add severities

.github/actions/setup-polaris/Dockerfile

@@ -1,6 +1,6 @@
 # The action uses an own Dockerfile on purpose because the root Dockerfile takes way too long to build for an action
 
-FROM alpine:3.10
+FROM alpine:3.17
 
 RUN	apk add --no-cache \
   bash \

.github/actions/setup-polaris/get_polaris.sh

@@ -17,4 +17,4 @@ mkdir polaris
 tar -xzf $TARGET_FILE -C polaris
 rm $TARGET_FILE
 echo "polaris" >> $GITHUB_PATH
-echo "::set-output name=version::$INPUT_VERSION"
+echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT

.github/workflows/stale.yml

@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v4
+      - uses: actions/stale@v7
         with:
           exempt-issue-labels: pinned
           stale-pr-label: stale

.github/workflows/test_setup.yml

@@ -7,7 +7,7 @@ jobs:
   build-int:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup polaris
         uses: ./.github/actions/setup-polaris
         with:
@@ -18,7 +18,7 @@ jobs:
   build-ext:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup polaris
         uses: fairwindsops/polaris/.github/actions/setup-polaris@master
         with:

README.md

@@ -38,8 +38,9 @@ and network with fellow Kubernetes users.
 or
 [join the user group](https://www.fairwinds.com/open-source-software-user-group) to get involved!
 
-<a href="https://www.fairwinds.com/t-shirt-offer?utm_source=polaris&utm_medium=polaris&utm_campaign=polaris-tshirt">
-  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png" alt="Love Fairwinds Open Source? Share your business email and job title and we'll send you a free Fairwinds t-shirt!" />
+<a href="https://insights.fairwinds.com/auth/register/">
+  <img src="https://www.fairwinds.com/hubfs/Doc_Banners/Fairwinds_OSS_User_Group_740x125_v6.png"
+  alt="Love Fairwinds Open Source? Automate Fairwinds Open Source for free with Fairwinds Insights. Click to learn more" />
 </a>
 
 ## Other Projects from Fairwinds

docs/checks/security.md

@@ -22,6 +22,19 @@ key | default | description
 `hostNetworkSet` | `warning` | Fails when `hostNetwork` attribute is configured.
 `hostPortSet` | `warning` | Fails when `hostPort` attribute is configured.
 `tlsSettingsMissing` | `warning` | Fails when an Ingress lacks TLS settings.
+`automountServiceAccountToken` | `ignore` | Fails if service account tokens are automounted to pods
+`clusterrolePodExecAttach` | `warning` | Fails if a ClusterRole is able to exec into pods
+`clusterrolebindingClusterAdmin` | `warning` | Fails if a ClusterRoleBinding is attached to the admin role
+`clusterrolebindingPodExecAttach` | `warning` | Fails if a ClusterRoleBinding is able to exec into pods
+`rolePodExecAttach` | `warning` | Fails if a Role is able to exec into pods
+`rolebindingClusterAdminClusterRole` | `warning` | Fails if a RoleBinding is attached to the cluster admin role
+`rolebindingClusterAdminRole` | `warning` | Fails if a RoleBinding is attached to the admin role
+`rolebindingClusterRolePodExecAttach` | `warning` | Fails if a RoleBinding is able to exec into pods in any namespace
+`rolebindingRolePodExecAttach` | `warning` | Fails if a RoleBinding is able to exec into pods in its namespace
+`linuxHardening` | `warning` | Fails if one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are not used to limit unwanted privileges
+`missingNetworkPolicy` | `warning` | Fails if a controller lacks a corresponding NetworkPolicy
+`sensitiveConfigmapContent` | `warning` | Fails if a ConfigMap contains a likely password or secret
+`sensitiveContainerEnvVar` | `warning` | Fails if a controller has an environment variable hard-coded to a likely password or secret
 
 ## Background