Merge branch 'master' into rb/machine

.circleci/config.yml

@@ -2,12 +2,11 @@ version: 2.1
 
 orbs:
   rok8s: fairwinds/rok8s-scripts@11
-  oss-docs: fairwinds/oss-docs@0
 
 executors:
   vm:
     machine:
-      enabled: true
+      image: cimg/base:stable-20.04
 
 references:
   set_environment_variables: &set_environment_variables
@@ -206,6 +205,48 @@ jobs:
       - setup_remote_docker
       - *set_environment_variables
       - *docker_build_and_push
+  publish_docs:
+    docker:
+      - image: cimg/node:15.5.1
+    steps:
+      - checkout
+      - run:
+          name: Build Docs Site
+          command: |
+            set -e
+            cd ./docs
+            npm install
+            npm run check-links
+            npm run build
+      - run:
+          name: Install Tools
+          command: |
+            cd /tmp
+            echo "Installing AWS CLI"
+            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+            unzip awscliv2.zip
+            sudo ./aws/install
+
+            echo "Installing Hashicorp Vault"
+            curl -LO https://releases.hashicorp.com/vault/1.9.3/vault_1.9.3_linux_amd64.zip
+            unzip vault_1.9.3_linux_amd64.zip
+            sudo mv vault /usr/bin/vault
+            sudo chmod +x /usr/bin/vault
+            vault --version
+
+            echo "Installing yq"
+            curl -LO https://github.com/mikefarah/yq/releases/download/v4.16.2/yq_linux_amd64.tar.gz
+            tar -zxvf yq_linux_amd64.tar.gz
+            sudo mv yq_linux_amd64 /usr/bin/yq
+            sudo chmod +x /usr/bin/yq
+            yq --version
+      - rok8s/get_vault_env:
+          vault_path: repo/polaris/env
+      - run:
+          name: Publish Docs Site to S3
+          command: |
+            cd ./dist
+            aws s3 sync ./ s3://polaris.docs.fairwinds.com --delete
 workflows:
   version: 2
 
@@ -253,8 +294,7 @@ workflows:
               ignore: /.*/
             tags:
               ignore: /^testing-.*/
-      - oss-docs/publish-docs:
-          repository: polaris
+      - publish_docs:
           filters:
             branches:
               ignore: /.*/

.github/workflows/triage.yml

@@ -1,98 +0,0 @@
-name: Triage issues
-on:
-  schedule:
-  - cron: '0 16 * * Mon' # noon ET on Mondays
-  issues:
-    types:
-    - reopened
-    - opened
-  pull_request:
-    types:
-    - reopened
-    - opened
-jobs:
-  notify:
-    if: github.actor!= 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: octokit/request-action@v2.x
-        id: need_triage
-        with:
-          route: GET /repos/FairwindsOps/${{ github.event.repository.name }}/issues?labels=triage
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Scheduled Reminders
-        env:
-          TITLES: ${{ join(fromJSON(steps.need_triage.outputs.data).*.title, ';') }}
-          LINKS: ${{ join(fromJSON(steps.need_triage.outputs.data).*.html_url, ';') }}
-        run: |
-          echo "Scheduled reminder! ${TITLES}"
-          IFS=';' read -r -a titles <<< "$TITLES"
-          IFS=';' read -r -a links <<< "$LINKS"
-          message=""
-          for index in "${!links[@]}"; do
-              title=${titles[$index]}
-              link=${links[$index]} 
-              echo "$index $title $link"
-              message="$message- <$link|$title>\\n"
-          done
-          echo "message: $message"
-          echo '{
-            "text": "Needs Triage",
-            "blocks": [
-            	{
-            		"type": "section",
-            		"text": {
-            			"type": "mrkdwn",
-            			"text": "$message"
-            		}
-            	}
-            ]
-          }' > body-template.json
-          export message=$(echo "${message}" | sed 's/"//g')
-          envsubst < body-template.json > body.json
-          cat body.json
-          curl -X POST "${{ secrets.SLACK_INCOMING_WEBHOOK }}" -H "Content-type: application/json" -d @./body.json
-
-      - name: Issue Notification
-        if: github.event.issue.title != ''
-        env:
-          TITLE: "${{ github.event.issue.title }}"
-          EVENT: github.event.pull_request.merged == true
-          LINK: "https://github.com/FairwindsOps/${{ github.event.repository.name }}/pulls/${{ github.event.issue.number }}"
-        run: |
-          echo '{
-            "text": "New Pull Request",
-            "blocks": [
-            	{
-            		"type": "section",
-            		"text": {
-            			"type": "mrkdwn",
-            			"text": ":issue: New Issue: <${LINK}|${TITLE}>"
-            		}
-            	}
-            ]
-          }' > body-template.json
-          envsubst < body-template.json > body.json
-          curl -X POST "${{ secrets.SLACK_INCOMING_WEBHOOK }}" -H "Content-type: application/json" -d @./body.json
-
-      - name: PR Notification
-        if: github.event.pull_request.title != ''
-        env:
-          TITLE: "${{ github.event.pull_request.title }}"
-          LINK: "https://github.com/FairwindsOps/${{ github.event.repository.name }}/pulls/${{ github.event.pull_request.number }}"
-        run: |
-          echo '{
-            "text": "New Pull Request",
-            "blocks": [
-            	{
-            		"type": "section",
-            		"text": {
-            			"type": "mrkdwn",
-            			"text": ":pr: New Pull Request: <${LINK}|${TITLE}>"
-            		}
-            	}
-            ]
-          }' > body-template.json
-          envsubst < body-template.json > body.json
-          curl -X POST "${{ secrets.SLACK_INCOMING_WEBHOOK }}" -H "Content-type: application/json" -d @./body.json

Dockerfile

@@ -15,7 +15,7 @@ RUN go get -u github.com/gobuffalo/packr/v2/packr2
 COPY . .
 RUN packr2 build -a -o polaris *.go
 
-FROM alpine:3.16.1
+FROM alpine:3.16.0
 WORKDIR /usr/local/bin
 RUN apk --no-cache add ca-certificates
 

checks/automountServiceAccountToken.yaml

@@ -1,36 +0,0 @@
-successMessage: The ServiceAccount will not be automounted
-failureMessage: The ServiceAccount will be automounted
-category: Security
-target: PodSpec
-schema:
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  required: ["serviceAccountName"]
-  properties:
-    serviceAccountName:
-      type: string
-    automountServiceAccountToken:
-      type: boolean
-      not:
-        const: true
-additionalSchemaStrings:
-  ServiceAccount: |
-    type: object
-    required:
-      - metadata
-      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
-      - automountServiceAccountToken
-      {{ end }}
-    properties:
-      metadata:
-        type: object
-        required: ["name"]
-        properties:
-          name:
-            type: string
-            const: "{{ .Polaris.PodSpec.serviceAccountName }}"
-      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
-      automountServiceAccountToken:
-        type: boolean
-        const: false
-      {{ end }}

checks/cpuLimitsMissing.yaml

@@ -26,9 +26,12 @@ schema:
               not:
                 const: ''
 mutations:
+  - op: add
+    path: /resources/limits
+    value: {}
   - op: add
     path: /resources/limits/cpu
     value: 100m
 comments:
   - find: "cpu: 100m"
-    comment: "TODO: Set this to the maximum amount of CPU you want your workload to use"
+    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"

checks/cpuRequestsMissing.yaml

@@ -26,9 +26,12 @@ schema:
               not:
                 const: ''
 mutations:
+  - op: add
+    path: /resources/requests
+    value: {}
   - op: add
     path: /resources/requests/cpu
     value: 100m
 comments:
   - find: "cpu: 100m"
-    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"
+    comment: "TODO: Set this to the amount of CPU you want to reserve for your workload"

checks/dangerousCapabilities.yaml

@@ -24,8 +24,3 @@ schema:
                 - not:
                     contains:
                       pattern: '^(?i)NET_ADMIN$'
-
-
-mutations:
-  - op: remove
-    path: /securityContext/capabilities

checks/insecureCapabilities.yaml

@@ -54,9 +54,3 @@ schema:
                     pattern: '^(?i)KILL$'
                 - contains:
                     pattern: '^(?i)AUDIT_WRITE$'
-mutations:
-  - op: remove
-    path: /securityContext/capabilities
-  - op: add
-    path: /securityContext/capabilities
-    value: {"drop": ["ALL"]}

checks/linuxHardening.yaml

@@ -1,89 +0,0 @@
-successMessage: One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
-FailureMessage: Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
-category: Security
-target: Container
-schemaString: |
-  '$schema': http://json-schema.org/draft-07/schema
-  definitions:
-    podOrContainerSeccompProfile:
-      type: object
-      {{ $podSeccompProfileType := .Polaris.PodSpec.securityContext.seccompProfile.type }}
-      required:
-      {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
-        - securityContext
-      {{ end }}
-      properties:
-        securityContext:
-          type: object
-          required:
-          {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
-            - seccompProfile
-          {{ end }}
-          properties:
-            seccompProfile:
-              type: object
-              required:
-              {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
-                - type
-              {{ end }}
-              properties:
-                type:
-                  type: string
-                  allOf:
-                    - not:
-                        const: "Unconfined"
-                    {{ if or (not $podSeccompProfileType) (eq $podSeccompProfileType "Unconfined") }}
-                    - minLength: 1
-                    {{ end }}
-    podOrContainerSELinuxOptions:
-      type: object
-      {{ $podSELinuxOptions := .Polaris.PodSpec.securityContext.seLinuxOptions }}
-      {{ if not $podSELinuxOptions }}
-      required: ["securityContext"]
-      properties:
-        securityContext:
-          type: object
-          required: ["seLinuxOptions"]
-          properties:
-            seLinuxOptions:
-              type: object
-              minProperties: 1
-      {{ end }}
-    containerDropCapabilities:
-      type: object
-      required: ["securityContext"]
-      properties:
-        securityContext:
-          type: object
-          required: ["capabilities"]
-          properties:
-            capabilities:
-              type: object
-              required: ["drop"]
-              properties:
-                drop:
-                  type: array
-                  minItems: 1
-                add:
-                  type: array
-                  items:
-                    type: string
-                    not:
-                      pattern: '^(?i)ALL$'
-  # End of definitions
-  {{/* Check for AppArmor which uses pod annotations. IF pod fields are missing,
-       require one of the other hardening measures. */}}
-  {{ $annotationName := (print "container.apparmor.security.beta.kubernetes.io/" .Polaris.Container.name) }}
-  {{/* Checking annotations before using index() avoids a nil panic when there are no annotations */}}
-  {{ $annotationExists := false }}
-  {{ if .Polaris.PodTemplate.metadata.annotations }}
-  {{ $annotationExists = index .Polaris "PodTemplate" "metadata" "annotations" $annotationName }}
-  {{ end }}
-  {{ if $annotationExists }}
-  type: object
-  {{ else }}
-  anyOf:
-  - $ref: "#/definitions/podOrContainerSeccompProfile"
-  - $ref: "#/definitions/podOrContainerSELinuxOptions"
-  - $ref: "#/definitions/containerDropCapabilities"
-  {{ end}}

checks/memoryLimitsMissing.yaml

@@ -26,9 +26,12 @@ schema:
               not:
                 const: ''
 mutations:
+  - op: add
+    path: /resources/limits
+    value: {}
   - op: add
     path: /resources/limits/memory
     value: "512Mi"
 comments:
   - find: "memory: 512Mi"
-    comment: "TODO: Set this to the maximum amount of memory you want your workload to use"
+    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"

checks/memoryRequestsMissing.yaml

@@ -26,9 +26,12 @@ schema:
               not:
                 const: ''
 mutations:
+  - op: add
+    path: /resources/requests
+    value: {}
   - op: add
     path: /resources/requests/memory
     value: "512Mi"
 comments:
   - find: "memory: 512Mi"
-    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"
+    comment: "TODO: Set this to the amount of Memory you want to reserve for your workload"

checks/missingNetworkPolicy.yaml

@@ -1,49 +0,0 @@
-successMessage: A NetworkPolicy matches pod labels and contains egress and ingress rules
-failureMessage: A NetworkPolicy should match pod labels and contain applied egress and ingress rules
-category: Security
-target: PodTemplate
-schema:
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  properties:
-    metadata:
-      type: object
-      properties:
-        labels:
-          type: object
-          minProperties: 1
-additionalSchemaStrings:
-  networking.k8s.io/NetworkPolicy: |
-    type: object
-    properties:
-      spec:
-        type: object
-        required: ["podSelector", "egress", "ingress"]
-        properties:
-          podSelector:
-            type: object
-            required: ["matchLabels"]
-            properties:
-              matchLabels:
-                type: object
-                oneOf:
-                {{ range $key, $value := .Polaris.PodTemplate.metadata.labels }}
-                - properties:
-                    "{{ $key }}":
-                      type: string
-                      const: {{ $value }}
-                  required: ["{{ $key }}"]
-                {{ end }}
-          egress:
-            type: array
-            minItems: 1
-          ingress:
-            minItems: 1
-            type: array
-          policyTypes:
-            type: array
-            allOf:
-              - contains:
-                  pattern: '^(?i)Egress$'
-              - contains:
-                  pattern: '^(?i)Ingress$'

checks/notReadOnlyRootFilesystem.yaml

@@ -40,9 +40,4 @@ schema:
           - securityContext
           properties:
             securityContext:
-              $ref: "#/definitions/goodSecurityContext"
-mutations:
-  - op: add
-    path: /securityContext/readOnlyRootFilesystem
-    value: true
-
+              $ref: "#/definitions/goodSecurityContext"

checks/runAsRootAllowed.yaml

@@ -51,6 +51,6 @@ schema:
             securityContext:
               $ref: "#/definitions/goodSecurityContext"
 mutations:
-  - op: add
+  - op: replace
     path: /securityContext/runAsNonRoot
-    value: true
+    value: true

checks/sensitiveConfigmapContent.yaml

@@ -1,43 +0,0 @@
-successMessage: The ConfigMap does not contain potentially sensitive content in its keys and values
-failureMessage: Potentially sensitive content is detected in the ConfigMap keys or values
-category: Security
-target: /ConfigMap
-schemaString: |
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  required: ["metadata"]
-  properties:
-    metadata:
-      required: ["name"]
-      properties:
-        name:
-          type: string
-    data:
-      type: object
-      propertyNames:
-        '$comment': These ConfigMap keys will be disallowed.
-        allOf:
-          - not:
-              pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
-          - not:
-              pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
-          - not:
-              pattern: '(?i)^AZURE_.+KEY$'
-          - not:
-              pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
-          - not:
-              pattern: '(?i)password'
-          - not:
-              pattern: '(?i)token'
-          - not:
-              pattern: '(?i)bearer'
-          - not:
-              pattern: '(?i)secret'
-            '$comment': This allows ConfigMap keys not excluded above.
-          - pattern: '(?i).*'
-      additionalProperties:
-        '$comment': These ConfigMap values will be disallowed.
-        allOf:
-        - not:
-            '$comment': THis matches variations like begin private key, begin rsa private key ...
-            pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'

checks/sensitiveContainerEnvVar.yaml

@@ -1,43 +0,0 @@
-successMessage: The container does not set potentially sensitive environment variables
-failureMessage: The container sets potentially sensitive environment variables
-category: Security
-target: Container
-schemaString: |
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  properties:
-    env:
-      type: array
-      items:
-        type: object
-        required: ["name"]
-        properties:
-          name:
-            type: string
-            '$comment': These environment variable names will be disallowed.
-            allOf:
-              - not:
-                  pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
-              - not:
-                  pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
-              - not:
-                  pattern: '(?i)^AZURE_.+KEY$'
-              - not:
-                  pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
-              - not:
-                  pattern: '(?i)password'
-              - not:
-                  pattern: '(?i)token'
-              - not:
-                  pattern: '(?i)bearer'
-              - not:
-                  pattern: '(?i)secret'
-                '$comment': This allows variable names not excluded above.
-              - pattern: '(?i).*'
-          value:
-            type: string
-            '$comment': These environment variable values will be disallowed.
-            allOf:
-            - not:
-                '$comment': THis matches variations like begin private key, begin rsa private key ...
-                pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'

cmd/polaris/fix.go

@@ -33,16 +33,11 @@ import (
 	"sigs.k8s.io/yaml"
 )
 
-var (
-	filesPath   string
-	checksToFix []string
-	fixAll      bool
-)
+var filesPath string
 
 func init() {
 	rootCmd.AddCommand(fixCommand)
 	fixCommand.PersistentFlags().StringVar(&filesPath, "files-path", "", "mutate and fix one or more YAML files in a specified folder")
-	fixCommand.PersistentFlags().StringSliceVar(&checksToFix, "checks", []string{}, "Optional flag to specify specific checks to fix eg. checks=hostIPCSet,hostPIDSet and checks=all applies fix to all defined checks mutations")
 }
 
 var fixCommand = &cobra.Command{
@@ -78,24 +73,12 @@ var fixCommand = &cobra.Command{
 		}
 		var contentStr string
 		isFirstResource := true
-
-		if len(checksToFix) > 0 {
-			if len(checksToFix) == 1 && checksToFix[0] == "all" {
-				allchecks := []string{}
-				for key := range config.Checks {
-					allchecks = append(allchecks, key)
-				}
-				config.Mutations = allchecks
-			} else {
-				config.Mutations = checksToFix
-			}
-		}
-
 		for _, fullFilePath := range yamlFiles {
 
 			yamlFile, err := ioutil.ReadFile(fullFilePath)
 			if err != nil {
-				logrus.Fatalf("Error reading file with file path %s: %v", fullFilePath, err)
+				logrus.Errorf("Error reading file with file path %s: %v", fullFilePath, err)
+				os.Exit(1)
 			}
 
 			dec := yamlV3.NewDecoder(bytes.NewReader(yamlFile))
@@ -112,16 +95,19 @@ var fixCommand = &cobra.Command{
 					break
 				}
 				if err != nil {
-					logrus.Fatalf("Error decoding data for file with file path %s: %v", fullFilePath, err)
+					logrus.Errorf("Error decoding data for file with file path %s: %v", fullFilePath, err)
+					os.Exit(1)
 				}
 				yamlContent, err := yamlV3.Marshal(data)
 				if err != nil {
-					logrus.Fatalf("Error marshalling %s: %v", fullFilePath, err)
+					logrus.Errorf("Error marshalling %s: %v", fullFilePath, err)
+					os.Exit(1)
 				}
 				kubeResources := kube.CreateResourceProviderFromYaml(string(yamlContent))
 				results, err := validator.ApplyAllSchemaChecksToResourceProvider(&config, kubeResources)
 				if err != nil {
-					logrus.Fatalf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+					logrus.Errorf("Error applying schema check to the resources %s: %v", fullFilePath, err)
+					os.Exit(1)
 				}
 				comments, allMutations := mutation.GetMutationsAndCommentsFromResults(results)
 				updatedYamlContent := string(yamlContent)
@@ -156,7 +142,8 @@ var fixCommand = &cobra.Command{
 			if contentStr != "" {
 				err = ioutil.WriteFile(fullFilePath, []byte(contentStr), 0644)
 				if err != nil {
-					logrus.Fatalf("Error writing output to file: %v", err)
+					logrus.Errorf("Error writing output to file: %v", err)
+					os.Exit(1)
 				}
 			}
 		}

cmd/polaris/webhook.go

@@ -29,15 +29,11 @@ import (
 
 var webhookPort int
 var disableWebhookConfigInstaller bool
-var enableMutations bool
-var enableValidations bool
 
 func init() {
 	rootCmd.AddCommand(webhookCmd)
 	webhookCmd.PersistentFlags().IntVarP(&webhookPort, "port", "p", 9876, "Port for the dashboard webserver.")
-	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "Disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
-	webhookCmd.PersistentFlags().BoolVar(&enableValidations, "validate", true, "Enable the validating webhook to reject workloads with issues")
-	webhookCmd.PersistentFlags().BoolVar(&enableMutations, "mutate", false, "Enable the mutating webhook to modify workloads with issues")
+	webhookCmd.PersistentFlags().BoolVar(&disableWebhookConfigInstaller, "disable-webhook-config-installer", false, "disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping.")
 }
 
 var webhookCmd = &cobra.Command{
@@ -65,17 +61,11 @@ var webhookCmd = &cobra.Command{
 		server.CertName = "tls.crt"
 		server.KeyName = "tls.key"
 
-		if !enableMutations && !enableValidations {
-			logrus.Errorf("One of --mutate or --validate must be set to true")
-			os.Exit(1)
-		}
+		// Iterate all the configurations supported controllers to scan and register them for webhooks
+		// Should only register controllers that are configured to be scanned
+		fwebhook.NewValidateWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
+		fwebhook.NewMutateWebhook(mgr, fwebhook.Mutator{Config: config, Client: mgr.GetClient()})
 
-		if enableValidations {
-			fwebhook.NewValidateWebhook(mgr, fwebhook.Validator{Config: config, Client: mgr.GetClient()})
-		}
-		if enableMutations {
-			fwebhook.NewMutateWebhook(mgr, fwebhook.Mutator{Config: config, Client: mgr.GetClient()})
-		}
 		logrus.Infof("Polaris webhook server listening on port %d", webhookPort)
 		if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
 			logrus.Errorf("Error starting manager: %v", err)

docs/admission-controller.md

@@ -45,17 +45,3 @@ output unless we are rejecting a workload altogether.
 This means that any checks with a severity of `warning` will still pass webhook validation,
 and the only evidence of that warning will either be in the Polaris dashboard or the
 Polaris webhook logs. This will change in a future version of Kubernetes.
-
-## Mutating Webhook
-By default, the Admission Controller is just pass/fail, but
-Polaris can also operate as a mutating webhook for many of the issues it checks for.
-This means Polaris will remediate the issue it finds, rather than rejecting
-the deployment.
-
-To enable the mutating webhook, add `--set webhook.mutate=true` to your
-Helm instlallation command.
-
-By default, the only mutation enabled is `pullPolicyNotAlways`. If you'd like to
-enable other mutations, you can set the `webhook.mutations` flag.
-
-

docs/changelog.md

@@ -5,18 +5,6 @@ meta:
     content: "Fairwinds Polaris | Changelog"
 
 ---
-## 7.0.1
-* Documentation updates
-
-## 7.0.0
-* Better support for `polaris fix`
-* `target: Pod` is now `target: PodSpec` (to differentiate naked Pods from Controllers)
-
-## 6.0.0
-* Preliminary support for `polaris fix` command
-* Changes to how Pod owners are determined
-* Removed YAML manifests from the `deploy/` directory - Helm is now the default install mechanism
-
 ## 5.1.0
 * Support `--context` flag for kubecontext
 * Treat core Kubernetes controllers (`Deployments`, `StatefulSets`, `DaemonSets`, `CronJobs`) as top-level objects, instead of following owner refs

docs/customization/custom-checks.md

@@ -44,10 +44,9 @@ check ID. Note that you'll also have to set its severity in the `checks` section
 * `target` - specifies the type of resource to check. This can be:
   * a group and kind, e.g. `apps/Deployment` or `networking.k8s.io/Ingress`
   * `Controller`, to check _any_ resource that creates Pods (e.g. Deployments, CronJobs, StatefulSets), as well as naked Pods
-  * `PodTemplate`, same as `Controller`, but the schema applies to the Pod template rather than the top-level controller
   * `PodSpec`, same as `Controller`, but the schema applies to the Pod spec rather than the top-level controller
   * `Container` same as `Controller`, but the schema applies to all Container specs rather than the top-level controller
-* `controllers` - if `target` is `Controller`, `PodSpec` or `Container`, you can use this to change which types of controllers are checked
+* `controllers` - if `target` is `Controller`, `Pod` or `Container`, you can use this to change which types of controllers are checked
 * `controllers.include` - _only_ check these controllers
 * `controllers.exclude` - check all controllers except these
 * `containers` - if `target` is `Container`, you can use this to decide if `initContainers`, `containers`, or both should be checked
@@ -135,11 +134,6 @@ schema:
               const: "{{ .metadata.name }}"
 ```
 
-* The object available via the go template is the full object, and not limited by `target`.
-* A check of `target: PodSpec` can directly access the pod specification via the go template variable `.Polaris.PodSpec`.
-* A check of `target: PodTemplate` can directly access the pod template via the go template variable `.Polaris.PodTemplate`.
-* A check of `target: Container` can directly access the container being checked via the go template variable `.Polaris.container`. The pod template and pod specification can also be accessed via the respective variables `.Polaris.PodTemplate` and `.Polaris.PodSpec`. Access to pod-level fields allows a container check to consult related fields from the pod, such as `securityContext`.
-
 You can also use the full [Go template syntax](https://golang.org/pkg/text/template/), though
 you may need to specify your schema as a string in order to use concepts like `range`. E.g.
 this check ensures that at least one of the object's labels is present in `matchLabels`:

docs/infrastructure-as-code.md

@@ -25,32 +25,6 @@ brew install FairwindsOps/tap/polaris
 polaris version
 ```
 
-## Checking Infrastructure as Code files
-You can audit Kubernetes YAML files by running:
-```bash
-polaris audit --audit-path ./deploy/ --format=pretty
-```
-This will print out any issues Polaris finds in your manifests.
-
-Polaris can only check raw YAML manifests. If you'd like to check a Helm template,
-you can run `helm template` to generate a manifest that Polaris can check.
-
-## Fixing Issues
-Polaris can automatically fix many of the issues it finds. For example, you can run
-```bash
-polaris fix --files-path ./deploy/ --checks=all
-```
-
-to fix any issues inside the `deploy` directory. Polaris may leave
-comments next to some changes (e.g. liveness and readiness probes) prompting
-the user to set them to something more appropriate given the context of their
-application.
-
-Note that not all issues can be automatically fixed.
-
-Currently only raw YAML manifests can be mutated. Helm charts etc.
-still need to be changed manually.
-
 ## Running in a CI pipeline
 
 ### Set minimum score for an exit code

examples/config-full.yaml

@@ -12,11 +12,8 @@ checks:
   memoryRequestsMissing: warning
   memoryLimitsMissing: warning
   # security
-  automountServiceAccountToken: warning
   hostIPCSet: danger
   hostPIDSet: danger
-  linuxHardening: danger
-  missingNetworkPolicy: warning
   notReadOnlyRootFilesystem: warning
   privilegeEscalationAllowed: danger
   runAsRootAllowed: danger
@@ -25,8 +22,6 @@ checks:
   insecureCapabilities: warning
   hostNetworkSet: danger
   hostPortSet: warning
-  sensitiveContainerEnvVar: danger
-  sensitiveConfigmapContent: danger
   # custom
   resourceLimits: warning
   imageRegistry: danger

examples/config.yaml

@@ -27,10 +27,7 @@ checks:
   hostNetworkSet: danger
   hostPortSet: warning
   tlsSettingsMissing: warning
-
-mutations:
-  - pullPolicyNotAlways
-
+ 
 exemptions:
   - namespace: kube-system
     controllerNames:

fairwinds-insights.yaml

@@ -1,5 +1,5 @@
 options:
-  organization: fairwinds-production
+  organization: fairwinds-opensource
   baseBranch: master
 
 images:

go.mod

@@ -9,15 +9,15 @@ require (
 	github.com/gorilla/mux v1.8.0
 	github.com/qri-io/jsonschema v0.1.1
 	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.5.0
+	github.com/spf13/cobra v1.4.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.8.0
+	github.com/stretchr/testify v1.7.1
 	github.com/thoas/go-funk v0.9.2
 	golang.org/x/text v0.3.7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.24.3
-	k8s.io/apimachinery v0.24.3
+	k8s.io/api v0.24.1
+	k8s.io/apimachinery v0.24.1
 	k8s.io/client-go v0.24.1
 	sigs.k8s.io/controller-runtime v0.12.1
 	sigs.k8s.io/yaml v1.3.0

go.sum

@@ -134,7 +134,6 @@ github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -540,9 +539,8 @@ github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkU
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
+github.com/spf13/cobra v1.4.0 h1:y+wJpx64xcgO1V+RcnwW0LEHxTKRi2ZDPSBjWnrg88Q=
 github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
-github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
-github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
@@ -553,16 +551,14 @@ github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/thoas/go-funk v0.9.2 h1:oKlNYv0AY5nyf9g+/GhMgS/UO2ces0QRdPKwkhY3VCk=
 github.com/thoas/go-funk v0.9.2/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
@@ -1145,15 +1141,13 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.24.0/go.mod h1:5Jl90IUrJHUJYEMANRURMiVvJ0g7Ax7r3R1bqO8zx8I=
+k8s.io/api v0.24.1 h1:BjCMRDcyEYz03joa3K1+rbshwh1Ay6oB53+iUx2H8UY=
 k8s.io/api v0.24.1/go.mod h1:JhoOvNiLXKTPQ60zh2g0ewpA+bnEYf5q44Flhquh4vQ=
-k8s.io/api v0.24.3 h1:tt55QEmKd6L2k5DP6G/ZzdMQKvG5ro4H4teClqm0sTY=
-k8s.io/api v0.24.3/go.mod h1:elGR/XSZrS7z7cSZPzVWaycpJuGIw57j9b95/1PdJNI=
 k8s.io/apiextensions-apiserver v0.24.0 h1:JfgFqbA8gKJ/uDT++feAqk9jBIwNnL9YGdQvaI9DLtY=
 k8s.io/apiextensions-apiserver v0.24.0/go.mod h1:iuVe4aEpe6827lvO6yWQVxiPSpPoSKVjkq+MIdg84cM=
 k8s.io/apimachinery v0.24.0/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
+k8s.io/apimachinery v0.24.1 h1:ShD4aDxTQKN5zNf8K1RQ2u98ELLdIW7jEnlO9uAMX/I=
 k8s.io/apimachinery v0.24.1/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
-k8s.io/apimachinery v0.24.3 h1:hrFiNSA2cBZqllakVYyH/VyEh4B581bQRmqATJSeQTg=
-k8s.io/apimachinery v0.24.3/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
 k8s.io/apiserver v0.24.0/go.mod h1:WFx2yiOMawnogNToVvUYT9nn1jaIkMKj41ZYCVycsBA=
 k8s.io/client-go v0.24.0/go.mod h1:VFPQET+cAFpYxh6Bq6f4xyMY80G6jKKktU6G0m00VDw=
 k8s.io/client-go v0.24.1 h1:w1hNdI9PFrzu3OlovVeTnf4oHDt+FJLd9Ndluvnb42E=

main.go

@@ -18,7 +18,7 @@ import (
 	cmd "github.com/fairwindsops/polaris/cmd/polaris"
 )
 
-var (
+const (
 	// Version is set during build
 	Version = "development"
 	// Commit is set during build

pkg/config/checks.go

@@ -32,7 +32,6 @@ var (
 		"hostIPCSet",
 		"hostPIDSet",
 		"hostNetworkSet",
-		"automountServiceAccountToken",
 		// Container checks
 		"memoryLimitsMissing",
 		"memoryRequestsMissing",
@@ -50,15 +49,11 @@ var (
 		"dangerousCapabilities",
 		"insecureCapabilities",
 		"priorityClassNotSet",
-		"linuxHardening",
-		"sensitiveContainerEnvVar",
 		// Other checks
 		"tlsSettingsMissing",
 		"pdbDisruptionsIsZero",
 		"metadataAndNameMismatched",
 		"missingPodDisruptionBudget",
-		"missingNetworkPolicy",
-		"sensitiveConfigmapContent",
 	}
 )
 

pkg/config/schema.go

@@ -41,8 +41,6 @@ const (
 	TargetContainer TargetKind = "Container"
 	// TargetPodSpec points to the pod spec
 	TargetPodSpec TargetKind = "PodSpec"
-	// TargetPodTemplate points to the pod template
-	TargetPodTemplate TargetKind = "PodTemplate"
 )
 
 // HandledTargets is a list of target names that are explicitly handled
@@ -50,7 +48,6 @@ var HandledTargets = []TargetKind{
 	TargetController,
 	TargetContainer,
 	TargetPodSpec,
-	TargetPodTemplate,
 }
 
 // MutationComment is the comments added to a mutated file
@@ -261,11 +258,6 @@ func (check SchemaCheck) CheckPodSpec(pod *corev1.PodSpec) (bool, []jsonschema.V
 	return check.CheckObject(pod)
 }
 
-// CheckPodTemplate checks a pod template against the schema
-func (check SchemaCheck) CheckPodTemplate(podTemplate interface{}) (bool, []jsonschema.ValError, error) {
-	return check.CheckObject(podTemplate)
-}
-
 // CheckController checks a controler's spec against the schema
 func (check SchemaCheck) CheckController(bytes []byte) (bool, []jsonschema.ValError, error) {
 	errs, err := check.Validator.ValidateBytes(bytes)
@@ -312,11 +304,6 @@ func (check SchemaCheck) CheckAdditionalObjects(groupkind string, objects []inte
 // IsActionable decides if this check applies to a particular target
 func (check SchemaCheck) IsActionable(target TargetKind, kind string, isInit bool) bool {
 	if funk.Contains(HandledTargets, target) {
-		if check.Target == TargetPodTemplate && target == TargetPodSpec {
-			// A target=PodSpec and check.Target=PodTemplate is expected
-			// because applyPodSchemaChecks() explicitly sets check.Target
-			return true
-		}
 		if check.Target != target {
 			return false
 		}

pkg/kube/resource.go

@@ -35,7 +35,6 @@ type GenericResource struct {
 	ObjectMeta         kubeAPIMetaV1.Object
 	Resource           unstructured.Unstructured
 	PodSpec            *kubeAPICoreV1.PodSpec
-	PodTemplate        interface{}
 	OriginalObjectJSON []byte
 }
 
@@ -54,10 +53,6 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured, podSpecM
 		return workload, err
 	}
 	workload.ObjectMeta = objMeta
-	workload.PodTemplate, err = GetPodTemplate(unst.UnstructuredContent())
-	if err != nil {
-		return workload, err
-	}
 
 	b, err := json.Marshal(&unst)
 	if err != nil {
@@ -89,15 +84,10 @@ func NewGenericResourceFromUnstructured(unst unstructured.Unstructured, podSpecM
 
 // NewGenericResourceFromPod builds a new workload for a given Pod without looking at parents
 func NewGenericResourceFromPod(podResource kubeAPICoreV1.Pod, originalObject interface{}) (GenericResource, error) {
-	podMap, err := SerializePod(&podResource)
-	if err != nil {
-		return GenericResource{}, err
-	}
 	workload := GenericResource{
-		Kind:        "Pod",
-		PodSpec:     &podResource.Spec,
-		PodTemplate: podMap,
-		ObjectMeta:  podResource.ObjectMeta.GetObjectMeta(),
+		Kind:       "Pod",
+		PodSpec:    &podResource.Spec,
+		ObjectMeta: podResource.ObjectMeta.GetObjectMeta(),
 	}
 	if originalObject != nil {
 		bytes, err := json.Marshal(originalObject)
@@ -247,34 +237,3 @@ func GetPodSpec(yaml map[string]interface{}) interface{} {
 	}
 	return nil
 }
-
-// GetPodTemplate looks inside arbitrary YAML for a Pod template, containing
-// fields `spec.containers`.
-// For example, it returns the `spec.template` level of a Kubernetes Deployment yaml.
-func GetPodTemplate(yaml map[string]interface{}) (podTemplate interface{}, err error) {
-	if yamlSpec, ok := yaml["spec"]; ok {
-		if yamlSpecMap, ok := yamlSpec.(map[string]interface{}); ok {
-			if _, ok := yamlSpecMap["containers"]; ok {
-				// This is a hack around unstructured.SetNestedField using DeepCopy which does
-				// not support the type int, and panics.
-				// Related: https://github.com/kubernetes/kubernetes/issues/62769
-				podTemplateJSON, err := json.Marshal(yaml)
-				if err != nil {
-					return nil, err
-				}
-				podTemplateMap := make(map[string]interface{})
-				err = json.Unmarshal(podTemplateJSON, &podTemplateMap)
-				if err != nil {
-					return nil, err
-				}
-				return podTemplateMap, nil
-			}
-		}
-	}
-	for _, podSpecField := range podSpecFields {
-		if childYaml, ok := yaml[podSpecField]; ok {
-			return GetPodTemplate(childYaml.(map[string]interface{}))
-		}
-	}
-	return nil, nil
-}

pkg/kube/resources.go

@@ -17,7 +17,6 @@ package kube
 import (
 	"bytes"
 	"context"
-	"encoding/json"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -59,12 +58,7 @@ type resourceKindMap map[string][]GenericResource
 
 func (rkm resourceKindMap) addResource(r GenericResource) {
 	gvk := r.Resource.GroupVersionKind()
-	var key string
-	if gvk.Group != "" {
-		key = gvk.Group + "/" + gvk.Kind
-	} else {
-		key = gvk.Kind
-	}
+	key := gvk.Group + "/" + gvk.Kind
 	rkm[key] = append(rkm[key], r)
 }
 
@@ -481,45 +475,3 @@ func (resources *ResourceProvider) addResourceFromString(contents string) error
 	}
 	return err
 }
-
-// SerializePodSpec converts a typed PodSpec into a map[string]interface{}
-func SerializePodSpec(pod *corev1.PodSpec) (map[string]interface{}, error) {
-	podJSON, err := json.Marshal(pod)
-	if err != nil {
-		return nil, err
-	}
-	podMap := make(map[string]interface{})
-	err = json.Unmarshal(podJSON, &podMap)
-	if err != nil {
-		return nil, err
-	}
-	return podMap, nil
-}
-
-// SerializePod converts a typed Pod into a map[string]interface{}
-func SerializePod(pod *corev1.Pod) (map[string]interface{}, error) {
-	podJSON, err := json.Marshal(pod)
-	if err != nil {
-		return nil, err
-	}
-	podMap := make(map[string]interface{})
-	err = json.Unmarshal(podJSON, &podMap)
-	if err != nil {
-		return nil, err
-	}
-	return podMap, nil
-}
-
-// SerializeContainer converts a typed Container into a map[string]interface{}
-func SerializeContainer(container *corev1.Container) (map[string]interface{}, error) {
-	containerJSON, err := json.Marshal(container)
-	if err != nil {
-		return nil, err
-	}
-	containerMap := make(map[string]interface{})
-	err = json.Unmarshal(containerJSON, &containerMap)
-	if err != nil {
-		return nil, err
-	}
-	return containerMap, nil
-}

pkg/mutation/mutate.go

@@ -27,10 +27,7 @@ func ApplyAllSchemaMutations(conf *config.Configuration, resourceProvider *kube.
 	if err != nil {
 		return resource, err
 	}
-	jsonByte, err = patch.ApplyWithOptions(resByte, &jsonpatchV5.ApplyOptions{
-		AllowMissingPathOnRemove: true,
-		EnsurePathExistsOnAdd: true,
-	})
+	jsonByte, err = patch.Apply(resByte)
 	if err != nil {
 		return resource, err
 	}

pkg/validator/output.go

@@ -16,7 +16,6 @@ package validator
 
 import (
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/fatih/color"
@@ -54,21 +53,12 @@ type AuditData struct {
 	Score                uint
 }
 
-// RemoveSuccessfulResults removes all tests that have passed
+// RemoveSuccessfulResults remove all test that have passed.
 func (res AuditData) RemoveSuccessfulResults() AuditData {
 	resCopy := res
-	resCopy.Results = []Result{}
-
-	filteredResults := funk.Map(res.Results, func(auditDataResult Result) Result {
+	resCopy.Results = funk.Map(res.Results, func(auditDataResult Result) Result {
 		return auditDataResult.removeSuccessfulResults()
 	}).([]Result)
-
-	for _, result := range filteredResults {
-		if result.isNotEmpty() {
-			resCopy.Results = append(resCopy.Results, result)
-		}
-	}
-
 	return resCopy
 }
 
@@ -96,10 +86,6 @@ type ResultMessage struct {
 // ResultSet contiains the results for a set of checks
 type ResultSet map[string]ResultMessage
 
-func (res ResultSet) isNotEmpty() bool {
-	return len(res) > 0
-}
-
 func (res ResultSet) removeSuccessfulResults() ResultSet {
 	newResults := ResultSet{}
 	for k, resultMessage := range res {
@@ -130,13 +116,6 @@ func (res Result) removeSuccessfulResults() Result {
 	return resCopy
 }
 
-func (res Result) isNotEmpty() bool {
-	if res.PodResult != nil {
-		return res.PodResult.isNotEmpty()
-	}
-	return res.Results.isNotEmpty()
-}
-
 // PodResult provides a list of validation messages for each pod.
 type PodResult struct {
 	Name             string
@@ -153,15 +132,6 @@ func (res PodResult) removeSuccessfulResults() PodResult {
 	return resCopy
 }
 
-func (res PodResult) isNotEmpty() bool {
-	for _, cr := range res.ContainerResults {
-		if cr.isNotEmpty() {
-			return true
-		}
-	}
-	return res.Results.isNotEmpty()
-}
-
 // ContainerResult provides a list of validation messages for each container.
 type ContainerResult struct {
 	Name    string
@@ -174,10 +144,6 @@ func (res ContainerResult) removeSuccessfulResults() ContainerResult {
 	return resCopy
 }
 
-func (res ContainerResult) isNotEmpty() bool {
-	return res.Results.isNotEmpty()
-}
-
 func fillString(id string, l int) string {
 	for len(id) < l {
 		id += " "
@@ -245,7 +211,7 @@ func (res ResultSet) GetPrettyOutput() string {
 			}
 		}
 		if color.NoColor {
-			status = strings.Fields(status)[1] // remove emoji
+			status = status[2:] // remove emoji
 		}
 		str += fmt.Sprintf("%s%s %s\n", indent, checkColor.Sprint(fillString(msg.ID, minIDLength-len(indent))), status)
 		str += fmt.Sprintf("%s    %s - %s\n", indent, msg.Category, msg.Message)

pkg/validator/polaris_template_variable_test.go

@@ -1,50 +0,0 @@
-// Copyright 2019 FairwindsOps Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package validator
-
-import (
-	"testing"
-
-	conf "github.com/fairwindsops/polaris/pkg/config"
-	"github.com/fairwindsops/polaris/pkg/kube"
-	"github.com/fairwindsops/polaris/test"
-	"github.com/stretchr/testify/require"
-
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-)
-
-func TestGetTemplateInputReturnsPolarisSubKeys(t *testing.T) {
-	pod := test.MockPod() // Includes a container, required by GetPodSpec
-	pod.Spec.NodeName = "testNodeName"
-	pod.ObjectMeta.Name = "testpod"
-	genRes, err := kube.NewGenericResourceFromPod(pod, pod)
-	require.NoError(t, err, "creating new generic resource from a pod")
-	schemaTest := schemaTestCase{
-		Target:   conf.TargetPodSpec, // ends up being set in the case of target: PodTemplate
-		Resource: genRes,
-	}
-
-	templateInput, err := getTemplateInput(schemaTest)
-	require.NoError(t, err, "getting template input from a generic resource")
-	require.NotNil(t, templateInput)
-	nodeName, ok, err := unstructured.NestedString(templateInput, "Polaris", "PodSpec", "nodeName")
-	require.NoError(t, err, "getting Polaris.PodSpec.nodeName from template input")
-	require.True(t, ok, "getting Polaris.PodSpec.nodeName from template input")
-	require.Equal(t, "testNodeName", nodeName, "the nodeName from template output")
-	podName, ok, err := unstructured.NestedString(templateInput, "Polaris", "PodTemplate", "metadata", "name")
-	require.NoError(t, err, "getting Polaris.PodTemplate.metadata.name from template input")
-	require.True(t, ok, "getting Polaris.PodTemplate.metadata.name from template input")
-	require.Equal(t, "testpod", podName, "the pod from template input")
-}

pkg/validator/schema.go

@@ -27,7 +27,6 @@ import (
 	"gomodules.xyz/jsonpatch/v2"
 	corev1 "k8s.io/api/core/v1"
 	metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
 	"github.com/fairwindsops/polaris/pkg/config"
 	"github.com/fairwindsops/polaris/pkg/kube"
@@ -65,55 +64,13 @@ func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCas
 	if !check.IsActionable(test.Target, test.Resource.Kind, test.IsInitContianer) {
 		return nil, nil
 	}
-	templateInput, err := getTemplateInput(test)
-	if err != nil {
-		return nil, err
-	}
-	checkPtr, err := check.TemplateForResource(templateInput)
+	checkPtr, err := check.TemplateForResource(test.Resource.Resource.Object)
 	if err != nil {
 		return nil, err
 	}
 	return checkPtr, nil
 }
 
-// getTemplateInput augments a schemaTestCase.Resource.Resource.Object with
-// Polaris built-in variables. The result can be used as input for
-// CheckSchema.TemplateForResource().
-func getTemplateInput(test schemaTestCase) (map[string]interface{}, error) {
-	templateInput := test.Resource.Resource.Object
-	if templateInput == nil {
-		return nil, nil
-	}
-	if test.Target == config.TargetPodSpec || test.Target == config.TargetContainer {
-		podSpecMap, err := kube.SerializePodSpec(test.Resource.PodSpec)
-		if err != nil {
-			return nil, err
-		}
-		err = unstructured.SetNestedMap(templateInput, podSpecMap, "Polaris", "PodSpec")
-		if err != nil {
-			return nil, err
-		}
-		podTemplateMap, ok := test.Resource.PodTemplate.(map[string]interface{})
-		if ok {
-			err := unstructured.SetNestedMap(templateInput, podTemplateMap, "Polaris", "PodTemplate")
-			if err != nil {
-				return nil, err
-			}
-		}
-		if test.Target == config.TargetContainer {
-			containerMap, err := kube.SerializeContainer(test.Container)
-			if err != nil {
-				return nil, err
-			}
-			err = unstructured.SetNestedMap(templateInput, containerMap, "Polaris", "Container")
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-	return templateInput, nil
-}
-
 func makeResult(conf *config.Configuration, check *config.SchemaCheck, passes bool, issues []jsonschema.ValError) ResultMessage {
 	details := []string{}
 	for _, issue := range issues {
@@ -331,9 +288,6 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	} else if check.Target == config.TargetPodSpec {
 		passes, issues, err = check.CheckPodSpec(test.Resource.PodSpec)
 		prefix = getJSONSchemaPrefix(test.Resource.Kind)
-	} else if check.Target == config.TargetPodTemplate {
-		passes, issues, err = check.CheckPodTemplate(test.Resource.PodTemplate)
-		prefix = getJSONSchemaPrefix(test.Resource.Kind)
 	} else if check.Target == config.TargetContainer {
 		containerIndex := funk.IndexOf(test.Resource.PodSpec.Containers, func(value corev1.Container) bool {
 			return value.Name == test.Container.Name
@@ -371,7 +325,7 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 	}
 	result := makeResult(conf, check, passes, issues)
 	if !passes {
-		if funk.Contains(conf.Mutations, checkID) && len(check.Mutations) > 0 {
+		if funk.Contains(conf.Mutations, checkID) {
 			mutations := funk.Map(check.Mutations, func(mutation jsonpatch.Operation) jsonpatch.Operation {
 				mutationCopy := deepCopyMutation(mutation)
 				mutationCopy.Path = prefix + mutationCopy.Path

pkg/webhook/mutate.go

@@ -44,7 +44,7 @@ func NewMutateWebhook(mgr manager.Manager, mutator Mutator) {
 }
 
 func (m *Mutator) mutate(req admission.Request) ([]jsonpatch.Operation, error) {
-	results, err := GetValidatedResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
+	results, err := getValidateResults(req.AdmissionRequest.Kind.Kind, m.decoder, req, m.Config)
 	if err != nil {
 		return nil, err
 	}

pkg/webhook/webhook.go

@@ -55,11 +55,10 @@ func NewValidateWebhook(mgr manager.Manager, validator Validator) {
 }
 
 func (v *Validator) handleInternal(req admission.Request) (*validator.Result, error) {
-	return GetValidatedResults(req.AdmissionRequest.Kind.Kind, v.decoder, req, v.Config)
+	return getValidateResults(req.AdmissionRequest.Kind.Kind, v.decoder, req, v.Config)
 }
 
-// GetValidatedResults returns the validated results.
-func GetValidatedResults(kind string, decoder *admission.Decoder, req admission.Request, config config.Configuration) (*validator.Result, error) {
+func getValidateResults(kind string, decoder *admission.Decoder, req admission.Request, config config.Configuration) (*validator.Result, error) {
 	var controller kube.GenericResource
 	var err error
 	if kind == "Pod" {

test/checks/automountServiceAccountToken/failure.all_true.yaml

@@ -1,19 +0,0 @@
-# This fails because automounting is true for both the pod and ServiceAccount.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  automountServiceAccountToken: true
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-automountServiceAccountToken: true

test/checks/automountServiceAccountToken/failure.pod_true_serviceaccount_false.yaml

@@ -1,19 +0,0 @@
-# This fails because automounting is true for the pod, overriding the ServiceAccount.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  automountServiceAccountToken: true
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-automountServiceAccountToken: false

test/checks/automountServiceAccountToken/failure.uses_defaults.yaml

@@ -1,17 +0,0 @@
-# This fails because automounting is not disabled anywhere.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test

test/checks/automountServiceAccountToken/success.pod.yaml

@@ -1,19 +0,0 @@
-# This succeeds because automounting is disabled at the pod.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  automountServiceAccountToken: false
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-

test/checks/automountServiceAccountToken/success.pod_and_serviceaccount.yaml

@@ -1,19 +0,0 @@
-# This succeeds because automounting is disabled at the pod and ServiceAccount.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  automountServiceAccountToken: false
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-automountServiceAccountToken: false

test/checks/automountServiceAccountToken/success.pod_false_serviceaccount_true.yaml

@@ -1,19 +0,0 @@
-# This succeeds because automounting is disabled at the pod, overriding the ServiceAccount.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  automountServiceAccountToken: false
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-automountServiceAccountToken: true

test/checks/automountServiceAccountToken/success.serviceaccount.yaml

@@ -1,18 +0,0 @@
-# This succeeds because automounting is disabled at the ServiceAccount.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  serviceAccountName: test
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: test
-automountServiceAccountToken: false

test/checks/cpuLimitsMissing/mutated.yaml

@@ -10,5 +10,5 @@ spec:
     name: nginx
     resources:
       limits:
-        cpu: 100m #TODO: Set this to the maximum amount of CPU you want your workload to use
+        cpu: 100m #TODO: Set this to the amount of CPU you want to reserve for your workload
         memory: 128Mi

test/checks/dangerousCapabilities/failure.yaml

@@ -6,9 +6,9 @@ metadata:
     app.kubernetes.io/name: nginx
 spec:
   containers:
-  - name: nginx
+  - name: nginx 
     image: nginx
     securityContext:
       capabilities:
         add:
-        - NET_ADMIN
+        - NET_ADMIN

test/checks/dangerousCapabilities/mutated.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  labels:
-    app.kubernetes.io/name: nginx
-  name: nginx
-spec:
-  containers:
-  - image: nginx
-    name: nginx
-    resources: {}
-    securityContext: {}

test/checks/insecureCapabilities/mutated.drop-most.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  labels:
-    env: test
-  name: nginx
-spec:
-  containers:
-  - image: nginx
-    name: nginx
-    resources: {}
-    securityContext:
-      capabilities:
-        drop:
-        - ALL

test/checks/insecureCapabilities/mutated.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  labels:
-    env: test
-  name: nginx
-spec:
-  containers:
-  - image: nginx
-    name: nginx
-    resources: {}
-    securityContext:
-      capabilities:
-        drop:
-        - ALL

test/checks/linuxHardening/failure.apparmor_incorrect_annotation_names.yaml

@@ -1,18 +0,0 @@
-# This fails because the annotation names do not match the containers.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  annotations:
-    container.apparmor.security.beta.kubernetes.io/container1: runtime/default
-    container.apparmor.security.beta.kubernetes.io/container2: runtime/default
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
-  - name: nginx2
-    image: nginx
-    ports:
-    - containerPort: 81

test/checks/linuxHardening/failure.drop_capabilities_but_add_all.yaml

@@ -1,17 +0,0 @@
-# This fails because ALL capabilities are also added.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    securityContext:
-      capabilities:
-        drop:
-          - ALL
-        add:
-          - all
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/failure.nothing_is_satisfied.yaml

@@ -1,11 +0,0 @@
-# This fails because none of the seccompProfile, seLinuxOptions, AppArmor, or dropping capabilities are present.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/failure.seccomp_profile_container_overrides_pod.yaml

@@ -1,17 +0,0 @@
-# This fails because the container overrides the pod profile type.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seccompProfile:
-      type: RuntimeDefault
-  containers:
-  - name: nginx
-    securityContext:
-      seccompProfile:
-        type: Unconfined
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/failure.seccomp_profile_pod_missing_type.yaml

@@ -1,13 +0,0 @@
-# This fails because the pod seccompPRofile is missing the type field.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seccompProfile:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/failure.seccomp_profile_pod_unconfined.yaml

@@ -1,14 +0,0 @@
-# This fails because the container overrides the pod profile type.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seccompProfile:
-      type: Unconfined
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/failure.selinux_container_missing_subfield.yaml

@@ -1,13 +0,0 @@
-# This fails because seLinuxOptions is defined but without any sub-field.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    securityContext:
-      seLinuxOptions:
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/failure.selinux_pod_missing_subfield.yaml

@@ -1,13 +0,0 @@
-# This fails because seLinuxOptions is defined but without any sub-field.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seLinuxOptions:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/success.apparmor_2_containers.yaml

@@ -1,18 +0,0 @@
-# This succeeds because AppArmor annotations exist matching both container names.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  annotations:
-    container.apparmor.security.beta.kubernetes.io/nginx: runtime/default
-    container.apparmor.security.beta.kubernetes.io/nginx2: runtime/default
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
-  - name: nginx2
-    image: nginx
-    ports:
-    - containerPort: 81

test/checks/linuxHardening/success.drop_capabilities.yaml

@@ -1,17 +0,0 @@
-# This succeeds because SOME capability is dropped, and ALL capabilities are not added.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    securityContext:
-      capabilities:
-        drop:
-        - ALL
-        add:
-        - someCapabilities
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/success.seccomp_profile_container.yaml

@@ -1,14 +0,0 @@
-# This succeeds because a seccomp profile is defined for the container.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    securityContext:
-      seccompProfile:
-        type: RuntimeDefault
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/success.seccomp_profile_pod.yaml

@@ -1,14 +0,0 @@
-# This succeeds because a seccomp profile is defined for the pod and not undefined for the container.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seccompProfile:
-      type: RuntimeDefault
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/success.seccomp_profile_unconfined_for_pod_but_set_for_container.yaml

@@ -1,17 +0,0 @@
-# This succeeds because the container seccomp profile  overrides the pod Unconfined setting.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seccompProfile:
-      type: Unconfined
-  containers:
-  - name: nginx
-    securityContext:
-      seccompProfile:
-        type: RuntimeDefault
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/success.selinux_container.yaml

@@ -1,14 +0,0 @@
-# This succeeds because seLinuxOptions are defined for the container.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    securityContext:
-      seLinuxOptions:
-        level:   "s0:c123,c456"
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/linuxHardening/success.selinux_pod.yaml

@@ -1,14 +0,0 @@
-# This succeeds because seLinuxOptions is defined for the pod.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  securityContext:
-    seLinuxOptions:
-      level:   "s0:c123,c456"
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/memoryLimitsMissing/failure.cpu.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx
-  labels:
-    app.kubernetes.io/name: nginx
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    resources:
-      limits:
-        cpu: 100m

test/checks/memoryLimitsMissing/mutated.cpu.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  labels:
-    app.kubernetes.io/name: nginx
-  name: nginx
-spec:
-  containers:
-  - image: nginx
-    name: nginx
-    resources:
-      limits:
-        cpu: 100m
-        memory: 512Mi #TODO: Set this to the maximum amount of memory you want your workload to use

test/checks/memoryLimitsMissing/mutated.yaml

@@ -10,4 +10,4 @@ spec:
     name: nginx
     resources:
       limits:
-        memory: 512Mi #TODO: Set this to the maximum amount of memory you want your workload to use
+        memory: 512Mi #TODO: Set this to the amount of Memory you want to reserve for your workload

test/checks/missingNetworkPolicy/failure.netpol_missing_egress_in_policytypes.yaml

@@ -1,41 +0,0 @@
-# This failes because the NetworkPolicy `policyTypes` lacks `Egress`,
-# without which the egress rules will not be applied.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  labels:
-    security: medium
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: test
-spec:
-  podSelector:
-    matchLabels:
-      security: medium
-  policyTypes:
-  - Ingress
-  ingress:
-  - from:
-    - ipBlock:
-        cidr: 0.0.0.0/0
-    ports:
-    - protocol: TCP
-      port: 8080
-  egress:
-  - to:
-    - podSelector:
-        matchLabels:
-          # Allow outbound with other medium-security pods.
-          security: medium
-    ports:
-    - protocol: TCP
-      port: 80

test/checks/missingNetworkPolicy/failure.netpol_missing_egress_rules.yaml

@@ -1,32 +0,0 @@
-# This fails because the NetworkPolicy lacks egress rules.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  labels:
-    security: medium
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: test
-spec:
-  podSelector:
-    matchLabels:
-      security: medium
-  policyTypes:
-  - Egress
-  - Ingress
-  ingress:
-  - from:
-    - ipBlock:
-        cidr: 0.0.0.0/0
-    ports:
-    - protocol: TCP
-      port: 8080

test/checks/missingNetworkPolicy/failure.netpol_missing_ingress_in_policytypes.yaml

@@ -1,41 +0,0 @@
-# This failes because the NetworkPolicy `policyTypes` lacks `Ingress`,
-# without which the egress rules will not be applied.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  labels:
-    security: medium
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: test
-spec:
-  podSelector:
-    matchLabels:
-      security: medium
-  policyTypes:
-  - Egress
-  ingress:
-  - from:
-    - ipBlock:
-        cidr: 0.0.0.0/0
-    ports:
-    - protocol: TCP
-      port: 8080
-  egress:
-  - to:
-    - podSelector:
-        matchLabels:
-          # Allow outbound with other medium-security pods.
-          security: medium
-    ports:
-    - protocol: TCP
-      port: 80

test/checks/missingNetworkPolicy/failure.netpol_missing_ingress_rules.yaml

@@ -1,34 +0,0 @@
-# This fails because the NetworkPolicy lacks ingress rules.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  labels:
-    security: medium
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: test
-spec:
-  podSelector:
-    matchLabels:
-      security: medium
-  policyTypes:
-  - Egress
-  - Ingress
-  egress:
-  - to:
-    - podSelector:
-        matchLabels:
-          # Allow outbound with other medium-security pods.
-          security: medium
-    ports:
-    - protocol: TCP
-      port: 80

test/checks/missingNetworkPolicy/failure.netpol_targets_wrong_pod_label.yaml

@@ -1,41 +0,0 @@
-# This fails because the NetworkPolicy matches a label the pod does not have
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  labels:
-    security: medium
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: test
-spec:
-  podSelector:
-    matchLabels:
-      security: high
-  policyTypes:
-  - Egress
-  - Ingress
-  ingress:
-  - from:
-    - ipBlock:
-        cidr: 0.0.0.0/0
-    ports:
-    - protocol: TCP
-      port: 8080
-  egress:
-  - to:
-    - podSelector:
-        matchLabels:
-          # Allow outbound with other medium-security pods.
-          security: medium
-    ports:
-    - protocol: TCP
-      port: 80

test/checks/missingNetworkPolicy/success.yaml

@@ -1,41 +0,0 @@
-# This succeeds because the NetworkPolicy contains and enables egress and ingress rules, and targets the pod's label.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-  labels:
-    security: medium
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: test
-spec:
-  podSelector:
-    matchLabels:
-      security: medium
-  policyTypes:
-  - Egress
-  - Ingress
-  ingress:
-  - from:
-    - ipBlock:
-        cidr: 0.0.0.0/0
-    ports:
-    - protocol: TCP
-      port: 8080
-  egress:
-  - to:
-    - podSelector:
-        matchLabels:
-          # Allow outbound with other medium-security pods.
-          security: medium
-    ports:
-    - protocol: TCP
-      port: 80

test/checks/sensitiveConfigmapContent/failure.key_aws_secret_access_key.yaml

@@ -1,7 +0,0 @@
-# This fails because the key AWS_SECRET_ACCESS_KEY is set.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-data:
-  AWS_SECRET_ACCESS_KEY: xxxxx

test/checks/sensitiveConfigmapContent/failure.key_azure_batch_key.yaml

@@ -1,7 +0,0 @@
-# This fails because the key AZURE_BATCH_KEY is set.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-data:
-  AZURE_BATCH_KEY: xxxxx

test/checks/sensitiveConfigmapContent/failure.key_oci_cli_key_content.yaml

@@ -1,7 +0,0 @@
-# This fails because the key OCI_CLI_KEY_CONTENT is set.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-data:
-  OCI_CLI_KEY_CONTENT: xxxxx

test/checks/sensitiveConfigmapContent/failure.key_password.yaml

@@ -1,8 +0,0 @@
-# This fails because a key contains "password".
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-data:
-  db_username: postgres
-  db_password: abc123

test/checks/sensitiveConfigmapContent/failure.value_private_key.yaml

@@ -1,11 +0,0 @@
-# This fails because a value contains a private key.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-data:
-  a_key: and value that are ok
-  ssh_access: |
-    -----BEGIN PRIVATE KEY-----
-    xxxxxxxx
-    -----END OPENSSH PRIVATE KEY-----

test/checks/sensitiveConfigmapContent/success.no_data.yaml

@@ -1,6 +0,0 @@
-# This succeeds because no data nor keys nor values are defined.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-  #data:

test/checks/sensitiveConfigmapContent/success.valid_keys_and_values.yaml

@@ -1,8 +0,0 @@
-# This succeeds because no keys or values are invalid.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: test-config
-data:
-  message: This is a test
-  db_user: postgres

test/checks/sensitiveContainerEnvVar/failure.key_aws_secret_access_key.yaml

@@ -1,16 +0,0 @@
-# This fails because an environment variable name AWS_SECRET_ACCESS_KEY is set.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: password
-      value: abc123
-    - name: AWS_SECRET_ACCESS_KEY
-      value: xxx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/sensitiveContainerEnvVar/failure.key_azure_batch_key.yaml

@@ -1,16 +0,0 @@
-# This fails because an environment variable named AZURE_BATCH_KEY is set.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: password
-      value: abc123
-    - name: AZURE_BATCH_KEY
-      value: xxx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/sensitiveContainerEnvVar/failure.key_oci_cli_key_content.yaml

@@ -1,16 +0,0 @@
-# This fails because an environment variable named OCI_CLI_KEY_CONTENT is set.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: password
-      value: abc123
-    - name: OCI_CLI_KEY_CONTENT
-      value: xxx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/sensitiveContainerEnvVar/failure.key_password.yaml

@@ -1,16 +0,0 @@
-# This fails because an environment variable name contains "password".
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: user_name
-      value: postgres
-    - name: my_password
-      value: abc123
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/sensitiveContainerEnvVar/failure.value_private_key.yaml

@@ -1,19 +0,0 @@
-# This fails because an environment variable value contains a private key.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: user_name
-      value: postgres
-    - name: the_good_stuff
-      value: |
-        ---BEGIN OPENSSH PRIVATE KEY---
-        xxxxx
-        ---END  OPENSSH PRIVATE KEY---
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/sensitiveContainerEnvVar/success.no_env_vars.yaml

@@ -1,11 +0,0 @@
-# This succeeds because there are no environment variables.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    ports:
-    - containerPort: 80

test/checks/sensitiveContainerEnvVar/success.valid_env_vars.yaml

@@ -1,14 +0,0 @@
-# This succeeds because there are no sensitive environment variable names or values.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: greeting
-      value: hello
-    image: nginx
-    ports:
-    - containerPort: 80

test/fixtures.go

@@ -199,8 +199,6 @@ func SetupTestAPI(objects ...runtime.Object) (kubernetes.Interface, dynamic.Inte
 			APIResources: []metav1.APIResource{
 				{Name: "pods", Namespaced: true, Kind: "Pod"},
 				{Name: "replicationcontrollers", Namespaced: true, Kind: "ReplicationController"},
-				{Name: "serviceaccounts", Namespaced: true, Kind: "ServiceAccount"},
-				{Name: "configmaps", Namespaced: true, Kind: "ConfigMap"},
 			},
 		},
 		{
@@ -241,7 +239,6 @@ func SetupTestAPI(objects ...runtime.Object) (kubernetes.Interface, dynamic.Inte
 			GroupVersion: "networking.k8s.io/v1",
 			APIResources: []metav1.APIResource{
 				{Name: "ingresses", Namespaced: true, Kind: "Ingress", Version: "v1"},
-				{Name: "networkpolicies", Namespaced: true, Kind: "NetworkPolicy", Version: "v1"},
 			},
 		},
 		{

test/mutation_test.go

@@ -33,18 +33,14 @@ func TestMutations(t *testing.T) {
 	c, err := config.Parse([]byte(configYaml))
 	assert.NoError(t, err)
 	assert.Len(t, c.Mutations, 0)
-	for mutationStr := range mutationTestCasesMap {
-		if len(mutationTestCasesMap[mutationStr]) == 0 {
-			panic("No test cases found for " + mutationStr)
-		}
-		for _, tc := range mutationTestCasesMap[mutationStr] {
+	mutations := []string{"hostIPCSet", "pullPolicyNotAlways", "hostPIDSet", "hostNetworkSet", "deploymentMissingReplicas", "runAsRootAllowed", "cpuRequestsMissing", "cpuLimitsMissing", "memoryRequestsMissing", "memoryLimitsMissing", "livenessProbeMissing", "readinessProbeMissing"}
+	for _, mutationStr := range mutations {
+		for _, tc := range failureTestCasesMap[mutationStr] {
 			newConfig := c
 			key := fmt.Sprintf("%s/%s", tc.check, strings.ReplaceAll(tc.filename, "failure", "mutated"))
 			mutatedYamlContent, ok := mutatedYamlContentMap[key]
 			assert.True(t, ok)
 			assert.Len(t, tc.resources.Resources, 1)
-			newConfig.Checks = map[string]config.Severity{}
-			newConfig.Checks[mutationStr] = config.SeverityDanger
 			newConfig.Mutations = []string{mutationStr}
 			results, err := validator.ApplyAllSchemaChecksToResourceProvider(&newConfig, tc.resources)
 			assert.NoError(t, err)
@@ -60,7 +56,7 @@ func TestMutations(t *testing.T) {
 				yamlContent, err := yaml.JSONToYAML(mutated.OriginalObjectJSON)
 				assert.NoError(t, err)
 				contentStr := mutation.UpdateMutatedContentWithComments(string(yamlContent), comments)
-				assert.EqualValues(t, mutatedYamlContent, contentStr, "Mutation test case for " + tc.check + "/" + tc.filename + " failed")
+				assert.EqualValues(t, mutatedYamlContent, contentStr)
 			}
 		}
 	}

test/schema_test.go

@@ -41,10 +41,9 @@ type testCase struct {
 }
 
 var mutatedYamlContentMap = map[string]string{}
-var mutationTestCasesMap = map[string][]testCase{}
+var failureTestCasesMap = map[string][]testCase{}
 
 func init() {
-	checkToTest := os.Getenv("POLARIS_CHECK_TEST")
 	_, baseDir, _, _ := runtime.Caller(0)
 	baseDir = filepath.Dir(baseDir) + "/checks"
 	dirs, err := ioutil.ReadDir(baseDir)
@@ -53,9 +52,6 @@ func init() {
 	}
 	for _, dir := range dirs {
 		check := dir.Name()
-		if checkToTest != "" && checkToTest != check {
-			continue
-		}
 		checkDir := baseDir + "/" + check
 		cases, err := ioutil.ReadDir(checkDir)
 		if err != nil {
@@ -80,19 +76,10 @@ func init() {
 			if tc.Name() == "check.yaml" {
 				continue
 			}
-			resourceFilename := strings.Replace(tc.Name(), "mutated", "failure", -1)
-
-			resources, err := kube.CreateResourceProviderFromPath(checkDir + "/" + resourceFilename)
+			resources, err := kube.CreateResourceProviderFromPath(checkDir + "/" + tc.Name())
 			if err != nil {
 				panic(err)
 			}
-			testcase := testCase{
-				filename:  tc.Name(),
-				check:     check,
-				resources: resources,
-				failure:   strings.Contains(resourceFilename, "failure"),
-				config:    c,
-			}
 
 			if strings.Contains(tc.Name(), "mutated") {
 				yamlContent, err := os.ReadFile(checkDir + "/" + tc.Name())
@@ -101,14 +88,24 @@ func init() {
 				}
 				key := fmt.Sprintf("%s/%s", check, tc.Name())
 				mutatedYamlContentMap[key] = string(yamlContent)
-				testCases, ok := mutationTestCasesMap[check]
-				if !ok {
-					testCases = []testCase{}
+			} else {
+				testcase := testCase{
+					filename:  tc.Name(),
+					check:     check,
+					resources: resources,
+					failure:   strings.Contains(tc.Name(), "failure"),
+					config:    c,
 				}
 				testCases = append(testCases, testcase)
-				mutationTestCasesMap[check] = testCases
-			} else {
-				testCases = append(testCases, testcase)
+
+				if strings.Contains(tc.Name(), "mutated") {
+					testCases, ok := failureTestCasesMap[check]
+					if !ok {
+						testCases = []testCase{}
+					}
+					testCases = append(testCases, testcase)
+					failureTestCasesMap[check] = testCases
+				}
 			}
 		}
 	}

test/webhook_test.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 set -e
 
-echo "Testing to ensure that the webhook starts up, allows a correct deployment to pass, and prevents a incorrectly formatted deployment."
-
+# Testing to ensure that the webhook starts up, allows a correct deployment to pass,
+# and prevents a incorrectly formatted deployment.
 BLUE='\033[0;34m'
 GREEN='\033[0;32m'
 RED='\033[0;31m'
@@ -57,11 +57,9 @@ function clean_up() {
         # || true to avoid issues when we cannot delete
         kubectl delete -f $filename ||true
     done
-    echo "Uninstalling webhook and webhook config"
-    kubectl delete validatingwebhookconfigurations polaris-webhook --wait=false || true
-    kubectl delete validatingwebhookconfigurations polaris-validate-webhook --wait=false || true
-    kubectl delete validatingwebhookconfigurations polaris-mutate-webhook --wait=false || true
-    kubectl -n polaris delete deploy -l app=polaris --wait=false || true
+    # Uninstall webhook and webhook config
+    kubectl delete validatingwebhookconfigurations polaris-webhook --wait=false
+    kubectl -n polaris delete deploy -l app=polaris --wait=false
     echo -e "\n\nDone cleaning up\n\n"
 }
 
@@ -79,26 +77,26 @@ kubectl create ns scale-test
 kubectl create ns polaris
 kubectl create ns tests
 
-echo "Installing a bad deployment"
+# Install a bad deployment
 kubectl apply -n scale-test -f ./test/webhook_cases/failing_test.deployment.yaml
 
-echo "Installing the webhook"
+# Install the webhook
 helm repo add fairwinds-stable https://charts.fairwinds.com/stable
 helm install polaris fairwinds-stable/polaris --namespace polaris --create-namespace \
   --set dashboard.enable=false \
   --set webhook.enable=true \
   --set image.tag=$CI_SHA1
 
-echo "Waiting for the webhook to come online"
+# wait for the webhook to come online
 check_webhook_is_ready
 sleep 5
 
 kubectl logs -n polaris $(kubectl get po -oname -n polaris | grep webhook) --follow &
 
-echo "Webhook started"
+# Webhook started, setting all tests as passed initially.
 ALL_TESTS_PASSED=1
 
-echo "Running tests against correctly configured objects"
+# Run tests against correctly configured objects
 for filename in test/webhook_cases/passing_test.*.yaml; do
     echo -e "\n\n"
     echo -e "${BLUE}TEST CASE: $filename${NC}"
@@ -111,7 +109,7 @@ for filename in test/webhook_cases/passing_test.*.yaml; do
     kubectl delete -n tests -f $filename || true
 done
 
-echo "Running tests against incorrectly configured objects"
+# Run tests against incorrectly configured objects
 for filename in test/webhook_cases/failing_test.*.yaml; do
     echo -e "\n\n"
     echo -e "${BLUE}TEST CASE: $filename${NC}"
@@ -125,7 +123,6 @@ for filename in test/webhook_cases/failing_test.*.yaml; do
     kubectl delete -n tests -f $filename || true
 done
 
-echo "Checking ability to scale"
 kubectl -n scale-test scale deployment nginx-deployment --replicas=2
 sleep 5
 kubectl get po -n scale-test
@@ -136,12 +133,9 @@ if [ $pod_count != 2 ]; then
 fi
 
 if [ -z $SKIP_FINAL_CLEANUP ]; then
-  echo "Doing final cleanup..."
   clean_up
 fi
 
-echo "Done with tests"
-
 #Verify that all the tests passed.
 if [ $ALL_TESTS_PASSED -eq 1 ]; then
     echo "Tests Passed."