add cpuLimitsRange

checks/cpuLimitsRange.yaml

@@ -0,0 +1,25 @@
+successMessage: CPU limits are within the required range
+failureMessage: CPU limits should be within the required range
+category: Efficiency
+target: Container
+containers:
+  exclude:
+  - initContainer
+schema:
+  '$schema': http://json-schema.org/draft-07/schema
+  type: object
+  required:
+  - resources
+  properties:
+    resources:
+      type: object
+      required:
+      - limits
+      properties:
+        limits:
+          required:
+          - cpu
+          properties:
+            cpu:
+              resourceMinimum: 200m
+              resourceMaximum: "2"

checks/missingPodDisruptionBudget.yaml

@@ -29,7 +29,7 @@ additionalSchemaStrings:
             properties:
               matchLabels:
                 type: object
-                allOf:
+                anyOf:
                 {{ range $key, $value := .metadata.labels }}
                 - properties:
                     "{{ $key }}":

checks/topologySpreadConstraint.yaml

@@ -2,10 +2,6 @@ successMessage: Pod has a valid topology spread constraint
 failureMessage: Pod should be configured with a valid topology spread constraint
 category: Reliability
 target: PodSpec
-controllers:
-  exclude:
-  - Job
-  - CronJob
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
@@ -14,4 +10,12 @@ schema:
   properties:
     topologySpreadConstraints:
       type: array
-      minItems: 1
+      items:
+        type: object
+        properties:
+          topologyKey:
+            anyOf:
+              - type: string
+                const: "kubernetes.io/hostname"
+              - type: string
+                const: "topology.kubernetes.io/zone"

cmd/polaris/audit.go

@@ -50,7 +50,6 @@ var (
 	useColor            bool
 	helmChart           string
 	helmValues          []string
-	helmSkipTests       bool
 	checks              []string
 	auditNamespace      string
 	severityLevel       string
@@ -73,7 +72,6 @@ func init() {
 	auditCmd.PersistentFlags().StringVar(&resourceToAudit, "resource", "", "Audit a specific resource, in the format namespace/kind/version/name, e.g. nginx-ingress/Deployment.apps/v1/default-backend.")
 	auditCmd.PersistentFlags().StringVar(&helmChart, "helm-chart", "", "Will fill out Helm template")
 	auditCmd.PersistentFlags().StringSliceVar(&helmValues, "helm-values", []string{}, "Optional flag to add helm values")
-	auditCmd.PersistentFlags().BoolVar(&helmSkipTests, "helm-skip-tests", false, "Corresponds to --skip-tests of helm template")
 	auditCmd.PersistentFlags().StringSliceVar(&checks, "checks", []string{}, "Optional flag to specify specific checks to check")
 	auditCmd.PersistentFlags().StringVar(&auditNamespace, "namespace", "", "Namespace to audit. Only applies to in-cluster audits")
 	auditCmd.PersistentFlags().StringVar(&severityLevel, "severity", "", "Severity level used to filter results. Behaves like log levels. 'danger' is the least verbose (warning, danger)")
@@ -112,7 +110,7 @@ var auditCmd = &cobra.Command{
 		}
 		if helmChart != "" {
 			var err error
-			auditPath, err = ProcessHelmTemplates(helmChart, helmValues, helmSkipTests)
+			auditPath, err = ProcessHelmTemplates(helmChart, helmValues)
 			if err != nil {
 				logrus.Errorf("Couldn't process helm chart: %v", err)
 				os.Exit(1)
@@ -198,7 +196,7 @@ var auditCmd = &cobra.Command{
 }
 
 // ProcessHelmTemplates turns helm into yaml to be processed by Polaris or the other tools.
-func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests bool) (string, error) {
+func ProcessHelmTemplates(helmChart string, helmValues []string) (string, error) {
 	cmd := exec.Command("helm", "dependency", "update", helmChart)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -220,10 +218,6 @@ func ProcessHelmTemplates(helmChart string, helmValues []string, helmSkipTests b
 		params = append(params, "--values", v)
 	}
 
-	if helmSkipTests {
-		params = append(params, "--skip-tests")
-	}
-
 	cmd = exec.Command("helm", params...)
 	output, err = cmd.CombinedOutput()
 

docs/cli.md

@@ -50,7 +50,6 @@ webhook
 -f, --format string                   Output format for results - json, yaml, pretty, or score. (default "json")
     --helm-chart string               Will fill out Helm template
     --helm-values string              Optional flag to add helm values
-    --helm-skip-tests bool            Corresponds to --skip-tests of helm template
 -h, --help                            help for audit
     --namespace string                Namespace to audit. Only applies to in-cluster audits
     --only-show-failed-tests          If specified, audit output will only show failed tests.
@@ -81,3 +80,4 @@ webhook
   status      View authentication status.
   token       Print the auth token gh is configured to use.
 ```
+

pkg/config/checks.go

@@ -38,6 +38,7 @@ var (
 		"memoryRequestsMissing",
 		"cpuLimitsMissing",
 		"cpuRequestsMissing",
+		"cpuLimitsRange",
 		"readinessProbeMissing",
 		"livenessProbeMissing",
 		"pullPolicyNotAlways",

pkg/config/schema.go

@@ -143,9 +143,6 @@ func (max resourceMaximum) Validate(path string, data interface{}, errs *[]jsons
 }
 
 func parseQuantity(i interface{}) (resource.Quantity, *[]jsonschema.ValError) {
-	if resNum, ok := i.(float64); ok {
-		i = fmt.Sprintf("%f", resNum)
-	}
 	resStr, ok := i.(string)
 	if !ok {
 		return resource.Quantity{}, &[]jsonschema.ValError{

test/checks/cpuLimitsRange/failure.number.yaml

@@ -10,5 +10,5 @@ spec:
     image: nginx
     resources:
       limits:
-        memory: 250Mi
-        cpu: 1.5
+        memory: 128Mi
+        cpu: 5

test/checks/cpuLimitsRange/success.number.yaml

@@ -10,5 +10,5 @@ spec:
     image: nginx
     resources:
       limits:
-        memory: 104857600
+        memory: 128Mi
         cpu: 1

test/checks/resourceRange/check.yaml

@@ -1,32 +0,0 @@
-containers:
-  exclude:
-  - initContainer
-successMessage: Resource limits are within the required range
-failureMessage: Resource limits should be within the required range
-category: Resources
-target: Container
-schema:
-  '$schema': http://json-schema.org/draft-07/schema
-  type: object
-  required:
-  - resources
-  properties:
-    resources:
-      type: object
-      required:
-      - limits
-      properties:
-        limits:
-          type: object
-          required:
-          - memory
-          - cpu
-          properties:
-            memory:
-              type: string
-              resourceMinimum: 100Mi # 104857600 bytes
-              resourceMaximum: 6G
-            cpu:
-              type: string
-              resourceMinimum: 100m
-              resourceMaximum: "2"

test/checks/resourceRange/failure.cpu-number.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx
-  labels:
-    app.kubernetes.io/name: nginx
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    resources:
-      limits:
-        memory: 250Mi
-        cpu: 0.05

test/checks/resourceRange/failure.mem-number.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx
-  labels:
-    app.kubernetes.io/name: nginx
-spec:
-  containers:
-  - name: nginx
-    image: nginx
-    resources:
-      limits:
-        memory: 104857599
-        cpu: 1

test/checks/topologySpreadConstraint/failure.invalidtopologykey.yaml

@@ -19,7 +19,10 @@ spec:
         app.kubernetes.io/name: basic-demo
         app.kubernetes.io/instance: demo
     spec:
-      topologySpreadConstraints: []
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: farglebargle
+          whenUnsatisfiable: ScheduleAnyway
       containers:
         - name: basic-demo
           image: "quay.io/fairwinds/docker-demo:latest"

test/checks/topologySpreadConstraint/success.yaml

@@ -21,13 +21,8 @@ spec:
     spec:
       topologySpreadConstraints:
         - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app: foo
-          matchLabelKeys:
-            - pod-template-hash
+          topologyKey: "topology.kubernetes.io/zone"
+          whenUnsatisfiable: ScheduleAnyway
       containers:
         - name: basic-demo
           image: "quay.io/fairwinds/docker-demo:latest"