Merge branch 'master' into rb/machine

* skip broken yaml (eg, patch file)

* skip in visitFile, not in parser

* restore filepath.Walk() error handling

* restore test; correct assertion

* Update pkg/kube/resources_test.go

Co-authored-by: Robert Brennan <accounts@rbren.io>

* Fix tests

* update kind

Co-authored-by: Robert Brennan <accounts@rbren.io>
Co-authored-by: Luke Reed <luke@lreed.net>
Co-authored-by: Barnabas Makonda <6409210+makoscafee@users.noreply.github.com>
Co-authored-by: MAKOSCAFEE <barnabasmakonda@gmail.com>

.circleci/config.yml

@@ -1,9 +1,12 @@
 version: 2.1
 
+orbs:
+  rok8s: fairwinds/rok8s-scripts@11
+
 executors:
   vm:
     machine:
-      enabled: true
+      image: cimg/base:stable-20.04
 
 references:
   set_environment_variables: &set_environment_variables
@@ -18,6 +21,7 @@ references:
         echo 'export GOPROXY=https://proxy.golang.org' >> ${BASH_ENV}
         echo 'export GO111MODULE=on' >> ${BASH_ENV}
         echo 'export GOFLAGS=-mod=mod' >> ${BASH_ENV}
+        echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
 
   install_k8s: &install_k8s
     run:
@@ -28,20 +32,20 @@ references:
         sudo apt-get install -yqq jq git
 
         echo "Installing KIND"
-        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.8.1/kind-linux-amd64
+        curl -sLO https://github.com/kubernetes-sigs/kind/releases/download/v0.14.0/kind-linux-amd64
         chmod 0755 kind-linux-amd64
         sudo mv kind-linux-amd64 /usr/local/bin/kind
         kind version
 
         echo "Installing Kubectl"
-        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.18.6/bin/linux/amd64/kubectl
+        curl -sLO https://storage.googleapis.com/kubernetes-release/release/v1.21.12/bin/linux/amd64/kubectl
         chmod 0755 kubectl
         sudo mv kubectl /usr/local/bin/
         kubectl version --client
 
 
         echo "Creating Kubernetes Cluster with Kind"
-        kind create cluster --wait=90s --image kindest/node:v1.15.11
+        kind create cluster --wait=90s --image kindest/node:v1.21.12
         docker ps -a
 
         kubectl version
@@ -82,16 +86,6 @@ references:
           echo "Skipping Kubernetes tests for forked PR"
         fi
 
-  # Release scripts
-  install_goreleaser: &install_goreleaser
-    run:
-      name: Install GoReleaser
-      command: |
-        curl -fsSLo goreleaser.deb https://github.com/goreleaser/goreleaser/releases/download/v0.131.1/goreleaser_amd64.deb
-        echo "640790dcbfa864f26de4c26c2d491f293a64525c8c6641c5bbdec7136b38977e goreleaser.deb" | sha256sum -c -
-        sudo dpkg -i goreleaser.deb
-        rm goreleaser.deb
-
   docker_build: &docker_build
     run:
       name: Docker login and build
@@ -108,14 +102,25 @@ references:
         docker login quay.io -u="${fairwinds_quay_user}" -p="${fairwinds_quay_token}"
         docker-push -f .circleci/build.config
 
-  release_deploy_configs: &release_deploy_configs
+  enable_experimental_features: &enable_experimental_docker_features
     run:
-      name: Release deploy configs
+      name: enable experimental features
       command: |
-        upload_url=$(curl --silent https://api.github.com/repos/FairwindsOps/polaris/releases/latest | grep upload_url)
-        upload_url=$(echo $upload_url | sed -e 's/.*\(https.*\){.*$/\1/')
-        curl -X POST "$upload_url?name=dashboard.yaml" --data-binary "@./deploy/dashboard.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
-        curl -X POST "$upload_url?name=webhook.yaml" --data-binary "@./deploy/webhook.yaml" -H "Authorization: Bearer $GITHUB_TOKEN" -H "Content-Type: application/x-yaml"
+        set -ex
+        apk --update add openssh
+        ssh remote-docker \<<EOF
+          sudo bash -c 'echo "{\"experimental\": true}" > /etc/docker/daemon.json'
+          sudo systemctl restart docker
+        EOF
+  install_vault_alpine: &install_vault_alpine
+    run:
+      name: install hashicorp vault
+      command: |
+        apk --update add curl yq
+        cd /tmp
+        curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+        unzip vault_1.9.3_linux_amd64.zip
+        mv vault /usr/bin/vault
 
 jobs:
   build:
@@ -148,7 +153,7 @@ jobs:
   test:
     working_directory: /go/src/github.com/fairwindsops/polaris/
     docker:
-      - image: circleci/golang:1.16
+      - image: circleci/golang:1.17
     steps:
       - checkout
       - *set_environment_variables
@@ -156,7 +161,6 @@ jobs:
       - run: go list ./... | grep -v vendor | xargs golint -set_exit_status
       - run: go list ./... | grep -v vendor | xargs go vet
       - run: go test ./... -coverprofile=coverage.txt -covermode=count
-      - run: go run main.go audit --audit-path ./deploy --set-exit-code-below-score 100 --set-exit-code-on-danger
       - *test_binary_dashboard
 
   insights:
@@ -165,29 +169,32 @@ jobs:
     steps:
       - checkout
       - setup_remote_docker
-      - run:
-          name: Adjust configs for latest image
-          command: |
-            sed -r "s|'(quay.io/fairwinds/polaris:).+'|'\1${CIRCLE_SHA1}'|" ./deploy/webhook.yaml > ./deploy/dashboard.yaml
-            sed -r "s|'(quay.io/fairwinds/polaris:).+'|'\1${CIRCLE_SHA1}'|" ./deploy/dashboard.yaml > ./deploy/webhook.yaml
       - run:
           name: Insights CI
           command: curl -L https://insights.fairwinds.com/v0/insights-ci.sh | bash
 
   release_binary:
     working_directory: /go/src/github.com/fairwindsops/polaris/
+    resource_class: large
+    shell: /bin/bash
     docker:
-      - image: circleci/golang:1.16
+      - image: goreleaser/goreleaser:v1.3.0
     steps:
       - checkout
-      - setup_remote_docker
+      - setup_remote_docker:
+          version: 20.10.6
+      - *enable_experimental_docker_features
+      - *install_vault_alpine
+      - rok8s/get_vault_env:
+          vault_path: repo/global/env
+      - rok8s/get_vault_env:
+          vault_path: repo/polaris/env
       - *set_environment_variables
-      - *install_goreleaser
       - run: go get -u github.com/gobuffalo/packr/v2/packr2
       - run: git checkout -- . # FIXME: the go get makes the directory dirty
       - run: packr2
+      - run: echo 'export GORELEASER_CURRENT_TAG="${CIRCLE_TAG}"' >> $BASH_ENV
       - run: goreleaser
-      - *release_deploy_configs
 
   release_images:
     working_directory: /go/src/github.com/fairwindsops/polaris/
@@ -198,7 +205,6 @@ jobs:
       - setup_remote_docker
       - *set_environment_variables
       - *docker_build_and_push
-
   publish_docs:
     docker:
       - image: cimg/node:15.5.1
@@ -213,17 +219,34 @@ jobs:
             npm run check-links
             npm run build
       - run:
-          name: Install AWS CLI
+          name: Install Tools
           command: |
+            cd /tmp
+            echo "Installing AWS CLI"
             curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
             unzip awscliv2.zip
             sudo ./aws/install
+
+            echo "Installing Hashicorp Vault"
+            curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+            unzip vault_1.9.3_linux_amd64.zip
+            sudo mv vault /usr/bin/vault
+            sudo chmod +x /usr/bin/vault
+            vault --version
+
+            echo "Installing yq"
+            curl -LO https://github.com/mikefarah/yq/releases/download/v4.16.2/yq_linux_amd64.tar.gz
+            tar -zxvf yq_linux_amd64.tar.gz
+            sudo mv yq_linux_amd64 /usr/bin/yq
+            sudo chmod +x /usr/bin/yq
+            yq --version
+      - rok8s/get_vault_env:
+          vault_path: repo/polaris/env
       - run:
           name: Publish Docs Site to S3
           command: |
             cd ./dist
             aws s3 sync ./ s3://polaris.docs.fairwinds.com --delete
-
 workflows:
   version: 2
 

.github/ISSUE_TEMPLATE/bug.yaml

@@ -0,0 +1,58 @@
+name: Bug Report
+description: File a bug report
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report! Please fill the form below.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+      description: What is the expected or desired behavior?
+    validations:
+      required: true
+  - type: textarea
+    id: reproducible
+    attributes:
+      label: How can we reproduce this?
+      description: Please share the steps that we can take to reproduce this. Also include any relevant configuration.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The version of the tool that you are using. If a helm chart, please share the name of the chart.
+    validations:
+      required: true
+  - type: checkboxes
+    id: search
+    attributes:
+      label: Search
+      options:
+        - label: I did search for other open and closed issues before opening this.
+          required: true
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow the CODE_OF_CONDUCT in this repository.
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true
+  - type: textarea
+    id: ctx
+    attributes:
+      label: Additional context
+      description: Anything else you would like to add
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,58 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
----
-name: Bug report
-about: Let us know about an unexpected error, a crash, or an incorrect behavior.
-
----
-### Installation Process
-<!--- 
-Did you install polaris on your local machine, or in a kubernetes cluster? Did you use kubectl, helm, brew, a GitHub release, or the source code? Let us know below. 
---> 
-
-### Polaris Version
-<!---
-If you are using polaris locally, run `polaris --version` to show the version, and paste the result between the ``` marks below.
-
-If you are not running the latest version of Polaris, please try upgrading because your issue may have already been fixed.
--->
-
-```
-...
-```
-
-### Expected Behavior
-<!--
-What should have happened?
--->
-
-### Actual Behavior
-<!--
-What actually happened?
--->
-
-### Steps to Reproduce
-<!--
-Please list the full steps required to reproduce the issue, for example:
-1. `polaris --audit --output-format score`
--->
-
-### Additional Context
-<!--
-Are there anything atypical about your situation that we should know? 
--->
-
-### References
-<!--
-Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:
-
-- #6017
-
--->

.github/ISSUE_TEMPLATE/other.md

@@ -6,5 +6,3 @@ labels: ''
 assignees: ''
 
 ---
-
-

.github/actions/setup-polaris/get_polaris.sh

@@ -3,15 +3,16 @@ if [[ -z "$INPUT_VERSION" ]]; then
   echo "Missing polaris version information"
   exit 1
 fi
+POLARIS_URL=https://github.com/FairwindsOps/polaris/releases/download/$INPUT_VERSION/polaris_linux_amd64.tar.gz
 polaris version | grep "$INPUT_VERSION" &> /dev/null
 if [ $? == 0 ]; then
    echo "Polaris $INPUT_VERSION is already installed! Exiting gracefully."
    exit 0
 else
-  echo "Installing polaris to path."
+  echo "Installing polaris to path from " $POLARIS_URL
 fi
 TARGET_FILE="polaris.tar.gz"
-curl -LJ -o $TARGET_FILE 'https://github.com/FairwindsOps/polaris/releases/download/'"$INPUT_VERSION"'/polaris_'"$INPUT_VERSION"'_linux_386.tar.gz'
+curl -LJ -o $TARGET_FILE $POLARIS_URL
 mkdir polaris
 tar -xzf $TARGET_FILE -C polaris
 rm $TARGET_FILE

.github/dependabot.yml

@@ -1,44 +1,20 @@
+## DO NOT EDIT - Managed by Terraform
 version: 2
 updates:
-- package-ecosystem: gomod
-  directory: "/"
-  schedule:
-    interval: weekly
-    time: "11:00"
-  ignore:
-  - dependency-name: cloud.google.com/go
-    versions:
-    - ">= 0.57.a, < 0.58"
-  - dependency-name: github.com/go-logr/logr
-    versions:
-    - ">= 0.2.a, < 0.3"
-  - dependency-name: github.com/go-logr/zapr
-    versions:
-    - ">= 0.2.a, < 0.3"
-  - dependency-name: github.com/googleapis/gnostic
-    versions:
-    - ">= 0.4.a, < 0.5"
-  - dependency-name: github.com/googleapis/gnostic
-    versions:
-    - ">= 0.5.a, < 0.6"
-  - dependency-name: github.com/qri-io/jsonschema
-    versions:
-    - ">= 0.2.a, < 0.3"
-  - dependency-name: k8s.io/api
-    versions:
-    - ">= 0.19.a, < 0.20"
-  - dependency-name: k8s.io/apimachinery
-    versions:
-    - ">= 0.19.a, < 0.20"
-  - dependency-name: k8s.io/client-go
-    versions:
-    - ">= 0.19.a, < 0.20"
-  - dependency-name: sigs.k8s.io/controller-runtime
-    versions:
-    - ">= 0.5.a, < 0.6"
-  - dependency-name: sigs.k8s.io/controller-runtime
-    versions:
-    - ">= 0.8.a, < 0.9"
-  - dependency-name: k8s.io/apimachinery
-    versions:
-    - 0.20.4
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,13 @@
+This PR fixes #
+
+## Checklist
+* [ ] I have signed the CLA
+* [ ] I have updated/added any relevant documentation
+
+## Description
+### What's the goal of this PR?
+
+### What changes did you make?
+
+### What alternative solution should we consider, if any?
+

.github/stale.yml

@@ -1,18 +0,0 @@
-daysUntilStale: 30
-daysUntilClose: 7
-onlyLabels: []
-exemptLabels:
-  - pinned
-  - security
-
-exemptProjects: false
-exemptMilestones: true
-exemptAssignees: false
-staleLabel: stale
-
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-
-limitPerRun: 30

.github/workflows/stale.yml

@@ -0,0 +1,18 @@
+name: 'Close stale issues and PRs'
+on:
+  schedule:
+    - cron: '32 1 * * *'
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v4
+        with:
+          exempt-issue-labels: pinned
+          stale-pr-label: stale
+          stale-issue-label: stale

.github/workflows/test_setup.yml

@@ -11,7 +11,7 @@ jobs:
       - name: Setup polaris
         uses: ./.github/actions/setup-polaris
         with:
-          version: 3.0.3
+          version: 4.2.0
       - name: Use command
         run: polaris version
 
@@ -22,6 +22,6 @@ jobs:
       - name: Setup polaris
         uses: fairwindsops/polaris/.github/actions/setup-polaris@master
         with:
-          version: 3.0.3
+          version: 4.2.0
       - name: Use command
         run: polaris version

.gitignore

@@ -1,4 +1,5 @@
 # Binaries for programs and plugins
+.go-version
 *.exe
 *.exe~
 *.dll

.goreleaser.yml

@@ -8,9 +8,15 @@ changelog:
     - '^test:'
 builds:
   - id: polaris
+    ldflags:
+      - -X main.Version={{.Version}} -X main.Commit={{.Commit}} -s -w
     env:
       - CGO_ENABLED=0
       - GO111MODULE=on
+    goos:
+      - linux
+      - darwin
+      - windows
     goarch:
       - amd64
       - arm
@@ -22,9 +28,21 @@ archives:
   - id: polaris
     builds: ["polaris"]
     name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
+signs:
+- cmd: cosign
+  args: ["sign-blob", "--key=hashivault://cosign", "-output-signature=${signature}", "${artifact}"]
+  artifacts: checksum
+release:
+  prerelease: auto
+  footer: |
+    You can verify the signature of the checksums.txt file using [cosign](https://github.com/sigstore/cosign).
+
+    ```
+    cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub
+    ```
 brews:
   - name: polaris
-    github:
+    tap:
       owner: FairwindsOps
       name: homebrew-tap
     folder: Formula

.licenserc.yaml

@@ -0,0 +1,24 @@
+header:
+  license:
+    spdx-id: Apache-2.0
+    copyright-owner: 'FairwindsOps, Inc.'
+  content: |
+    // Copyright 2019 FairwindsOps Inc
+    //
+    // Licensed under the Apache License, Version 2.0 (the "License");
+    // you may not use this file except in compliance with the License.
+    // You may obtain a copy of the License at
+    //
+    //     http://www.apache.org/licenses/LICENSE-2.0
+    //
+    // Unless required by applicable law or agreed to in writing, software
+    // distributed under the License is distributed on an "AS IS" BASIS,
+    // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    // See the License for the specific language governing permissions and
+    // limitations under the License.
+  paths:
+    - '**/*.go'
+  comment: on-failure
+dependency:
+  files:
+    - go.mod

CODEOWNERS

@@ -1 +1,2 @@
-* @rbren @makoscafee
+## DO NOT EDIT - Managed by Terraform
+* @rbren @makoscafee

CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at opensource@fairwinds.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16 AS build-env
+FROM golang:1.17 AS build-env
 WORKDIR /go/src/github.com/fairwindsops/polaris/
 
 ENV GO111MODULE=on
@@ -15,7 +15,7 @@ RUN go get -u github.com/gobuffalo/packr/v2/packr2
 COPY . .
 RUN packr2 build -a -o polaris *.go
 
-FROM alpine:3.14
+FROM alpine:3.16.0
 WORKDIR /usr/local/bin
 RUN apk --no-cache add ca-certificates
 

README.md

@@ -2,8 +2,8 @@
   <img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
   <br>
   <h3>Best Practices for Kubernetes Workload Configuration</h3>
-  <a href="https://github.com/FairwindsOps/polaris">
-    <img src="https://img.shields.io/static/v1.svg?label=Version&message=4.0.8&color=239922">
+  <a href="https://github.com/FairwindsOps/polaris/releases">
+    <img src="https://img.shields.io/github/v/release/FairwindsOps/polaris">
   </a>
   <a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
     <img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
@@ -32,10 +32,18 @@ Polaris can be run in three different modes:
 ## Documentation
 Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)
 
+<!-- Begin boilerplate -->
 ## Join the Fairwinds Open Source Community
 
-The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap, and network with fellow Kubernetes users. [Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g) or [join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
+The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap,
+and network with fellow Kubernetes users.
+[Chat with us on Slack](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)
+or
+[join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
 
+<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
+</a>
 
 ## Other Projects from Fairwinds
 
@@ -45,14 +53,14 @@ Enjoying Polaris? Check out some of our other projects:
 * [Nova](https://github.com/FairwindsOps/Nova) - Check to see if any of your Helm charts have updates available
 * [rbac-manager](https://github.com/FairwindsOps/rbac-manager) - Simplify the management of RBAC in your Kubernetes clusters
 
+Or [check out the full list](https://www.fairwinds.com/open-source-software?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris)
 ## Fairwinds Insights
-<p align="center">
-  <a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
-    <img src="https://polaris.docs.fairwinds.com/img/insights-banner.png" alt="Fairwinds Insights" width="550"/>
-  </a>
-</p>
-
 If you're interested in running Polaris in multiple clusters,
 tracking the results over time, integrating with Slack, Datadog, and Jira,
 or unlocking other functionality, check out
-[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris), a platform for auditing and enforcing policy in Kubernetes clusters.
+[Fairwinds Insights](https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris),
+a platform for auditing and enforcing policy in Kubernetes clusters.
+
+<a href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_Polaris_Ad.png" alt="Fairwinds Insights" />
+</a>

checks/cpuLimitsMissing.yaml

@@ -25,3 +25,13 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/limits
+    value: {}
+  - op: add
+    path: /resources/limits/cpu
+    value: 100m
+comments:
+  - find: "cpu: 100m"
+    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"

checks/cpuRequestsMissing.yaml

@@ -25,3 +25,13 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/requests
+    value: {}
+  - op: add
+    path: /resources/requests/cpu
+    value: 100m
+comments:
+  - find: "cpu: 100m"
+    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"

checks/dangerousCapabilities.yaml

@@ -17,10 +17,10 @@ schema:
               allOf:
                 - not:
                     contains:
-                      const: ALL
+                      pattern: '^(?i)ALL$'
                 - not:
                     contains:
-                      const: SYS_ADMIN
+                      pattern: '^(?i)SYS_ADMIN$'
                 - not:
                     contains:
-                      const: NET_ADMIN
+                      pattern: '^(?i)NET_ADMIN$'

checks/deploymentMissingReplicas.yaml

@@ -19,3 +19,7 @@ schema:
         replicas:
           type: integer
           minimum: 2
+mutations:
+  - op: add
+    path: /spec/replicas
+    value: 3

checks/hostIPCSet.yaml

@@ -1,7 +1,7 @@
 successMessage: Host IPC is not configured
 failureMessage: Host IPC should not be configured
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -9,3 +9,6 @@ schema:
     hostIPC:
       not:
         const: true
+mutations:
+  - op: remove
+    path: /hostIPC

checks/hostNetworkSet.yaml

@@ -1,7 +1,7 @@
 successMessage: Host network is not configured
 failureMessage: Host network should not be configured
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -9,3 +9,6 @@ schema:
     hostNetwork:
       not:
         const: true
+mutations:
+  - op: remove
+    path: /hostNetwork

checks/hostPIDSet.yaml

@@ -1,7 +1,7 @@
 successMessage: Host PID is not configured
 failureMessage: Host PID should not be configured
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -9,3 +9,6 @@ schema:
     hostPID:
       not:
         const: true
+mutations:
+  - op: remove
+    path: /hostPID

checks/hostPortSet.yaml

@@ -12,4 +12,4 @@ schema:
       items:
         properties:
           hostPort:
-            const: 0
+            const: 0

checks/insecureCapabilities.yaml

@@ -22,35 +22,35 @@ schema:
               type: array
               oneOf:
               - contains:
-                  const: ALL
+                  pattern: '^(?i)ALL$'
               - allOf:
                 - contains:
-                    const: NET_ADMIN
+                    pattern: '^(?i)NET_ADMIN$'
                 - contains:
-                    const: CHOWN
+                    pattern: '^(?i)CHOWN$'
                 - contains:
-                    const: DAC_OVERRIDE
+                    pattern: '^(?i)DAC_OVERRIDE$'
                 - contains:
-                    const: FSETID
+                    pattern: '^(?i)FSETID$'
                 - contains:
-                    const: FOWNER
+                    pattern: '^(?i)FOWNER$'
                 - contains:
-                    const: MKNOD
+                    pattern: '^(?i)MKNOD$'
                 - contains:
-                    const: NET_RAW
+                    pattern: '^(?i)NET_RAW$'
                 - contains:
-                    const: SETGID
+                    pattern: '^(?i)SETGID$'
                 - contains:
-                    const: SETUID
+                    pattern: '^(?i)SETUID$'
                 - contains:
-                    const: SETFCAP
+                    pattern: '^(?i)SETFCAP$'
                 - contains:
-                    const: SETPCAP
+                    pattern: '^(?i)SETPCAP$'
                 - contains:
-                    const: NET_BIND_SERVICE
+                    pattern: '^(?i)NET_BIND_SERVICE$'
                 - contains:
-                    const: SYS_CHROOT
+                    pattern: '^(?i)SYS_CHROOT$'
                 - contains:
-                    const: KILL
+                    pattern: '^(?i)KILL$'
                 - contains:
-                    const: AUDIT_WRITE
+                    pattern: '^(?i)AUDIT_WRITE$'

checks/livenessProbeMissing.yaml

@@ -19,3 +19,10 @@ schema:
       type: object
       not:
         const: null
+mutations:
+  - op: add
+    path: /livenessProbe
+    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
+comments:
+  - find: "livenessProbe:"
+    comment: "TODO: Change livenessProbe setting to reflect your health endpoints"

checks/memoryLimitsMissing.yaml

@@ -25,3 +25,13 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/limits
+    value: {}
+  - op: add
+    path: /resources/limits/memory
+    value: "512Mi"
+comments:
+  - find: "memory: 512Mi"
+    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"

checks/memoryRequestsMissing.yaml

@@ -25,3 +25,13 @@ schema:
               type: string
               not:
                 const: ''
+mutations:
+  - op: add
+    path: /resources/requests
+    value: {}
+  - op: add
+    path: /resources/requests/memory
+    value: "512Mi"
+comments:
+  - find: "memory: 512Mi"
+    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"

checks/notReadOnlyRootFilesystem.yaml

@@ -2,7 +2,7 @@ successMessage: Filesystem is read only
 failureMessage: Filesystem should be read only
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:

checks/pdbDisruptionsIsZero.yaml

@@ -1,18 +1,22 @@
-successMessage: disruptionsAllowed is greater than zero
-failureMessage: disruptionsAllowed is not greater than zero
+successMessage: Voluntary evictions are possible
+failureMessage: Voluntary evictions are not possible
 category: Reliability
 target: policy/PodDisruptionBudget
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
   required:
-  - status
+  - spec
   properties:
-    status:
+    spec:
       type: object
-      required:
-      - disruptionsAllowed
       properties:
-        disruptionsAllowed:
-          type: integer
-          minimum: 1
+          minAvailable:
+            not:
+              const: '100%'
+          maxUnavailable:
+            allOf:
+            - not:
+                const: 0
+            - not:
+                const: '0%'

checks/priorityClassNotSet.yaml

@@ -1,9 +1,13 @@
 successMessage: Priority class has been set
 failureMessage: Priority class should be set
 category: Security
-target: Pod
+target: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
   required:
   - priorityClassName
+mutations:
+  - op: add
+    path: /priorityClassName
+    value: high-priority

checks/privilegeEscalationAllowed.yaml

@@ -2,7 +2,7 @@ successMessage: Privilege escalation not allowed
 failureMessage: Privilege escalation should not be allowed
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:

checks/pullPolicyNotAlways.yaml

@@ -9,3 +9,7 @@ schema:
   properties:
     imagePullPolicy:
       const: Always
+mutations:
+  - op: add
+    path: /imagePullPolicy
+    value: Always

checks/readinessProbeMissing.yaml

@@ -19,3 +19,10 @@ schema:
       type: object
       not:
         const: null
+mutations:
+  - op: add
+    path: /readinessProbe
+    value: {"exec": { "command": [ "cat", "/tmp/healthy" ] }, "initialDelaySeconds": 5, "periodSeconds": 5 }
+comments:
+  - find: "readinessProbe:"
+    comment: "TODO: Change livenessProbe setting to reflect your health endpoints"

checks/runAsPrivileged.yaml

@@ -2,7 +2,7 @@ successMessage: Not running as privileged
 failureMessage: Should not be running as privileged
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:
@@ -21,4 +21,8 @@ schema:
       items:
         properties:
           securityContext:
-            $ref: "#/definitions/notBadSecurityContext"
+            $ref: "#/definitions/notBadSecurityContext"
+mutations:
+  - op: add
+    path: /securityContext/privileged
+    value: false

checks/runAsRootAllowed.yaml

@@ -2,7 +2,7 @@ successMessage: Is not allowed to run as root
 failureMessage: Should not be allowed to run as root
 category: Security
 target: Container
-schemaTarget: Pod
+schemaTarget: PodSpec
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   definitions:
@@ -50,3 +50,7 @@ schema:
           properties:
             securityContext:
               $ref: "#/definitions/goodSecurityContext"
+mutations:
+  - op: replace
+    path: /securityContext/runAsNonRoot
+    value: true

cmd/polaris/audit.go

@@ -24,6 +24,7 @@ import (
 	"os"
 	"os/exec"
 
+	cfg "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
 	"github.com/fairwindsops/polaris/pkg/validator"
 	"github.com/sirupsen/logrus"
@@ -31,16 +32,20 @@ import (
 	"sigs.k8s.io/yaml"
 )
 
-var setExitCode bool
-var onlyShowFailedTests bool
-var minScore int
-var auditOutputURL string
-var auditOutputFile string
-var auditOutputFormat string
-var resourceToAudit string
-var useColor bool
-var helmChart string
-var helmValues string
+var (
+	setExitCode         bool
+	onlyShowFailedTests bool
+	minScore            int
+	auditOutputURL      string
+	auditOutputFile     string
+	auditOutputFormat   string
+	resourceToAudit     string
+	useColor            bool
+	helmChart           string
+	helmValues          string
+	checks              []string
+	auditNamespace      string
+)
 
 func init() {
 	rootCmd.AddCommand(auditCmd)
@@ -56,6 +61,8 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
 	auditCmd.PersistentFlags().StringVar(&helmValues, "helm-values", "", "Optional flag to add helm values")
+	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
+	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
 }
 
 var auditCmd = &cobra.Command{
@@ -66,6 +73,26 @@ var auditCmd = &cobra.Command{
 		if displayName != "" {
 			config.DisplayName = displayName
 		}
+		if len(checks) > 0 {
+			targetChecks := make(map[string]bool)
+			for _, check := range checks {
+				targetChecks[check] = true
+			}
+			for key := range config.Checks {
+				if isTarget := targetChecks[key]; !isTarget {
+					config.Checks[key] = cfg.SeverityIgnore
+				}
+			}
+		}
+		if auditNamespace != "" {
+			if helmChart != "" {
+				logrus.Warn("--namespace and --helm-chart are mutually exclusive. --namespace will be ignored.")
+			}
+			if auditPath != "" {
+				logrus.Warn("--namespace and --audit-path are mutually exclusive. --namespace will be ignored.")
+			}
+			config.Namespace = auditNamespace
+		}
 		if helmChart != "" {
 			var err error
 			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)

cmd/polaris/fix.go

@@ -0,0 +1,166 @@
+// Copyright 2020 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	yamlV3 "gopkg.in/yaml.v3"
+	"sigs.k8s.io/yaml"
+)
+
+var filesPath string
+
+func init() {
+	rootCmd.AddCommand(fixCommand)
+	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
+}
+
+var fixCommand = &cobra.Command{
+	Use:   "fix",
+	Short: "Fix Infrastructure as code files.",
+	Long:  `Fix Infrastructure as code files.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		logrus.Debug("Setting up controller manager")
+
+		if filesPath == "" {
+			logrus.Error("Please specify a file-path flag")
+			cmd.Help()
+			os.Exit(1)
+		}
+		var yamlFiles []string
+		fileInfo, err := os.Stat(filesPath)
+		if err != nil {
+			logrus.Error(err)
+			os.Exit(1)
+		}
+		if fileInfo.IsDir() {
+			baseDir := filesPath
+			if !strings.HasSuffix(filesPath, "/") {
+				baseDir = baseDir + "/"
+			}
+			yamlFiles, err = getYamlFiles(baseDir)
+			if err != nil {
+				logrus.Error(err)
+				os.Exit(1)
+			}
+		} else {
+			yamlFiles = append(yamlFiles, filesPath)
+		}
+		var contentStr string
+		isFirstResource := true
+		for _, fullFilePath := range yamlFiles {
+
+			yamlFile, err := ioutil.ReadFile(fullFilePath)
+			if err != nil {
+				logrus.Errorf("Error reading file with file path %s: %v", fullFilePath, err)
+				os.Exit(1)
+			}
+
+			dec := yamlV3.NewDecoder(bytes.NewReader(yamlFile))
+
+			for {
+				data := map[string]interface{}{}
+				err := dec.Decode(&data)
+				// check it was parsed
+				if data == nil {
+					continue
+				}
+				// break the loop in case of EOF
+				if errors.Is(err, io.EOF) {
+					break
+				}
+				if err != nil {
+					logrus.Errorf("Error decoding data for file with file path %s: %v", fullFilePath, err)
+					os.Exit(1)
+				}
+				yamlContent, err := yamlV3.Marshal(data)
+				if err != nil {
+					logrus.Errorf("Error marshalling %s: %v", fullFilePath, err)
+					os.Exit(1)
+				}
+				kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
+				results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
+				if err != nil {
+					logrus.Errorf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+					os.Exit(1)
+				}
+				comments, allMutations := mutation.GetMutationsAndCommentsFromResults(results)
+				updatedYamlContent := string(yamlContent)
+				if len(allMutations) > 0 {
+					for _, resources := range kubeResources.Resources {
+						key := fmt.Sprintf("%s/%s/%s", resources[0].Kind, resources[0].Resource.GetName(), resources[0].Resource.GetNamespace())
+						mutations := allMutations[key]
+						mutated, err := mutation.ApplyAllSchemaMutations(&config, kubeResources, resources[0], mutations)
+						if err != nil {
+							logrus.Errorf("Error applying schema mutations to the resources: %v", err)
+							os.Exit(1)
+						}
+						mutatedYamlContent, err := yaml.JSONToYAML(mutated.OriginalObjectJSON)
+						if err != nil {
+							logrus.Errorf("Error converting JSON to Yaml : %v", err)
+							os.Exit(1)
+						}
+						updatedYamlContent = mutation.UpdateMutatedContentWithComments(string(mutatedYamlContent), comments)
+					}
+				}
+				if isFirstResource {
+					contentStr = updatedYamlContent
+					isFirstResource = false
+				} else {
+					contentStr += "\n"
+					contentStr += "---"
+					contentStr += "\n"
+					contentStr += updatedYamlContent
+				}
+			}
+
+			if contentStr != "" {
+				err = ioutil.WriteFile(fullFilePath, []byte(contentStr), 0644)
+				if err != nil {
+					logrus.Errorf("Error writing output to file: %v", err)
+					os.Exit(1)
+				}
+			}
+		}
+
+	},
+}
+
+func getYamlFiles(rootpath string) ([]string, error) {
+	var list []string
+	err := filepath.Walk(rootpath, func(path string, info os.FileInfo, err error) error {
+		if info.IsDir() {
+			return nil
+		}
+		if filepath.Ext(path) == ".yaml" || filepath.Ext(path) == ".yml" {
+			list = append(list, path)
+		}
+		return nil
+	})
+	return list, err
+}

cmd/polaris/root.go

@@ -25,10 +25,11 @@ import (
 )
 
 var configPath string
-var disallowExemptions bool
+var disallowExemptions, disallowConfigExemptions, disallowAnnotationExemptions, fixChecks bool
 var logLevel string
 var auditPath string
 var displayName string
+var kubeContext string
 
 var (
 	version string
@@ -37,7 +38,10 @@ var (
 func init() {
 	// Flags
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "Location of Polaris configuration file.")
-	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any exemptions from configuration file.")
+	rootCmd.PersistentFlags().StringVarP(&kubeContext, "context", "x", "", "Set the kube context.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
+	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level.")
 	flag.Parse()
 	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
@@ -63,10 +67,10 @@ var rootCmd = &cobra.Command{
 			os.Exit(1)
 		}
 
-		if disallowExemptions {
-			config.DisallowExemptions = true
-		}
-
+		config.DisallowExemptions = disallowExemptions
+		config.DisallowConfigExemptions = disallowConfigExemptions
+		config.DisallowAnnotationExemptions = disallowAnnotationExemptions
+		config.KubeContext = kubeContext
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		logrus.Error("You must specify a sub-command.")

cmd/polaris/webhook.go

@@ -63,7 +63,8 @@ var webhookCmd = &cobra.Command{
 
 		// Iterate all the configurations supported controllers to scan and register them for webhooks
 		// Should only register controllers that are configured to be scanned
-		fwebhook.NewWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
+		fwebhook.NewValidateWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
+		fwebhook.NewMutateWebhook(mgr, fwebhook.Mutator{Config: config, Client: mgr.GetClient()})
 
 		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
 		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {

deploy/dashboard.yaml

@@ -1,156 +0,0 @@
----
-# Source: polaris/templates/0-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: polaris
----
-# Source: polaris/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: polaris
-  namespace: polaris
-  labels:
-    app: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-rules:
-  # required by controller-runtime code doing a cluster wide lookup
-  # when it seems namespace would suffice
-  - apiGroups:
-      - ''
-    resources:
-      - 'nodes'
-    verbs:
-      - 'get'
-      - 'list'
-  - apiGroups: 
-      - 'monitoring.coreos.com'
-    resources: 
-      - 'prometheuses'
-      - 'alertmanagers'
-    verbs: 
-      - 'get'
-      - 'list'
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris-view
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: view
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: polaris
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/dashboard.service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
-  annotations:
-spec:
-  ports:
-  - name: http-dashboard
-    port: 80
-    protocol: TCP
-    targetPort: 8080
-  selector:
-    app: polaris
-    component: dashboard
-  type: ClusterIP
----
-# Source: polaris/templates/dashboard.deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: polaris-dashboard
-  namespace: polaris
-  labels:
-    app: polaris
-    component: dashboard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: polaris
-      component: dashboard
-  template:
-    metadata:
-      labels:
-        app: polaris
-        component: dashboard
-    spec:
-      containers:
-      - command:
-        - polaris
-        - dashboard
-        - --port
-        - "8080"
-        image: 'quay.io/fairwinds/polaris:4.0'
-        imagePullPolicy: 'Always'
-        name: dashboard
-        ports:
-        - containerPort: 8080
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 20
-        resources:
-          limits:
-            cpu: 150m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-              - ALL
-      serviceAccountName: polaris
-      nodeSelector:
-      tolerations:

deploy/webhook.yaml

@@ -1,270 +0,0 @@
----
-# Source: polaris/templates/0-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: polaris
----
-# Source: polaris/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: polaris
-  namespace: polaris
-  labels:
-    app: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-rules:
-  # required by controller-runtime code doing a cluster wide lookup
-  # when it seems namespace would suffice
-  - apiGroups:
-      - ''
-    resources:
-      - 'nodes'
-    verbs:
-      - 'get'
-      - 'list'
-  - apiGroups: 
-      - 'monitoring.coreos.com'
-    resources: 
-      - 'prometheuses'
-      - 'alertmanagers'
-    verbs: 
-      - 'get'
-      - 'list'
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris-view
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: view
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: polaris
-  labels:
-    app: polaris
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: polaris
-subjects:
-  - kind: ServiceAccount
-    name: polaris
-    namespace: polaris
----
-# Source: polaris/templates/webhook.service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-spec:
-  ports:
-  - name: webhook
-    port: 443
-    protocol: TCP
-    targetPort: 9876
-  selector:
-    app: polaris
-    component: webhook
-  type: ClusterIP
----
-# Source: polaris/templates/webhook.deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: polaris-webhook
-  namespace: polaris
-  labels:
-    app: polaris
-    component: webhook
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: polaris
-      component: webhook
-  template:
-    metadata:
-      labels:
-        app: polaris
-        component: webhook
-    spec:
-      containers:
-        - name: webhook
-          command:
-            - polaris
-            - webhook
-          image: 'quay.io/fairwinds/polaris:4.0'
-          imagePullPolicy: 'Always'
-          ports:
-            - containerPort: 9876
-          # These are fairly useless readiness/liveness probes for now
-          # Follow this issue for potential improvements:
-          # https://github.com/kubernetes-sigs/controller-runtime/issues/356
-          livenessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - ps -ef | grep polaris
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 100m
-              memory: 128Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: secret
-              mountPath: /opt/cert/
-              readOnly: true
-            - name: cr-logs
-              mountPath: /tmp/
-              readOnly: false
-      serviceAccountName:  polaris
-      nodeSelector:
-      tolerations:
-      volumes:
-        - name: secret
-          secret:
-            secretName: polaris
-        - name: cr-logs
-          emptyDir: {}
----
-# Source: polaris/templates/webhook.cert.yaml
-apiVersion: cert-manager.io/v1alpha2
-kind: Certificate
-metadata:
-  name: polaris-cert
-  namespace: polaris
-  labels:
-    app: polaris
-spec:
-  commonName: polaris-webhook.polaris.svc
-  dnsNames:
-  - polaris-webhook.polaris.svc
-  - polaris-webhook.polaris
-  - polaris-webhook
-  - polaris-webhook.polaris.svc.
-  issuerRef:
-    kind: Issuer
-    name: polaris-selfsigned
-  secretName: polaris
----
-# Source: polaris/templates/webhook.cert.yaml
-apiVersion: cert-manager.io/v1alpha2
-kind: Issuer
-metadata:
-  name: polaris-selfsigned
-  namespace: polaris
-spec:
-  selfSigned: {}
----
-# Source: polaris/templates/webhook.configuration.yaml
-apiVersion: admissionregistration.k8s.io/v1beta1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: polaris-webhook
-  annotations:
-    cert-manager.io/inject-ca-from: polaris/polaris-cert
-webhooks:
-- admissionReviewVersions:
-  - v1beta1
-  clientConfig:
-    service:
-      name: polaris-webhook
-      namespace: polaris
-      path: /validate
-      port: 443
-  failurePolicy: Fail
-  matchPolicy: Exact
-  name: polaris.fairwinds.com
-  namespaceSelector:
-    
-    matchExpressions:
-    - key: control-plane
-      operator: DoesNotExist
-  objectSelector:
-    
-    {}
-  rules:
-  - apiGroups:
-    - apps
-    apiVersions:
-    - v1
-    - v1beta1
-    - v1beta2
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - daemonsets
-    - deployments
-    - statefulsets
-    scope: Namespaced
-  - apiGroups:
-    - batch
-    apiVersions:
-    - v1
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - jobs
-    - cronjobs
-    scope: Namespaced
-  - apiGroups:
-    - ""
-    apiVersions:
-    - v1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - pods
-    - replicationcontrollers
-    scope: Namespaced
-  sideEffects: None
-  timeoutSeconds: 10

docs/admission-controller.md

@@ -25,11 +25,6 @@ If you don't use cert-manager, you'll need to:
 * Create a TLS secret in your cluster with a valid certificate that uses that CA
 * Pass the name of that secret with the webhook.secretName parameter.
 
-### kubectl
-```bash
-kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/webhook.yaml
-```
-
 ### Helm
 ```bash
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable

docs/changelog.md

@@ -5,6 +5,26 @@ meta:
     content: "Fairwinds Polaris | Changelog"
 
 ---
+## 5.1.0
+* Support `--context` flag for kubecontext
+* Treat core Kubernetes controllers (`Deployments`, `StatefulSets`, `DaemonSets`, `CronJobs`) as top-level objects, instead of following owner refs
+
+## 5.0.0
+* Renamed `multipleReplicasForDeployment` to `deploymentMissingReplicas`
+* Changed `RunAsRootAllowed` and `hostNetworkSet` default severity to `danger`
+* Changed `deploymentMissingReplicas` default severity to `warning`
+
+## 4.2.0
+* New flags `--disallow-(config|annotation)-exemptions`
+* Kubernetes dependency updates
+* Documentation updates
+## 4.1.0
+* Handle case-insentitivity in capabilities checks
+* Change test for PDB disruptions to better handle IaC
+
+## 4.0.9
+* Update Alpine base image
+
 ## 4.0.8
 * Fix support for namespace checks
 

docs/checks/reliability.md

@@ -15,7 +15,7 @@ key | default | description
 `tagNotSpecified` | `danger` | Fails when an image tag is either not specified or `latest`.
 `pullPolicyNotAlways` | `warning` | Fails when an image pull policy is not `always`.
 `priorityClassNotSet` | `ignore` | Fails when a priorityClassName is not set for a pod.
-`multipleReplicasForDeployment` | `ignore` | Fails when there is only one replica for a deployment.
+`deploymentMissingReplicas` | `warning` | Fails when there is only one replica for a deployment.
 `missingPodDisruptionBudget` | `ignore` 
 
 ## Background

docs/cli.md

@@ -19,10 +19,13 @@ webhook
       Runs the webhook webserver
 
 # global flags
--c, --config string         Location of Polaris configuration file.
-    --disallow-exemptions   Disallow any exemptions from configuration file.
-    --kubeconfig string     Paths to a kubeconfig. Only required if out-of-cluster.
-    --log-level string      Logrus log level. (default "info")
+-c, --config string                    Location of Polaris configuration file.
+-x, --context string                   Set the kube context.
+    --disallow-exemptions              Disallow any exemptions from configuration file.
+    --disallow-config-exemptions       Disallow exemptions set within the configuration file.
+    --disallow-annotation-exemptions   Disallow any exemption defined as a controller annotation.
+    --kubeconfig string                Paths to a kubeconfig. Only required if out-of-cluster.
+    --log-level string                 Logrus log level. (default "info")
 
 # dashboard flags
     --audit-path string          If specified, audits one or more YAML files instead of a cluster.
@@ -35,12 +38,14 @@ webhook
 
 # audit flags
     --audit-path string               If specified, audits one or more YAML files instead of a cluster.
+    --checks stringArray              Optional flag to specify specific checks to check
     --color                           Whether to use color in pretty format. (default true)
     --display-name string             An optional identifier for the audit.
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
     --helm-chart string               Will fill out Helm template
     --helm-values string              Optional flag to add helm values
 -h, --help                            help for audit
+    --namespace string                Namespace to audit. Only applies to in-cluster audits
     --only-show-failed-tests          If specified, audit output will only show failed tests.
     --output-file string              Destination file for audit results.
     --output-url string               Destination URL to send audit results.

docs/contributing.md

@@ -73,50 +73,7 @@ Each new pull request should:
 - Be up to date and/or rebased on the master branch
 
 ## Creating a new release
+To create a new release, simply tag this repo with the new version.
 
-### Patch releases
-Patch releases only need to change this repo. The Helm chart and deploy scripts
-will automatically pull in the latest changes.
-
-If the release involves changes to anything in the `deploy/` folder (e.g. new RBAC permissions),
-it needs to be a minor or major release in order to prevent breaking the Helm chart.
-
-1. Create a PR for this repo
-    1. Bump the version number in:
-        1. main.go
-        2. README.md
-    2. Update CHANGELOG.md
-    3. Merge your PR
-2. Tag the latest branch for this repo
-    1. Pull the latest commit for the `master` branch (which you just merged in your PR)
-    2. Run `git tag $VERSION && git push --tags`
-    3. Make sure CircleCI runs successfully for the new tag - this will push images to quay.io and create a release in GitHub
-        1. If CircleCI fails, check with Codeowners ASAP
-
-### Minor/Major releases
-Minor and major releases need to change both this repository and the
-[Helm chart repo](https://github.com/FairwindsOps/charts/).
-
-The steps are:
-1. Modify the [Helm chart](https://github.com/FairwindsOps/charts/stable/polaris)
-    1. Clone the helm charts repo
-        1. `git clone https://github.com/FairwindsOps/charts`
-        2. `git checkout -b yourname/update-polaris`
-    1. Bump the version number in `stable/polaris/Chart.yaml`
-    2. Make any necessary changes to the chart to support the new version of Polaris (e.g. new RBAC permissions)
-    3. **Don't merge yet!**
-2. Create a PR for this repo
-    1. Create a new branch named `yourname/update-version`
-    2. Bump the version number in:
-        1. main.go
-        2. README.md
-    3. Regenerate the deployment files. Assuming you've cloned the charts repo to `~/git/charts`:
-        1. `CHARTS_DIR=~/git/charts ./scripts/generate-deployment-files.sh`
-    4. Update CHANGELOG.md
-    5. Merge your PR
-3. Tag the latest branch for this repo
-    1. Pull the latest for the `master` branch
-    2. Run `git tag $VERSION && git push --tags`
-    3. Make sure CircleCI runs successfully for the new tag - this will push images to quay.io and create a release in GitHub
-        1. If CircleCI fails, check with Codeowners ASAP
-4. Create and merge a PR for your changes to the Helm chart
+For major and minor releases, don't forget to update the Helm chart at
+https://github.com/FairwindsOps/charts

docs/customization/custom-checks.md

@@ -43,8 +43,8 @@ check ID. Note that you'll also have to set its severity in the `checks` section
 * `category` - one of `Security`, `Efficiency`, or `Reliability`
 * `target` - specifies the type of resource to check. This can be:
   * a group and kind, e.g. `apps/Deployment` or `networking.k8s.io/Ingress`
-  * `Controller`, to check _any_ resource that contains a pod spec (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
-  * `Pod`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
+  * `Controller`, to check _any_ resource that creates Pods (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
+  * `PodSpec`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
   * `Container` same as `Controller`, but the schema applies to all Container specs rather than the top-level controller
 * `controllers` - if `target` is `Controller`, `Pod` or `Container`, you can use this to change which types of controllers are checked
 * `controllers.include` - _only_ check these controllers

docs/dashboard.md

@@ -16,11 +16,6 @@ don't conform to best practices.
 
 ## Installation
 
-### kubectl
-```bash
-kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/dashboard.yaml
-kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
-```
 ### Helm
 ```bash
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable

docs/infrastructure-as-code.md

@@ -88,9 +88,9 @@ The version number of the release tag.
 ##### Example usage
 
 ```yaml
-uses: fairwindsops/polaris@master
+uses: fairwindsops/polaris/.github/actions/setup-polaris@master
 with:
-  version: "3.0.3"
+  version: 5.0.0
 ```
 
 Example inside a job:
@@ -99,9 +99,9 @@ Example inside a job:
 steps:
   - uses: actions/checkout@v2
   - name: Setup polaris
-    uses: fairwindsops/polaris@master
+    uses: fairwindsops/polaris/.github/actions/setup-polaris@master
     with:
-      version: 3.0.3
+      version: 5.0.0
 
   - name: Use command
     run: polaris version

examples/config-full.yaml

@@ -1,6 +1,6 @@
 checks:
   # reliability
-  multipleReplicasForDeployment: warning
+  deploymentMissingReplicas: warning
   priorityClassNotSet: warning
   tagNotSpecified: danger
   pullPolicyNotAlways: warning
@@ -16,16 +16,17 @@ checks:
   hostPIDSet: danger
   notReadOnlyRootFilesystem: warning
   privilegeEscalationAllowed: danger
-  runAsRootAllowed: warning
+  runAsRootAllowed: danger
   runAsPrivileged: danger
   dangerousCapabilities: danger
   insecureCapabilities: warning
-  hostNetworkSet: warning
+  hostNetworkSet: danger
   hostPortSet: warning
   # custom
   resourceLimits: warning
   imageRegistry: danger
 
+  
 exemptions:
   - controllerNames:
     - my-network-controller
@@ -86,4 +87,3 @@ customChecks:
           type: string
           not:
             pattern: ^quay.io
-

examples/config.yaml

@@ -1,6 +1,6 @@
 checks:
   # reliability
-  multipleReplicasForDeployment: ignore
+  deploymentMissingReplicas: warning
   priorityClassNotSet: ignore
   tagNotSpecified: danger
   pullPolicyNotAlways: warning
@@ -20,14 +20,14 @@ checks:
   hostPIDSet: danger
   notReadOnlyRootFilesystem: warning
   privilegeEscalationAllowed: danger
-  runAsRootAllowed: warning
+  runAsRootAllowed: danger
   runAsPrivileged: danger
   dangerousCapabilities: danger
   insecureCapabilities: warning
-  hostNetworkSet: warning
+  hostNetworkSet: danger
   hostPortSet: warning
   tlsSettingsMissing: warning
-
+ 
 exemptions:
   - namespace: kube-system
     controllerNames:

fairwinds-insights.yaml

@@ -2,13 +2,6 @@ options:
   organization: fairwinds-opensource
   baseBranch: master
 
-# These images will be scanned for vulnerabilities.
 images:
   docker:
   - quay.io/fairwinds/polaris:$CI_SHA1
-
-# These manifests will be scanned for configuration issues.
-manifests:
-  yaml:
-  - ./deploy/dashboard.yaml
-  - ./deploy/webhook.yaml

go.mod

@@ -1,25 +1,93 @@
 module github.com/fairwindsops/polaris
 
-go 1.15
+go 1.17
 
 require (
-	github.com/fatih/color v1.12.0
-	github.com/gobuffalo/packr/v2 v2.8.1
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/uuid v1.1.3 // indirect
+	github.com/evanphx/json-patch/v5 v5.6.0
+	github.com/fatih/color v1.13.0
+	github.com/gobuffalo/packr/v2 v2.8.3
 	github.com/gorilla/mux v1.8.0
-	github.com/karrick/godirwalk v1.16.1 // indirect
 	github.com/qri-io/jsonschema v0.1.1
-	github.com/rogpeppe/go-internal v1.6.2 // indirect
 	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.2.1
+	github.com/spf13/cobra v1.4.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.0
-	github.com/thoas/go-funk v0.9.0
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
-	k8s.io/api v0.22.0
-	k8s.io/apimachinery v0.22.0
-	k8s.io/client-go v0.22.0
-	sigs.k8s.io/controller-runtime v0.9.6
-	sigs.k8s.io/yaml v1.2.0
+	github.com/stretchr/testify v1.7.1
+	github.com/thoas/go-funk v0.9.2
+	golang.org/x/text v0.3.7 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/api v0.24.1
+	k8s.io/apimachinery v0.24.1
+	k8s.io/client-go v0.24.1
+	sigs.k8s.io/controller-runtime v0.12.1
+	sigs.k8s.io/yaml v1.3.0
+)
+
+require gomodules.xyz/jsonpatch/v2 v2.2.0
+
+require (
+	cloud.google.com/go/compute v1.6.1 // indirect
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.1 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.8.0 // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.20.0 // indirect
+	github.com/go-openapi/swag v0.21.1 // indirect
+	github.com/gobuffalo/logger v1.0.6 // indirect
+	github.com/gobuffalo/packd v1.0.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.4.1 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/gnostic v0.6.9 // indirect
+	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/karrick/godirwalk v1.17.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/markbates/errx v1.1.0 // indirect
+	github.com/markbates/oncer v1.0.0 // indirect
+	github.com/markbates/safe v1.0.1 // indirect
+	github.com/mattn/go-colorable v0.1.12 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.12.2 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.34.0 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/qri-io/jsonpointer v0.1.1 // indirect
+	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
+	golang.org/x/net v0.0.0-20220607020251-c690dde0001d // indirect
+	golang.org/x/oauth2 v0.0.0-20220524215830-622c5d57e401 // indirect
+	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
+	golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 // indirect
+	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/component-base v0.24.1 // indirect
+	k8s.io/klog/v2 v2.60.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20220603121420-31174f50af60 // indirect
+	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
+	sigs.k8s.io/json v0.0.0-20220525155127-227cbc7cc124 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 )

main.go

@@ -15,12 +15,14 @@
 package main
 
 import (
-	"github.com/fairwindsops/polaris/cmd/polaris"
+	cmd "github.com/fairwindsops/polaris/cmd/polaris"
 )
 
 const (
-	// Version represents the current release version of Polaris
-	Version = "4.0.8"
+	// Version is set during build
+	Version = "development"
+	// Commit is set during build
+	Commit = ""
 )
 
 func main() {

pkg/config/checks.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config
 
 import (
@@ -13,7 +27,7 @@ var (
 	// tests as we migrate toward JSON schema
 	checkOrder = []string{
 		// Controller Checks
-		"multipleReplicasForDeployment",
+		"deploymentMissingReplicas",
 		// Pod checks
 		"hostIPCSet",
 		"hostPIDSet",

pkg/config/config.go

@@ -29,11 +29,16 @@ import (
 
 // Configuration contains all of the config for the validation checks.
 type Configuration struct {
-	DisplayName        string                 `json:"displayName"`
-	Checks             map[string]Severity    `json:"checks"`
-	CustomChecks       map[string]SchemaCheck `json:"customChecks"`
-	Exemptions         []Exemption            `json:"exemptions"`
-	DisallowExemptions bool                   `json:"disallowExemptions"`
+	DisplayName                  string                 `json:"displayName"`
+	Checks                       map[string]Severity    `json:"checks"`
+	CustomChecks                 map[string]SchemaCheck `json:"customChecks"`
+	Exemptions                   []Exemption            `json:"exemptions"`
+	DisallowExemptions           bool                   `json:"disallowExemptions"`
+	DisallowConfigExemptions     bool                   `json:"disallowConfigExemptions"`
+	DisallowAnnotationExemptions bool                   `json:"disallowAnnotationExemptions"`
+	Mutations                    []string               `json:"mutations"`
+	KubeContext                  string                 `json:"kubeContext"`
+	Namespace                    string                 `json:"namespace"`
 }
 
 // Exemption represents an exemption to normal rules

pkg/config/exemptions.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config
 
 import (
@@ -11,7 +25,7 @@ func (conf Configuration) IsActionable(ruleID string, objMeta metav1.Object, con
 	if severity, ok := conf.Checks[ruleID]; !ok || !severity.IsActionable() {
 		return false
 	}
-	if conf.DisallowExemptions {
+	if conf.DisallowExemptions || conf.DisallowConfigExemptions {
 		return true
 	}
 	for _, exemption := range conf.Exemptions {

pkg/config/exemptions_test.go

@@ -25,40 +25,40 @@ import (
 
 var confContainerTest = `
 checks:
-  multipleReplicasForDeployment: warning
+  deploymentMissingReplicas: warning
   priorityClassNotSet: warning
   pullPolicyNotAlways: warning
 exemptions:
   - namespace: prometheus
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
   - controllerNames: 
       - controller2
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
   - namespace: kube-system
     controllerNames:
       - controller3
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
   - containerNames:
       - container41
       - container42
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
   - namespace: kube-system
     containerNames:
       - container51
       - container52
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
   - controllerNames:
       - controller6
     containerNames:
       - container61
       - container62
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
   - namespace: kube-system
     controllerNames:
       - controller7
@@ -66,7 +66,7 @@ exemptions:
       - container71
       - container72
     rules:
-      - multipleReplicasForDeployment
+      - deploymentMissingReplicas
       - priorityClassNotSet
   - namespace: polaris
 `
@@ -86,22 +86,22 @@ func TestNamespaceExemptionForSpecifiedRules(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", ""), "")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", ""), "")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller1"), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller1"), "container11")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", ""), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", ""), "container11")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller1"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller1"), "")
 	assert.False(t, actionable)
 
 	actionable = parsedConf.IsActionable("pullPolicyNotAlways", createMeta("prometheus", "controller1"), "")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "")
 	assert.True(t, actionable)
 }
 
@@ -109,16 +109,16 @@ func TestNamespaceExemptionForAllRules(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", ""), "")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", ""), "")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", "controller1"), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", "controller1"), "container11")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", ""), "container11")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", ""), "container11")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("polaris", "controller1"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("polaris", "controller1"), "")
 	assert.False(t, actionable)
 
 	actionable = parsedConf.IsActionable("pullPolicyNotAlways", createMeta("polaris", "controller1"), "")
@@ -129,28 +129,28 @@ func TestControllerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller2"), "")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller2"), "")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller2"), "container21")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller2"), "container21")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller2"), "container21")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller2"), "container21")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("prometheus", "controller2"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("prometheus", "controller2"), "")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller3"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller3"), "")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller3"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller3"), "")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller3"), "container31")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller3"), "container31")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller4"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller4"), "")
 	assert.True(t, actionable)
 }
 
@@ -158,22 +158,22 @@ func TestOnlyContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container41")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container41")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container42")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container42")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller4"), "container41")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller4"), "container41")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container41")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container41")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller4"), "container41")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller4"), "container41")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container51")
 	assert.True(t, actionable)
 }
 
@@ -181,25 +181,25 @@ func TestNamespaceAndContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container51")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container51")
 	assert.False(t, actionable)
 
 	actionable = parsedConf.IsActionable("priorityClassNotSet", createMeta("kube-system", ""), "container51")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller5"), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller5"), "container51")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller5"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller5"), "")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("insights-agent", ""), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("insights-agent", ""), "container51")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container51")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller5"), "container51")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller5"), "container51")
 	assert.True(t, actionable)
 }
 
@@ -207,25 +207,25 @@ func TestControllerAndContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller6"), "container61")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller6"), "container61")
 	assert.False(t, actionable)
 
 	actionable = parsedConf.IsActionable("priorityClassNotSet", createMeta("", "controller6"), "container61")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller6"), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller6"), "container61")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller6"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller6"), "")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller7"), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller7"), "container61")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container61")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container61")
 	assert.True(t, actionable)
 }
 
@@ -233,28 +233,28 @@ func TestContainerExemption(t *testing.T) {
 	parsedConf, err := Parse([]byte(confContainerTest))
 	assert.NoError(t, err)
 
-	actionable := parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", ""), "container71")
+	actionable := parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", ""), "container71")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", ""), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", ""), "container71")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("", "controller7"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("", "controller7"), "container71")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller7"), "")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller7"), "")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller7"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller7"), "container71")
 	assert.False(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("insights-agent", "controller7"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("insights-agent", "controller7"), "container71")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller6"), "container71")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller6"), "container71")
 	assert.True(t, actionable)
 
-	actionable = parsedConf.IsActionable("multipleReplicasForDeployment", createMeta("kube-system", "controller7"), "container61")
+	actionable = parsedConf.IsActionable("deploymentMissingReplicas", createMeta("kube-system", "controller7"), "container61")
 	assert.True(t, actionable)
 
 	actionable = parsedConf.IsActionable("priorityClassNotSet", createMeta("kube-system", "controller7"), "container71")

pkg/config/schema.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config
 
 import (
@@ -11,6 +25,7 @@ import (
 
 	"github.com/qri-io/jsonschema"
 	"github.com/thoas/go-funk"
+	"gomodules.xyz/jsonpatch/v2"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	k8sYaml "k8s.io/apimachinery/pkg/util/yaml"
@@ -24,15 +39,21 @@ const (
 	TargetController TargetKind = "Controller"
 	// TargetContainer points to the container spec
 	TargetContainer TargetKind = "Container"
-	// TargetPod points to the pod spec
-	TargetPod TargetKind = "Pod"
+	// TargetPodSpec points to the pod spec
+	TargetPodSpec TargetKind = "PodSpec"
 )
 
 // HandledTargets is a list of target names that are explicitly handled
 var HandledTargets = []TargetKind{
 	TargetController,
 	TargetContainer,
-	TargetPod,
+	TargetPodSpec,
+}
+
+// MutationComment is the comments added to a mutated file
+type MutationComment struct {
+	Find    string `yaml:"find" json:"find"`
+	Comment string `yaml:"comment" json:"comment"`
 }
 
 // SchemaCheck is a Polaris check that runs using JSON Schema
@@ -51,6 +72,8 @@ type SchemaCheck struct {
 	AdditionalSchemas       map[string]map[string]interface{} `yaml:"additionalSchemas" json:"additionalSchemas"`
 	AdditionalSchemaStrings map[string]string                 `yaml:"additionalSchemaStrings" json:"additionalSchemaStrings"`
 	AdditionalValidators    map[string]jsonschema.RootSchema  `yaml:"-" json:"-"`
+	Mutations               []jsonpatch.Operation             `yaml:"mutations" json:"mutations"`
+	Comments                []MutationComment                 `yaml:"comments" json:"comments"`
 }
 
 type resourceMinimum string
@@ -230,8 +253,8 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
 	return &newCheck, err
 }
 
-// CheckPod checks a pod spec against the schema
-func (check SchemaCheck) CheckPod(pod *corev1.PodSpec) (bool, []jsonschema.ValError, error) {
+// CheckPodSpec checks a pod spec against the schema
+func (check SchemaCheck) CheckPodSpec(pod *corev1.PodSpec) (bool, []jsonschema.ValError, error) {
 	return check.CheckObject(pod)
 }
 

pkg/dashboard/dashboard.go

@@ -130,13 +130,17 @@ func writeTemplate(tmpl *template.Template, data *templateData, w http.ResponseW
 
 func getConfigForQuery(base config.Configuration, query url.Values) config.Configuration {
 	c := base
-	exemptions := query.Get("disallowExemptions")
-	if exemptions == "false" {
-		c.DisallowExemptions = false
-	}
-	if exemptions == "true" {
+	switch query.Get("disallowExemptions") {
+	case "true":
 		c.DisallowExemptions = true
+		c.DisallowConfigExemptions = true
+		c.DisallowAnnotationExemptions = true
+	default:
+		c.DisallowExemptions = false
+		c.DisallowConfigExemptions = false
+		c.DisallowAnnotationExemptions = false
 	}
+
 	return c
 }
 

pkg/dashboard/helpers_test.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package dashboard
 
 import (
@@ -238,4 +252,3 @@ func TestStringInSlice(t *testing.T) {
 	assert.Equal(t, expectedOutput, actual)
 	assert.NotEqual(t, true, actual)
 }
-

pkg/dashboard/templates/dashboard.gohtml

@@ -87,7 +87,7 @@
     <a class="align-self-center"
         target="_blank"
         href="https://www.fairwinds.com/polaris-user-insights-demo?utm_source=polaris&utm_medium=ad&utm_campaign=polarisad">
-      <img src="static/images/FW_Insights_Polaris.svg" />
+      <img src="static/images/benchmark.png" />
     </a>
   </div>
 

pkg/kube/resource.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package kube
 
 import (
@@ -25,12 +39,15 @@ type GenericResource struct {
 }
 
 // NewGenericResourceFromUnstructured creates a workload from an unstructured.Unstructured
-func NewGenericResourceFromUnstructured(unst unstructured.Unstructured) (GenericResource, error) {
+func NewGenericResourceFromUnstructured(unst unstructured.Unstructured, podSpecMap interface{}) (GenericResource, error) {
+	if unst.GetCreationTimestamp().Time.IsZero() {
+		unstructured.RemoveNestedField(unst.Object, "metadata", "creationTimestamp")
+		unstructured.RemoveNestedField(unst.Object, "status")
+	}
 	workload := GenericResource{
 		Kind:     unst.GetKind(),
 		Resource: unst,
 	}
-
 	objMeta, err := meta.Accessor(&unst)
 	if err != nil {
 		return workload, err
@@ -47,7 +64,9 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured) (Generic
 	if err != nil {
 		return workload, err
 	}
-	podSpecMap := GetPodSpec(m)
+	if podSpecMap == nil {
+		podSpecMap = GetPodSpec(m)
+	}
 	if podSpecMap != nil {
 		b, err = json.Marshal(podSpecMap)
 		if err != nil {
@@ -99,7 +118,7 @@ func NewGenericResourceFromBytes(contentBytes []byte) (GenericResource, error) {
 	if err != nil {
 		return GenericResource{}, err
 	}
-	return NewGenericResourceFromUnstructured(unst)
+	return NewGenericResourceFromUnstructured(unst, nil)
 }
 
 // ResolveControllerFromPod builds a new workload for a given Pod
@@ -121,6 +140,8 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 	}
 	topKind := "Pod"
 	topMeta := podWorkload.ObjectMeta
+	var topPodSpec interface{}
+	topPodSpec = podWorkload.Resource.Object
 	owners := podResource.ObjectMeta.GetOwnerReferences()
 	lastKey := ""
 	for len(owners) > 0 {
@@ -153,13 +174,17 @@ func resolveControllerFromPod(ctx context.Context, podResource kubeAPICoreV1.Pod
 			logrus.Warnf("Error retrieving parent metadata %s of API %s and Kind %s because of error: %v ", firstOwner.Name, firstOwner.APIVersion, firstOwner.Kind, err)
 			return GenericResource{}, err
 		}
+		podSpec := GetPodSpec(abstractObject.Object)
+		if podSpec != nil {
+			topPodSpec = podSpec
+		}
 		topMeta = objMeta
 		owners = abstractObject.GetOwnerReferences()
 	}
 
 	if lastKey != "" {
 		unst := objectCache[lastKey]
-		return NewGenericResourceFromUnstructured(unst)
+		return NewGenericResourceFromUnstructured(unst, topPodSpec)
 	}
 	workload, err := NewGenericResourceFromPod(podResource, podResource)
 	if err != nil {

pkg/kube/resources.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package kube
 
 import (
@@ -168,7 +182,7 @@ func CreateResourceProviderFromResource(ctx context.Context, workload string) (*
 		logrus.Errorf("Could not find workload %s: %v", workload, err)
 		return nil, err
 	}
-	workloadObj, err := NewGenericResourceFromUnstructured(*obj)
+	workloadObj, err := NewGenericResourceFromUnstructured(*obj, nil)
 	if err != nil {
 		logrus.Errorf("Could not parse workload %s: %v", workload, err)
 		return nil, err
@@ -201,7 +215,11 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 			logrus.Errorf("Error reading file: %v", path)
 			return err
 		}
-		return resources.addResourcesFromYaml(string(contents))
+		err = resources.addResourcesFromYaml(string(contents))
+		if err != nil {
+			logrus.Warnf("Skipping %s: cannot add resource from YAML: %v", path, err)
+		}
+		return nil
 	}
 
 	err := filepath.Walk(directory, visitFile)
@@ -211,9 +229,16 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 	return &resources, nil
 }
 
+// CreateResourceProviderFromYaml returns a new ResourceProvider using the yaml
+func CreateResourceProviderFromYaml(yamlContent string) *ResourceProvider {
+	resources := newResourceProvider("unknown", "Content", "unknown")
+	resources.addResourcesFromYaml(string(yamlContent))
+	return &resources
+}
+
 // CreateResourceProviderFromCluster creates a new ResourceProvider using live data from a cluster
 func CreateResourceProviderFromCluster(ctx context.Context, c conf.Configuration) (*ResourceProvider, error) {
-	kubeConf, configError := config.GetConfig()
+	kubeConf, configError := config.GetConfigWithContext(c.KubeContext)
 	if configError != nil {
 		logrus.Errorf("Error fetching KubeConfig: %v", configError)
 		return nil, configError
@@ -239,19 +264,38 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		logrus.Errorf("Error fetching Cluster API version: %v", err)
 		return nil, err
 	}
-	provider := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, "Cluster", clusterName)
+
+	sourceType := "Cluster"
+	if c.Namespace != "" {
+		logrus.Debug("namespace is specififed in config, setting source type to ClusterNamespace")
+		sourceType = "ClusterNamespace"
+	}
+	provider := newResourceProvider(serverVersion.Major+"."+serverVersion.Minor, sourceType, clusterName)
 
 	nodes, err := kube.CoreV1().Nodes().List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Nodes: %v", err)
 		return nil, err
 	}
-	namespaces, err := kube.CoreV1().Namespaces().List(ctx, listOpts)
-	if err != nil {
-		logrus.Errorf("Error fetching Namespaces: %v", err)
-		return nil, err
+
+	var namespaces *corev1.NamespaceList
+	if c.Namespace != "" {
+		ns, err := kube.CoreV1().Namespaces().Get(ctx, c.Namespace, metav1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+		namespaces = &corev1.NamespaceList{
+			Items: []corev1.Namespace{*ns},
+		}
+	} else {
+		nsList, err := kube.CoreV1().Namespaces().List(ctx, listOpts)
+		if err != nil {
+			logrus.Errorf("Error fetching Namespaces: %v", err)
+			return nil, err
+		}
+		namespaces = nsList
 	}
-	pods, err := kube.CoreV1().Pods("").List(ctx, listOpts)
+	pods, err := kube.CoreV1().Pods(c.Namespace).List(ctx, listOpts)
 	if err != nil {
 		logrus.Errorf("Error fetching Pods: %v", err)
 		return nil, err
@@ -287,6 +331,7 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		}
 	}
 
+	var kubernetesResources []GenericResource
 	for _, kind := range additionalKinds {
 		groupKind := parseGroupKind(maybeTransformKindIntoGroupKind(string(kind)))
 		mapping, err := (restMapper).RESTMapping(groupKind)
@@ -295,17 +340,17 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 			return nil, err
 		}
 
-		objects, err := (*dynamic).Resource(mapping.Resource).Namespace("").List(ctx, metav1.ListOptions{})
+		objects, err := (*dynamic).Resource(mapping.Resource).Namespace(c.Namespace).List(ctx, metav1.ListOptions{})
 		if err != nil {
 			logrus.Warnf("Error retrieving parent object API %s and Kind %s because of error: %v", mapping.Resource.Version, mapping.Resource.Resource, err)
 			return nil, err
 		}
 		for _, obj := range objects.Items {
-			res, err := NewGenericResourceFromUnstructured(obj)
+			res, err := NewGenericResourceFromUnstructured(obj, nil)
 			if err != nil {
 				return nil, err
 			}
-			provider.Resources.addResource(res)
+			kubernetesResources = append(kubernetesResources, res)
 		}
 	}
 
@@ -316,9 +361,12 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		logrus.Errorf("Error loading controllers from pods: %v", err)
 		return nil, err
 	}
+	// resources loaded from custom checks can also contain controllers and thus would be added twice to the provider
+	kubernetesResources = deduplicateControllers(append(kubernetesResources, controllers...))
+
 	provider.Nodes = nodes.Items
 	provider.Namespaces = namespaces.Items
-	provider.Resources.addResources(controllers)
+	provider.Resources.addResources(kubernetesResources)
 	return &provider, nil
 }
 
@@ -341,14 +389,14 @@ func LoadControllers(ctx context.Context, pods []corev1.Pod, dynamicClientPointe
 		}
 		interfaces = append(interfaces, workload)
 	}
-	return deduplicateControllers(interfaces), nil
+	return interfaces, nil
 }
 
 // Because the controllers with an Owner take on the name of the Owner, this eliminates any duplicates.
 // In cases like CronJobs older children can hang around, so this takes the most recent.
-func deduplicateControllers(inputControllers []GenericResource) []GenericResource {
+func deduplicateControllers(inputResources []GenericResource) []GenericResource {
 	controllerMap := make(map[string]GenericResource)
-	for _, controller := range inputControllers {
+	for _, controller := range inputResources {
 		key := controller.ObjectMeta.GetNamespace() + "/" + controller.Kind + "/" + controller.ObjectMeta.GetName()
 		oldController, ok := controllerMap[key]
 		if !ok || controller.ObjectMeta.GetCreationTimestamp().Time.After(oldController.ObjectMeta.GetCreationTimestamp().Time) {
@@ -399,7 +447,6 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 	decoder = k8sYaml.NewYAMLOrJSONDecoder(bytes.NewReader(contentBytes), 1000)
 
 	if err != nil {
-		logrus.Errorf("Invalid YAML: %s", string(contents))
 		return err
 	}
 	if resource.Kind == "Namespace" {

pkg/kube/resources_test.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package kube
 
 import (
@@ -60,7 +74,7 @@ func TestGetMultipleResourceFromSingleFile(t *testing.T) {
 
 func TestGetMultipleResourceFromBadFile(t *testing.T) {
 	_, err := CreateResourceProviderFromPath("./test_files/test_3")
-	assert.NotEqual(t, nil, err, "CreateResource From Path should fail with bad yaml")
+	assert.Equal(t, nil, err, "CreateResource From Path should not fail with bad yaml")
 }
 
 func TestAddResourcesFromReader(t *testing.T) {
@@ -83,15 +97,6 @@ func TestAddResourcesFromReader(t *testing.T) {
 
 func TestGetResourceFromAPI(t *testing.T) {
 	k8s, dynamicInterface := test.SetupTestAPI(test.GetMockControllers("test")...)
-	resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, "test", &dynamicInterface, conf.Configuration{})
-	assert.Equal(t, nil, err, "Error should be nil")
-
-	assert.Equal(t, "Cluster", resources.SourceType, "Should have type Path")
-	assert.Equal(t, "test", resources.SourceName, "Should have source name")
-	assert.IsType(t, time.Now(), resources.CreationTime, "Creation time should be set")
-
-	assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
-	assert.Equal(t, 5, len(resources.Resources), "Should have 5 controllers")
 
 	expectedNames := map[string]bool{
 		"deploy":      false,
@@ -100,12 +105,68 @@ func TestGetResourceFromAPI(t *testing.T) {
 		"statefulset": false,
 		"daemonset":   false,
 	}
-	for _, controllers := range resources.Resources {
-		for _, ctrl := range controllers {
-			expectedNames[ctrl.ObjectMeta.GetName()] = true
-		}
+
+	tests := []struct {
+		name        string
+		config      conf.Configuration
+		want        *ResourceProvider
+		wantErr     bool
+		clusterName string
+	}{
+		{
+			name:        "standard",
+			config:      conf.Configuration{},
+			clusterName: "test1",
+			want: &ResourceProvider{
+				SourceType:   "Cluster",
+				SourceName:   "test1",
+				CreationTime: time.Now(),
+			},
+		},
+		{
+			name: "namespaced",
+			config: conf.Configuration{
+				Namespace: "test",
+			},
+			clusterName: "test2",
+			want: &ResourceProvider{
+				SourceType:   "ClusterNamespace",
+				SourceName:   "test2",
+				CreationTime: time.Now(),
+			},
+		},
+		{
+			name: "namespace does not exist",
+			config: conf.Configuration{
+				Namespace: "test3",
+			},
+			clusterName: "test3",
+			wantErr:     true,
+		},
 	}
-	for name, val := range expectedNames {
-		assert.Equal(t, true, val, name)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resources, err := CreateResourceProviderFromAPI(context.Background(), k8s, tt.clusterName, &dynamicInterface, tt.config)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.want.SourceType, resources.SourceType)
+				assert.Equal(t, tt.want.SourceName, resources.SourceName)
+				assert.IsType(t, tt.want.CreationTime, resources.CreationTime)
+				assert.Equal(t, 0, len(resources.Nodes), "Should not have any nodes")
+				assert.Equal(t, 5, len(resources.Resources), "Should have 5 controllers")
+
+				for _, controllers := range resources.Resources {
+					for _, ctrl := range controllers {
+						expectedNames[ctrl.ObjectMeta.GetName()] = true
+					}
+				}
+				for name, val := range expectedNames {
+					assert.Equal(t, true, val, name)
+				}
+			}
+		})
 	}
 }

pkg/mutation/mutate.go

@@ -0,0 +1,115 @@
+package mutation
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	jsonpatchV5 "github.com/evanphx/json-patch/v5"
+	"github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/kube"
+	"github.com/fairwindsops/polaris/pkg/validator"
+	"github.com/thoas/go-funk"
+	"gomodules.xyz/jsonpatch/v2"
+)
+
+// ApplyAllSchemaMutations applies available mutation to a single resource
+func ApplyAllSchemaMutations(conf *config.Configuration, resourceProvider *kube.ResourceProvider, resource kube.GenericResource, mutations []jsonpatch.Operation) (kube.GenericResource, error) {
+	resByte := resource.OriginalObjectJSON
+	var jsonByte []byte
+	mutationByte, err := json.Marshal(mutations)
+	if err != nil {
+		return resource, err
+	}
+
+	patch, err := jsonpatchV5.DecodePatch(mutationByte)
+	if err != nil {
+		return resource, err
+	}
+	jsonByte, err = patch.Apply(resByte)
+	if err != nil {
+		return resource, err
+	}
+	mutated, err := kube.NewGenericResourceFromBytes(jsonByte)
+	if err != nil {
+		return resource, err
+	}
+
+	return mutated, nil
+}
+
+// GetMutationsAndCommentsFromResults returns all mutations from results
+func GetMutationsAndCommentsFromResults(results []validator.Result) ([]config.MutationComment, map[string][]jsonpatch.Operation) {
+	allMutationsFromResults := make(map[string][]jsonpatch.Operation)
+	comments := []config.MutationComment{}
+	for _, result := range results {
+		key := fmt.Sprintf("%s/%s/%s", result.Kind, result.Name, result.Namespace)
+
+		mutations, resultsComments := GetMutationsAndCommentsFromResult(&result)
+		allMutationsFromResults[key] = mutations
+		comments = append(comments, resultsComments...)
+
+	}
+	return comments, allMutationsFromResults
+}
+
+// GetMutationsAndCommentsFromResult returns all mutations from single result
+func GetMutationsAndCommentsFromResult(result *validator.Result) ([]jsonpatch.Operation, []config.MutationComment) {
+	mutations := []jsonpatch.Operation{}
+	comments := []config.MutationComment{}
+	for _, resultMessage := range result.Results {
+		if len(resultMessage.Mutations) > 0 {
+			mutations = append(mutations, resultMessage.Mutations...)
+		}
+		if len(resultMessage.Comments) > 0 {
+			comments = append(comments, resultMessage.Comments...)
+		}
+	}
+
+	for _, resultMessage := range result.PodResult.Results {
+		if len(resultMessage.Mutations) > 0 {
+			mutations = append(mutations, resultMessage.Mutations...)
+		}
+		if len(resultMessage.Comments) > 0 {
+			comments = append(comments, resultMessage.Comments...)
+		}
+	}
+
+	for _, containerResult := range result.PodResult.ContainerResults {
+		for _, resultMessage := range containerResult.Results {
+			if len(resultMessage.Mutations) > 0 {
+				mutations = append(mutations, resultMessage.Mutations...)
+			}
+			if len(resultMessage.Comments) > 0 {
+				comments = append(comments, resultMessage.Comments...)
+			}
+		}
+	}
+
+	return mutations, comments
+}
+
+// UpdateMutatedContentWithComments Updates mutated object with comments
+func UpdateMutatedContentWithComments(yamlContent string, comments []config.MutationComment) string {
+	var lines []string
+	scanner := bufio.NewScanner(strings.NewReader(yamlContent))
+	scanner.Split(bufio.ScanLines)
+	for scanner.Scan() {
+		line := scanner.Text()
+		lines = append(lines, line)
+	}
+	commentMap := funk.Map(comments, func(c config.MutationComment) (string, string) {
+		return c.Find, c.Comment
+	}).(map[string]string)
+	fileContent := ""
+	for _, line := range lines {
+		comment, ok := commentMap[strings.TrimSpace(line)]
+		if ok {
+			line += (" #" + comment)
+		}
+		fileContent += line
+		fileContent += "\n"
+	}
+	return fileContent
+}

pkg/validator/arbitrary_test.go

@@ -33,7 +33,7 @@ func TestValidatePDB(t *testing.T) {
 		},
 	}
 	pdb := unstructured.Unstructured{}
-	res, err := kube.NewGenericResourceFromUnstructured(pdb)
+	res, err := kube.NewGenericResourceFromUnstructured(pdb, nil)
 	res.Kind = "PodDisruptionBudget"
 
 	actualResult, err := applyNonControllerSchemaChecks(&c, nil, res)
@@ -45,7 +45,7 @@ func TestValidatePDB(t *testing.T) {
 	assert.False(t, results.Success)
 	assert.Equal(t, conf.SeverityWarning, results.Severity)
 	assert.Equal(t, "Reliability", results.Category)
-	assert.EqualValues(t, "disruptionsAllowed is not greater than zero", results.Message)
+	assert.EqualValues(t, "Voluntary evictions are not possible", results.Message)
 }
 
 func TestValidateIngress(t *testing.T) {
@@ -70,7 +70,7 @@ func TestValidateIngress(t *testing.T) {
 	if err != nil {
 		panic(err)
 	}
-	res, err := kube.NewGenericResourceFromUnstructured(unst)
+	res, err := kube.NewGenericResourceFromUnstructured(unst, nil)
 	if err != nil {
 		panic(err)
 	}

pkg/validator/controller_test.go

@@ -64,11 +64,11 @@ func TestControllerLevelChecks(t *testing.T) {
 	testResources := func(res *kube.ResourceProvider) {
 		c := conf.Configuration{
 			Checks: map[string]conf.Severity{
-				"multipleReplicasForDeployment": conf.SeverityDanger,
+				"deploymentMissingReplicas": conf.SeverityDanger,
 			},
 		}
 		expectedResult := ResultMessage{
-			ID:       "multipleReplicasForDeployment",
+			ID:       "deploymentMissingReplicas",
 			Severity: "danger",
 			Category: "Reliability",
 		}
@@ -85,7 +85,7 @@ func TestControllerLevelChecks(t *testing.T) {
 				expectedResult.Message = "Only one replica is scheduled"
 			}
 			expectedResults := ResultSet{
-				"multipleReplicasForDeployment": expectedResult,
+				"deploymentMissingReplicas": expectedResult,
 			}
 
 			assert.Equal(t, "Deployment", actualResult.Kind)

pkg/validator/fullaudit.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator
 
 import (

pkg/validator/fullaudit_test.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator
 
 import (

pkg/validator/output.go

@@ -20,6 +20,7 @@ import (
 
 	"github.com/fatih/color"
 	"github.com/thoas/go-funk"
+	"gomodules.xyz/jsonpatch/v2"
 
 	"github.com/fairwindsops/polaris/pkg/config"
 )
@@ -72,12 +73,14 @@ type ClusterInfo struct {
 
 // ResultMessage is the result of a given check
 type ResultMessage struct {
-	ID       string
-	Message  string
-	Details  []string
-	Success  bool
-	Severity config.Severity
-	Category string
+	ID        string
+	Message   string
+	Details   []string
+	Success   bool
+	Severity  config.Severity
+	Category  string
+	Mutations []jsonpatch.Operation
+	Comments  []config.MutationComment
 }
 
 // ResultSet contiains the results for a set of checks
@@ -166,7 +169,7 @@ func (res AuditData) GetPrettyOutput(useColor bool) string {
 func (res Result) GetPrettyOutput() string {
 	str := titleColor.Sprint(fmt.Sprintf("%s %s", res.Kind, res.Name))
 	if res.Namespace != "" {
-		str += titleColor.Sprint(fmt.Sprintf("in namespace %s", res.Namespace))
+		str += titleColor.Sprint(fmt.Sprintf(" in namespace %s", res.Namespace))
 	}
 	str += "\n"
 	str += res.Results.GetPrettyOutput()

pkg/validator/schema.go

@@ -1,12 +1,30 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator
 
 import (
+	"errors"
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/qri-io/jsonschema"
+	"github.com/sirupsen/logrus"
 	"github.com/thoas/go-funk"
+	"gomodules.xyz/jsonpatch/v2"
 	corev1 "k8s.io/api/core/v1"
 	metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -23,7 +41,9 @@ type schemaTestCase struct {
 }
 
 func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCase) (*config.SchemaCheck, error) {
-	if !conf.DisallowExemptions && hasExemptionAnnotation(test.Resource.ObjectMeta, checkID) {
+	if !conf.DisallowExemptions &&
+		!conf.DisallowAnnotationExemptions &&
+		hasExemptionAnnotation(test.Resource.ObjectMeta, checkID) {
 		return nil, nil
 	}
 	check, ok := conf.CustomChecks[checkID]
@@ -146,6 +166,17 @@ func applyControllerSchemaChecks(conf *config.Configuration, resourceProvider *k
 	}
 	finalResult.Results = resultSet
 
+	nonControllerResults, err := applyTopLevelSchemaChecks(conf, resourceProvider, resource, false)
+	if err != nil {
+		return finalResult, err
+	}
+	for key, val := range nonControllerResults {
+		if _, ok := finalResult.Results[key]; ok {
+			return finalResult, errors.New("Duplicate finding for check " + key)
+		}
+		finalResult.Results[key] = val
+	}
+
 	podRS, err := applyPodSchemaChecks(conf, resourceProvider, resource)
 	if err != nil {
 		return finalResult, err
@@ -195,7 +226,7 @@ func applyTopLevelSchemaChecks(conf *config.Configuration, resources *kube.Resou
 
 func applyPodSchemaChecks(conf *config.Configuration, resources *kube.ResourceProvider, controller kube.GenericResource) (ResultSet, error) {
 	test := schemaTestCase{
-		Target:           config.TargetPod,
+		Target:           config.TargetPodSpec,
 		ResourceProvider: resources,
 		Resource:         controller,
 	}
@@ -237,18 +268,34 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	}
 	var passes bool
 	var issues []jsonschema.ValError
+	var prefix string
 	if check.SchemaTarget != "" {
-		if check.SchemaTarget == config.TargetPod && check.Target == config.TargetContainer {
+		if check.SchemaTarget == config.TargetPodSpec && check.Target == config.TargetContainer {
 			podCopy := *test.Resource.PodSpec
 			podCopy.InitContainers = []corev1.Container{}
 			podCopy.Containers = []corev1.Container{*test.Container}
-			passes, issues, err = check.CheckPod(&podCopy)
+			containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
+				return value.Name == test.Container.Name
+			})
+			prefix = getJSONSchemaPrefix(test.Resource.Kind)
+			if prefix != "" {
+				prefix += "/containers/" + strconv.Itoa(containerIndex)
+			}
+			passes, issues, err = check.CheckPodSpec(&podCopy)
 		} else {
 			return nil, fmt.Errorf("Unknown combination of target (%s) and schema target (%s)", check.Target, check.SchemaTarget)
 		}
-	} else if check.Target == config.TargetPod {
-		passes, issues, err = check.CheckPod(test.Resource.PodSpec)
+	} else if check.Target == config.TargetPodSpec {
+		passes, issues, err = check.CheckPodSpec(test.Resource.PodSpec)
+		prefix = getJSONSchemaPrefix(test.Resource.Kind)
 	} else if check.Target == config.TargetContainer {
+		containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
+			return value.Name == test.Container.Name
+		})
+		prefix = getJSONSchemaPrefix(test.Resource.Kind)
+		if prefix != "" {
+			prefix += "/containers/" + strconv.Itoa(containerIndex)
+		}
 		passes, issues, err = check.CheckContainer(test.Container)
 	} else {
 		passes, issues, err = check.CheckObject(test.Resource.Resource.Object)
@@ -277,6 +324,17 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 		}
 	}
 	result := makeResult(conf, check, passes, issues)
+	if !passes {
+		if funk.Contains(conf.Mutations, checkID) {
+			mutations := funk.Map(check.Mutations, func(mutation jsonpatch.Operation) jsonpatch.Operation {
+				mutationCopy := deepCopyMutation(mutation)
+				mutationCopy.Path = prefix + mutationCopy.Path
+				return mutationCopy
+			}).([]jsonpatch.Operation)
+			result.Mutations = mutations
+			result.Comments = check.Comments
+		}
+	}
 	return &result, nil
 }
 
@@ -288,3 +346,26 @@ func getSortedKeys(m map[string]config.Severity) []string {
 	sort.Strings(keys)
 	return keys
 }
+
+func deepCopyMutation(source jsonpatch.Operation) jsonpatch.Operation {
+	destination := jsonpatch.Operation{
+		Operation: source.Operation,
+		Path:      source.Path,
+		Value:     source.Value,
+	}
+	return destination
+}
+
+func getJSONSchemaPrefix(kind string) (prefix string) {
+	if kind == "CronJob" {
+		prefix = "/spec/jobTemplate/spec/template/spec"
+	} else if kind == "Pod" {
+		prefix = "/spec"
+	} else if (kind == "Deployment") || (kind == "DaemonSet") ||
+		(kind == "StatefulSet") || (kind == "Job") || (kind == "ReplicationController") {
+		prefix = "/spec/template/spec"
+	} else {
+		logrus.Warningf("Mutation for this this resource (%s) is not supported", kind)
+	}
+	return prefix
+}

pkg/validator/schema_test.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator
 
 import (

pkg/validator/summary.go

@@ -1,3 +1,17 @@
+// Copyright 2022 FairwindsOps, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package validator
 
 import (

pkg/webhook/mutate.go

@@ -0,0 +1,66 @@
+// Copyright 2022 FairwindsOps Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package webhook
+
+import (
+	"context"
+
+	"github.com/fairwindsops/polaris/pkg/config"
+	"github.com/fairwindsops/polaris/pkg/mutation"
+	"github.com/sirupsen/logrus"
+	"gomodules.xyz/jsonpatch/v2"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+)
+
+// Mutator mutate k8s resources.
+type Mutator struct {
+	Client  client.Client
+	Config  config.Configuration
+	decoder *admission.Decoder
+}
+
+var _ admission.Handler = &Mutator{}
+
+// NewMutateWebhook creates a mutating admission webhook for the apiType.
+func NewMutateWebhook(mgr manager.Manager, mutator Mutator) {
+	path := "/mutate"
+
+	mgr.GetWebhookServer().Register(path, &webhook.Admission{Handler: &mutator})
+}
+
+func (m *Mutator) mutate(req admission.Request) ([]jsonpatch.Operation, error) {
+	results, err := getValidateResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
+	if err != nil {
+		return nil, err
+	}
+	patches, _ := mutation.GetMutationsAndCommentsFromResult(results)
+	return patches, nil
+}
+
+// Handle for Validator to run validation checks.
+func (m *Mutator) Handle(ctx context.Context, req admission.Request) admission.Response {
+	logrus.Info("Starting request")
+	patches, err := m.mutate(req)
+	if err != nil {
+		return admission.Errored(403, err)
+	}
+	if patches == nil {
+		return admission.Allowed("Allowed")
+	}
+	return admission.Patched("", patches...)
+}

pkg/webhook/webhook.go

@@ -47,19 +47,23 @@ func (v *Validator) InjectDecoder(d *admission.Decoder) error {
 
 var _ admission.Handler = &Validator{}
 
-// NewWebhook creates a validating admission webhook for the apiType.
-func NewWebhook(mgr manager.Manager, validator Validator) {
+// NewValidateWebhook creates a validating admission webhook for the apiType.
+func NewValidateWebhook(mgr manager.Manager, validator Validator) {
 	path := "/validate"
 
 	mgr.GetWebhookServer().Register(path, &webhook.Admission{Handler: &validator})
 }
 
 func (v *Validator) handleInternal(req admission.Request) (*validator.Result, error) {
+	return getValidateResults(req.AdmissionRequest.Kind.Kind, v.decoder, req, v.Config)
+}
+
+func getValidateResults(kind string, decoder *admission.Decoder, req admission.Request, config config.Configuration) (*validator.Result, error) {
 	var controller kube.GenericResource
 	var err error
-	if req.AdmissionRequest.Kind.Kind == "Pod" {
+	if kind == "Pod" {
 		pod := corev1.Pod{}
-		err := v.decoder.Decode(req, &pod)
+		err := decoder.Decode(req, &pod)
 		if err != nil {
 			return nil, err
 		}
@@ -75,7 +79,7 @@ func (v *Validator) handleInternal(req admission.Request) (*validator.Result, er
 		return nil, err
 	}
 	// TODO: consider enabling multi-resource checks
-	controllerResult, err := validator.ApplyAllSchemaChecks(&v.Config, nil, controller)
+	controllerResult, err := validator.ApplyAllSchemaChecks(&config, nil, controller)
 	if err != nil {
 		return nil, err
 	}

test/checks/cpuLimitsMissing/mutated.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app.kubernetes.io/name: nginx
+  name: nginx
+spec:
+  containers:
+  - image: nginx
+    name: nginx
+    resources:
+      limits:
+        cpu: 100m #TODO: Set this to the amount of CPU you want to reserve for your workload
+        memory: 128Mi

test/checks/cpuLimitsMissing/success.yaml

@@ -10,5 +10,5 @@ spec:
     image: nginx
     resources: 
       limits: 
-        memory: 256Mi
+        memory: 128Mi
         cpu: 100m

test/checks/cpuRequestsMissing/mutated.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app.kubernetes.io/name: nginx
+  name: nginx
+spec:
+  containers:
+  - image: nginx
+    name: nginx
+    resources:
+      requests:
+        cpu: 100m #TODO: Set this to the amount of CPU you want to reserve for your workload
+        memory: 128Mi

test/checks/cpuRequestsMissing/success.yaml

@@ -10,5 +10,5 @@ spec:
     image: nginx
     resources: 
       requests: 
-        memory: 256Mi
+        memory: 128Mi
         cpu: 100m

test/checks/dangerousCapabilities/failure.all-caps.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add: ["all"]

test/checks/dangerousCapabilities/failure.case.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add:
+        - nEt_aDmIn

test/checks/dangerousCapabilities/success.yaml

@@ -6,9 +6,8 @@ metadata:
     app.kubernetes.io/name: nginx
 spec:
   containers:
-  - name: nginx 
+  - name: nginx
     image: nginx
     securityContext:
       capabilities:
         add:
-        

test/checks/deploymentMissingReplicas/mutated.yaml

@@ -1,12 +1,11 @@
 apiVersion: v1
 kind: Deployment
 metadata:
-  name: nginx
   labels:
     env: test
+  name: nginx
 spec:
   replicas: 3
   template:
     spec:
       containers: []
-

test/checks/deploymentMissingReplicas/success.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers: []

test/checks/hostIPCSet/mutated.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app.kubernetes.io/name: nginx
+  name: nginx
+spec:
+  containers:
+  - image: nginx
+    name: nginx
+    resources: {}

test/checks/hostIPCSet/success.yaml

@@ -8,5 +8,4 @@ spec:
   hostIPC: false
   containers:
   - name: nginx 
-    image: nginx
-        
+    image: nginx

test/checks/hostNetworkSet/mutated.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app.kubernetes.io/name: nginx
+  name: nginx
+spec:
+  containers:
+  - image: nginx
+    name: nginx
+    resources: {}

test/checks/hostPIDSet/mutated.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app.kubernetes.io/name: nginx
+  name: nginx
+spec:
+  containers:
+  - image: nginx
+    name: nginx
+    resources: {}

test/checks/insecureCapabilities/success.all.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+        - All

test/checks/insecureCapabilities/success.case.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - net_admin
+          - ChOwN
+          - DaC_OverriDE
+          - fsetid
+          - FOWNER
+          - MKNOD
+          - NET_RAW
+          - SETGID
+          - SETUID
+          - SETFCAP
+          - SETPCAP
+          - NET_BIND_SERVICE
+          - SYS_CHROOT
+          - KILL
+          - AUDIT_WRITE
+

test/checks/livenessProbeMissing/failure.yaml

@@ -11,4 +11,4 @@ spec:
     args:
     - /bin/sh
     - -c
-    - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600.
+    - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600

test/checks/livenessProbeMissing/mutated.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    test: liveness
+  name: liveness-exec
+spec:
+  containers:
+  - args:
+    - /bin/sh
+    - -c
+    - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600
+    image: k8s.gcr.io/busybox
+    livenessProbe: #TODO: Change livenessProbe setting to reflect your health endpoints
+      exec:
+        command:
+        - cat
+        - /tmp/healthy
+      initialDelaySeconds: 5
+      periodSeconds: 5
+    name: liveness
+    resources: {}