Fix 7e099521

Define tag filters for all jobs in the workflow
Re-enable build/push of documentation
2026-08-29 22:17:16 +00:00 · 2022-09-22 12:06:29 -06:00 · 2022-09-22 11:58:19 -06:00 · 2022-09-22 11:36:13 -06:00
52 changed files with 168 additions and 1030 deletions
@@ -1,2 +1,2 @@
 ## DO NOT EDIT - Managed by Terraform
-* @rbren @mggude
+* @rbren @makoscafee
@@ -1,4 +1,4 @@
-FROM alpine:3.17
+FROM alpine:3.16
 WORKDIR /usr/local/bin
 RUN apk -U upgrade
 RUN apk --no-cache add ca-certificates
@@ -18,8 +18,9 @@ schemaString: |
                - const: 'admin'
                - const: "cluster-admin"
                - const: "edit"
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
+                - const: "system:aggregate-to-edit"
+                - const: "system:controller:generic-garbage-collector"
+                - const: "system:controller:namespace-controller"
    - properties:
        rules:
          type: array
@@ -17,8 +17,8 @@ schemaString: |
              type: string
              anyOf:
                - const: "cluster-admin"
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
+                - const: "system:controller:generic-garbage-collector"
+                - const: "system:controller:namespace-controller"
    - required: ["roleRef"]
      properties:
        roleRef:
@@ -39,7 +39,7 @@ additionalSchemaStrings:
  rbac.authorization.k8s.io/ClusterRole: |
    type: object
    # Do not alert on default ClusterRoleBindings.
-    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    {{ if and (ne .metadata.name "cluster-admin") (ne .metadata.name "system:controller:generic-garbage-collector") (ne .metadata.name "system:controller:namespace-controller") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -17,8 +17,8 @@ schemaString: |
              type: string
              anyOf:
                - const: "cluster-admin"
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
+                - const: "system:controller:generic-garbage-collector"
+                - const: "system:controller:namespace-controller"
    - required: ["roleRef"]
      properties:
        roleRef:
@@ -37,7 +37,7 @@ additionalSchemaStrings:
  rbac.authorization.k8s.io/ClusterRole: |
    type: object
    # Do not alert on default ClusterRoleBindings.
-    {{ if and (ne .metadata.name "cluster-admin") (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
+    {{ if and (ne .metadata.name "cluster-admin") (ne .metadata.name "system:controller:generic-garbage-collector") (ne .metadata.name "system:controller:namespace-controller") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -6,51 +6,40 @@ schemaString: |
  '$schema': http://json-schema.org/draft-07/schema
  type: object
  required: ["metadata", "rules"]
-  anyOf:
-    # Do not alert on default Roles.
-    - properties:
-        metadata:
-          required: ["name"]
+  properties:
+    metadata:
+      required: ["name"]
+      properties:
+        name:
+          type: string
+    rules:
+      type: array
+      items:
+        type: object
+        not:
+          required: ["apiGroups", "resources", "verbs"]
          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
-    - properties:
-        metadata:
-          required: ["name"]
-          properties:
-            name:
-              type: string
-        rules:
-          type: array
-          items:
-            type: object
-            not:
-              required: ["apiGroups", "resources", "verbs"]
-              properties:
-                apiGroups:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: ""
-                      - const: '*'
-                resources:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: '*'
-                      - const: "pods/exec"
-                      - const: "pods/attach"
-                verbs:
-                  type: array
-                  contains:
-                    type: string
-                    anyOf:
-                      - const: '*'
-                      # An exec is also possible by `get`ing a web socket.
-                      - const: 'get'
-                      - const: 'create'
+            apiGroups:
+              type: array
+              contains:
+                type: string
+                anyOf:
+                  - const: ""
+                  - const: '*'
+            resources:
+              type: array
+              contains:
+                type: string
+                anyOf:
+                  - const: '*'
+                  - const: "pods/exec"
+                  - const: "pods/attach"
+            verbs:
+              type: array
+              contains:
+                type: string
+                anyOf:
+                  - const: '*'
+                  # An exec is also possible by `get`ing a web socket.
+                  - const: 'get'
+                  - const: 'create'
@@ -15,18 +15,6 @@ schemaString: |
            kind:
              type: string
              const: "Role"
-    # Do not alert on default ClusterRoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
    - required: ["roleRef"]
      properties:
        roleRef:
@@ -48,7 +36,6 @@ additionalSchemaStrings:
    type: object
    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "ClusterRole" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -95,4 +82,3 @@ additionalSchemaStrings:
                            - "patch"
                            - "delete"
    {{ end }}
-    {{ end }}
@@ -15,18 +15,6 @@ schemaString: |
            kind:
              type: string
              const: "ClusterRole"
-    # Do not alert on default RoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
    - required: ["roleRef"]
      properties:
        roleRef:
@@ -46,7 +34,6 @@ additionalSchemaStrings:
    type: object
    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "Role" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -93,4 +80,3 @@ additionalSchemaStrings:
                            - "patch"
                            - "delete"
    {{ end }}
-    {{ end }}
@@ -15,18 +15,6 @@ schemaString: |
            kind:
              type: string
              const: "Role"
-    # Do not alert on default RoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
    - required: ["roleRef"]
      properties:
        roleRef:
@@ -46,7 +34,6 @@ additionalSchemaStrings:
    type: object
    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "ClusterRole" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -89,4 +76,3 @@ additionalSchemaStrings:
                        - const: 'get'
                        - const: 'create'
    {{ end }}
-    {{ end }}
@@ -18,18 +18,6 @@ schemaString: |
            kind:
              type: string
              const: "Role"
-    # Do not alert on default RoleBindings.
-    - required: ["metadata"]
-      properties:
-        metadata:
-          type: object
-          required: ["name"]
-          properties:
-            name:
-              type: string
-              anyOf:
-                - pattern: '^system:'
-                - const: "gce:podsecuritypolicy:calico-sa"
    - required: ["roleRef"]
      properties:
        roleRef:
@@ -49,7 +37,6 @@ additionalSchemaStrings:
    type: object
    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "Role" }}
-    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
@@ -92,4 +79,3 @@ additionalSchemaStrings:
                        - const: 'get'
                        - const: 'create'
    {{ end }}
-    {{ end }}
@@ -10,41 +10,34 @@ schemaString: |
      type: array
      items:
        type: object
-        oneOf:
-          - required: ["name", "value"]
-            properties:
-              name:
-                type: string
-                '$comment': These environment variable names will be disallowed.
-                allOf:
-                  - not:
-                      pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
-                  - not:
-                      pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
-                  - not:
-                      pattern: '(?i)^AZURE_.+KEY$'
-                  - not:
-                      pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
-                  - not:
-                      pattern: '(?i)password'
-                  - not:
-                      pattern: '(?i)token'
-                  - not:
-                      pattern: '(?i)bearer'
-                  - not:
-                      pattern: '(?i)secret'
-                    '$comment': This allows variable names not excluded above.
-                  - pattern: '(?i).*'
-              value:
-                type: string
-                '$comment': These environment variable values will be disallowed.
-                allOf:
-                - not:
-                    '$comment': THis matches variations like begin private key, begin rsa private key ...
-                    pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'
-          - required: ["name", "valueFrom"]
-            properties:
-              name:
-                type: string
-              valueFrom:
-                type: object
+        required: ["name"]
+        properties:
+          name:
+            type: string
+            '$comment': These environment variable names will be disallowed.
+            allOf:
+              - not:
+                  pattern: '(?i)^AWS_SECRET_ACCESS_KEY$'
+              - not:
+                  pattern: '(?i)^GOOGLE_APPLICATION_CREDENTIALS$'
+              - not:
+                  pattern: '(?i)^AZURE_.+KEY$'
+              - not:
+                  pattern: '(?i)^OCI_CLI_KEY_CONTENT$'
+              - not:
+                  pattern: '(?i)password'
+              - not:
+                  pattern: '(?i)token'
+              - not:
+                  pattern: '(?i)bearer'
+              - not:
+                  pattern: '(?i)secret'
+                '$comment': This allows variable names not excluded above.
+              - pattern: '(?i).*'
+          value:
+            type: string
+            '$comment': These environment variable values will be disallowed.
+            allOf:
+            - not:
+                '$comment': THis matches variations like begin private key, begin rsa private key ...
+                pattern: '(?i)\s*-BEGIN\s+.*PRIVATE KEY-\s*'
@@ -19,7 +19,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net/http"
 	"os"
 	"os/exec"
@@ -137,7 +137,7 @@ func ProcessHelmTemplates(helmChart, helmValues string) (string, error) {
 		return "", err
 	}

-	dir, err := os.MkdirTemp("", "*")
+	dir, err := ioutil.TempDir("", "*")
 	if err != nil {
 		return "", err
 	}
@@ -212,7 +212,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor

 			defer resp.Body.Close()

-			body, err := io.ReadAll(resp.Body)
+			body, err := ioutil.ReadAll(resp.Body)

 			if err != nil {
 				logrus.Errorf("Error reading response: %v", err)
@@ -223,7 +223,7 @@ func outputAudit(auditData validator.AuditData, outputFile, outputURL, outputFor
 		}

 		if outputFile != "" {
-			err := os.WriteFile(outputFile, []byte(outputBytes), 0644)
+			err := ioutil.WriteFile(outputFile, []byte(outputBytes), 0644)
 			if err != nil {
 				logrus.Errorf("Error writing output to file: %v", err)
 				os.Exit(1)
@@ -16,6 +16,7 @@ package cmd

 import (
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -92,7 +93,7 @@ var fixCommand = &cobra.Command{
 		}

 		for _, fullFilePath := range yamlFiles {
-			yamlContent, err := os.ReadFile(fullFilePath)
+			yamlContent, err := ioutil.ReadFile(fullFilePath)
 			if err != nil {
 				logrus.Fatalf("Error reading file with file path %s: %v", fullFilePath, err)
 			}
@@ -135,7 +136,7 @@ var fixCommand = &cobra.Command{
 			}

 			if updatedYamlContent != "" {
-				err = os.WriteFile(fullFilePath, []byte(updatedYamlContent), 0644)
+				err = ioutil.WriteFile(fullFilePath, []byte(updatedYamlContent), 0644)
 				if err != nil {
 					logrus.Fatalf("Error writing output to file: %v", err)
 				}
@@ -15,11 +15,13 @@
 package cmd

 import (
+	"flag"
 	"os"

 	conf "github.com/fairwindsops/polaris/pkg/config"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 )

 var configPath string
@@ -40,7 +42,9 @@ func init() {
 	rootCmd.PersistentFlags().BoolVarP(&disallowExemptions, "disallow-exemptions", "", false, "Disallow any configured exemption.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowConfigExemptions, "disallow-config-exemptions", "", false, "Disallow exemptions set within the configuration file.")
 	rootCmd.PersistentFlags().BoolVarP(&disallowAnnotationExemptions, "disallow-annotation-exemptions", "", false, "Disallow any exemption defined as a controller annotation.")
-	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level to be output (trace, debug, info, warning, error, fatal, panic).")
+	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "", logrus.InfoLevel.String(), "Logrus log level.")
+	flag.Parse()
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
 }

 var config conf.Configuration
@@ -167,18 +167,6 @@ schemaString: |
              {{ end }}
 ```

-### Additional Go Template Functions
-
-These functions are also available in the GO template.
-
-* [hasPrefix](https://pkg.go.dev/strings#HasPrefix) - for example, `hasPrefix "string" "prefix"`
-* [hasSuffix](https://pkg.go.dev/strings#HasSuffix) - for example, `hasSuffix "string" "suffix"`
-
-For example, the `hasPrefix` function can be used in a template to determine whether a resource name starts with `system:`
-```
-{{ if hasPrefix .metadata.name "system:" }}
-```
-
 ## Multi-Resource Checks
 You can write checks that span multiple resources. This is helpful for ensuring e.g.
 that every Deployment has a PDB or an HPA associated with it.
@@ -32,9 +32,6 @@ checks:
  clusterrolebindingPodExecAttach: danger
  rolebindingClusterRolePodExecAttach: danger
  rolebindingRolePodExecAttach: danger
-  clusterrolebindingClusterAdmin: danger
-  rolebindingClusterAdminClusterRole: danger
-  rolebindingClusterAdminRole: danger
  # custom
  resourceLimits: warning
  imageRegistry: danger
@@ -16,11 +16,8 @@ checks:
  memoryRequestsMissing: warning
  memoryLimitsMissing: warning
  # security
-  automountServiceAccountToken: ignore
  hostIPCSet: danger
  hostPIDSet: danger
-  linuxHardening: warning
-  missingNetworkPolicy: ignore
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
  runAsRootAllowed: danger
@@ -30,62 +27,11 @@ checks:
  hostNetworkSet: danger
  hostPortSet: warning
  tlsSettingsMissing: warning
-  # These are initially warning and will later be promoted to danger.
-  sensitiveContainerEnvVar: warning
-  sensitiveConfigmapContent: warning
-  clusterrolePodExecAttach: warning
-  rolePodExecAttach: warning
-  clusterrolebindingPodExecAttach: warning
-  rolebindingClusterRolePodExecAttach: warning
-  rolebindingRolePodExecAttach: warning
-  clusterrolebindingClusterAdmin: warning
-  rolebindingClusterAdminClusterRole: warning
-  rolebindingClusterAdminRole: warning
-

 mutations:
  - pullPolicyNotAlways

 exemptions:
-  - namespace: kube-system
-    controllerNames:
-      - dns-controller
-      - ebs-csi-controller
-      - ebs-csi-node
-      - kindnet
-      - kops-controller
-      - kube-dns
-      - kube-flannel-ds
-      - kube-proxy
-      - kube-scheduler
-      - vpa-recommender
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-  - namespace: kube-system
-    controllerNames:
-      - coredns
-    rules:
-      - automountServiceAccountToken
-      - missingNetworkPolicy
-  - namespace: kube-system
-    controllerNames:
-      - ebs-csi-controller
-    rules:
-      - sensitiveContainerEnvVar
-  - namespace: kube-system
-    controllerNames:
-      - coredns-autoscaler
-    rules:
-      - linuxHardening
-  - namespace: local-path-storage
-    controllerNames:
-      - local-path-provisioner
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
  - namespace: kube-system
    controllerNames:
      - kube-apiserver
@@ -108,48 +54,7 @@ exemptions:
      - runAsPrivileged
      - notReadOnlyRootFilesystem
      - hostPIDSet
-  - namespace: datadog
-    controllerNames:
-      - datadogtoken
-    rules:
-      - sensitiveConfigmapContent
-  - namespace: datadog
-    controllerNames:
-      - datadog-cluster-agent-apiserver
-    rules:
-      - rolebindingClusterAdminRole
-      - rolebindingRolePodExecAttach

-  - controllerNames:
-      - ingress-nginx-controller
-    rules:
-      - sensitiveConfigmapContent
-  - controllerNames:
-      - ingress-nginx-controller
-      - ingress-nginx-default-backend
-      - polaris
-      - rbac-manager
-    rules:
-      - automountServiceAccountToken
-      - missingNetworkPolicy
-  - controllerNames:
-      - aws-iam-authenticator
-      - aws-load-balancer-controller
-      - docker-registry
-      - external-dns
-      - kube2iam
-      - metrics-server
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-  - controllerNames:
-      - oauth2-proxy
-    rules:
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-      - sensitiveContainerEnvVar
  - controllerNames:
      - kube-flannel-ds
    rules:
@@ -167,9 +72,6 @@ exemptions:
      - runAsRootAllowed
      - readinessProbeMissing
      - livenessProbeMissing
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy

  - controllerNames:
      - cluster-autoscaler
@@ -177,9 +79,6 @@ exemptions:
      - notReadOnlyRootFilesystem
      - runAsRootAllowed
      - readinessProbeMissing
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy

  - controllerNames:
      - vpa
@@ -196,10 +95,6 @@ exemptions:
      - readinessProbeMissing
      - livenessProbeMissing
      - notReadOnlyRootFilesystem
-      - automountServiceAccountToken
-      - linuxHardening
-      - missingNetworkPolicy
-      - sensitiveContainerEnvVar

  - controllerNames:
      - nginx-ingress-controller
@@ -8,16 +8,16 @@ require (
 	github.com/gorilla/mux v1.8.0
 	github.com/qri-io/jsonschema v0.1.1
 	github.com/sirupsen/logrus v1.9.0
-	github.com/spf13/cobra v1.6.1
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/testify v1.8.1
+	github.com/spf13/cobra v1.5.0
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.8.0
 	github.com/thoas/go-funk v0.9.2
-	golang.org/x/text v0.4.0 // indirect
+	golang.org/x/text v0.3.7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.25.3
-	k8s.io/apimachinery v0.25.3
-	k8s.io/client-go v0.25.3
+	k8s.io/api v0.25.0
+	k8s.io/apimachinery v0.25.0
+	k8s.io/client-go v0.25.0
 	sigs.k8s.io/controller-runtime v0.13.0
 	sigs.k8s.io/yaml v1.3.0
 )
@@ -28,7 +28,7 @@ require (
 )

 require (
-	cloud.google.com/go/compute v1.10.0 // indirect
+	cloud.google.com/go/compute v1.9.0 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest v0.11.28 // indirect
 	github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
@@ -41,7 +41,7 @@ require (
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
@@ -67,7 +67,7 @@ require (
 	github.com/markbates/safe v1.0.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
@@ -77,19 +77,19 @@ require (
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/qri-io/jsonpointer v0.1.1 // indirect
-	golang.org/x/crypto v0.0.0-20221012134737-56aed061732a // indirect
-	golang.org/x/net v0.0.0-20221017152216-f25eb7ecb193 // indirect
-	golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783 // indirect
-	golang.org/x/sys v0.1.0 // indirect
-	golang.org/x/term v0.0.0-20221017184919-83659145692c // indirect
-	golang.org/x/time v0.1.0 // indirect
+	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90 // indirect
+	golang.org/x/net v0.0.0-20220909164309-bea034e7d591 // indirect
+	golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 // indirect
+	golang.org/x/sys v0.0.0-20220913175220-63ea55921009 // indirect
+	golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 // indirect
+	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/component-base v0.25.3 // indirect
+	k8s.io/component-base v0.25.0 // indirect
 	k8s.io/klog/v2 v2.80.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
-	k8s.io/utils v0.0.0-20221012122500-cfd413dd9e85 // indirect
+	k8s.io/kube-openapi v0.0.0-20220803164354-a70c9af30aea // indirect
+	k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73 // indirect
 	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )
@@ -24,8 +24,8 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.10.0 h1:aoLIYaA1fX3ywihqpBk2APQKOo20nXsp1GEZQbx5Jk4=
-cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
+cloud.google.com/go/compute v1.9.0 h1:ED/FP4xv8GJw63v556/ASNc1CeeLUO2Bs8nzaHchkHg=
+cloud.google.com/go/compute v1.9.0/go.mod h1:lWv1h/zUWTm/LozzfTJhBSkd6ShQq8la8VeeuOEGxfY=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
@@ -115,8 +115,8 @@ github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/flowstack/go-jsonschema v0.1.1/go.mod h1:yL7fNggx1o8rm9RlgXv7hTBWxdBM0rVwpMwimd3F3N0=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
+github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -129,6 +129,7 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -311,8 +312,8 @@ github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27k
 github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.2 h1:hAHbPm5IJGijwng3PWk09JkG9WeqChjprR5s9bBZ+OM=
-github.com/matttproud/golang_protobuf_extensions v1.0.2/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 h1:I0XW9+e1XWDxdcEniV4rQAIOPUGDq67JSCiRCgGCZLI=
+github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -335,8 +336,8 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
-github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/ginkgo/v2 v2.1.4 h1:GNapqRSid3zijZ9H77KrgVG4/8KqiyRsxcSxe+7ApXY=
+github.com/onsi/gomega v1.19.0 h1:4ieX6qQjPP/BfC3mpsAtIGGlxTWPeA3Inl/7DtXw1tw=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -398,11 +399,12 @@ github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVs
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
-github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
-github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
+github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
+github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -411,7 +413,6 @@ github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -419,9 +420,8 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/thoas/go-funk v0.9.2 h1:oKlNYv0AY5nyf9g+/GhMgS/UO2ces0QRdPKwkhY3VCk=
 github.com/thoas/go-funk v0.9.2/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
@@ -447,7 +447,7 @@ go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
+go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
 go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
@@ -462,8 +462,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20221012134737-56aed061732a h1:NmSIgad6KjE6VvHciPZuNRTKxGhlPfD6OA87W/PLkqg=
-golang.org/x/crypto v0.0.0-20221012134737-56aed061732a/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90 h1:Y/gsMcFOcR+6S6f3YeMKl5g+dZMEWqcz5Czj/GWYbkM=
+golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -542,8 +542,8 @@ golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20221017152216-f25eb7ecb193 h1:3Moaxt4TfzNcQH6DWvlYKraN1ozhBXQHcgvXjRGeim0=
-golang.org/x/net v0.0.0-20221017152216-f25eb7ecb193/go.mod h1:RpDiru2p0u2F0lLpEoqnP2+7xs0ifAuOcJ442g6GU2s=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591 h1:D0B/7al0LLrVC8aWF4+oxpv/m8bc7ViFfVS8/gXGdqI=
+golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -558,8 +558,8 @@ golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783 h1:nt+Q6cXKz4MosCSpnbMtqiQ8Oz0pxTef2B4Vca2lvfk=
-golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
+golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1 h1:lxqLZaMad/dJHMFZH0NiNpiEZI/nhgWhe4wgzpE+MuA=
+golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -629,16 +629,15 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220913175220-63ea55921009 h1:PuvuRMeLWqsf/ZdT1UUZz0syhioyv1mzuFZsXs4fvhw=
+golang.org/x/sys v0.0.0-20220913175220-63ea55921009/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
 golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20221017184919-83659145692c h1:dveknrit5futqEmXAvd2I1BbZIDhxRijsyWHM86NlcA=
-golang.org/x/term v0.0.0-20221017184919-83659145692c/go.mod h1:VTIZ7TEbF0BS9Sv9lPTvGbtW8i4z6GGbJBCM37uMCzY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -647,14 +646,13 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0 h1:xYY+Bajn2a7VBmTM5GikTmnK8ZuX8YgnQCqZpbBNtmA=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 h1:ftMN5LMiBFjbzleLqtoBZk7KdJwhuybIU+FckUHgoyQ=
+golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -853,21 +851,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.25.3 h1:Q1v5UFfYe87vi5H7NU0p4RXC26PPMT8KOpr1TLQbCMQ=
-k8s.io/api v0.25.3/go.mod h1:o42gKscFrEVjHdQnyRenACrMtbuJsVdP+WVjqejfzmI=
+k8s.io/api v0.25.0 h1:H+Q4ma2U/ww0iGB78ijZx6DRByPz6/733jIuFpX70e0=
+k8s.io/api v0.25.0/go.mod h1:ttceV1GyV1i1rnmvzT3BST08N6nGt+dudGrquzVQWPk=
 k8s.io/apiextensions-apiserver v0.25.0 h1:CJ9zlyXAbq0FIW8CD7HHyozCMBpDSiH7EdrSTCZcZFY=
-k8s.io/apimachinery v0.25.3 h1:7o9ium4uyUOM76t6aunP0nZuex7gDf8VGwkR5RcJnQc=
-k8s.io/apimachinery v0.25.3/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo=
-k8s.io/client-go v0.25.3 h1:oB4Dyl8d6UbfDHD8Bv8evKylzs3BXzzufLiO27xuPs0=
-k8s.io/client-go v0.25.3/go.mod h1:t39LPczAIMwycjcXkVc+CB+PZV69jQuNx4um5ORDjQA=
-k8s.io/component-base v0.25.3 h1:UrsxciGdrCY03ULT1h/S/gXFCOPnLhUVwSyx+hM/zq4=
-k8s.io/component-base v0.25.3/go.mod h1:WYoS8L+IlTZgU7rhAl5Ctpw0WdMxDfCC5dkxcEFa/TI=
+k8s.io/apimachinery v0.25.0 h1:MlP0r6+3XbkUG2itd6vp3oxbtdQLQI94fD5gCS+gnoU=
+k8s.io/apimachinery v0.25.0/go.mod h1:qMx9eAk0sZQGsXGu86fab8tZdffHbwUfsvzqKn4mfB0=
+k8s.io/client-go v0.25.0 h1:CVWIaCETLMBNiTUta3d5nzRbXvY5Hy9Dpl+VvREpu5E=
+k8s.io/client-go v0.25.0/go.mod h1:lxykvypVfKilxhTklov0wz1FoaUZ8X4EwbhS6rpRfN8=
+k8s.io/component-base v0.25.0 h1:haVKlLkPCFZhkcqB6WCvpVxftrg6+FK5x1ZuaIDaQ5Y=
+k8s.io/component-base v0.25.0/go.mod h1:F2Sumv9CnbBlqrpdf7rKZTmmd2meJq0HizeyY/yAFxk=
+k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
-k8s.io/utils v0.0.0-20221012122500-cfd413dd9e85 h1:cTdVh7LYu82xeClmfzGtgyspNh6UxpwLWGi8R4sspNo=
-k8s.io/utils v0.0.0-20221012122500-cfd413dd9e85/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20220803164354-a70c9af30aea h1:3QOH5+2fGsY8e1qf+GIFpg+zw/JGNrgyZRQR7/m6uWg=
+k8s.io/kube-openapi v0.0.0-20220803164354-a70c9af30aea/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU=
+k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73 h1:H9TCJUUx+2VA0ZiD9lvtaX8fthFsMoD+Izn93E/hm8U=
+k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
@@ -19,8 +19,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
-	"os"
 	"strings"

 	"github.com/gobuffalo/packr/v2"
@@ -70,10 +70,10 @@ func ParseFile(path string) (Configuration, error) {
 		if err2 != nil {
 			return Configuration{}, err2
 		}
-		rawBytes, err = io.ReadAll(response.Body)
+		rawBytes, err = ioutil.ReadAll(response.Body)
 	} else {
 		// path is local
-		rawBytes, err = os.ReadFile(path)
+		rawBytes, err = ioutil.ReadFile(path)
 	}
 	if err != nil {
 		return Configuration{}, err
@@ -223,10 +223,7 @@ func (check SchemaCheck) TemplateForResource(res interface{}) (*SchemaCheck, err
 	newCheck.AdditionalSchemaStrings = map[string]string{}

 	for kind, tmplString := range templateStrings {
-		tmpl := template.New(newCheck.ID).Funcs(template.FuncMap{
-			"hasPrefix": strings.HasPrefix,
-			"hasSuffix": strings.HasSuffix,
-		})
+		tmpl := template.New(newCheck.ID)
 		tmpl, err := tmpl.Parse(tmplString)
 		if err != nil {
 			return nil, err
@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -215,7 +216,7 @@ func CreateResourceProviderFromPath(directory string) (*ResourceProvider, error)
 		if !strings.HasSuffix(path, ".yml") && !strings.HasSuffix(path, ".yaml") {
 			return nil
 		}
-		contents, err := os.ReadFile(path)
+		contents, err := ioutil.ReadFile(path)
 		if err != nil {
 			logrus.Errorf("Error reading file: %v", path)
 			return err
@@ -426,7 +427,7 @@ func deduplicateControllers(inputResources []GenericResource) []GenericResource
 }

 func (resources *ResourceProvider) addResourcesFromReader(reader io.Reader) error {
-	contents, err := io.ReadAll(reader)
+	contents, err := ioutil.ReadAll(reader)
 	if err != nil {
 		logrus.Errorf("Error reading from %v: %v", reader, err)
 		return err
@@ -17,7 +17,7 @@ package kube
 import (
 	"bytes"
 	"context"
-	"os"
+	"io/ioutil"
 	"testing"
 	"time"

@@ -78,7 +78,7 @@ func TestGetMultipleResourceFromBadFile(t *testing.T) {
 }

 func TestAddResourcesFromReader(t *testing.T) {
-	contents, err := os.ReadFile("./test_files/test_2/multi.yaml")
+	contents, err := ioutil.ReadFile("./test_files/test_2/multi.yaml")
 	assert.NoError(t, err)
 	reader := bytes.NewBuffer(contents)
 	resources := newResourceProvider("unknown", "Path", "-")
@@ -18,6 +18,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"time"

@@ -61,7 +62,7 @@ func RunAudit(config conf.Configuration, kubeResources *kube.ResourceProvider) (
 // ReadAuditFromFile reads the data from a past audit stored in a JSON or YAML file.
 func ReadAuditFromFile(fileName string) AuditData {
 	auditData := AuditData{}
-	oldFileBytes, err := os.ReadFile(fileName)
+	oldFileBytes, err := ioutil.ReadFile(fileName)
 	if err != nil {
 		logrus.Errorf("Unable to read contents of loaded file: %v", err)
 		os.Exit(1)
@@ -40,25 +40,6 @@ type schemaTestCase struct {
 	ResourceProvider *kube.ResourceProvider
 }

-// ShortString supplies some fields of a schemaTestCase suitable for brief
-// output.
-func (s schemaTestCase) ShortString() string {
-	var msg strings.Builder
-	targetStr := s.Target
-	if targetStr != "" {
-		msg.WriteString(fmt.Sprintf("target=%s, ", targetStr))
-	}
-	ns := s.Resource.ObjectMeta.GetNamespace()
-	if ns != "" {
-		msg.WriteString(fmt.Sprintf("namespace=%s, ", ns))
-	}
-	msg.WriteString(fmt.Sprintf("resource=%s/%s", s.Resource.Kind, s.Resource.ObjectMeta.GetName()))
-	if s.Target == config.TargetContainer {
-		msg.WriteString(fmt.Sprintf(", container=%s", s.Container.Name))
-	}
-	return msg.String()
-}
-
 func resolveCheck(conf *config.Configuration, checkID string, test schemaTestCase) (*config.SchemaCheck, error) {
 	if !conf.DisallowExemptions &&
 		!conf.DisallowAnnotationExemptions &&
@@ -129,7 +110,6 @@ func getTemplateInput(test schemaTestCase) (map[string]interface{}, error) {
 			}
 		}
 	}
-	logrus.Debugf("the go template input for schema test-case %s is: %v", test.ShortString(), templateInput)
 	return templateInput, nil
 }

@@ -397,16 +377,6 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 			return nil, err
 		}
 	}
-	if len(issues) > 0 {
-		issueMessages := make([]string, len(issues))
-		for i, issue := range issues {
-			issueMessages[i] = issue.Message
-		}
-		logrus.Debugf("there were %d issue(s) validating the schema for test-case %s: %v", len(issueMessages), test.ShortString(), issueMessages)
-	} else {
-		logrus.Debugf("there were no issues validating the schema for test-case %s", test.ShortString())
-
-	}
 	result := makeResult(conf, check, passes, issues)
 	if !passes {
 		if funk.Contains(conf.Mutations, checkID) && len(check.Mutations) > 0 {
@@ -58,11 +58,7 @@ func (m *Mutator) mutate(req admission.Request) ([]jsonpatch.Operation, error) {
 	if err != nil {
 		return nil, err
 	}
-	mutatedJSONStr, err := yaml.YAMLToJSON([]byte(mutatedYamlStr))
-	if err != nil {
-		return nil, err
-	}
-	return jsonpatch.CreatePatch(kubeResources.OriginalObjectJSON, []byte(mutatedJSONStr))
+	return jsonpatch.CreatePatch(originalYaml, []byte(mutatedYamlStr))
 }

 // Handle for Validator to run validation checks.
@@ -1,9 +0,0 @@
-# This succeeds because the clusterRole is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
@@ -1,9 +0,0 @@
-# This succeeds because the clusterRole has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: system:test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
@@ -1,35 +0,0 @@
-# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards which happens to have a `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  # The system: prefix does not cause this test to fail, but this test
-  # avoids incorectly ignoring user-created bindings to system ClusterRoles.
-  name: system:test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: test-binding-to-system-prefix-clusterrole
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This Role exists so there is at least one Role for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: not-used
-  namespace: test
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,33 +0,0 @@
-# This succeeds because the clusterRoleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This Role exists so there is at least one Role for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: not-used
-  namespace: test
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,33 +0,0 @@
-# This succeeds because the clusterRoleBinding has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: system:test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This Role exists so there is at least one Role for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: not-used
-  namespace: test
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,35 +0,0 @@
-# This fails because the clusterRoleBinding references a ClusterRole that uses all wildcards which happens to have a `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  # The system: prefix does not cause this test to fail, but this test
-  # avoids incorectly ignoring user-created bindings to system ClusterRoles.
-  name: system:test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: test-binding-to-system-prefix-clusterrole
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This Role exists so there is at least one Role for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: not-used
-  namespace: test
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,33 +0,0 @@
-# This succeeds because the clusterRoleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This Role exists so there is at least one Role for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: not-used
-  namespace: test
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,33 +0,0 @@
-# This succeeds because the clusterRoleBinding has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: system:test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This Role exists so there is at least one Role for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: not-used
-  namespace: test
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,10 +0,0 @@
-# This succeeds because the role is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-  namespace: kube-system
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
@@ -1,10 +0,0 @@
-# This succeeds because the Role has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: system:controller:glbc
-  namespace: kube-system
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
@@ -1,26 +0,0 @@
-# This fails because the roleBinding references a ClusterRole that uses all wildcards which happens to have a `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  # The system: prefix does not cause this test to fail, but this test
-  # avoids incorectly ignoring user-created bindings to system ClusterRoles.
-  name: system:test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test-binding-to-system-prefix-role
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,23 +0,0 @@
-# This succeeds because the roleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,24 +0,0 @@
-# This succeeds because the RoleBinding has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: system:test
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
-
@@ -1,36 +0,0 @@
-# This fails because the roleBinding references a Role that uses all wildcards which happens to have a `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  # The system: prefix does not cause this test to fail, but this test
-  # avoids incorectly ignoring user-created bindings to system ClusterRoles.
-  name: system:test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test-binding-to-system-prefix-role
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: system:test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This ClusterRole exists so there is at least one ClusterRole for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: not-used
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,34 +0,0 @@
-# This succeeds because the roleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This ClusterRole exists so there is at least one ClusterRole for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: not-used
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,34 +0,0 @@
-# This succeeds because the RoleBinding has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: system:test
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
---
-# This ClusterRole exists so there is at least one ClusterRole for the additionalSchema to find.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: not-used
-rules:
-  - apiGroups: [ "" ]
-    resources: [ "pods" ]
-    verbs: [ list ]
@@ -1,26 +0,0 @@
-# This fails because the roleBinding references a ClusterRole that uses all wildcards which happens to have a `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  # The system: prefix does not cause this test to fail, but this test
-  # avoids incorectly ignoring user-created bindings to system ClusterRoles.
-  name: system:test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test-binding-to-system-prefix-role
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,23 +0,0 @@
-# This succeeds because the roleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,24 +0,0 @@
-# This succeeds because the RoleBinding has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: system:test
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
-
@@ -1,26 +0,0 @@
-# This fails because the roleBinding references a Role that uses all wildcards which happens to have a `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  # The system: prefix does not cause this test to fail, but this test
-  # avoids incorectly ignoring user-created bindings to system ClusterRoles.
-  name: system:test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: test-binding-to-system-prefix-role
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: system:test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,24 +0,0 @@
-# This succeeds because the roleBinding is an exempt name `gce:podsecuritypolicy:calico-sa`
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: gce:podsecuritypolicy:calico-sa
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,24 +0,0 @@
-# This succeeds because the RoleBinding has an exempt `system:` prefix.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: test
-  namespace: test
-rules:
-  - apiGroups: [ "*" ]
-    resources: [ "*" ]
-    verbs: [ "*" ]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: system:test
-  namespace: test
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: test
-subjects:
- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: testuser
@@ -1,17 +0,0 @@
-# This succeeds because a sensitive environment variable name references an external value.
-apiVersion: v1
-kind: Pod
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: nginx
-    env:
-    - name: token
-      valueFrom:
-        secretKeyRef:
-          key: token
-          name: a-secret
-    image: nginx
-    ports:
-    - containerPort: 80
@@ -16,6 +16,7 @@ package test

 import (
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -47,7 +48,7 @@ func init() {
 	checkToTest := os.Getenv("POLARIS_CHECK_TEST")
 	_, baseDir, _, _ := runtime.Caller(0)
 	baseDir = filepath.Dir(baseDir) + "/checks"
-	dirs, err := os.ReadDir(baseDir)
+	dirs, err := ioutil.ReadDir(baseDir)
 	if err != nil {
 		panic(err)
 	}
@@ -57,13 +58,13 @@ func init() {
 			continue
 		}
 		checkDir := baseDir + "/" + check
-		cases, err := os.ReadDir(checkDir)
+		cases, err := ioutil.ReadDir(checkDir)
 		if err != nil {
 			panic(err)
 		}
 		configString := "checks:\n  " + check + ": danger"
 		checkPath := checkDir + "/check.yaml"
-		customCheckContent, err := os.ReadFile(checkPath)
+		customCheckContent, err := ioutil.ReadFile(checkPath)
 		if err == nil {
 			lines := strings.Split(string(customCheckContent), "\n")
 			for idx := range lines {
@@ -1,30 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx-deployment-mutated
-  labels:
-    app: nginx
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: nginx
-  template:
-    metadata:
-      labels:
-        app: nginx
-    spec:
-      containers:
-      - name: nginx
-        image: nginx:1.7.9
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 80
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-              - ALL
@@ -25,7 +25,6 @@ function check_webhook_is_ready() {

    # loop until this fails (desired condition is we cannot apply this yaml doc, which means the webhook is working
    echo "Waiting for webhook to be ready"
-    kubectl get pods -n polaris
    while ! kubectl get pods -n polaris | grep -E "webhook.*1/1.*Running"; do
        check_timeout "${timeout_epoch}"
        echo -n "."
@@ -34,10 +33,6 @@ function check_webhook_is_ready() {
    check_timeout "${timeout_epoch}"

    echo "Webhook started!"
-    kubectl get svc -n polaris
-    kubectl get pods -n polaris
-    kubectl get validatingwebhookconfiguration -n polaris
-    kubectl get mutatingwebhookconfiguration -n polaris
 }

 # Check if timeout is hit and exit if it is
@@ -55,7 +50,6 @@ function check_timeout() {
 function clean_up() {
    echo -e "\n\nCleaning up (you may see some errors)...\n\n"
    kubectl delete ns scale-test || true
-    kubectl delete ns mutate-test || true
    kubectl delete ns polaris || true
    kubectl delete ns tests || true
    # Clean up files you've installed (helps with local testing)
@@ -66,7 +60,7 @@ function clean_up() {
    echo "Uninstalling webhook and webhook config"
    kubectl delete validatingwebhookconfigurations polaris-webhook --wait=false || true
    kubectl delete validatingwebhookconfigurations polaris-validate-webhook --wait=false || true
-    kubectl delete mutatingwebhookconfigurations polaris-mutate-webhook --wait=false || true
+    kubectl delete validatingwebhookconfigurations polaris-mutate-webhook --wait=false || true
    kubectl -n polaris delete deploy -l app=polaris --wait=false || true
    echo -e "\n\nDone cleaning up\n\n"
 }
@@ -82,12 +76,9 @@ clean_up || true

 echo -e "Setting up..."
 kubectl create ns scale-test
-kubectl create ns mutate-test
 kubectl create ns polaris
 kubectl create ns tests

-kubectl get validatingwebhookconfiguration
-
 echo "Installing a bad deployment"
 kubectl apply -n scale-test -f ./test/webhook_cases/failing_test.deployment.yaml

@@ -144,32 +135,13 @@ if [ $pod_count != 2 ]; then
  echo "Existing deployment was unable to scale after webhook installed: found $pod_count pods"
 fi

-echo "Checking mutations"
-helm upgrade --install polaris fairwinds-stable/polaris --namespace polaris --create-namespace \
-  --set dashboard.enable=false \
-  --set webhook.enable=true \
-  --set webhook.mutate=true \
-  --set image.tag=$CI_SHA1
-echo "Waiting for the webhook to come online"
-check_webhook_is_ready
-kubectl apply -n mutate-test -f test/webhook_cases/mutation.deployment.yaml
-if ! kubectl get -n mutate-test deployment nginx-deployment-mutated -oyaml | grep "imagePullPolicy: Always"; then
-  ALL_TESTS_PASSED=0
-  echo -e "${RED}****Test Failed: Polaris failed to mutate this resource****${NC}"
-else
-  echo -e "${GREEN}****Test Passed: Polaris mutated this resource****${NC}"
-fi
-kubectl delete -n mutate-test -f test/webhook_cases/mutation.deployment.yaml || true
-sleep 5
-
-
-echo "Done with tests"
-
 if [ -z $SKIP_FINAL_CLEANUP ]; then
  echo "Doing final cleanup..."
  clean_up
 fi

+echo "Done with tests"
+
 #Verify that all the tests passed.
 if [ $ALL_TESTS_PASSED -eq 1 ]; then
    echo "Tests Passed."
Author	SHA1	Message	Date
Ivan Fetch	98d8646c9a	Fix `7e099521`	2022-09-22 12:06:29 -06:00
Ivan Fetch	7e09952139	Define tag filters for all jobs in the workflow	2022-09-22 11:58:19 -06:00
Ivan Fetch	21ca5ee6c3	Re-enable build/push of documentation	2022-09-22 11:36:13 -06:00