Update triage.yml

2026-08-29 22:17:16 +00:00 · 2022-08-09 13:00:27 -04:00 · 2022-08-09 12:46:03 -04:00 · 2022-08-09 12:42:52 -04:00 · 2022-08-09 12:42:07 -04:00 · 2022-08-09 12:37:55 -04:00
376 changed files with 17011 additions and 16276 deletions
@@ -1,182 +1,262 @@
-## DO NOT EDIT - Managed by Terraform
 version: 2.1

 orbs:
-  rok8s: fairwinds/rok8s-scripts@16.0.0
+  rok8s: fairwinds/rok8s-scripts@11
  oss-docs: fairwinds/oss-docs@0

+executors:
+  vm:
+    machine:
+      enabled: true
+
 references:
-  install_vault_machine: &install_vault_machine
+  set_environment_variables: &set_environment_variables
+    run:
+      name: Set Environment Variables
+      command: |
+        echo 'export CI_SHA1=$CIRCLE_SHA1' >> ${BASH_ENV}
+        echo 'export CI_BRANCH=$CIRCLE_BRANCH' >> ${BASH_ENV}
+        echo 'export CI_BUILD_NUM=$CIRCLE_BUILD_NUM' >> ${BASH_ENV}
+        echo 'export CI_TAG=$CIRCLE_TAG' >> ${BASH_ENV}
+        echo 'export PUSH_ALL_VERSION_TAGS=true' >> ${BASH_ENV}
+        echo 'export GOPROXY=https://proxy.golang.org' >> ${BASH_ENV}
+        echo 'export GO111MODULE=on' >> ${BASH_ENV}
+        echo 'export GOFLAGS=-mod=mod' >> ${BASH_ENV}
+        echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
+
+  install_k8s: &install_k8s
+    run:
+      name: Install K8s
+      command: |
+        sudo apt-get update
+        echo "Installing git and jq"
+        sudo apt-get install -yqq jq git
+
+        echo "Installing KIND"
+        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.14.0/kind-linux-amd64
+        chmod 0755 kind-linux-amd64
+        sudo mv kind-linux-amd64 /usr/local/bin/kind
+        kind version
+
+        echo "Installing Kubectl"
+        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.21.12/bin/linux/amd64/kubectl
+        chmod 0755 kubectl
+        sudo mv kubectl /usr/local/bin/
+        kubectl version --client
+
+
+        echo "Creating Kubernetes Cluster with Kind"
+        kind create cluster --wait=90s --image kindest/node:v1.21.12
+        docker ps -a
+
+        kubectl version
+
+        echo "Installing Helm"
+        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
+        chmod 700 get_helm.sh
+        ./get_helm.sh
+
+        echo "Installing cert-manager"
+        kubectl create namespace cert-manager
+        helm repo add jetstack https://charts.jetstack.io
+        helm repo update
+        echo "Helm install"
+        helm install cert-manager jetstack/cert-manager --namespace cert-manager --version 0.16.1 --set "installCRDs=true" --wait
+        echo "Install cert-manager successful"
+
+  test_binary_dashboard: &test_binary_dashboard
+    run:
+      name: Test Dashboard
+      command: |
+        go run main.go dashboard --port 3000 --audit-path ./examples &
+        sleep 30
+        curl -f http://localhost:3000 > /dev/null
+        curl -f http://localhost:3000/health > /dev/null
+        curl -f http://localhost:3000/favicon.ico > /dev/null
+        curl -f http://localhost:3000/static/css/main.css > /dev/null
+        curl -f http://localhost:3000/results.json > /dev/null
+        curl -f http://localhost:3000/details/security > /dev/null
+  test_k8s: &test_k8s
+    run:
+      name: Test Kubernetes Deployments
+      command: |
+        if [[ -z $CIRCLE_PR_NUMBER ]]; then
+          ./test/webhook_test.sh
+          ./test/kube_dashboard_test.sh
+        else
+          echo "Skipping Kubernetes tests for forked PR"
+        fi
+
+  docker_build: &docker_build
+    run:
+      name: Docker login and build
+      command: |
+        docker-pull -f .circleci/build.config
+        docker-build -f .circleci/build.config
+
+  docker_build_and_push: &docker_build_and_push
+    run:
+      name: Docker login, build, and push
+      command: |
+        docker-pull -f .circleci/build.config
+        docker-build -f .circleci/build.config
+        docker login quay.io -u="${fairwinds_quay_user}" -p="${fairwinds_quay_token}"
+        docker-push -f .circleci/build.config
+
+  enable_experimental_features: &enable_experimental_docker_features
+    run:
+      name: enable experimental features
+      command: |
+        set -ex
+        apk --update add openssh
+        ssh remote-docker \<<EOF
+          sudo bash -c 'echo "{\"experimental\": true}" > /etc/docker/daemon.json'
+          sudo systemctl restart docker
+        EOF
+  install_vault_alpine: &install_vault_alpine
    run:
      name: install hashicorp vault
      command: |
-        sudo apt-get update -y && sudo apt-get install -y curl unzip
+        apk --update add curl yq
        cd /tmp
-        curl -LO https://releases.hashicorp.com/vault/1.21.4/vault_1.21.4_linux_amd64.zip
-        echo '889b681990fe221b884b7932fa9c9dd0ee9811b9349554f1aa287ab63c9f3dae  vault_1.21.4_linux_amd64.zip' | sha256sum -c
-        unzip -o vault_1.21.4_linux_amd64.zip
-        sudo mv vault /usr/bin/vault
-  setup_qemu_binfmt: &setup_qemu_binfmt
-    run:
-      name: Setup QEMU for multi-arch Docker builds
-      command: |
-        sudo apt-get update -y
-        sudo apt-get install -y qemu-user-static binfmt-support
-        docker buildx create --use || true
-        docker buildx inspect --bootstrap
-  e2e_configuration: &e2e_configuration
-    executor: golang-exec
-    pre_script: e2e/pre.sh
-    script: e2e/test.sh
-    command_runner_image: quay.io/reactiveops/ci-images:v14.1-bullseye
-    enable_docker_layer_caching: true
-    store-test-results: /tmp/test-results
-    attach-workspace: true
-    requires:
-      - test
-      - snapshot
-    filters:
-      branches:
-        only: /.*/
-      tags:
-        ignore: /.*/
-
-executors:
-  golang-exec:
-    docker:
-      - image: cimg/go:1.26.7
+        curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+        unzip vault_1.9.3_linux_amd64.zip
+        mv vault /usr/bin/vault

 jobs:
-  test:
+  build:
    docker:
-      - image: cimg/go:1.26.7
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
    steps:
      - checkout
-      - run:
-          name: Go Mod Download
-          command: go mod download && go mod verify
-      - run:
-          name: golangci-lint
-          command: |
-            curl -fsSL -o golangci-lint.tar.gz https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz
-            echo '8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553  golangci-lint.tar.gz' | sha256sum -c
-            tar -xzf golangci-lint.tar.gz
-            mv golangci-lint-2.12.2-linux-amd64/golangci-lint "$(go env GOPATH)/bin/golangci-lint"
-            golangci-lint run --timeout 5m
-      - run:
-          name: test
-          command: |
-            go test -v -coverprofile=coverage.txt -covermode=atomic ./...
-            go vet ./...
-      - run:
-          name: Test Dashboard
-          command: ./test/dashboard_test.sh
-  snapshot:
-    machine:
-      image: ubuntu-2204:current
-    resource_class: large
+      - setup_remote_docker
+      - *set_environment_variables
+      - *docker_build
+
+  push:
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
    steps:
      - checkout
-      - *setup_qemu_binfmt
+      - setup_remote_docker
+      - *set_environment_variables
+      - *docker_build_and_push
+
+  test_k8s:
+    working_directory: ~/polaris
+    resource_class: medium
+    executor: vm
+    steps:
+      - checkout
+      - *install_k8s
+      - *test_k8s
+
+  test:
+    working_directory: /go/src/github.com/fairwindsops/polaris/
+    docker:
+      - image: circleci/golang:1.17
+    steps:
+      - checkout
+      - *set_environment_variables
+      - run: go get -u golang.org/x/lint/golint
+      - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
+      - run: go list ./... | grep -v vendor | xargs go vet
+      - run: go test ./... -coverprofile=coverage.txt -covermode=count
+      - *test_binary_dashboard
+
+  insights:
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
+    steps:
+      - checkout
+      - setup_remote_docker
      - run:
-          name: Run GoReleaser snapshot
-          command: |
-            docker run --rm \
-              -v /var/run/docker.sock:/var/run/docker.sock \
-              -v "$(pwd):/workspace" -w /workspace \
-              -e CIRCLE_SHA1 \
-              -e CIRCLE_BRANCH \
-              -e CIRCLE_TAG \
-              goreleaser/goreleaser:v2.17.1 release --snapshot --skip=sign
-      - run:
-          name: Save snapshot amd64 image for e2e
-          command: |
-            mkdir -p /tmp/workspace/docker_save
-            docker save us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CIRCLE_SHA1}-amd64 > /tmp/workspace/docker_save/polaris_${CIRCLE_SHA1}-amd64.tar
-      - persist_to_workspace:
-          root: /tmp/workspace/
-          paths:
-            - docker_save
-      - store_artifacts:
-          path: dist
-          destination: snapshot
-  release:
-    machine:
-      image: ubuntu-2204:current
+          name: Insights CI
+          command: curl -L https://insights.fairwinds.com/v0/insights-ci.sh | bash
+
+  release_binary:
+    working_directory: /go/src/github.com/fairwindsops/polaris/
    resource_class: large
    shell: /bin/bash
+    docker:
+      - image: goreleaser/goreleaser:v1.3.0
    steps:
      - checkout
-      - *install_vault_machine
+      - setup_remote_docker:
+          version: 20.10.6
+      - *enable_experimental_docker_features
+      - *install_vault_alpine
      - rok8s/get_vault_env:
          vault_path: repo/global/env
      - rok8s/get_vault_env:
          vault_path: repo/polaris/env
-      - run:
-          name: docker login Google Artifact Registry
-          command: |
-            echo "$GCP_ARTIFACTREADWRITE_JSON_KEY" | base64 -d | docker login -u _json_key --password-stdin us-docker.pkg.dev
-      - *setup_qemu_binfmt
-      - run:
-          name: Run GoReleaser release
-          command: |
-            export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"
-            docker run --rm \
-              -v /var/run/docker.sock:/var/run/docker.sock \
-              -v "$(pwd):/workspace" -w /workspace \
-              -v "${HOME}/.docker:/root/.docker" \
-              -e GORELEASER_CURRENT_TAG \
-              -e CIRCLE_TAG \
-              -e CIRCLE_SHA1 \
-              -e GO111MODULE=on \
-              -e GITHUB_TOKEN \
-              -e VAULT_ADDR \
-              -e VAULT_TOKEN \
-              goreleaser/goreleaser:v2.17.1 release
+      - *set_environment_variables
+      - run: go get -u github.com/gobuffalo/packr/v2/packr2
+      - run: git checkout -- . # FIXME: the go get makes the directory dirty
+      - run: packr2
+      - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
+      - run: goreleaser

+  release_images:
+    working_directory: /go/src/github.com/fairwindsops/polaris/
+    docker:
+      - image: quay.io/reactiveops/ci-images:v11.0-stretch
+    steps:
+      - checkout
+      - setup_remote_docker
+      - *set_environment_variables
+      - *docker_build_and_push
 workflows:
  version: 2
-  test_and_build:
+
+  build:
    jobs:
-      - test:
-          filters:
-            tags:
-              ignore: /.*/
-      - snapshot:
+      - test
+      - build:
          requires:
            - test
+      - push:
+          context: org-global
+          requires:
+            - build
          filters:
            branches:
-              only: /.*/
-            tags:
-              ignore: /.*/
-      - rok8s/kubernetes_e2e_tests:
-          name: "kubernetes e2e"
-          kind_node_image: "kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a"
-          <<: *e2e_configuration
+              ignore: /pull\/[0-9]+/
+      - insights:
+          requires:
+            - push
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+      - test_k8s:
+          requires:
+            - push
+          filters:
+            branches:
+              ignore: /pull\/[0-9]+/
+
  release:
    jobs:
-      - test:
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: /v.*/
-      - release:
-          requires:
-            - test
+      - release_binary:
          context: org-global
          filters:
            branches:
              ignore: /.*/
            tags:
-              only: /v.*/
-      - oss-docs/publish-docs:
+              ignore: /^testing-.*/
+      - release_images:
          requires:
-            - release
+            - release_binary
+          context: org-global
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              ignore: /^testing-.*/
+      - oss-docs/publish-docs:
          repository: polaris
          filters:
            branches:
              ignore: /.*/
            tags:
-              only: /v.*/
+              ignore: /^testing-.*/
@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ''
-labels: [triage, enhancement]
+labels: ''
 assignees: ''

 ---
@@ -2,7 +2,7 @@
 name: Other
 about: For misc. tasks like research or continued conversation
 title: ''
-labels: [triage]
+labels: ''
 assignees: ''

 ---
@@ -1,6 +1,6 @@
 # The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action

-FROM alpine:3.24
+FROM alpine:3.10

 RUN	apk add --no-cache \
  bash \
@@ -17,4 +17,4 @@ mkdir polaris
 tar -xzf $TARGET_FILE -C polaris
 rm $TARGET_FILE
 echo "polaris" >> $GITHUB_PATH
-echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT
+echo "::set-output name=version::$INPUT_VERSION"
@@ -0,0 +1,20 @@
+## DO NOT EDIT - Managed by Terraform
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
@@ -1,4 +1,3 @@
-
 This PR fixes #

 ## Checklist
@@ -7,7 +7,7 @@ jobs:
  build-int:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v2
      - name: Setup polaris
        uses: ./.github/actions/setup-polaris
        with:
@@ -18,7 +18,7 @@ jobs:
  build-ext:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v2
      - name: Setup polaris
        uses: fairwindsops/polaris/.github/actions/setup-polaris@master
        with:
@@ -0,0 +1,98 @@
+name: Triage issues
+on:
+  schedule:
+  - cron: '0 16 * * Mon' # noon ET on Mondays
+  issues:
+    types:
+    - reopened
+    - opened
+  pull_request:
+    types:
+    - reopened
+    - opened
+jobs:
+  notify:
+    if: github.actor!= 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: octokit/request-action@v2.x
+        id: need_triage
+        with:
+          route: GET /repos/FairwindsOps/${{ github.event.repository.name }}/issues?labels=triage
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Scheduled Reminders
+        env:
+          TITLES: ${{ join(fromJSON(steps.need_triage.outputs.data).*.title, ';') }}
+          LINKS: ${{ join(fromJSON(steps.need_triage.outputs.data).*.html_url, ';') }}
+        run: |
+          echo "Scheduled reminder! ${TITLES}"
+          IFS=';' read -r -a titles <<< "$TITLES"
+          IFS=';' read -r -a links <<< "$LINKS"
+          message=""
+          for index in "${!links[@]}"; do
+              title=${titles[$index]}
+              link=${links[$index]} 
+              echo "$index $title $link"
+              message="$message- <$link|$title>\\n"
+          done
+          echo "message: $message"
+          echo '{
+            "text": "Needs Triage",
+            "blocks": [
+            	{
+            		"type": "section",
+            		"text": {
+            			"type": "mrkdwn",
+            			"text": "$message"
+            		}
+            	}
+            ]
+          }' > body-template.json
+          export message=$(echo "${message}" | sed 's/"//g')
+          envsubst < body-template.json > body.json
+          cat body.json
+          curl -X POST "${{ secrets.SLACK_INCOMING_WEBHOOK }}" -H "Content-type: application/json" -d @./body.json
+
+      - name: Issue Notification
+        if: github.event.issue.title != ''
+        env:
+          TITLE: "${{ github.event.issue.title }}"
+          EVENT: github.event.pull_request.merged == true
+          LINK: "https://github.com/FairwindsOps/${{ github.event.repository.name }}/pulls/${{ github.event.issue.number }}"
+        run: |
+          echo '{
+            "text": "New Pull Request",
+            "blocks": [
+            	{
+            		"type": "section",
+            		"text": {
+            			"type": "mrkdwn",
+            			"text": ":issue: New Issue: <${LINK}|${TITLE}>"
+            		}
+            	}
+            ]
+          }' > body-template.json
+          envsubst < body-template.json > body.json
+          curl -X POST "${{ secrets.SLACK_INCOMING_WEBHOOK }}" -H "Content-type: application/json" -d @./body.json
+
+      - name: PR Notification
+        if: github.event.pull_request.title != ''
+        env:
+          TITLE: "${{ github.event.pull_request.title }}"
+          LINK: "https://github.com/FairwindsOps/${{ github.event.repository.name }}/pulls/${{ github.event.pull_request.number }}"
+        run: |
+          echo '{
+            "text": "New Pull Request",
+            "blocks": [
+            	{
+            		"type": "section",
+            		"text": {
+            			"type": "mrkdwn",
+            			"text": ":pr: New Pull Request: <${LINK}|${TITLE}>"
+            		}
+            	}
+            ]
+          }' > body-template.json
+          envsubst < body-template.json > body.json
+          curl -X POST "${{ secrets.SLACK_INCOMING_WEBHOOK }}" -H "Content-type: application/json" -d @./body.json
@@ -1,5 +1,4 @@
-# dist
-# # Binaries for programs and plugins
+# Binaries for programs and plugins
 .go-version
 *.exe
 *.exe~
@@ -21,6 +20,7 @@ Tiltfile
 main
 .DS_Store

+*-packr.go
 dist
 .vscode

@@ -28,4 +28,3 @@ dist

 node_modules
 /dist
-docs/README.md
@@ -1,11 +1,11 @@
-## DO NOT EDIT - Managed by Terraform
-# yaml-language-server: $$schema=https://goreleaser.com/static/schema.json
-
-version: 2
-project_name: polaris
-before:
-  hooks:
-    - go mod download
+checksum:
+  name_template: 'checksums.txt'
+changelog:
+  sort: asc
+  filters:
+    exclude:
+    - '^docs:'
+    - '^test:'
 builds:
  - id: polaris
    ldflags:
@@ -22,95 +22,30 @@ builds:
      - arm
      - arm64
    goarm:
-      - "6"
-      - "7"
-    ignore:
-      - goos: windows
-        goarch: arm
-      - goos: windows
-        goarch: arm64
+      - 6
+      - 7
+archives:
+  - id: polaris
+    builds: ["polaris"]
+    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
+signs:
+- cmd: cosign
+  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
+  artifacts: checksum
+release:
+  prerelease: auto
+  footer: |
+    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
+
+    ```
+    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
+    ```
 brews:
  - name: polaris
-    repository:
+    tap:
      owner: FairwindsOps
      name: homebrew-tap
-    directory: Formula
+    folder: Formula
    description: Open Source Best Practices for Kubernetes
-    url_template: "https://github.com/FairwindsOps/polaris/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
    test: |
      system "#{bin}/polaris version"
-release:
-  disable: '{{ eq (envOrDefault "GORELEASER_SKIP_RELEASE" "false") "true" }}'
-  prerelease: auto
-  github:
-    owner: FairwindsOps
-    name: polaris
-  footer: |
-    You can verify the signatures of both the checksums.txt file and the published docker images using [cosign](https://github.com/sigstore/cosign).
-
-    ```bash
-    cosign verify-blob checksums.txt --bundle=checksums.txt.sigstore.json --key https://artifacts.fairwinds.com/cosign-p256.pub
-    ```
-
-    ```bash
-    cosign verify us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }} --key https://artifacts.fairwinds.com/cosign-p256.pub
-    ```
-checksum:
-  name_template: "checksums.txt"
-changelog:
-  sort: asc
-  filters:
-    exclude:
-      - '^docs:'
-      - '^test:'
-signs:
-  - cmd: cosign
-    signature: "${artifact}.sigstore.json"
-    args:
-      - "sign-blob"
-      - "--key=hashivault://cosign-p256"
-      - "--bundle=${signature}"
-      - "${artifact}"
-      - "--yes"
-    artifacts: all
-docker_signs:
-  - artifacts: all
-    args: ["sign", "--key=hashivault://cosign-p256", "us-docker.pkg.dev/fairwinds-ops/oss/polaris@${digest}", "-r", "--yes"]
-dockers:
-   - image_templates:
-        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-amd64"
-        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-amd64"
-     use: buildx
-     dockerfile: Dockerfile
-     build_flag_templates:
-        - "--platform=linux/amd64"
-   - image_templates:
-        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-arm64v8"
-        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-arm64v8"
-     use: buildx
-     goarch: arm64
-     goos: linux
-     dockerfile: Dockerfile
-     build_flag_templates:
-        - "--platform=linux/arm64/v8"
-   - image_templates:
-        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-armv7"
-        - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-armv7"
-     use: buildx
-     goarch: arm
-     goarm: 7
-     goos: linux
-     dockerfile: Dockerfile
-     build_flag_templates:
-        - "--platform=linux/arm/v7"
-docker_manifests:
-  - name_template: us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}
-    image_templates:
-      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-amd64"
-      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-arm64v8"
-      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .Tag }}-armv7"
-  - name_template: us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}
-    image_templates:
-      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-amd64"
-      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-arm64v8"
-      - "us-docker.pkg.dev/fairwinds-ops/oss/polaris:{{ .FullCommit }}-armv7"
@@ -1,2 +1,2 @@
 ## DO NOT EDIT - Managed by Terraform
-* @sudermanjr @jdesouza @vitorvezani
+* @rbren @makoscafee
@@ -1,21 +1,27 @@
-FROM alpine:3.24.1
+FROM golang:1.17 AS build-env
+WORKDIR /go/src/github.com/fairwindsops/polaris/

-LABEL org.opencontainers.image.authors="FairwindsOps, Inc." \
-      org.opencontainers.image.vendor="FairwindsOps, Inc." \
-      org.opencontainers.image.title="polaris" \
-      org.opencontainers.image.description="Polaris is a cli tool to help discover deprecated apiVersions in Kubernetes" \
-      org.opencontainers.image.documentation="https://polaris.docs.fairwinds.com/" \
-      org.opencontainers.image.source="https://github.com/FairwindsOps/polaris" \
-      org.opencontainers.image.url="https://github.com/FairwindsOps/polaris" \
-      org.opencontainers.image.licenses="Apache License 2.0"
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
+ENV CGO_ENABLED=0
+ENV GOOS=linux
+ENV GOARCH=amd64

+COPY go.mod .
+COPY go.sum .
+RUN go mod download
+RUN go get -u github.com/gobuffalo/packr/v2/packr2
+
+COPY . .
+RUN packr2 build -a -o polaris *.go
+
+FROM alpine:3.16.1
 WORKDIR /usr/local/bin
-# Install ca-certs
 RUN apk --no-cache add ca-certificates

 RUN addgroup -S polaris && adduser -u 1200 -S polaris -G polaris
 USER 1200
-COPY polaris .
+COPY --from=build-env /go/src/github.com/fairwindsops/polaris/polaris .

 WORKDIR /opt/app

@@ -1,7 +1,7 @@
 <div align="center" class="no-border">
  <img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
  <br>
-  <h3>Polaris is an open source policy engine for Kubernetes</h3>
+  <h3>Best Practices for Kubernetes Workload Configuration</h3>
  <a href="https://github.com/FairwindsOps/polaris/releases">
    <img src="https://img.shields.io/github/v/release/FairwindsOps/polaris">
  </a>
@@ -16,12 +16,15 @@
  </a>
 </div>

-Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.
+Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
+Kubernetes pods and controllers are configured using best practices, helping you avoid
+problems in the future.

 Polaris can be run in three different modes:
-* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard) - Validate Kubernetes resources against policy-as-code.
-* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller) - Automatically reject or modify workloads that don't adhere to your organization's policies.
-* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code) - Incorporate policy-as-code into the CI/CD process to test local YAML files.
+* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard), so you can audit what's running inside your cluster.
+* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
+* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
+
 <p align="center">
  <img src="https://polaris.docs.fairwinds.com/img/architecture.svg" alt="Polaris Architecture" width="550"/>
 </p>
@@ -29,50 +32,18 @@ Polaris can be run in three different modes:
 ## Documentation
 Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)

-## Notice: Registry Migration and Immutable Images (v10.1.8 → v10.2.0)
-
-Starting with **v10.2.0**:
-
- Images moved to `us-docker.pkg.dev/fairwinds-ops/oss/polaris`
- `quay.io/fairwinds/polaris` is deprecated
-
-### Required action
-
-```diff
- quay.io/fairwinds/polaris:<tag>
-+ us-docker.pkg.dev/fairwinds-ops/oss/polaris:<tag>
-```
-
---
-
-## Immutable and signed images
-
-* Images are now **signed**
-* Tags are **immutable**
-* No more floating tags:
-
-  * `v10`
-  * `v10.1`
-  * `latest`
-
-Use full version tags:
-
-```
-us-docker.pkg.dev/fairwinds-ops/oss/polaris:v<major>.<minor>.<patch>
-```
-
-Or pin by digest:
-
-```
-us-docker.pkg.dev/fairwinds-ops/oss/polaris@sha256:<digest>
-```
-
 <!-- Begin boilerplate -->
 ## Join the Fairwinds Open Source Community

 The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap,
 and network with fellow Kubernetes users.
-[Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-2na8gtwb4-DGQ4qgmQbczQyB2NlFlYQQ)
+[Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)
+or
+[join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
+
+<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
+</a>

 ## Other Projects from Fairwinds

@@ -87,5 +58,9 @@ Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_
 If you're interested in running Polaris in multiple clusters,
 tracking the results over time, integrating with Slack, Datadog, and Jira,
 or unlocking other functionality, check out
-[Fairwinds Insights](https://fairwinds.com/insights),
+[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris),
 a platform for auditing and enforcing policy in Kubernetes clusters.
+
+<a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
+</a>
@@ -3,8 +3,9 @@ failureMessage: The ServiceAccount will be automounted
 category: Security
 target: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
+  required: ["serviceAccountName"]
  properties:
    serviceAccountName:
      type: string
@@ -14,11 +15,12 @@ schema:
        const: true
 additionalSchemaStrings:
  ServiceAccount: |
-    {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
    type: object
    required:
      - metadata
+      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
      - automountServiceAccountToken
+      {{ end }}
    properties:
      metadata:
        type: object
@@ -32,4 +34,3 @@ additionalSchemaStrings:
        type: boolean
        const: false
      {{ end }}
-    {{ end }}
@@ -6,7 +6,7 @@ containers:
  exclude:
  - initContainer
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - resources
@@ -29,4 +29,6 @@ mutations:
  - op: add
    path: /resources/limits/cpu
    value: 100m
+comments:
+  - find: "cpu: 100m"
    comment: "TODO: Set this to the maximum amount of CPU you want your workload to use"
@@ -6,7 +6,7 @@ containers:
  exclude:
  - initContainer
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - resources
@@ -29,4 +29,6 @@ mutations:
  - op: add
    path: /resources/requests/cpu
    value: 100m
+comments:
+  - find: "cpu: 100m"
    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"
@@ -3,7 +3,7 @@ failureMessage: Container should not have dangerous capabilities
 category: Security
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    securityContext:
@@ -28,4 +28,4 @@ schema:

 mutations:
  - op: remove
-    path: /securityContext/capabilities/add
+    path: /securityContext/capabilities
@@ -6,7 +6,7 @@ controllers:
  include:
  - Deployment
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - spec
@@ -3,7 +3,7 @@ failureMessage: Host IPC should not be configured
 category: Security
 target: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    hostIPC:
@@ -3,7 +3,7 @@ failureMessage: Host network should not be configured
 category: Security
 target: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    hostNetwork:
@@ -3,7 +3,7 @@ failureMessage: Host PID should not be configured
 category: Security
 target: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    hostPID:
@@ -3,7 +3,7 @@ failureMessage: Host port should not be configured
 category: Security
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  properties:
@@ -12,7 +12,4 @@ schema:
      items:
        properties:
          hostPort:
-            const: 0
-mutations:
-  - op: remove
-    path: /ports/*/hostPort
+            const: 0
@@ -3,7 +3,7 @@ failureMessage: Container should not have insecure capabilities
 category: Security
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - securityContext
@@ -55,6 +55,8 @@ schema:
                - contains:
                    pattern: '^(?i)AUDIT_WRITE$'
 mutations:
-  - op: replace
+  - op: remove
+    path: /securityContext/capabilities
+  - op: add
    path: /securityContext/capabilities
    value: {"drop": ["ALL"]}
@@ -3,8 +3,8 @@ FailureMessage: Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabil
 category: Security
 target: Container
 schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  $defs:
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
    podOrContainerSeccompProfile:
      type: object
      {{ $podSeccompProfileType := .Polaris.PodSpec.securityContext.seccompProfile.type }}
@@ -83,7 +83,7 @@ schemaString: |
  type: object
  {{ else }}
  anyOf:
-  - $ref: "#/$defs/podOrContainerSeccompProfile"
-  - $ref: "#/$defs/podOrContainerSELinuxOptions"
-  - $ref: "#/$defs/containerDropCapabilities"
+  - $ref: "#/definitions/podOrContainerSeccompProfile"
+  - $ref: "#/definitions/podOrContainerSELinuxOptions"
+  - $ref: "#/definitions/containerDropCapabilities"
  {{ end}}
@@ -10,7 +10,7 @@ containers:
  - initContainer
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - livenessProbe
@@ -23,4 +23,6 @@ mutations:
  - op: add
    path: /livenessProbe
    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
-    comment: "TODO: Change the livenessProbe setting to reflect your application's health"
+comments:
+  - find: "livenessProbe:"
+    comment: "TODO: Change livenessProbe setting to reflect your health endpoints"
@@ -6,7 +6,7 @@ containers:
  exclude:
  - initContainer
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - resources
@@ -29,4 +29,6 @@ mutations:
  - op: add
    path: /resources/limits/memory
    value: "512Mi"
+comments:
+  - find: "memory: 512Mi"
    comment: "TODO: Set this to the maximum amount of memory you want your workload to use"
@@ -6,7 +6,7 @@ containers:
  exclude:
  - initContainer
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - resources
@@ -29,4 +29,6 @@ mutations:
  - op: add
    path: /resources/requests/memory
    value: "512Mi"
+comments:
+  - find: "memory: 512Mi"
    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"
@@ -0,0 +1,17 @@
+successMessage: Label app.kubernetes.io/name matches metadata.name
+failureMessage: Label app.kubernetes.io/name must match metadata.name
+target: Controller
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    metadata:
+      type: object
+      required: ["labels"]
+      properties:
+        labels:
+          type: object
+          required: ["app.kubernetes.io/name"]
+          properties:
+            app.kubernetes.io/name:
+              const: "{{ .metadata.name }}"
@@ -3,7 +3,7 @@ failureMessage: A NetworkPolicy should match pod labels and contain applied egre
 category: Security
 target: PodTemplate
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    metadata:
@@ -4,27 +4,17 @@ category: Reliability
 target: Controller
 controllers:
  include:
-    - Deployment
+  - Deployment
 schema:
-  "$schema": https://json-schema.org/draft/2019-09/schema#
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
-  required: [spec]
  properties:
-    spec:
+    metadata:
      type: object
-      required: [template]
      properties:
-        template:
+        labels:
          type: object
-          required: [metadata]
-          properties:
-            metadata:
-              type: object
-              required: [labels]
-              properties:
-                labels:
-                  type: object
-                  minProperties: 1
+          minProperties: 1
 additionalSchemaStrings:
  policy/PodDisruptionBudget: |
    type: object
@@ -40,7 +30,7 @@ additionalSchemaStrings:
              matchLabels:
                type: object
                anyOf:
-                {{ range $key, $value := .spec.template.metadata.labels }}
+                {{ range $key, $value := .metadata.labels }}
                - properties:
                    "{{ $key }}":
                      type: string
@@ -4,8 +4,8 @@ category: Security
 target: Container
 schemaTarget: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  $defs:
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
    goodSecurityContext:
      type: object
      anyOf:
@@ -25,13 +25,13 @@ schema:
    - securityContext
    properties:
      securityContext:
-        $ref: "#/$defs/goodSecurityContext"
+        $ref: "#/definitions/goodSecurityContext"
      containers:
        type: array
        items:
          properties:
            securityContext:
-              $ref: "#/$defs/notBadSecurityContext"
+              $ref: "#/definitions/notBadSecurityContext"
  - properties:
      containers:
        type: array
@@ -40,7 +40,7 @@ schema:
          - securityContext
          properties:
            securityContext:
-              $ref: "#/$defs/goodSecurityContext"
+              $ref: "#/definitions/goodSecurityContext"
 mutations:
  - op: add
    path: /securityContext/readOnlyRootFilesystem
@@ -3,7 +3,7 @@ failureMessage: Voluntary evictions are not possible
 category: Reliability
 target: policy/PodDisruptionBudget
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - spec
@@ -1,9 +1,9 @@
 successMessage: Priority class has been set
 failureMessage: Priority class should be set
-category: Reliability
+category: Security
 target: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - priorityClassName
@@ -4,8 +4,8 @@ category: Security
 target: Container
 schemaTarget: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  $defs:
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
    goodSecurityContext:
      type: object
      anyOf:
@@ -25,13 +25,13 @@ schema:
    - securityContext
    properties:
      securityContext:
-        $ref: "#/$defs/goodSecurityContext"
+        $ref: "#/definitions/goodSecurityContext"
      containers:
        type: array
        items:
          properties:
            securityContext:
-              $ref: "#/$defs/notBadSecurityContext"
+              $ref: "#/definitions/notBadSecurityContext"
  - properties:
      containers:
        type: array
@@ -40,9 +40,4 @@ schema:
          - securityContext
          properties:
            securityContext:
-              $ref: "#/$defs/goodSecurityContext"
-
-mutations:
-  - op: add
-    path: /securityContext/allowPrivilegeEscalation
-    value: false
+              $ref: "#/definitions/goodSecurityContext"
@@ -3,7 +3,7 @@ failureMessage: Image pull policy should be "Always"
 category: Reliability
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  required:
  - imagePullPolicy
  properties:
@@ -10,7 +10,7 @@ containers:
  - initContainer
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - readinessProbe
@@ -23,4 +23,6 @@ mutations:
  - op: add
    path: /readinessProbe
    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
-    comment: "TODO: Change the readinessProbe setting to reflect your application's readiness to serve traffic"
+comments:
+  - find: "readinessProbe:"
+    comment: "TODO: Change livenessProbe setting to reflect your health endpoints"
@@ -4,8 +4,8 @@ category: Security
 target: Container
 schemaTarget: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  $defs:
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
    notBadSecurityContext:
      type: object
      properties:
@@ -15,13 +15,13 @@ schema:
  type: object
  properties:
    securityContext:
-      $ref: "#/$defs/notBadSecurityContext"
+      $ref: "#/definitions/notBadSecurityContext"
    containers:
      type: array
      items:
        properties:
          securityContext:
-            $ref: "#/$defs/notBadSecurityContext"
+            $ref: "#/definitions/notBadSecurityContext"
 mutations:
  - op: add
    path: /securityContext/privileged
@@ -4,8 +4,8 @@ category: Security
 target: Container
 schemaTarget: PodSpec
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  $defs:
+  '$schema': http://json-schema.org/draft-07/schema
+  definitions:
    goodSecurityContext:
      type: object
      anyOf:
@@ -33,13 +33,13 @@ schema:
    - securityContext
    properties:
      securityContext:
-        $ref: "#/$defs/goodSecurityContext"
+        $ref: "#/definitions/goodSecurityContext"
      containers:
        type: array
        items:
          properties:
            securityContext:
-              $ref: "#/$defs/notBadSecurityContext"
+              $ref: "#/definitions/notBadSecurityContext"
  # non-root specified at container level
  - properties:
      containers:
@@ -49,7 +49,7 @@ schema:
          - securityContext
          properties:
            securityContext:
-              $ref: "#/$defs/goodSecurityContext"
+              $ref: "#/definitions/goodSecurityContext"
 mutations:
  - op: add
    path: /securityContext/runAsNonRoot
@@ -3,7 +3,7 @@ failureMessage: Potentially sensitive content is detected in the ConfigMap keys
 category: Security
 target: /ConfigMap
 schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required: ["metadata"]
  properties:
@@ -0,0 +1,43 @@
+successMessage: The container does not set potentially sensitive environment variables
+failureMessage: The container sets potentially sensitive environment variables
+category: Security
+target: Container
+schemaString: |
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  properties:
+    env:
+      type: array
+      items:
+        type: object
+        required: ["name"]
+        properties:
+          name:
+            type: string
+            '$comment': These environment variable names will be disallowed.
+            allOf:
+              - not:
+                  pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+              - not:
+                  pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+              - not:
+                  pattern: '(?i)^AZURE_.+KEY$'
+              - not:
+                  pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+              - not:
+                  pattern: '(?i)password'
+              - not:
+                  pattern: '(?i)token'
+              - not:
+                  pattern: '(?i)bearer'
+              - not:
+                  pattern: '(?i)secret'
+                '$comment': This allows variable names not excluded above.
+              - pattern: '(?i).*'
+          value:
+            type: string
+            '$comment': These environment variable values will be disallowed.
+            allOf:
+            - not:
+                '$comment': THis matches variations like begin private key, begin rsa private key ...
+                pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'
@@ -3,7 +3,7 @@ failureMessage: Image tag should be specified
 category: Reliability
 target: Container
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  required:
  - image
  allOf:
@@ -3,7 +3,7 @@ failureMessage: Ingress does not have TLS configured
 category: Security
 target: networking.k8s.io/Ingress
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required:
  - spec
@@ -17,10 +17,9 @@ package cmd
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net/http"
 	"os"
 	"os/exec"
@@ -43,12 +42,9 @@ var (
 	resourceToAudit     string
 	useColor            bool
 	helmChart           string
-	helmValues          []string
-	helmSkipTests       bool
+	helmValues          string
 	checks              []string
 	auditNamespace      string
-	severityLevel       string
-	skipSslValidation   bool
 )

 func init() {
@@ -64,12 +60,9 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&displayName, "display-name", "", "An optional identifier for the audit.")
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
-	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
-	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
+	auditCmd.PersistentFlags().StringVar(&helmValues, "helm-values", "", "Optional flag to add helm values")
 	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
 	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
-	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
-	auditCmd.PersistentFlags().BoolVar(&skipSslValidation, "skip-ssl-validation", false, "Skip https certificate verification")
 }

 var auditCmd = &cobra.Command{
@@ -102,27 +95,26 @@ var auditCmd = &cobra.Command{
 		}
 		if helmChart != "" {
 			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)
 			if err != nil {
-				logrus.Errorf("Couldn't process helm chart: %v", err)
+				logrus.Infof("Couldn't process helm chart: %v", err)
 				os.Exit(1)
 			}
 		}

-		ctx := context.TODO()
-		k, err := kube.CreateResourceProvider(ctx, auditPath, resourceToAudit, config)
+		k, err := kube.CreateResourceProvider(context.TODO(), auditPath, resourceToAudit, config)
 		if err != nil {
 			logrus.Errorf("Error fetching Kubernetes resources %v", err)
 			os.Exit(1)
 		}

-		auditData, err := validator.RunAudit(context.Background(), config, k)
+		auditData, err := validator.RunAudit(config, k)
 		if err != nil {
 			logrus.Errorf("Error while running audit on resources: %v", err)
 			os.Exit(1)
 		}

-		outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests, severityLevel)
+		outputAudit(auditData, auditOutputFile, auditOutputURL, auditOutputFormat, useColor, onlyShowFailedTests)

 		summary := auditData.GetSummary()
 		score := summary.GetScore()
@@ -137,7 +129,7 @@ var auditCmd = &cobra.Command{
 }

 // ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
+func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
 	cmd := exec.Command("helm", "dependency", "update", helmChart)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -145,22 +137,18 @@ func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests b
 		return "", err
 	}

-	dir, err := os.MkdirTemp("", "*")
+	dir, err := ioutil.TempDir("", "*")
 	if err != nil {
 		return "", err
 	}
 	params := []string{
 		"template", helmChart,
-		"--generate-name",
+		helmChart,
 		"--output-dir",
 		dir,
 	}
-	for _, v := range helmValues {
-		params = append(params, "--values", v)
-	}
-
-	if helmSkipTests {
-		params = append(params, "--skip-tests")
+	if helmValues != "" {
+		params = append(params, "--values", helmValues)
 	}

 	cmd = exec.Command("helm", params...)
@@ -173,34 +161,23 @@ func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests b
 	return dir, nil
 }

-func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFormat string, useColor bool, onlyShowFailedTests bool, severityLevel string) {
+func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFormat string, useColor bool, onlyShowFailedTests bool) {
 	if onlyShowFailedTests {
 		auditData = auditData.RemoveSuccessfulResults()
 	}
-
-	if severityLevel != "" {
-		switch severityLevel {
-		case "danger":
-			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityDanger)
-		case "warning":
-			auditData = auditData.FilterResultsBySeverityLevel(cfg.SeverityWarning)
-		}
-	}
-
 	var outputBytes []byte
 	var err error
-	switch outputFormat {
-	case "score":
-		outputBytes = fmt.Appendf(nil, "%d\n", auditData.GetSummary().GetScore())
-	case "yaml":
+	if outputFormat == "score" {
+		outputBytes = []byte(fmt.Sprintf("%d\n", auditData.GetSummary().GetScore()))
+	} else if outputFormat == "yaml" {
 		var jsonBytes []byte
 		jsonBytes, err = json.Marshal(auditData)
 		if err == nil {
 			outputBytes, err = yaml.JSONToYAML(jsonBytes)
 		}
-	case "pretty":
+	} else if outputFormat == "pretty" {
 		outputBytes = []byte(auditData.GetPrettyOutput(useColor))
-	default:
+	} else {
 		outputBytes, err = json.MarshalIndent(auditData, "", "  ")
 	}
 	if err != nil {
@@ -208,10 +185,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 		os.Exit(1)
 	}
 	if outputURL == "" && outputFile == "" {
-		if _, err := os.Stdout.Write(outputBytes); err != nil {
-			logrus.Errorf("Error writing audit to stdout: %v", err)
-			os.Exit(1)
-		}
+		os.Stdout.Write(outputBytes)
 	} else {
 		if outputURL != "" {
 			req, err := http.NewRequest("POST", outputURL, bytes.NewBuffer(outputBytes))
@@ -221,33 +195,24 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 				os.Exit(1)
 			}

-			switch outputFormat {
-			case "json":
+			if outputFormat == "json" {
 				req.Header.Set("Content-Type", "application/json")
-			case "yaml":
+			} else if outputFormat == "yaml" {
 				req.Header.Set("Content-Type", "application/x-yaml")
-			default:
+			} else {
 				req.Header.Set("Content-Type", "text/plain")
 			}
-
 			client := &http.Client{}
-			if skipSslValidation {
-				transport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
-				client = &http.Client{Transport: transport}
-			}
 			resp, err := client.Do(req)
+
 			if err != nil {
 				logrus.Errorf("Error making request for output: %v", err)
 				os.Exit(1)
 			}

-			defer func() {
-				if err := resp.Body.Close(); err != nil {
-					logrus.Errorf("Error closing response body: %v", err)
-				}
-			}()
+			defer resp.Body.Close()

-			body, err := io.ReadAll(resp.Body)
+			body, err := ioutil.ReadAll(resp.Body)

 			if err != nil {
 				logrus.Errorf("Error reading response: %v", err)
@@ -258,7 +223,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 		}

 		if outputFile != "" {
-			err := os.WriteFile(outputFile, outputBytes, 0644)
+			err := ioutil.WriteFile(outputFile, []byte(outputBytes), 0644)
 			if err != nil {
 				logrus.Errorf("Error writing output to file: %v", err)
 				os.Exit(1)
@@ -15,7 +15,6 @@
 package cmd

 import (
-	"context"
 	"fmt"
 	"net/http"

@@ -55,15 +54,9 @@ var dashboardCmd = &cobra.Command{
 			auditData := validator.ReadAuditFromFile(loadAuditFile)
 			auditDataPtr = &auditData
 		}
-		router, err := dashboard.GetRouter(context.Background(), config, auditPath, serverPort, basePath, auditDataPtr)
-		if err != nil {
-			logrus.Fatalf("error creating router: %v", err)
-		}
-
+		router := dashboard.GetRouter(config, auditPath, serverPort, basePath, auditDataPtr)
 		router.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
-			if _, err := w.Write([]byte("OK")); err != nil {
-				logrus.Errorf("Error writing health response: %v", err)
-			}
+			w.Write([]byte("OK"))
 		})
 		http.Handle("/", router)

@@ -15,25 +15,33 @@
 package cmd

 import (
-	"context"
+	"bytes"
 	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
 	"os"
+	"path/filepath"
+	"strings"

-	"github.com/fairwindsops/polaris/pkg/fix"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	yamlV3 "gopkg.in/yaml.v3"
+	"sigs.k8s.io/yaml"
 )

 var (
 	filesPath   string
 	checksToFix []string
-	isTemplate  bool
+	fixAll      bool
 )

 func init() {
 	rootCmd.AddCommand(fixCommand)
 	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
-	fixCommand.PersistentFlags().BoolVar(&isTemplate, "template", false, "set to true when modifyng a YAML template, like a Helm chart (experimental)")
 	fixCommand.PersistentFlags().StringSliceVar(&checksToFix, "checks", []string{}, "Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations")
 }

@@ -44,16 +52,128 @@ var fixCommand = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		logrus.Debug("Setting up controller manager")

-		err := fix.Execute(context.Background(), config, filesPath, isTemplate, checksToFix...)
+		if filesPath == "" {
+			logrus.Error("Please specify a file-path flag")
+			cmd.Help()
+			os.Exit(1)
+		}
+		var yamlFiles []string
+		fileInfo, err := os.Stat(filesPath)
 		if err != nil {
-			if errors.Is(err, fix.ErrFilesPathRequired) {
-				logrus.Error("Please specify a files-path flag")
-				if helpErr := cmd.Help(); helpErr != nil {
-					logrus.Error(helpErr)
-				}
+			logrus.Error(err)
+			os.Exit(1)
+		}
+		if fileInfo.IsDir() {
+			baseDir := filesPath
+			if !strings.HasSuffix(filesPath, "/") {
+				baseDir = baseDir + "/"
+			}
+			yamlFiles, err = getYamlFiles(baseDir)
+			if err != nil {
+				logrus.Error(err)
 				os.Exit(1)
 			}
-			logrus.Fatal(err)
+		} else {
+			yamlFiles = append(yamlFiles, filesPath)
 		}
+		var contentStr string
+		isFirstResource := true
+
+		if len(checksToFix) > 0 {
+			if len(checksToFix) == 1 && checksToFix[0] == "all" {
+				allchecks := []string{}
+				for key := range config.Checks {
+					allchecks = append(allchecks, key)
+				}
+				config.Mutations = allchecks
+			} else {
+				config.Mutations = checksToFix
+			}
+		}
+
+		for _, fullFilePath := range yamlFiles {
+
+			yamlFile, err := ioutil.ReadFile(fullFilePath)
+			if err != nil {
+				logrus.Fatalf("Error reading file with file path %s: %v", fullFilePath, err)
+			}
+
+			dec := yamlV3.NewDecoder(bytes.NewReader(yamlFile))
+
+			for {
+				data := map[string]interface{}{}
+				err := dec.Decode(&data)
+				// check it was parsed
+				if data == nil {
+					continue
+				}
+				// break the loop in case of EOF
+				if errors.Is(err, io.EOF) {
+					break
+				}
+				if err != nil {
+					logrus.Fatalf("Error decoding data for file with file path %s: %v", fullFilePath, err)
+				}
+				yamlContent, err := yamlV3.Marshal(data)
+				if err != nil {
+					logrus.Fatalf("Error marshalling %s: %v", fullFilePath, err)
+				}
+				kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
+				results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
+				if err != nil {
+					logrus.Fatalf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+				}
+				comments, allMutations := mutation.GetMutationsAndCommentsFromResults(results)
+				updatedYamlContent := string(yamlContent)
+				if len(allMutations) > 0 {
+					for _, resources := range kubeResources.Resources {
+						key := fmt.Sprintf("%s/%s/%s", resources[0].Kind, resources[0].Resource.GetName(), resources[0].Resource.GetNamespace())
+						mutations := allMutations[key]
+						mutated, err := mutation.ApplyAllSchemaMutations(&config, kubeResources, resources[0], mutations)
+						if err != nil {
+							logrus.Errorf("Error applying schema mutations to the resources: %v", err)
+							os.Exit(1)
+						}
+						mutatedYamlContent, err := yaml.JSONToYAML(mutated.OriginalObjectJSON)
+						if err != nil {
+							logrus.Errorf("Error converting JSON to Yaml : %v", err)
+							os.Exit(1)
+						}
+						updatedYamlContent = mutation.UpdateMutatedContentWithComments(string(mutatedYamlContent), comments)
+					}
+				}
+				if isFirstResource {
+					contentStr = updatedYamlContent
+					isFirstResource = false
+				} else {
+					contentStr += "\n"
+					contentStr += "---"
+					contentStr += "\n"
+					contentStr += updatedYamlContent
+				}
+			}
+
+			if contentStr != "" {
+				err = ioutil.WriteFile(fullFilePath, []byte(contentStr), 0644)
+				if err != nil {
+					logrus.Fatalf("Error writing output to file: %v", err)
+				}
+			}
+		}
+
 	},
 }
+
+func getYamlFiles(rootpath string) ([]string, error) {
+	var list []string
+	err := filepath.Walk(rootpath, func(path string, info os.FileInfo, err error) error {
+		if info.IsDir() {
+			return nil
+		}
+		if filepath.Ext(path) == ".yaml" || filepath.Ext(path) == ".yml" {
+			list = append(list, path)
+		}
+		return nil
+	})
+	return list, err
+}
@@ -15,26 +15,21 @@
 package cmd

 import (
+	"flag"
 	"os"
-	"strings"

 	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 )

-var (
-	mergeConfig                  bool
-	configPath                   string
-	disallowExemptions           bool
-	disallowConfigExemptions     bool
-	disallowAnnotationExemptions bool
-	logLevel                     string
-	auditPath                    string
-	displayName                  string
-	kubeContext                  string
-	insightsHost                 string
-)
+var configPath string
+var disallowExemptions, disallowConfigExemptions, disallowAnnotationExemptions, fixChecks bool
+var logLevel string
+var auditPath string
+var displayName string
+var kubeContext string

 var (
 	version string
@@ -42,14 +37,14 @@ var (

 func init() {
 	// Flags
-	rootCmd.PersistentFlags().BoolVarP(&mergeConfig, "merge-config", "m", false, "If true, custom configuration will be merged with default configuration instead of replacing it.")
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "Location of Polaris configuration file.")
 	rootCmd.PersistentFlags().StringVarP(&kubeContext, "context", "x", "", "Set the kube context.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
-	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level to be output (trace, debug, info, warning, error, fatal, panic).")
-	rootCmd.PersistentFlags().StringVar(&insightsHost, "insights-host", "https://insights.fairwinds.com", "Fairwinds Insights host URL")
+	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level.")
+	flag.Parse()
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
 }

 var config conf.Configuration
@@ -66,7 +61,7 @@ var rootCmd = &cobra.Command{
 			logrus.SetLevel(parsedLevel)
 		}

-		config, err = conf.MergeConfigAndParseFile(configPath, mergeConfig)
+		config, err = conf.ParseFile(configPath)
 		if err != nil {
 			logrus.Errorf("Error parsing config at %s: %v", configPath, err)
 			os.Exit(1)
@@ -85,13 +80,6 @@ var rootCmd = &cobra.Command{
 		}
 		os.Exit(1)
 	},
-	PersistentPostRun: func(cmd *cobra.Command, args []string) {
-		if !strings.HasPrefix(cmd.Use, "audit") {
-			if _, err := os.Stderr.WriteString("\n\nWant more? Automate Polaris for free with Fairwinds Insights!\n🚀 https://fairwinds.com/insights-signup/polaris 🚀 \n"); err != nil {
-				logrus.Error(err)
-			}
-		}
-	},
 }

 // Execute the stuff
@@ -31,7 +31,4 @@ var versionCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		fmt.Println("Polaris version:" + version)
 	},
-	PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-		return nil
-	},
 }
@@ -15,8 +15,8 @@
 package cmd

 import (
-	"context"
 	"os"
+	"time"

 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -25,14 +25,12 @@ import (
 	k8sConfig "sigs.k8s.io/controller-runtime/pkg/client/config"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
 )

 var webhookPort int
 var disableWebhookConfigInstaller bool
 var enableMutations bool
 var enableValidations bool
-var certDir string

 func init() {
 	rootCmd.AddCommand(webhookCmd)
@@ -40,7 +38,6 @@ func init() {
 	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "Disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
 	webhookCmd.PersistentFlags().BoolVar(&enableValidations, "validate", true, "Enable the validating webhook to reject workloads with issues")
 	webhookCmd.PersistentFlags().BoolVar(&enableMutations, "mutate", false, "Enable the mutating webhook to modify workloads with issues")
-	webhookCmd.PersistentFlags().StringVar(&certDir, "cert-dir", "/opt/cert", "Directory in which tls certificate is located")
 }

 var webhookCmd = &cobra.Command{
@@ -51,22 +48,22 @@ var webhookCmd = &cobra.Command{
 		logrus.Debug("Setting up controller manager")

 		mgr, err := manager.New(k8sConfig.GetConfigOrDie(), manager.Options{
-			WebhookServer: webhook.NewServer(webhook.Options{
-				CertDir:  certDir,
-				Port:     webhookPort,
-				CertName: "tls.crt",
-				KeyName:  "tls.key",
-			}),
+			CertDir: "/opt/cert",
+			Port:    webhookPort,
 		})
 		if err != nil {
 			logrus.Errorf("Unable to set up overall controller manager: %v", err)
 			os.Exit(1)
 		}

-		_, err = os.Stat(certDir + "/tls.crt")
+		_, err = os.Stat("/opt/cert/tls.crt")
 		if os.IsNotExist(err) {
+			time.Sleep(time.Second * 10)
 			panic("Cert does not exist")
 		}
+		server := mgr.GetWebhookServer()
+		server.CertName = "tls.crt"
+		server.KeyName = "tls.key"

 		if !enableMutations && !enableValidations {
 			logrus.Errorf("One of --mutate or --validate must be set to true")
@@ -74,10 +71,10 @@ var webhookCmd = &cobra.Command{
 		}

 		if enableValidations {
-			fwebhook.NewValidateWebhook(mgr, config)
+			fwebhook.NewValidateWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
 		}
 		if enableMutations {
-			fwebhook.NewMutateWebhook(context.Background(), mgr, config)
+			fwebhook.NewMutateWebhook(mgr, fwebhook.Mutator{Config: config, Client: mgr.GetClient()})
 		}
 		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
 		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
@@ -11,16 +11,6 @@ var sf14gv = 32793;
  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(sf14g, s);
 })();

-(function() {
-  var gtag = document.createElement('script');
-  gtag.src = "https://www.googletagmanager.com/gtag/js?id=G-ZR5M5SRYKY";
-  var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(gtag, s);
-  window.dataLayer = window.dataLayer || [];
-  function gtag(){dataLayer.push(arguments);}
-  gtag('js', new Date());
-  gtag('config', 'G-ZR5M5SRYKY');
-})();
-
 !function(f,b,e,v,n,t,s)
 {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
 n.callMethod.apply(n,arguments):n.queue.push(arguments)};
@@ -31,3 +21,9 @@ s.parentNode.insertBefore(t,s)}(window,document,'script',
 'https://connect.facebook.net/en_US/fbevents.js');
 fbq('init', '521127644762074');
 fbq('track', 'PageView');
+
+(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+})(window,document,'script','dataLayer','GTM-TM95WXQ');
@@ -53,30 +53,9 @@ This means Polaris will remediate the issue it finds, rather than rejecting
 the deployment.

 To enable the mutating webhook, add `--set webhook.mutate=true` to your
-Helm installation command.
+Helm instlallation command.

-The following default checks currently have mutation support enabled:
-* `hostPIDSet`
-* `hostNetworkSet`
-* `hostIPCSet`
-* `priorityClassNotSet`
-* `hostPortSet`
-* `pullPolicyNotAlways`
-* `deploymentMissingReplicas`
-* `dangerousCapabilities`
-* `cpuLimitsMissing`
-* `memoryLimitsMissing`
-* `livenessProbeMissing`
-* `memoryRequestsMissing`
-* `cpuRequestsMissing`
-* `runAsPrivileged`
-* `readinessProbeMissing`
-* `privilegeEscalationAllowed`
-* `notReadOnlyRootFilesystem`
-* `insecureCapabilities`
-* `runAsRootAllowed`
-
-If you'd like to
+By default, the only mutation enabled is `pullPolicyNotAlways`. If you'd like to
 enable other mutations, you can set the `webhook.mutations` flag.


@@ -5,105 +5,6 @@ meta:
    content: "Fairwinds Polaris | Changelog"

 ---
-
-## 9.1.1
-* Fix `hpaMinAvailability` failure message
-* Fix `missingPodDisruptionBudget` typo
-* Rewrite `hpaMaxAvailability` check to use go-template
-
-## 9.1.0
-* Add HPA `minAvailable` and HPA `maxAvailable` checks 
-* Fix typo for PDB `minAvailable`
-
-## 9.0.1
-* Fix comments handling in `addOrReplaceValue` function
-
-## 9.0.0
-* Expose issue fixer and mutations in the library
-* Remove `packr` in favor of `go:embed`
-
-## 8.5.6
-* Fix trying to list cluster-level resources
-
-## 8.5.5
-* Fix missing PDB check
-
-## 8.5.4
-* Fix conditional expressions should be at very top of `additionalSchemaStrings`
-* Update alpine to 3.19
-
-## 8.5.3
-* Add quiet flag to polaris audit CLI command to suppress 'upload to Insights' prompt
-
-## 8.5.2
-* Switch to `controller-utils` package to get workloads
-
-## 8.5.1
-* Update `topologySpreadConstraint` check
-
-## 8.5.0
-* Add helm-skip-tests flag
-* Update CLI docs
-* Handle multiple helm-values files
-
-## 8.4.0
-* Change kubernetes.io/ label from name to instance
-
-## 8.3.0
-* Add option to filter audit results by severity level
-* Add insights prompt
-
-## 8.2.4
-* Fix nil pointer issue with webhook
-
-## 8.2.3
-* Add category for `metadataAndNameMismatched`.
-* Fix category for `priorityClassNotSet`.
-
-## 8.2.2
-* Fix webhook server cert dir argument
-
-## 8.2.1
-* Fix on Insights integration
-
-## 8.2.0
-* Minor fixes for NSA checks
-
-## 8.1.0
-* Add `insights-host` global flag to configure Fairwinds Insights host (defaults to `https://insights.fairwinds.com`).
-* Add new `auth` sub-commands be able to authenticate on Polaris using Fairwinds Insights credentials
-  - `login` - login using Fairwinds Insights credentials via the web interface or provide a token
-  - `logout` - logout from Fairwinds Insights
-  - `status` - show relevant information regarding login state
-  - `token` - prints the token from local storage
-* Add new `audit` flags to be able to upload Workloads and Polaris results to Fairwinds Insights
-  - `upload-insights` - indicates that the results should be uploaded to Fairwinds Insights. (defaults to `false`)
-  - `cluster-name`  - cluster name that the results belongs to. Creates the cluster if it does not exist. (required if `upload-insights` is used) 
-
-
-## 8.0.0
-* Change default severity from `ignore` to `warning` for `priorityClassNotSet`, `metadataAndNameMismatched`, `missingPodDisruptionBudget`, `automountServiceAccountToken`, `missingNetworkPolicy` checks.
-* Change default severity from `warning` to `danger` for `sensitiveContainerEnvVar`, `sensitiveConfigmapContent`, `clusterrolePodExecAttach`, `rolePodExecAttach`, `clusterrolebindingPodExecAttach`, `rolebindingClusterRolePodExecAttach`, `rolebindingRolePodExecAttach`,`clusterrolebindingClusterAdmin`,`rolebindingClusterAdminClusterRole`,`rolebindingClusterAdminRole` checks.
-
-## 7.4.0
-* Skip https certificate verification (#920)
-
-## 7.3.0
-* Add a check for `topologySpreadConstraint` (#879)
-
-## 7.2.0
-* Enable new RBAC / sensitive content / Pod exec checks, add `hasPrefix` and `hasSuffix` functions to the GO template, exempt `system:` name prefixes for RBAC checks, sensitive content checks ignore `valueFrom`, (#832)
-
-## 7.1.0
-* Let Polaris modify YAML without losing comments/formatting (#821)
-* Add checks for RBAC allowing exec or attaching to a Pod (#820)
-* Add `clusterrolebindingClusterAdmin`, `rolebindingClusterAdminRole`, and `rolebindingClusterAdminClusterRole` checks + schema tests (#823)
-
-## 7.0.2
-* Fixes for pretty CLI output
-* Some new checks (disabled by default)
-* Some additional features in templating engine
-
 ## 7.0.1
 * Documentation updates

@@ -251,7 +152,7 @@ JSON schema (see changes to `./checks/multipleReplicasForDeployment.yaml`)
 * Docker image now includes the default config

 ### Breaking Changes
-* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/examples) for examples of the new formats.
+* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/examples) for examples of the new formats.
    * removed config-level configuration for checks like max/min memory settings
    * changed severity `error` to `danger`
 * Breaking changes to the CLI
@@ -14,58 +14,22 @@ key | default | description
 `livenessProbeMissing` | `warning` | Fails when a liveness probe is not configured for a pod.
 `tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
 `pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
-`priorityClassNotSet` | `warning` | Fails when a priorityClassName is not set for a pod.
+`priorityClassNotSet` | `ignore` | Fails when a priorityClassName is not set for a pod.
 `deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
-`missingPodDisruptionBudget` | `warning` | Fails when PDB is missing.
-`metadataAndInstanceMismatched` | `warning` | Fails when label `app.kubernetes.io/instance` and `metadata.name` mismatch
-`topologySpreadConstraint` | `warning` | Fails when there is no topology spread constraint on the pod
-`hpaMaxAvailability` | `warning` | Fails when `maxAvailable` lesser or equal than `minAvailable` (if defined) for a HorizontalPodAutoscaler
-`hpaMinAvailability` | `warning` | Fails when `minAvailable` (if defined) lesser or equal to one for a HorizontalPodAutoscaler
-`pdbMinAvailableGreaterThanHPAMinReplicas` | `warning` |  Fails when PDB `minAvailable` is greater than HPA `minReplicas`
+`missingPodDisruptionBudget` | `ignore` 

 ## Background

-### Liveness and Readiness Probes
 Readiness and liveness probes can help maintain the health of applications running inside Kubernetes. By default, Kubernetes only knows whether or not a process is running, not if it's healthy. Properly configured readiness and liveness probes will also be able to ensure the health of an application.

 Readiness probes are designed to ensure that an application has reached a "ready" state. In many cases there is a period of time between when a webserver process starts and when it is ready to receive traffic. A readiness probe can ensure the traffic is not sent to a pod until it is actually ready to receive traffic.

 Liveness probes are designed to ensure that an application stays in a healthy state. When a liveness probe fails, the pod will be restarted.

-### Image Pull Policy
 Docker's `latest` tag is applied by default to images where a tag hasn't been specified. Not specifying a specific version of an image can lead to a wide variety of problems. The underlying image could include unexpected breaking changes that break your application whenever the latest image is pulled. Reusing the same tag for multiple versions of an image can lead to different nodes in the same cluster having different versions of an image, even if the tag is identical.

 Related to that, relying on cached versions of a Docker image can become a security vulnerability. By default, an image will be pulled if it isn't already cached on the node attempting to run it. This can result in variations in images that are running per node, or potentially provide a way to gain access to an image without having direct access to the ImagePullSecret. With that in mind, it's often better to ensure the a pod has `pullPolicy: Always` specified, so images are always pulled directly from their source.

-### Topology Spread Constraints
-
-By default, the Kubernetes scheduler uses a bin-packing algorithm to fit as many pods as possible into a cluster. The scheduler prefers a more evenly distributed general node load to app replicas precisely spread across nodes. Therefore, by default, multi-replica is not guaranteed to be spread across multiple availability zones. Kubernetes provides topologySpreadConstraint configuration in order to better ensure pod spread across multiple AZs and/or Hosts.
-
-Example of a topologySpreadConstraint spreading across zones:
-
-```
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: demo-basic-demo
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: basic-demo
-      app.kubernetes.io/instance: demo
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: basic-demo
-        app.kubernetes.io/instance: demo
-    spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: "topology.kubernetes.io/zone"
-          whenUnsatisfiable: ScheduleAnyway
-```
-
-
 ## Further Reading

 - [What's Wrong With The Docker :latest Tag?](https://vsupalov.com/docker-latest-tag/)
@@ -73,4 +37,3 @@ spec:
 - [Kubernetes Docs: Configure Liveness and Readiness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
 - [Utilizing Kubernetes Liveness and Readiness Probes to Automatically Recover From Failure](https://medium.com/spire-labs/utilizing-kubernetes-liveness-and-readiness-probes-to-automatically-recover-from-failure-2fe0314f2b2e)
 - [Kubernetes Liveness and Readiness Probes: How to Avoid Shooting Yourself in the Foot](https://blog.colinbreck.com/kubernetes-liveness-and-readiness-probes-how-to-avoid-shooting-yourself-in-the-foot/)
- [Topology Spread Constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
@@ -11,52 +11,22 @@ for privilege escalation.

 key | default | description
 ----|---------|------------
-`automountServiceAccountToken` | `warning` | Fails when `automountServiceAccountToken` is automounted.
 `hostIPCSet` | `danger` | Fails when `hostIPC` attribute is configured.
 `hostPIDSet` | `danger` | Fails when `hostPID` attribute is configured.
-`linuxHardening` | `danger` | Fails when neither `AppArmor`, `Seccomp`, `SELinux`, or dropping Linux Capabilities is in use.
 `notReadOnlyRootFilesystem` | `warning` | Fails when `securityContext.readOnlyRootFilesystem` is not true.
 `privilegeEscalationAllowed` | `danger` | Fails when `securityContext.allowPrivilegeEscalation` is true.
 `runAsRootAllowed` | `warning` | Fails when `securityContext.runAsNonRoot` is not true.
 `runAsPrivileged` | `danger` | Fails when `securityContext.privileged` is true.
-`insecureCapabilities` | `warning` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks/insecureCapabilities.yaml)
-`dangerousCapabilities` | `danger` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks/dangerousCapabilities.yaml)
+`insecureCapabilities` | `warning` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/checks/insecureCapabilities.yaml)
+`dangerousCapabilities` | `danger` | Fails when `securityContext.capabilities` includes one of the capabilities [listed here](https://github.com/FairwindsOps/polaris/tree/master/checks/dangerousCapabilities.yaml)
 `hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
 `hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
 `tlsSettingsMissing` | `warning` | Fails when an Ingress lacks TLS settings.
-`gatewayTLSMissing` | `warning` | Fails when an HTTPS, GRPC, or terminating TLS Gateway listener lacks certificate references.
-`gatewayAllowedRoutesAll` | `warning` | Fails when a Gateway listener allows Routes from every namespace.
-`gatewayInsecureFrontendValidation` | `warning` | Fails when Gateway frontend client certificate validation allows insecure fallback.
-`gatewayCrossNamespaceCertificateRef` | `warning` | Fails when a Gateway references a certificate in another namespace without a matching ReferenceGrant. Cluster audits only.
-`httpRouteWildcardOrEmptyHost` | `warning` | Fails when an HTTPRoute omits hostnames or uses a wildcard hostname.
-`httpRouteInsecureListener` | `warning` | Fails when an HTTPRoute serves application traffic over HTTP without a full HTTPS redirect. Cluster audits only.
-`httpRouteCrossNamespaceBackendRef` | `warning` | Fails when an HTTPRoute references a backend in another namespace without a matching ReferenceGrant. Cluster audits only.
-`httpRouteBackendTLSMissing` | `warning` | Fails when an HTTPRoute TLS backend lacks a BackendTLSPolicy or kgateway BackendConfigPolicy. Cluster audits only.
-`kgatewayBackendTLSVerificationDisabled` | `warning` | Fails when a kgateway BackendConfigPolicy disables TLS certificate verification.
-`sensitiveContainerEnvVar` | `danger` | Fails when the container sets potentially sensitive environment variables.
-`sensitiveConfigmapContent` | `danger` | Fails when potentially sensitive content is detected in the ConfigMap keys or values.
-`missingNetworkPolicy` | `warning`
-`clusterrolePodExecAttach` | `danger` | Fails when the ClusterRole allows Pods/exec or pods/attach.
-`rolePodExecAttach` | `danger` | Fails when the Role allows Pods/exec or pods/attach.
-`clusterrolebindingPodExecAttach` | `danger` | Fails when the ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
-`rolebindingRolePodExecAttach` | `danger` | Fails when the RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist.
-`rolebindingClusterRolePodExecAttach` | `danger` | Fails when the RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist.
-`clusterrolebindingClusterAdmin` | `danger` | Fails when the ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
-`rolebindingClusterAdminClusterRole` | `danger` | Fails when the RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions.
-`rolebindingClusterAdminRole` | `danger` | Fails when the RoleBinding references a Role with wildcard permissions.

 ## Background

 Securing workloads in Kubernetes is an important part of overall cluster security. The overall goal should be to ensure that containers are running with as minimal privileges as possible. This includes avoiding privilege escalation, not running containers with a root user, not giving excessive access to the host network, and using read only file systems wherever possible.

-### Gateway API
-
-Gateway API separates listeners, routes, and backend TLS policy across different resources. Polaris checks standard `Gateway` and `HTTPRoute` resources for listener TLS, namespace isolation, host specificity, HTTPS redirects, cross-namespace authorization, and backend TLS. These checks work with conformant implementations such as kgateway.
-
-`httpRouteBackendTLSMissing` also recognizes kgateway's `Backend` and `BackendConfigPolicy` resources. It identifies TLS backends from ports 443 and 8443, Service port names and `appProtocol`, and kgateway static Backend ports. `kgatewayBackendTLSVerificationDisabled` checks the kgateway-specific `insecureSkipVerify` setting. Authentication, authorization, and rate-limiting requirements are organization-specific and should be implemented as custom checks.
-
-Checks marked "Cluster audits only" need related resources that are not available when Polaris evaluates a single admission request. They pass without a resource provider rather than rejecting an object without enough context.
-
 A pod running with the `hostNetwork` attribute enabled will have access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node. There are certain examples where setting `hostNetwork` to true is required, such as deploying a networking plugin like Flannel.

 Setting the `hostPort` attribute on a container will ensure that it is accessible on that specific port on each node it is deployed to. Unfortunately when this is specified, it limits where a pod can actually be scheduled in a cluster.
@@ -11,14 +11,12 @@ audit
      Runs a one-time audit.
 dashboard
      Runs the webserver for Polaris dashboard.
-fix
-      Fix Infrastructure as code files.
 help
      Prints help, if you give it a command then it will print help for that command. Same as -h
 version
      Prints the version of Polaris
 webhook
-      Runs the webhook webserver.
+      Runs the webhook webserver

 # global flags
 -c, --config string                    Location of Polaris configuration file.
@@ -27,7 +25,6 @@ webhook
    --disallow-config-exemptions       Disallow exemptions set within the configuration file.
    --disallow-annotation-exemptions   Disallow any exemption defined as a controller annotation.
    --kubeconfig string                Paths to a kubeconfig. Only required if out-of-cluster.
-    --insights-host string             Fairwinds Insights host URL. (default "https://insights.fairwinds.com")
    --log-level string                 Logrus log level. (default "info")

 # dashboard flags
@@ -41,13 +38,12 @@ webhook

 # audit flags
    --audit-path string               If specified, audits one or more YAML files instead of a cluster.
-    --checks strings                  Optional flag to specify specific checks to check
+    --checks stringArray              Optional flag to specify specific checks to check
    --color                           Whether to use color in pretty format. (default true)
    --display-name string             An optional identifier for the audit.
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
    --helm-chart string               Will fill out Helm template
    --helm-values string              Optional flag to add helm values
-    --helm-skip-tests bool            Corresponds to --skip-tests of helm template
 -h, --help                            help for audit
    --namespace string                Namespace to audit. Only applies to in-cluster audits
    --only-show-failed-tests          If specified, audit output will only show failed tests.
@@ -56,19 +52,10 @@ webhook
    --resource string                 Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.
    --set-exit-code-below-score int   Set an exit code of 4 when the score is below this threshold (1-100).
    --set-exit-code-on-danger         Set an exit code of 3 when the audit contains danger-level issues.
-    --severity string                 Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)
-    --skip-ssl-validation             Skip https certificate verification
-
-# fix flags
-    --checks strings      Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations
-    --files-path string   mutate and fix one or more YAML files in a specified folder
-h, --help                help for fix
-    --template            set to true when modifyng a YAML template, like a Helm chart (experimental)
-

 # webhook flags
    --disable-webhook-config-installer   disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.
 -h, --help                               help for webhook
 -p, --port int                           Port for the dashboard webserver. (default 9876)
-
 ```
+
@@ -46,11 +46,12 @@ go test ./pkg/... -v -coverprofile cover.out
 ### Webhook tests
 ```bash
 kind create cluster --wait=90s --image kindest/node:v1.15.11 --name polaris-test
-docker build -t us-docker.pkg.dev/fairwinds-ops/oss/polaris:debug . # or use your own registry
-docker push us-docker.pkg.dev/fairwinds-ops/oss/polaris:debug
+docker build -t quay.io/fairwinds/polaris:debug . # or use your own registry
+docker push quay.io/fairwinds/polaris:debug
 helm repo add jetstack https://charts.jetstack.io
- helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.12.1 --set "installCRDs=true" --wait
-POLARIS_IMAGE=us-docker.pkg.dev/fairwinds-ops/oss/polaris:debug ./test/webhook_test.sh
+kubectl create ns cert-manager
+helm install cert-manager jetstack/cert-manager --namespace cert-manager --version 0.16.1 --set "installCRDs=true" --wait
+POLARIS_IMAGE=quay.io/fairwinds/polaris:debug ./test/webhook_test.sh
 ```
 to avoid the final cleanup for debugging purposes, you can run
 ```bash
@@ -5,7 +5,7 @@ meta:
 ---
 # Configuration

-The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/pkg/config/default.yaml).
+The default Polaris configuration can be [seen here](https://github.com/FairwindsOps/polaris/blob/master/examples/config.yaml).

 You can customize the configuration to do things like:
 * Turn checks [on and off](checks.md)
@@ -7,7 +7,7 @@ meta:

 If you'd like to create your own checks, you can use [JSON Schema](https://json-schema.org/).
 This is how built-in Polaris checks are defined as well - you can see all the built-in checks
-in the [checks folder](https://github.com/FairwindsOps/polaris/tree/master/pkg/config/checks) for examples.
+in the [checks folder](https://github.com/FairwindsOps/polaris/tree/master/checks) for examples.

 If you write a check that could be useful for others, feel free to open a PR to add it in!

@@ -25,7 +25,7 @@ customChecks:
    category: Security
    target: Container
    schema:
-      '$schema': https://json-schema.org/draft/2019-09/schema
+      '$schema': http://json-schema.org/draft-07/schema
      type: object
      properties:
        image:
@@ -73,7 +73,7 @@ customChecks:
    category: Resources
    target: Container
    schema:
-      '$schema': https://json-schema.org/draft/2019-09/schema
+      '$schema': http://json-schema.org/draft-07/schema
      type: object
      required:
      - resources
@@ -120,7 +120,7 @@ successMessage: Label app.kubernetes.io/name matches metadata.name
 failureMessage: Label app.kubernetes.io/name must match metadata.name
 target: Controller
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    metadata:
@@ -167,18 +167,6 @@ schemaString: |
              {{ end }}
 ```

-### Additional Go Template Functions
-
-These functions are also available in the GO template.
-
-* [hasPrefix](https://pkg.go.dev/strings#HasPrefix) - for example, `hasPrefix "string" "prefix"`
-* [hasSuffix](https://pkg.go.dev/strings#HasSuffix) - for example, `hasSuffix "string" "suffix"`
-
-For example, the `hasPrefix` function can be used in a template to determine whether a resource name starts with `system:`
-```
-{{ if hasPrefix .metadata.name "system:" }}
-```
-
 ## Multi-Resource Checks
 You can write checks that span multiple resources. This is helpful for ensuring e.g.
 that every Deployment has a PDB or an HPA associated with it.
@@ -193,7 +181,7 @@ controllers:
  include:
  - Deployment
 schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
+  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    metadata:
@@ -233,7 +221,7 @@ customChecks:
  foo:
    jsonSchema: |
      {
-        "$schema": "https://json-schema.org/draft/2019-09/schema",
+        "$schema": "http://json-schema.org/draft-07/schema",
        "type": "object"
      }
 ```
@@ -42,7 +42,7 @@ polaris dashboard --port 8080 --audit-path=./deploy/
 ### Local Docker container

 ```
-docker run -d -p8080:8080 -v ~/.kube/config:/opt/app/config:ro  us-docker.pkg.dev/fairwinds-ops/oss/polaris:1.2 polaris dashboard --kubeconfig /opt/app/config
+docker run -d -p8080:8080 -v ~/.kube/config:/opt/app/config:ro  quay.io/fairwinds/polaris:1.2 polaris dashboard --kubeconfig /opt/app/config
 ```

 ##  Using the Dashboard
@@ -8,9 +8,9 @@
  },
  "description": "A repository with a Vuepress template for Fairwinds projects",
  "devDependencies": {
-    "vuepress": "^1.9.7",
+    "vuepress": "^1.4.0",
    "vuepress-plugin-clean-urls": "^1.1.1",
-    "vuepress-plugin-redirect": "^1.2.5"
+    "vuepress-plugin-redirect": "^1.2.3"
  },
  "directories": {
    "doc": "docs"
@@ -1,35 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-KIND_VERSION=v0.30.0
-
-if [ -z "${CI_SHA1:-}" ]; then
-  echo "CI_SHA1 not set"
-  exit 1
-fi
-
-echo "CI_SHA1: ${CI_SHA1}"
-
-tar="/tmp/workspace/docker_save/polaris_${CI_SHA1}-amd64.tar"
-if [ ! -f "$tar" ]; then
-  echo "Missing snapshot image at ${tar}"
-  exit 1
-fi
-
-if ! command -v kind > /dev/null; then
-  echo "Installing kind ${KIND_VERSION}"
-  bindir="$(pwd)/bin-kind"
-  mkdir -p "$bindir"
-  curl -fsSLo "$bindir/kind" \
-    "https://github.com/kubernetes-sigs/kind/releases/download/${KIND_VERSION}/kind-linux-amd64"
-  chmod +x "$bindir/kind"
-  export PATH="$bindir:$PATH"
-fi
-kind version
-
-docker load --input "$tar"
-docker tag "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CI_SHA1}-amd64" \
-  "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CI_SHA1}"
-kind load docker-image --name e2e "us-docker.pkg.dev/fairwinds-ops/oss/polaris:${CI_SHA1}"
-
-docker cp . e2e-command-runner:/polaris
@@ -1,23 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-mkdir -p /tmp/test-results
-
-if [[ -n "${CIRCLE_PR_NUMBER:-}" ]]; then
-  echo "Skipping Kubernetes tests for forked PR"
-  exit 0
-fi
-
-cd /polaris
-
-helm repo add jetstack https://charts.jetstack.io
-helm repo update
-helm install cert-manager jetstack/cert-manager \
-  --namespace cert-manager \
-  --version v1.12.1 \
-  --set installCRDs=true \
-  --wait \
-  --create-namespace
-
-./test/webhook_test.sh
-./test/kube_dashboard_test.sh
@@ -6,61 +6,32 @@ checks:
  pullPolicyNotAlways: warning
  readinessProbeMissing: warning
  livenessProbeMissing: warning
-  topologySpreadConstraint: warning
-  pdbDisruptionsIsZero: warning
-  missingPodDisruptionBudget: warning
-  metadataAndInstanceMismatched: warning
-  hpaMaxAvailability: warning
-  hpaMinAvailability: warning
-  pdbMinAvailableGreaterThanHPAMinReplicas: warning
-
  # efficiency
  cpuRequestsMissing: warning
  cpuLimitsMissing: warning
  memoryRequestsMissing: warning
  memoryLimitsMissing: warning
-
  # security
  automountServiceAccountToken: warning
  hostIPCSet: danger
-  hostPathSet: warning
-  hostProcess: warning
  hostPIDSet: danger
  linuxHardening: danger
  missingNetworkPolicy: warning
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
-  procMount: warning
  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
  insecureCapabilities: warning
  hostNetworkSet: danger
  hostPortSet: warning
-  tlsSettingsMissing: warning
-  gatewayTLSMissing: warning
-  gatewayAllowedRoutesAll: warning
-  gatewayInsecureFrontendValidation: warning
-  gatewayCrossNamespaceCertificateRef: warning
-  httpRouteWildcardOrEmptyHost: warning
-  httpRouteInsecureListener: warning
-  httpRouteCrossNamespaceBackendRef: warning
-  httpRouteBackendTLSMissing: warning
-  kgatewayBackendTLSVerificationDisabled: warning
  sensitiveContainerEnvVar: danger
  sensitiveConfigmapContent: danger
-  clusterrolePodExecAttach: danger
-  rolePodExecAttach: danger
-  clusterrolebindingPodExecAttach: danger
-  rolebindingClusterRolePodExecAttach: danger
-  rolebindingRolePodExecAttach: danger
-  clusterrolebindingClusterAdmin: danger
-  rolebindingClusterAdminClusterRole: danger
-  rolebindingClusterAdminRole: danger
  # custom
  resourceLimits: warning
  imageRegistry: danger

+  
 exemptions:
  - controllerNames:
    - my-network-controller
@@ -84,7 +55,7 @@ customChecks:
    category: Resources
    target: Container
    schema:
-      '$schema': https://json-schema.org/draft/2019-09/schema
+      '$schema': http://json-schema.org/draft-07/schema
      type: object
      required:
      - resources
@@ -114,7 +85,7 @@ customChecks:
    category: Images
    target: Container
    schema:
-      '$schema': https://json-schema.org/draft/2019-09/schema
+      '$schema': http://json-schema.org/draft-07/schema
      type: object
      properties:
        image:
@@ -1,36 +1,25 @@
 checks:
  # reliability
  deploymentMissingReplicas: warning
-  priorityClassNotSet: warning
+  priorityClassNotSet: ignore
  tagNotSpecified: danger
  pullPolicyNotAlways: warning
  readinessProbeMissing: warning
  livenessProbeMissing: warning
-  metadataAndInstanceMismatched: warning
+  metadataAndNameMismatched: ignore
  pdbDisruptionsIsZero: warning
-  missingPodDisruptionBudget: warning
-  topologySpreadConstraint: warning
-  hpaMaxAvailability: warning
-  hpaMinAvailability: warning
-  pdbMinAvailableGreaterThanHPAMinReplicas: warning
+  missingPodDisruptionBudget: ignore

  # efficiency
  cpuRequestsMissing: warning
  cpuLimitsMissing: warning
  memoryRequestsMissing: warning
  memoryLimitsMissing: warning
-  
  # security
-  automountServiceAccountToken: warning
  hostIPCSet: danger
-  hostPathSet: warning
-  hostProcess: warning
  hostPIDSet: danger
-  linuxHardening: warning
-  missingNetworkPolicy: warning
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
-  procMount: warning
  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
@@ -38,70 +27,11 @@ checks:
  hostNetworkSet: danger
  hostPortSet: warning
  tlsSettingsMissing: warning
-  gatewayTLSMissing: warning
-  gatewayAllowedRoutesAll: warning
-  gatewayInsecureFrontendValidation: warning
-  gatewayCrossNamespaceCertificateRef: warning
-  httpRouteWildcardOrEmptyHost: warning
-  httpRouteInsecureListener: warning
-  httpRouteCrossNamespaceBackendRef: warning
-  httpRouteBackendTLSMissing: warning
-  kgatewayBackendTLSVerificationDisabled: warning
-  sensitiveContainerEnvVar: danger
-  sensitiveConfigmapContent: danger
-  clusterrolePodExecAttach: danger
-  rolePodExecAttach: danger
-  clusterrolebindingPodExecAttach: danger
-  rolebindingClusterRolePodExecAttach: danger
-  rolebindingRolePodExecAttach: danger
-  clusterrolebindingClusterAdmin: danger
-  rolebindingClusterAdminClusterRole: danger
-  rolebindingClusterAdminRole: danger
-

 mutations:
  - pullPolicyNotAlways

 exemptions:
-  - namespace: kube-system
-    controllerNames:
-      - dns-controller
-      - ebs-csi-controller
-      - ebs-csi-node
-      - kindnet
-      - kops-controller
-      - kube-dns
-      - kube-flannel-ds
-      - kube-proxy
-      - kube-scheduler
-      - vpa-recommender
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-  - namespace: kube-system
-    controllerNames:
-      - coredns
-    rules:
-      - automountServiceAccountToken
-      - missingNetworkPolicy
-  - namespace: kube-system
-    controllerNames:
-      - ebs-csi-controller
-    rules:
-      - sensitiveContainerEnvVar
-  - namespace: kube-system
-    controllerNames:
-      - coredns-autoscaler
-    rules:
-      - linuxHardening
-  - namespace: local-path-storage
-    controllerNames:
-      - local-path-provisioner
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
  - namespace: kube-system
    controllerNames:
      - kube-apiserver
@@ -124,48 +54,7 @@ exemptions:
      - runAsPrivileged
      - notReadOnlyRootFilesystem
      - hostPIDSet
-  - namespace: datadog
-    controllerNames:
-      - datadogtoken
-    rules:
-      - sensitiveConfigmapContent
-  - namespace: datadog
-    controllerNames:
-      - datadog-cluster-agent-apiserver
-    rules:
-      - rolebindingClusterAdminRole
-      - rolebindingRolePodExecAttach

-  - controllerNames:
-      - ingress-nginx-controller
-    rules:
-      - sensitiveConfigmapContent
-  - controllerNames:
-      - ingress-nginx-controller
-      - ingress-nginx-default-backend
-      - polaris
-      - rbac-manager
-    rules:
-      - automountServiceAccountToken
-      - missingNetworkPolicy
-  - controllerNames:
-      - aws-iam-authenticator
-      - aws-load-balancer-controller
-      - docker-registry
-      - external-dns
-      - kube2iam
-      - metrics-server
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-  - controllerNames:
-      - oauth2-proxy
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-      - sensitiveContainerEnvVar
  - controllerNames:
      - kube-flannel-ds
    rules:
@@ -183,9 +72,6 @@ exemptions:
      - runAsRootAllowed
      - readinessProbeMissing
      - livenessProbeMissing
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy

  - controllerNames:
      - cluster-autoscaler
@@ -193,9 +79,6 @@ exemptions:
      - notReadOnlyRootFilesystem
      - runAsRootAllowed
      - readinessProbeMissing
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy

  - controllerNames:
      - vpa
@@ -212,10 +95,6 @@ exemptions:
      - readinessProbeMissing
      - livenessProbeMissing
      - notReadOnlyRootFilesystem
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-      - sensitiveContainerEnvVar

  - controllerNames:
      - nginx-ingress-controller
@@ -4,4 +4,4 @@ options:

 images:
  docker:
-  - us-docker.pkg.dev/fairwinds-ops/oss/polaris:$CI_SHA1
+  - quay.io/fairwinds/polaris:$CI_SHA1
@@ -1,86 +1,93 @@
 module github.com/fairwindsops/polaris

-go 1.26.2
+go 1.17

 require (
-	github.com/fairwindsops/controller-utils v0.3.4
-	github.com/fatih/color v1.19.0
-	github.com/gorilla/mux v1.8.1
-	github.com/pkg/errors v0.9.1
-	github.com/qri-io/jsonpointer v0.1.1
-	github.com/qri-io/jsonschema v0.2.1
-	github.com/sirupsen/logrus v1.10.1
-	github.com/spf13/cobra v1.10.2
-	github.com/stretchr/testify v1.12.1
-	github.com/thoas/go-funk v0.9.3
-	gomodules.xyz/jsonpatch/v2 v2.5.0
+	github.com/evanphx/json-patch/v5 v5.6.0
+	github.com/fatih/color v1.13.0
+	github.com/gobuffalo/packr/v2 v2.8.3
+	github.com/gorilla/mux v1.8.0
+	github.com/qri-io/jsonschema v0.1.1
+	github.com/sirupsen/logrus v1.8.1
+	github.com/spf13/cobra v1.5.0
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.8.0
+	github.com/thoas/go-funk v0.9.2
+	golang.org/x/text v0.3.7 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.36.4
-	k8s.io/apimachinery v0.36.4
-	k8s.io/client-go v0.36.4
-	sigs.k8s.io/controller-runtime v0.24.1
-	sigs.k8s.io/yaml v1.6.0
+	k8s.io/api v0.24.3
+	k8s.io/apimachinery v0.24.3
+	k8s.io/client-go v0.24.1
+	sigs.k8s.io/controller-runtime v0.12.1
+	sigs.k8s.io/yaml v1.3.0
 )

+require gomodules.xyz/jsonpatch/v2 v2.2.0
+
 require (
+	cloud.google.com/go/compute v1.6.1 // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.1 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
-	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.22.5 // indirect
-	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/swag v0.25.5 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
-	github.com/go-openapi/swag/conv v0.25.5 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
-	github.com/go-openapi/swag/loading v0.25.5 // indirect
-	github.com/go-openapi/swag/mangling v0.25.5 // indirect
-	github.com/go-openapi/swag/netutils v0.25.5 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
-	github.com/google/gnostic-models v0.7.1 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.8.0 // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
+	github.com/go-openapi/swag v0.21.1 // indirect
+	github.com/gobuffalo/logger v1.0.6 // indirect
+	github.com/gobuffalo/packd v1.0.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.4.1 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/gnostic v0.6.9 // indirect
+	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/karrick/godirwalk v1.17.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/markbates/errx v1.1.0 // indirect
+	github.com/markbates/oncer v1.0.0 // indirect
+	github.com/markbates/safe v1.0.1 // indirect
+	github.com/mattn/go-colorable v0.1.12 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
-	github.com/samber/lo v1.53.0 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.39.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.12.2 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.34.0 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/qri-io/jsonpointer v0.1.1 // indirect
+	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
+	golang.org/x/net v0.0.0-20220607020251-c690dde0001d // indirect
+	golang.org/x/oauth2 v0.0.0-20220524215830-622c5d57e401 // indirect
+	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
+	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 // indirect
+	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apiextensions-apiserver v0.36.0 // indirect
-	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
-	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
-	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
+	k8s.io/component-base v0.24.1 // indirect
+	k8s.io/klog/v2 v2.60.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20220603121420-31174f50af60 // indirect
+	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
+	sigs.k8s.io/json v0.0.0-20220525155127-227cbc7cc124 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 )
@@ -15,13 +15,14 @@
 package config

 import (
-	"embed"
-	"fmt"
-
+	"github.com/gobuffalo/packr/v2"
 	"github.com/sirupsen/logrus"
 )

 var (
+	// BuiltInChecks contains the checks that come pre-installed w/ Polaris
+	BuiltInChecks = map[string]SchemaCheck{}
+	schemaBox     = (*packr.Box)(nil)
 	// We explicitly set the order to avoid thrash in the
 	// tests as we migrate toward JSON schema
 	checkOrder = []string{
@@ -29,14 +30,10 @@ var (
 		"deploymentMissingReplicas",
 		// Pod checks
 		"hostIPCSet",
-		"hostPathSet",
-		"hostProcess",
 		"hostPIDSet",
 		"hostNetworkSet",
 		"automountServiceAccountToken",
-		"topologySpreadConstraint",
 		// Container checks
-		"procMount",
 		"memoryLimitsMissing",
 		"memoryRequestsMissing",
 		"cpuLimitsMissing",
@@ -57,43 +54,18 @@ var (
 		"sensitiveContainerEnvVar",
 		// Other checks
 		"tlsSettingsMissing",
-		"gatewayTLSMissing",
-		"gatewayAllowedRoutesAll",
-		"gatewayInsecureFrontendValidation",
-		"gatewayCrossNamespaceCertificateRef",
-		"httpRouteWildcardOrEmptyHost",
-		"httpRouteInsecureListener",
-		"httpRouteCrossNamespaceBackendRef",
-		"httpRouteBackendTLSMissing",
-		"kgatewayBackendTLSVerificationDisabled",
 		"pdbDisruptionsIsZero",
-		"metadataAndInstanceMismatched",
+		"metadataAndNameMismatched",
 		"missingPodDisruptionBudget",
 		"missingNetworkPolicy",
 		"sensitiveConfigmapContent",
-		"clusterrolePodExecAttach",
-		"rolePodExecAttach",
-		"clusterrolebindingPodExecAttach",
-		"rolebindingClusterRolePodExecAttach",
-		"rolebindingRolePodExecAttach",
-		"clusterrolebindingClusterAdmin",
-		"rolebindingClusterAdminClusterRole",
-		"rolebindingClusterAdminRole",
-		"hpaMaxAvailability",
-		"hpaMinAvailability",
-		"pdbMinAvailableGreaterThanHPAMinReplicas",
 	}
-
-	// BuiltInChecks contains the checks that come pre-installed w/ Polaris
-	BuiltInChecks = map[string]SchemaCheck{}
-
-	//go:embed all:checks
-	checksFS embed.FS
 )

 func init() {
+	schemaBox = packr.New("Schemas", "../../checks")
 	for _, checkID := range checkOrder {
-		contents, err := checksFS.ReadFile(fmt.Sprintf("checks/%s.yaml", checkID))
+		contents, err := schemaBox.Find(checkID + ".yaml")
 		if err != nil {
 			panic(err)
 		}
@@ -1,54 +0,0 @@
-successMessage: The ClusterRole does not allow pods/exec or pods/attach
-failureMessage: The ClusterRole allows Pods/exec or pods/attach
-category: Security
-target: rbac.authorization.k8s.io/ClusterRole
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  required: ["metadata", "rules"]
-  anyOf:
-    # Do not alert on default ClusterRoles.
-    - properties:
-        metadata:
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - const: 'admin'
-                - const: "cluster-admin"
-                - const: "edit"
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - properties:
-        rules:
-          type: array
-          items:
-            type: object
-            not:
-              required: ["apiGroups", "resources", "verbs"]
-              properties:
-                apiGroups:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: ""
-                      - const: '*'
-                resources:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: '*'
-                      - const: "pods/exec"
-                      - const: "pods/attach"
-                verbs:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: '*'
-                      # An exec is also possible by `get`ing a web socket.
-                      - const: 'get'
-                      - const: 'create'
@@ -1,90 +0,0 @@
-successMessage: The ClusterRoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
-failureMessage: The ClusterRoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
-category: Security
-target: rbac.authorization.k8s.io/ClusterRoleBinding
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  anyOf:
-    # Do not alert on default ClusterRoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - const: "cluster-admin"
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "ClusterRole"
-            name:
-              type: string
-              minLength: 1
-              not:
-                const: "cluster-admin"
-additionalSchemaStrings:
-  rbac.authorization.k8s.io/ClusterRole: |
-    {{ if (ne .roleRef.name "view") }}
-    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # Do not alert on default ClusterRoleBindings.
-    type: object
-    required: ["metadata", "rules"]
-    allOf:
-      - properties:
-          metadata:
-            required: ["name"]
-            properties:
-              name:
-                type: string
-                const: "{{ .roleRef.name }}"
-      - properties:
-          rules:
-            type: array
-            items:
-              type: object
-              not:
-                required: ["apiGroups", "resources", "verbs"]
-                properties:
-                  apiGroups:
-                    type: array
-                    contains:
-                      type: string
-                      const: "*"
-                  resources:
-                    type: array
-                    contains:
-                      type: string
-                      const: '*'
-                  verbs:
-                    type: array
-                    uniqueItems: true
-                    oneOf:
-                      - contains:
-                          type: string
-                          const: '*'
-                      - minItems: 7
-                        items:
-                          type: string
-                          enum:
-                            - "get"
-                            - "list"
-                            - "watch"
-                            - "create"
-                            - "update"
-                            - "patch"
-                            - "delete"
-    {{ end }}
-    {{ end }}
@@ -1,84 +0,0 @@
-successMessage: The ClusterRoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
-failureMessage: The ClusterRoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
-category: Security
-target: rbac.authorization.k8s.io/ClusterRoleBinding
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  anyOf:
-    # Do not alert on default ClusterRoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - const: "cluster-admin"
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "ClusterRole"
-            name:
-              type: string
-              minLength: 1
-additionalSchemaStrings:
-  rbac.authorization.k8s.io/ClusterRole: |
-    type: object
-    # Do not alert on default ClusterRoleBindings.
-    {{ if (ne .roleRef.name "view") }}
-    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    required: ["metadata", "rules"]
-    allOf:
-      - properties:
-          metadata:
-            required: ["name"]
-            properties:
-              name:
-                type: string
-                const: "{{ .roleRef.name }}"
-      - properties:
-          rules:
-            type: array
-            items:
-              type: object
-              not:
-                required: ["apiGroups", "resources", "verbs"]
-                properties:
-                  apiGroups:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: ""
-                        - const: '*'
-                  resources:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: '*'
-                        - const: "pods/exec"
-                        - const: "pods/attach"
-                  verbs:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: '*'
-                        # An exec is also possible by `get`ing a web socket.
-                        - const: 'get'
-                        - const: 'create'
-    {{ end }}
-    {{ end }}
@@ -1,25 +0,0 @@
-successMessage: Gateway listeners restrict route attachment by namespace
-failureMessage: Gateway listeners should not allow routes from all namespaces
-category: Security
-target: gateway.networking.k8s.io/Gateway
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    spec:
-      type: object
-      properties:
-        listeners:
-          type: array
-          items:
-            type: object
-            properties:
-              allowedRoutes:
-                type: object
-                properties:
-                  namespaces:
-                    type: object
-                    properties:
-                      from:
-                        not:
-                          const: All
@@ -1,6 +0,0 @@
-successMessage: Gateway cross-namespace certificate references are authorized
-failureMessage: Gateway cross-namespace certificate references should have a matching ReferenceGrant
-category: Security
-target: gateway.networking.k8s.io/Gateway
-relatedKinds:
-  - gateway.networking.k8s.io/ReferenceGrant
@@ -1,40 +0,0 @@
-successMessage: Gateway frontend client certificate validation fails closed
-failureMessage: Gateway frontend client certificate validation should not allow insecure fallback
-category: Security
-target: gateway.networking.k8s.io/Gateway
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    spec:
-      type: object
-      properties:
-        tls:
-          type: object
-          properties:
-            frontend:
-              type: object
-              properties:
-                default:
-                  type: object
-                  properties:
-                    validation:
-                      type: object
-                      properties:
-                        mode:
-                          not:
-                            const: AllowInsecureFallback
-                perPort:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      tls:
-                        type: object
-                        properties:
-                          validation:
-                            type: object
-                            properties:
-                              mode:
-                                not:
-                                  const: AllowInsecureFallback
@@ -1,41 +0,0 @@
-successMessage: Gateway TLS listeners have certificates configured
-failureMessage: Gateway HTTPS, GRPC, and terminating TLS listeners should configure certificateRefs
-category: Security
-target: gateway.networking.k8s.io/Gateway
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    spec:
-      type: object
-      properties:
-        listeners:
-          type: array
-          items:
-            type: object
-            if:
-              anyOf:
-              - required: [protocol]
-                properties:
-                  protocol:
-                    enum: [HTTPS, GRPC]
-              - required: [protocol]
-                properties:
-                  protocol:
-                    const: TLS
-                  tls:
-                    type: object
-                    properties:
-                      mode:
-                        not:
-                          const: Passthrough
-            then:
-              required: [tls]
-              properties:
-                tls:
-                  type: object
-                  required: [certificateRefs]
-                  properties:
-                    certificateRefs:
-                      type: array
-                      minItems: 1
@@ -1,16 +0,0 @@
-successMessage: HostPath volumes are not configured
-failureMessage: HostPath volumes must be forbidden
-category: Security
-target: PodSpec
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    volumes:
-      type: array
-      items:
-        type: object
-        properties:
-          hostPath:
-            type: string
-            const: ''
@@ -1,31 +0,0 @@
-successMessage: Privileged access to the host check is valid
-failureMessage: Privileged access to the host is disallowed
-category: Security
-target: PodSpec
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    containers:
-      type: array
-      items:
-        type: object
-        properties:
-          securityContext:
-            type: object
-            properties:
-              windowsOptions:
-                type: object
-                properties:
-                  hostProcess:
-                    type: boolean
-                    const: false
-    securityContext:
-      type: object
-      properties:
-        windowsOptions:
-          type: object
-          properties:
-            hostProcess:
-              type: boolean
-              const: false                
@@ -1,35 +0,0 @@
-successMessage: HPA has a valid max and min replica configuration
-failureMessage: HPA maxReplicas and minReplicas should be different 
-category: Reliability
-target: autoscaling/HorizontalPodAutoscaler
-schemaString: |
-  "$schema": https://json-schema.org/draft/2019-09/schema#
-  type: object
-  properties:
-    spec:
-      type: object
-      properties:
-        minReplicas:
-          type: integer
-          minimum: 1
-        maxReplicas:
-          type: integer
-          minimum: 1
-      required:
-      - maxReplicas
-      {{- if .spec.minReplicas }}
-      if:
-        properties:
-          minReplicas:
-            type: integer
-          maxReplicas:
-            type: integer
-      then:
-        properties:
-          maxReplicas:
-            exclusiveMinimum: {{ .spec.minReplicas }}
-      else:
-        properties:
-          maxReplicas:
-            minimum: 1
-      {{- end }}
@@ -1,14 +0,0 @@
-successMessage: HPA has a valid min replica configuration
-failureMessage: HPA minReplicas should be 2 or more
-category: Reliability
-target: autoscaling/HorizontalPodAutoscaler
-schema:
-  "$schema": https://json-schema.org/draft/2019-09/schema#
-  type: object
-  properties:
-    spec:
-      type: object
-      properties:
-        minReplicas:
-          type: integer
-          minimum: 2
@@ -1,9 +0,0 @@
-successMessage: HTTPRoute TLS backends have TLS origination configured
-failureMessage: HTTPRoute backends on TLS ports should have a BackendTLSPolicy or kgateway BackendConfigPolicy
-category: Security
-target: gateway.networking.k8s.io/HTTPRoute
-relatedKinds:
-  - Service
-  - gateway.networking.k8s.io/BackendTLSPolicy
-  - gateway.kgateway.dev/Backend
-  - gateway.kgateway.dev/BackendConfigPolicy
@@ -1,6 +0,0 @@
-successMessage: HTTPRoute cross-namespace backend references are authorized
-failureMessage: HTTPRoute cross-namespace backend references should have a matching ReferenceGrant
-category: Security
-target: gateway.networking.k8s.io/HTTPRoute
-relatedKinds:
-  - gateway.networking.k8s.io/ReferenceGrant
@@ -1,6 +0,0 @@
-successMessage: HTTPRoute uses secure listeners or redirects HTTP to HTTPS
-failureMessage: HTTPRoute should not serve application traffic over an HTTP listener
-category: Security
-target: gateway.networking.k8s.io/HTTPRoute
-relatedKinds:
-  - gateway.networking.k8s.io/Gateway
@@ -1,19 +0,0 @@
-successMessage: HTTPRoute uses explicit hostnames
-failureMessage: HTTPRoute should use explicit hostnames instead of matching every hostname
-category: Security
-target: gateway.networking.k8s.io/HTTPRoute
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  required: [spec]
-  properties:
-    spec:
-      type: object
-      required: [hostnames]
-      properties:
-        hostnames:
-          type: array
-          minItems: 1
-          items:
-            type: string
-            pattern: '^[^*]+$'
@@ -1,17 +0,0 @@
-successMessage: kgateway backend TLS certificate verification is enabled
-failureMessage: kgateway BackendConfigPolicy should not disable TLS certificate verification
-category: Security
-target: gateway.kgateway.dev/BackendConfigPolicy
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    spec:
-      type: object
-      properties:
-        tls:
-          type: object
-          properties:
-            insecureSkipVerify:
-              not:
-                const: true
@@ -1,18 +0,0 @@
-successMessage: Label app.kubernetes.io/instance matches metadata.name
-failureMessage: Label app.kubernetes.io/instance must match metadata.name
-category: Reliability
-target: Controller
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    metadata:
-      type: object
-      required: ["labels"]
-      properties:
-        labels:
-          type: object
-          required: ["app.kubernetes.io/instance"]
-          properties:
-            app.kubernetes.io/instance:
-              const: "{{ .metadata.name }}"
@@ -1,7 +0,0 @@
-successMessage: PDB and HPA are correctly configured
-failureMessage: PDB minAvailable is greater than HPA minReplicas
-category: Reliability
-target: Controller
-controllers:
-  include:
-    - Deployment
@@ -1,19 +0,0 @@
-successMessage: The default /proc masks are set up to reduce attack surface, and should be required
-failureMessage: Proc mount must not be changed from the default
-category: Security
-target: PodSpec
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    containers:
-      type: array
-      items:
-        type: object
-        properties:
-          securityContext:
-            type: object
-            properties:
-              procMount:
-                type: string
-                const: Default
@@ -1,56 +0,0 @@
-successMessage: The Role does not allow pods/exec or pods/attach
-failureMessage: The Role allows Pods/exec or pods/attach
-category: Security
-target: rbac.authorization.k8s.io/Role
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  required: ["metadata", "rules"]
-  anyOf:
-    # Do not alert on default Roles.
-    - properties:
-        metadata:
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - properties:
-        metadata:
-          required: ["name"]
-          properties:
-            name:
-              type: string
-        rules:
-          type: array
-          items:
-            type: object
-            not:
-              required: ["apiGroups", "resources", "verbs"]
-              properties:
-                apiGroups:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: ""
-                      - const: '*'
-                resources:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: '*'
-                      - const: "pods/exec"
-                      - const: "pods/attach"
-                verbs:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: '*'
-                      # An exec is also possible by `get`ing a web socket.
-                      - const: 'get'
-                      - const: 'create'
@@ -1,98 +0,0 @@
-successMessage: The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
-failureMessage: The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
-category: Security
-target: rbac.authorization.k8s.io/RoleBinding
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  anyOf:
-    # Pass RoleBindings that point to a Role.
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["kind"]
-          properties:
-            kind:
-              type: string
-              const: "Role"
-    # Do not alert on default ClusterRoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "ClusterRole"
-            name:
-              type: string
-              minLength: 1
-              not:
-                const: "cluster-admin"
-additionalSchemaStrings:
-  rbac.authorization.k8s.io/ClusterRole: |
-    {{ if eq .roleRef.kind "ClusterRole" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
-    required: ["metadata", "rules"]
-    allOf:
-      - properties:
-          metadata:
-            required: ["name"]
-            properties:
-              name:
-                type: string
-                const: "{{ .roleRef.name }}"
-      - properties:
-          rules:
-            type: array
-            items:
-              type: object
-              not:
-                required: ["apiGroups", "resources", "verbs"]
-                properties:
-                  apiGroups:
-                    type: array
-                    contains:
-                      type: string
-                      const: "*"
-                  resources:
-                    type: array
-                    contains:
-                      type: string
-                      const: '*'
-                  verbs:
-                    type: array
-                    uniqueItems: true
-                    oneOf:
-                      - contains:
-                          type: string
-                          const: '*'
-                      - minItems: 7
-                        items:
-                          type: string
-                          enum:
-                            - "get"
-                            - "list"
-                            - "watch"
-                            - "create"
-                            - "update"
-                            - "patch"
-                            - "delete"
-    {{ end }}
-    {{ end }}
@@ -1,96 +0,0 @@
-successMessage: The RoleBinding does not reference a Role with wildcard permissions
-failureMessage: The RoleBinding references a Role with wildcard permissions
-category: Security
-target: rbac.authorization.k8s.io/RoleBinding
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  anyOf:
-    # Pass RoleBindings that point to a ClusterRole.
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["kind"]
-          properties:
-            kind:
-              type: string
-              const: "ClusterRole"
-    # Do not alert on default RoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "Role"
-            name:
-              type: string
-              minLength: 1
-additionalSchemaStrings:
-  rbac.authorization.k8s.io/Role: |
-    type: object
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    {{ if eq .roleRef.kind "Role" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    required: ["metadata", "rules"]
-    allOf:
-      - properties:
-          metadata:
-            required: ["name"]
-            properties:
-              name:
-                type: string
-                const: "{{ .roleRef.name }}"
-      - properties:
-          rules:
-            type: array
-            items:
-              type: object
-              not:
-                required: ["apiGroups", "resources", "verbs"]
-                properties:
-                  apiGroups:
-                    type: array
-                    contains:
-                      type: string
-                      const: "*"
-                  resources:
-                    type: array
-                    contains:
-                      type: string
-                      const: '*'
-                  verbs:
-                    type: array
-                    uniqueItems: true
-                    oneOf:
-                      - contains:
-                          type: string
-                          const: '*'
-                      - minItems: 7
-                        items:
-                          type: string
-                          enum:
-                            - "get"
-                            - "list"
-                            - "watch"
-                            - "create"
-                            - "update"
-                            - "patch"
-                            - "delete"
-    {{ end }}
-    {{ end }}
@@ -1,92 +0,0 @@
-successMessage: The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
-failureMessage: The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
-category: Security
-target: rbac.authorization.k8s.io/RoleBinding
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  anyOf:
-    # Pass RoleBindings that point to a Role.
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["kind"]
-          properties:
-            kind:
-              type: string
-              const: "Role"
-    # Do not alert on default RoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "ClusterRole"
-            name:
-              type: string
-              minLength: 1
-additionalSchemaStrings:
-  rbac.authorization.k8s.io/ClusterRole: |
-    {{ if eq .roleRef.kind "ClusterRole" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
-    required: ["metadata", "rules"]
-    allOf:
-      - properties:
-          metadata:
-            required: ["name"]
-            properties:
-              name:
-                type: string
-                const: "{{ .roleRef.name }}"
-      - properties:
-          rules:
-            type: array
-            items:
-              type: object
-              not:
-                required: ["apiGroups", "resources", "verbs"]
-                properties:
-                  apiGroups:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: ""
-                        - const: '*'
-                  resources:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: '*'
-                        - const: "pods/exec"
-                        - const: "pods/attach"
-                  verbs:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: '*'
-                        # An exec is also possible by `get`ing a web socket.
-                        - const: 'get'
-                        - const: 'create'
-    {{ end }}
-    {{ end }}
@@ -1,95 +0,0 @@
-successMessage: The RoleBinding does not reference a Role allowing Pod exec or attach
-failureMessage: The RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist
-category: Security
-target: rbac.authorization.k8s.io/RoleBinding
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  anyOf:
-    # Pass RoleBindings that point to a ClusterRole.
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "ClusterRole"
-    # Do not alert on default RoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - required: ["roleRef"]
-      properties:
-        roleRef:
-          required: ["apiGroup", "kind", "name"]
-          properties:
-            apiGroup:
-              type: string
-              const: "rbac.authorization.k8s.io"
-            kind:
-              type: string
-              const: "Role"
-            name:
-              type: string
-              minLength: 1
-additionalSchemaStrings:
-  rbac.authorization.k8s.io/Role: |
-    {{ if eq .roleRef.kind "Role" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
-    # This schema is validated for all roleBindings, regardless of their roleRef.
-    type: object
-    required: ["metadata", "rules"]
-    allOf:
-      - properties:
-          metadata:
-            required: ["name"]
-            properties:
-              name:
-                type: string
-                const: "{{ .roleRef.name }}"
-      - properties:
-          rules:
-            type: array
-            items:
-              type: object
-              not:
-                required: ["apiGroups", "resources", "verbs"]
-                properties:
-                  apiGroups:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: ""
-                        - const: '*'
-                  resources:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: '*'
-                        - const: "pods/exec"
-                        - const: "pods/attach"
-                  verbs:
-                    type: array
-                    contains:
-                      type: string
-                      anyOf:
-                        - const: '*'
-                        # An exec is also possible by `get`ing a web socket.
-                        - const: 'get'
-                        - const: 'create'
-    {{ end }}
-    {{ end }}
@@ -1,52 +0,0 @@
-successMessage: The container does not set potentially sensitive environment variables
-failureMessage: The container sets potentially sensitive environment variables
-category: Security
-target: Container
-schemaString: |
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  properties:
-    env:
-      type: array
-      items:
-        type: object
-        anyOf:
-          - not:
-              required: ["value"]
-          - required: ["name", "value"]
-            properties:
-              name:
-                type: string
-                '$comment': These environment variable names will be disallowed.
-                allOf:
-                  - not:
-                      pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
-                  - not:
-                      pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
-                  - not:
-                      pattern: '(?i)^AZURE_.+KEY$'
-                  - not:
-                      pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
-                  - not:
-                      pattern: '(?i)password'
-                  - not:
-                      pattern: '(?i)token'
-                  - not:
-                      pattern: '(?i)bearer'
-                  - not:
-                      pattern: '(?i)secret'
-                    '$comment': This allows variable names not excluded above.
-                  - pattern: '(?i).*'
-              value:
-                type: string
-                '$comment': These environment variable values will be disallowed.
-                allOf:
-                - not:
-                    '$comment': THis matches variations like begin private key, begin rsa private key ...
-                    pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'
-          - required: ["name", "valueFrom"]
-            properties:
-              name:
-                type: string
-              valueFrom:
-                type: object
@@ -1,17 +0,0 @@
-successMessage: Pod has a valid topology spread constraint
-failureMessage: Pod should be configured with a valid topology spread constraint
-category: Reliability
-target: PodSpec
-controllers:
-  exclude:
-  - Job
-  - CronJob
-schema:
-  '$schema': https://json-schema.org/draft/2019-09/schema
-  type: object
-  required:
-    - topologySpreadConstraints
-  properties:
-    topologySpreadConstraints:
-      type: array
-      minItems: 1
@@ -1,16 +0,0 @@
-package config
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestRequiredFieldsOnBuiltInChecks(t *testing.T) {
-	for _, v := range BuiltInChecks {
-		assert.NotEmpty(t, v.SuccessMessage)
-		assert.NotEmpty(t, v.FailureMessage)
-		assert.NotEmpty(t, v.Category)
-		assert.NotEmpty(t, v.Target)
-	}
-}
@@ -16,14 +16,14 @@ package config

 import (
 	"bytes"
-	_ "embed"
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
-	"os"
 	"strings"

+	"github.com/gobuffalo/packr/v2"
 	"k8s.io/apimachinery/pkg/util/yaml"
 )

@@ -49,55 +49,38 @@ type Exemption struct {
 	Namespace       string   `json:"namespace"`
 }

-//go:embed default.yaml
-var defaultConfig []byte
+var configBox = (*packr.Box)(nil)

-// MergeConfigAndParseFile parses config from a file.
-func MergeConfigAndParseFile(customConfigPath string, mergeConfig bool) (Configuration, error) {
-	rawBytes, err := mergeConfigFile(customConfigPath, mergeConfig)
+func getConfigBox() *packr.Box {
+	if configBox == (*packr.Box)(nil) {
+		configBox = packr.New("Config", "../../examples")
+	}
+	return configBox
+}
+
+// ParseFile parses config from a file.
+func ParseFile(path string) (Configuration, error) {
+	var rawBytes []byte
+	var err error
+	if path == "" {
+		rawBytes, err = getConfigBox().Find("config.yaml")
+	} else if strings.HasPrefix(path, "https://") || strings.HasPrefix(path, "http://") {
+		// path is a url
+		response, err2 := http.Get(path)
+		if err2 != nil {
+			return Configuration{}, err2
+		}
+		rawBytes, err = ioutil.ReadAll(response.Body)
+	} else {
+		// path is local
+		rawBytes, err = ioutil.ReadFile(path)
+	}
 	if err != nil {
 		return Configuration{}, err
 	}
-
 	return Parse(rawBytes)
 }

-func mergeConfigFile(customConfigPath string, mergeConfig bool) ([]byte, error) {
-	if customConfigPath == "" {
-		return defaultConfig, nil
-	}
-
-	var customConfigContent []byte
-	var err error
-	if strings.HasPrefix(customConfigPath, "https://") || strings.HasPrefix(customConfigPath, "http://") {
-		// path is a url
-		response, err := http.Get(customConfigPath)
-		if err != nil {
-			return nil, err
-		}
-		customConfigContent, err = io.ReadAll(response.Body)
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		// path is local
-		customConfigContent, err = os.ReadFile(customConfigPath)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if mergeConfig {
-		mergedConfig, err := mergeYaml(defaultConfig, customConfigContent)
-		if err != nil {
-			return nil, err
-		}
-		return mergedConfig, nil
-	}
-
-	return customConfigContent, nil
-}
-
 // Parse parses config from a byte array.
 func Parse(rawBytes []byte) (Configuration, error) {
 	reader := bytes.NewReader(rawBytes)
@@ -108,7 +91,7 @@ func Parse(rawBytes []byte) (Configuration, error) {
 			if err == io.EOF {
 				break
 			}
-			return conf, fmt.Errorf("decoding config failed: %v", err)
+			return conf, fmt.Errorf("Decoding config failed: %v", err)
 		}
 	}
 	for key, check := range conf.CustomChecks {
@@ -127,7 +110,7 @@ func Parse(rawBytes []byte) (Configuration, error) {
 // Validate checks if a config is valid
 func (conf Configuration) Validate() error {
 	if len(conf.Checks) == 0 {
-		return errors.New("no checks were enabled")
+		return errors.New("No checks were enabled")
 	}
 	return nil
 }
@@ -52,7 +52,7 @@ customChecks:
    category: Security
    target: Container
    schema:
-      '$schema': https://json-schema.org/draft/2019-09/schema
+      '$schema': http://json-schema.org/draft-07/schema
      type: object
      required:
      - securityContext
@@ -69,7 +69,7 @@ customChecks:
    target: Container
    jsonSchema: >
      {
-        "$schema": "https://json-schema.org/draft/2019-09/schema",
+        "$schema": "http://json-schema.org/draft-07/schema",
        "type": "object",
        "required": ["securityContext"]
      }
@@ -83,7 +83,7 @@ customChecks:
    category: Security
    target: Container
    schema:
-      '$schema': https://json-schema.org/draft/2019-09/schema
+      '$schema': http://json-schema.org/draft-07/schema
      type: object
      required:
      - securityContext
@@ -92,7 +92,7 @@ customChecks:

 func TestParseError(t *testing.T) {
 	_, err := Parse([]byte(confInvalid))
-	expectedErr := "decoding config failed: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go value of type config.Configuration"
+	expectedErr := "Decoding config failed: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go value of type config.Configuration"
 	assert.EqualError(t, err, expectedErr)
 }

@@ -115,9 +115,7 @@ func TestConfigFromURL(t *testing.T) {
 	var parsedConf Configuration
 	srv := &http.Server{Addr: ":8081"}
 	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		if _, err := io.WriteString(w, confValidYAML); err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
+		io.WriteString(w, confValidYAML)
 	})

 	go func() {
@@ -127,7 +125,7 @@ func TestConfigFromURL(t *testing.T) {
 	}()
 	time.Sleep(time.Second)

-	parsedConf, err = MergeConfigAndParseFile("http://localhost:8081/exampleURL", false)
+	parsedConf, err = ParseFile("http://localhost:8081/exampleURL")
 	assert.NoError(t, err, "Expected no error when parsing YAML from URL")
 	if err := srv.Shutdown(context.TODO()); err != nil {
 		panic(err)
@@ -138,42 +136,41 @@ func TestConfigFromURL(t *testing.T) {

 func TestConfigNoServerError(t *testing.T) {
 	var err error
-	_, err = MergeConfigAndParseFile("http://localhost:8081/exampleURL", false)
+	_, err = ParseFile("http://localhost:8081/exampleURL")
 	assert.Error(t, err)
 	assert.Regexp(t, regexp.MustCompile("connection refused"), err.Error())
 }

 func TestConfigWithCustomChecks(t *testing.T) {
-	valid := map[string]any{
-		"securityContext": map[string]any{
+	valid := map[string]interface{}{
+		"securityContext": map[string]interface{}{
 			"foo": "bar",
 		},
 	}
-	invalid := map[string]any{
-		"notSecurityContext": map[string]any{},
+	invalid := map[string]interface{}{
+		"notSecurityContext": map[string]interface{}{},
 	}

 	parsedConf, err := Parse([]byte(confCustomChecks))
 	assert.NoError(t, err, "Expected no error when parsing YAML config")
 	assert.Equal(t, 1, len(parsedConf.CustomChecks))
-	check, err := parsedConf.CustomChecks["foo"].TemplateForResource(map[string]any{})
-	assert.NoError(t, err)
-	isValid, _, err := check.CheckObject(context.TODO(), valid)
+	check, err := parsedConf.CustomChecks["foo"].TemplateForResource(map[string]interface{}{})
+	isValid, _, err := check.CheckObject(valid)
 	assert.NoError(t, err)
 	assert.Equal(t, true, isValid)
-	isValid, _, err = check.CheckObject(context.TODO(), invalid)
+	isValid, _, err = check.CheckObject(invalid)
 	assert.NoError(t, err)
 	assert.Equal(t, false, isValid)

 	parsedConf, err = Parse([]byte(confCustomChecksWithJSONSchema))
 	assert.NoError(t, err, "Expected no error when parsing YAML config")
 	assert.Equal(t, 1, len(parsedConf.CustomChecks))
-	isValid, problems, err := parsedConf.CustomChecks["foo"].CheckObject(context.TODO(), valid)
+	isValid, problems, err := parsedConf.CustomChecks["foo"].CheckObject(valid)
 	assert.NoError(t, err)
 	if !assert.Equal(t, true, isValid) {
 		fmt.Println(problems[0].PropertyPath, problems[0].InvalidValue, problems[0].Message)
 	}
-	isValid, _, err = check.CheckObject(context.TODO(), invalid)
+	isValid, _, err = check.CheckObject(invalid)
 	assert.NoError(t, err)
 	assert.Equal(t, false, isValid)
 }
@@ -1,45 +0,0 @@
-package config
-
-import (
-	"gopkg.in/yaml.v3" // do not change the yaml import
-)
-
-func mergeYaml(defaultConfig, overridesConfig []byte) ([]byte, error) {
-	var defaultData, overrideConfig map[string]any
-
-	err := yaml.Unmarshal([]byte(defaultConfig), &defaultData)
-	if err != nil {
-		return nil, err
-	}
-
-	err = yaml.Unmarshal([]byte(overridesConfig), &overrideConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	mergedData := mergeYAMLMaps(defaultData, overrideConfig)
-
-	mergedConfig, err := yaml.Marshal(mergedData)
-	if err != nil {
-		return nil, err
-	}
-
-	return mergedConfig, nil
-}
-
-func mergeYAMLMaps(defaults, overrides map[string]any) map[string]any {
-	for k, v := range overrides {
-		if vMap, ok := v.(map[string]any); ok {
-			// if the key exists in defaults and is a map, recursively merge
-			if mv1, ok := defaults[k].(map[string]any); ok {
-				defaults[k] = mergeYAMLMaps(mv1, vMap)
-			} else {
-				defaults[k] = vMap
-			}
-		} else {
-			// add or overwrite the value in defaults
-			defaults[k] = v
-		}
-	}
-	return defaults
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Robert Brennan	e9bf38fe28	Update triage.yml	2022-08-09 13:00:27 -04:00
Robert Brennan	4601c1fff4	Update triage.yml	2022-08-09 12:46:03 -04:00
Robert Brennan	e81c2d3930	Update triage.yml	2022-08-09 12:42:52 -04:00
Robert Brennan	9f33a603e4	Update triage.yml	2022-08-09 12:42:07 -04:00
Robert Brennan	7bae85c493	Update triage.yml	2022-08-09 12:37:55 -04:00
Robert Brennan	468bc2ef64	Update triage.yml	2022-08-09 12:30:48 -04:00
Robert Brennan	ab2d52b8d8	Update triage.yml	2022-08-09 12:21:36 -04:00
Robert Brennan	b079665364	Update triage.yml	2022-08-09 12:20:31 -04:00
Robert Brennan	baad393ea5	Update triage.yml	2022-08-09 12:17:28 -04:00
Robert Brennan	025cac8981	Update triage.yml	2022-08-09 12:15:09 -04:00
Robert Brennan	f229f4d663	Update triage.yml	2022-08-09 12:09:33 -04:00
Robert Brennan	e1cbe4ce6a	Update triage.yml	2022-08-09 12:00:22 -04:00
Robert Brennan	5d91a5f7e0	Update triage.yml	2022-08-09 11:54:00 -04:00
Robert Brennan	c5ac49583e	Update triage.yml	2022-08-09 11:52:13 -04:00
Robert Brennan	8ff5ad679a	Update triage.yml	2022-08-09 11:51:25 -04:00
Robert Brennan	c09dac5262	Update triage.yml	2022-08-09 11:49:52 -04:00
Robert Brennan	7c675c6d43	Update triage.yml	2022-08-09 11:40:50 -04:00
Robert Brennan	6ef6193c3d	Update triage.yml	2022-08-09 10:35:25 -04:00
Robert Brennan	bd9dd660ff	Update triage.yml	2022-08-09 10:35:14 -04:00
Robert Brennan	559736b1b2	Update triage.yml	2022-08-09 10:33:51 -04:00
Robert Brennan	ef4b6ece30	Update triage.yml	2022-08-09 10:32:34 -04:00
Robert Brennan	34152609a8	Update triage.yml	2022-08-09 10:27:00 -04:00
Robert Brennan	0879f2a040	Update triage.yml	2022-08-09 10:22:17 -04:00
Robert Brennan	a2123293f7	Update triage.yml	2022-08-09 10:19:42 -04:00
Robert Brennan	a5acc96001	Update triage.yml	2022-08-09 10:17:22 -04:00
Robert Brennan	e2e7918d36	Update triage.yml	2022-08-09 10:10:22 -04:00
Robert Brennan	ad7b4f6aee	Update triage.yml	2022-08-09 10:03:27 -04:00
Robert Brennan	581d06c194	Update triage.yml	2022-08-09 10:02:25 -04:00
Robert Brennan	729e7a9482	Update triage.yml	2022-08-09 10:01:01 -04:00
Robert Brennan	a63756a158	Update triage.yml	2022-08-09 09:58:15 -04:00
Robert Brennan	affab91d92	Update triage.yml	2022-08-09 09:55:28 -04:00
Robert Brennan	ccd707f230	Update triage.yml	2022-08-09 09:53:17 -04:00
Robert Brennan	68064da185	Update triage.yml	2022-08-09 09:52:46 -04:00
Robert Brennan	e4758dbc44	Update triage.yml	2022-08-09 09:50:20 -04:00
Robert Brennan	09209c9a7b	Update triage.yml	2022-08-09 09:48:45 -04:00
Robert Brennan	8a7e691a8e	Update triage.yml	2022-08-09 09:39:34 -04:00
Robert Brennan	3440296557	Update triage.yml	2022-08-09 09:37:04 -04:00
Robert Brennan	511157e010	Update triage.yml	2022-08-09 09:36:15 -04:00
Robert Brennan	195b9a8860	Update triage.yml	2022-08-09 09:35:41 -04:00
Robert Brennan	93b251d5c0	Update triage.yml	2022-08-09 09:33:40 -04:00
Robert Brennan	af840db564	Update triage.yml	2022-08-09 09:32:30 -04:00
Robert Brennan	909bc5e86b	Update triage.yml	2022-08-09 09:29:33 -04:00
Robert Brennan	3cdaf143a4	Update triage.yml	2022-08-09 09:27:50 -04:00
Robert Brennan	693dbc5b25	Update triage.yml	2022-08-09 09:03:02 -04:00
Robert Brennan	b77672bde8	Update triage.yml	2022-08-08 18:14:48 -04:00
Robert Brennan	bf96f1dc89	Update triage.yml	2022-08-08 18:07:50 -04:00
Robert Brennan	40c6c569e0	Update triage.yml	2022-08-08 16:05:11 -04:00
Robert Brennan	fe014ac2bf	Update triage.yml	2022-08-08 16:04:18 -04:00
Robert Brennan	5f87baaa56	Update triage.yml	2022-08-08 16:01:53 -04:00
Robert Brennan	35e7896553	Update triage.yml	2022-08-08 15:55:39 -04:00
Robert Brennan	1d7d3433c1	Update triage.yml	2022-08-08 15:51:21 -04:00
Robert Brennan	3a421412bb	Create triage.yml	2022-08-08 15:43:45 -04:00