js/3.dd1730de.js" defer></script><script src="/assets/js/2.a4557b55.js" defer></script><script src="/assets/js/9.fa586f8c.js" defer></script>
+  </body>
+</html>
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="12" height="13"><g stroke-width="2" stroke="#aaa" fill="none"><path d="M11.29 11.71l-4-4"/><circle cx="5" cy="5" r="4"/></g></svg>
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[11],{366:function(e,t,r){"use strict";r.r(t);var s=r(42),o=Object(s.a)({},(function(){var e=this,t=e.$createElement,r=e._self._c||t;return r("ContentSlotsDistributor",{attrs:{"slot-key":e.$parent.slotKey}},[r("h1",{attrs:{id:"efficiency"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#efficiency"}},[e._v("#")]),e._v(" Efficiency")]),e._v(" "),r("p",[e._v("These checks ensure that CPU and memory settings are configured, so that\nKubernetes can schedule your workload effectively.")]),e._v(" "),r("h2",{attrs:{id:"presence-checks"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#presence-checks"}},[e._v("#")]),e._v(" Presence Checks")]),e._v(" "),r("p",[e._v("To simplify ensure that these values have been set, the following attributes are available:")]),e._v(" "),r("table",[r("thead",[r("tr",[r("th",[e._v("key")]),e._v(" "),r("th",[e._v("default")]),e._v(" "),r("th",[e._v("description")])])]),e._v(" "),r("tbody",[r("tr",[r("td",[r("code",[e._v("resources.cpuRequestsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.requests.cpu")]),e._v(" attribute is not configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("resources.memoryRequestsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.requests.memory")]),e._v(" attribute is not configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("resources.cpuLimitsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.limits.cpu")]),e._v(" attribute is not configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("resources.memoryLimitsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.limits.memory")]),e._v(" attribute is not configured.")])])])]),e._v(" "),r("h2",{attrs:{id:"background"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#background"}},[e._v("#")]),e._v(" Background")]),e._v(" "),r("p",[e._v("Configuring resource requests and limits for containers running in Kubernetes is an important best practice to follow. Setting appropriate resource requests will ensure that all your applications have sufficient compute resources. Setting appropriate resource limits will ensure that your applications do not consume too many resources.")]),e._v(" "),r("p",[e._v("Having these values appropriately configured ensures that:")]),e._v(" "),r("ul",[r("li",[r("p",[e._v("Cluster autoscaling can function as intended. New nodes are scheduled once pods are unable to be scheduled on an existing node due to insufficient resources. This will not happen if resource requests are not configured.")])]),e._v(" "),r("li",[r("p",[e._v("Each container has sufficient access to compute resources. Without resource requests, a pod may be scheduled on a node that is already overutilized. Without resource limits, a single poorly behaving pod could utilize the majority of resources on a node, significantly impacting the performance of other pods on the same node.")])])]),e._v(" "),r("h2",{attrs:{id:"further-reading"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#further-reading"}},[e._v("#")]),e._v(" Further Reading")]),e._v(" "),r("ul",[r("li",[r("a",{attrs:{href:"https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes Docs: Managing Compute Resources for Containers"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://cloud.google.com/blog/products/gcp/kubernetes-best-practices-resource-requests-and-limits",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes best practices: Resource requests and limits"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler",target:"_blank",rel:"noopener noreferrer"}},[e._v("Vertical Pod Autoscaler (can automatically set resource requests and limits)"),r("OutboundLink")],1)])])])}),[],!1,null,null,null);t.default=o.exports}}]);
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[14],{370:function(e,n,t){"use strict";t.r(n);var s=t(42),i=Object(s.a)({},(function(){var e=this.$createElement,n=this._self._c||e;return n("ContentSlotsDistributor",{attrs:{"slot-key":this.$parent.slotKey}},[n("h4",{attrs:{id:"cli-options"}},[n("a",{staticClass:"header-anchor",attrs:{href:"#cli-options"}},[this._v("#")]),this._v(" CLI Options")]),this._v(" "),n("div",{staticClass:"language- extra-class"},[n("pre",{pre:!0,attrs:{class:"language-text"}},[n("code",[this._v('# top-level commands\naudit\n      Runs a one-time audit.\ndashboard\n      Runs the webserver for Polaris dashboard.\nhelp\n      Prints help, if you give it a command then it will print help for that command. Same as -h\nversion\n      Prints the version of Polaris\nwebhook\n      Runs the webhook webserver\n\n# high-level flags\n-c, --config string\n      Location of Polaris configuration file\n--disallow-exemptions\n      Disallow any exemptions from configuration file.\n-h, --help\n      Help for Polaris (same as help command)\n--kubeconfig string\n      Path to a kubeconfig. Only required if out-of-cluster.\n--log-level string\n      Logrus log level (default "info")\n--master string\n      The address of the Kubernetes API server. Overrides any value in kubeconfig. Only required if out-of-cluster.\n\n# dashboard flags\n--audit-path string\n      If specified, audits one or more YAML files instead of a cluster\n--base-path string\n      Path on which the dashboard is served (default "/")\n--display-name string\n      An optional identifier for the audit\n--load-audit-file string\n      Runs the dashboard with data saved from a past audit.\n-p, --port int\n      Port for the dashboard webserver (default 8080)\n\n# audit flags\n--audit-path string\n      If specified, audits one or more YAML files instead of a cluster\n--resource string\n      If specified, audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend\n--display-name string\n      An optional identifier for the audit\n--format string\n      Output format for results - json, yaml, or score (default "json")\n--output-file string\n      Destination file for audit results\n--output-url string\n      Destination URL to send audit results\n--set-exit-code-below-score int\n      Set an exit code of 4 when the score is below this threshold (1-100)\n--set-exit-code-on-danger\n      Set an exit code of 3 when the audit contains danger-level issues.\n\n# webhook flags\n--disable-webhook-config-installer\n      disable the installer in the webhook server, so it won\'t install webhook configuration resources during bootstrapping\n-p, --port int\n      Port for the webhook webserver (default 9876)\n')])])])])}),[],!1,null,null,null);n.default=i.exports}}]);
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[17],{373:function(e,t,a){"use strict";a.r(t);var s=a(42),n=Object(s.a)({},(function(){var e=this,t=e.$createElement,a=e._self._c||t;return a("ContentSlotsDistributor",{attrs:{"slot-key":e.$parent.slotKey}},[a("h1",{attrs:{id:"check-settings"}},[a("a",{staticClass:"header-anchor",attrs:{href:"#check-settings"}},[e._v("#")]),e._v(" Check Settings")]),e._v(" "),a("p",[e._v("Each check can be assigned a "),a("code",[e._v("severity")]),e._v(". Only checks with a severity of "),a("code",[e._v("danger")]),e._v(" or "),a("code",[e._v("warning")]),e._v(" will be validated. The results of these validations are visible on the dashboard. In the case of the validating webhook, only failures with a severity of "),a("code",[e._v("danger")]),e._v(" will result in a change being rejected.")]),e._v(" "),a("p",[e._v("Polaris validation checks fall into several different categories:")]),e._v(" "),a("ul",[a("li",[a("RouterLink",{attrs:{to:"/checks/security.html"}},[e._v("Security")])],1),e._v(" "),a("li",[a("RouterLink",{attrs:{to:"/checks/reliability.html"}},[e._v("Reliability")])],1),e._v(" "),a("li",[a("RouterLink",{attrs:{to:"/checks/efficiency.html"}},[e._v("Efficiency")])],1)]),e._v(" "),a("p",[e._v("To change the default severity levels, or to turn checks on or off, you can create your own "),a("code",[e._v("config.yaml")]),e._v(":")]),e._v(" "),a("div",{staticClass:"language-yaml extra-class"},[a("pre",{pre:!0,attrs:{class:"language-yaml"}},[a("code",[a("span",{pre:!0,attrs:{class:"token key atrule"}},[e._v("checks")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[e._v(":")]),e._v("\n  "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[e._v("tagNotSpecified")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[e._v(":")]),e._v(" ignore\n  "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[e._v("runAsRootAllowed")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[e._v(":")]),e._v(" danger\n  "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[e._v("pullPolicyNotAlways")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[e._v(":")]),e._v(" warning\n")])])])])}),[],!1,null,null,null);t.default=n.exports}}]);
@@ -0,0 +1 @@
+(window.webpackJsonp=window.webpackJsonp||[]).push([[18],{374:function(t,o,e){"use strict";e.r(o);var n=e(42),i=Object(n.a)({},(function(){var t=this,o=t.$createElement,e=t._self._c||o;return e("ContentSlotsDistributor",{attrs:{"slot-key":t.$parent.slotKey}},[e("h1",{attrs:{id:"configuration"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#configuration"}},[t._v("#")]),t._v(" Configuration")]),t._v(" "),e("p",[t._v("The default Polaris configuration can be "),e("a",{attrs:{href:"https://github.com/FairwindsOps/polaris/blob/master/examples/config.yaml",target:"_blank",rel:"noopener noreferrer"}},[t._v("seen here"),e("OutboundLink")],1),t._v(".")]),t._v(" "),e("p",[t._v("You can customize the configuration to do things like:")]),t._v(" "),e("ul",[e("li",[t._v("Turn checks "),e("RouterLink",{attrs:{to:"/customization/checks.html"}},[t._v("on and off")])],1),t._v(" "),e("li",[t._v("Change the "),e("RouterLink",{attrs:{to:"/customization/checks.html"}},[t._v("severity level")]),t._v(" of checks")],1),t._v(" "),e("li",[t._v("Add new "),e("RouterLink",{attrs:{to:"/customization/custom-checks.html"}},[t._v("custom checks")])],1),t._v(" "),e("li",[t._v("Add "),e("RouterLink",{attrs:{to:"/customization/exemptions.html"}},[t._v("exemptions")]),t._v(" for particular workloads or namespaces")],1)]),t._v(" "),e("p",[t._v("To pass in your custom configuration, follow the instructions for your environment:")]),t._v(" "),e("ul",[e("li",[t._v("CLI - set the "),e("code",[t._v("--config")]),t._v(" argument to point to your "),e("code",[t._v("config.yaml")])]),t._v(" "),e("li",[t._v("Helm - set the "),e("code",[t._v("config")]),t._v(" variable in your values file")]),t._v(" "),e("li",[t._v("kubectl - create a ConfigMap with your "),e("code",[t._v("config.yaml")]),t._v(", mount it as a volume, and use the "),e("code",[t._v("--config")]),t._v(" argument in your Deployment")])])])}),[],!1,null,null,null);o.default=i.exports}}]);
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" width="12" height="13"><g stroke-width="2" stroke="#aaa" fill="none"><path d="M11.29 11.71l-4-4"/><circle cx="5" cy="5" r="4"/></g></svg>`
				`@@ -0,0 +1 @@`
				(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[11],{366:function(e,t,r){"use strict";r.r(t);var s=r(42),o=Object(s.a)({},(function(){var e=this,t=e.$createElement,r=e._self._c\|\|t;return r("ContentSlotsDistributor",{attrs:{"slot-key":e.$parent.slotKey}},[r("h1",{attrs:{id:"efficiency"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#efficiency"}},[e._v("#")]),e._v(" Efficiency")]),e._v(" "),r("p",[e._v("These checks ensure that CPU and memory settings are configured, so that\nKubernetes can schedule your workload effectively.")]),e._v(" "),r("h2",{attrs:{id:"presence-checks"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#presence-checks"}},[e._v("#")]),e._v(" Presence Checks")]),e._v(" "),r("p",[e._v("To simplify ensure that these values have been set, the following attributes are available:")]),e._v(" "),r("table",[r("thead",[r("tr",[r("th",[e._v("key")]),e._v(" "),r("th",[e._v("default")]),e._v(" "),r("th",[e._v("description")])])]),e._v(" "),r("tbody",[r("tr",[r("td",[r("code",[e._v("resources.cpuRequestsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.requests.cpu")]),e._v(" attribute is not configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("resources.memoryRequestsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.requests.memory")]),e._v(" attribute is not configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("resources.cpuLimitsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.limits.cpu")]),e._v(" attribute is not configured.")])]),e._v(" "),r("tr",[r("td",[r("code",[e._v("resources.memoryLimitsMissing")])]),e._v(" "),r("td",[r("code",[e._v("warning")])]),e._v(" "),r("td",[e._v("Fails when "),r("code",[e._v("resources.limits.memory")]),e._v(" attribute is not configured.")])])])]),e._v(" "),r("h2",{attrs:{id:"background"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#background"}},[e._v("#")]),e._v(" Background")]),e._v(" "),r("p",[e._v("Configuring resource requests and limits for containers running in Kubernetes is an important best practice to follow. Setting appropriate resource requests will ensure that all your applications have sufficient compute resources. Setting appropriate resource limits will ensure that your applications do not consume too many resources.")]),e._v(" "),r("p",[e._v("Having these values appropriately configured ensures that:")]),e._v(" "),r("ul",[r("li",[r("p",[e._v("Cluster autoscaling can function as intended. New nodes are scheduled once pods are unable to be scheduled on an existing node due to insufficient resources. This will not happen if resource requests are not configured.")])]),e._v(" "),r("li",[r("p",[e._v("Each container has sufficient access to compute resources. Without resource requests, a pod may be scheduled on a node that is already overutilized. Without resource limits, a single poorly behaving pod could utilize the majority of resources on a node, significantly impacting the performance of other pods on the same node.")])])]),e._v(" "),r("h2",{attrs:{id:"further-reading"}},[r("a",{staticClass:"header-anchor",attrs:{href:"#further-reading"}},[e._v("#")]),e._v(" Further Reading")]),e._v(" "),r("ul",[r("li",[r("a",{attrs:{href:"https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes Docs: Managing Compute Resources for Containers"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://cloud.google.com/blog/products/gcp/kubernetes-best-practices-resource-requests-and-limits",target:"_blank",rel:"noopener noreferrer"}},[e._v("Kubernetes best practices: Resource requests and limits"),r("OutboundLink")],1)]),e._v(" "),r("li",[r("a",{attrs:{href:"https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler",target:"_blank",rel:"noopener noreferrer"}},[e._v("Vertical Pod Autoscaler (can automatically set resource requests and limits)"),r("OutboundLink")],1)])])])}),[],!1,null,null,null);t.default=o.exports}}]);