mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-08-22 05:36:38 +00:00
Robert BrennanandRobert Brennan
9e0ed9ed33
* move docs files * update docs from template * another update * add insights callouts * add ingress check to the docs * remove old prefixes on check names
37 lines
1.3 KiB
Markdown
37 lines
1.3 KiB
Markdown
# Exemptions
|
|
Sometimes a workload really does need to do things that Polaris considers insecure. For instance,
|
|
many of the `kube-system` workloads need to run as root, or need access to the host network. In these
|
|
cases, we can add **exemptions** to allow the workload to pass Polaris checks.
|
|
|
|
Exemptions can be added two ways: by annotating a controller, or editing the Polaris config.
|
|
|
|
## Annotations
|
|
To exempt a controller from all checks via annotations, use the annotation `polaris.fairwinds.com/exempt=true`, e.g.
|
|
```
|
|
kubectl annotate deployment my-deployment polaris.fairwinds.com/exempt=true
|
|
```
|
|
|
|
To exempt a controller from a particular check via annotations, use an annotation in the form of `polaris.fairwinds.com/<check>-exempt=true`, e.g.
|
|
```
|
|
kubectl annotate deployment my-deployment polaris.fairwinds.com/cpuRequestsMissing-exempt=true
|
|
```
|
|
|
|
## Config
|
|
|
|
To exempt a controller via the config, you have to specify a namespace (optional), a list of controller names and a list of rules, e.g.
|
|
```yaml
|
|
exemptions:
|
|
# exemption valid for kube-system namespace
|
|
- namespace: kube-system
|
|
controllerNames:
|
|
- dns-controller
|
|
rules:
|
|
- hostNetworkSet
|
|
# exemption valid in all namespaces
|
|
- controllerNames:
|
|
- dns-controller
|
|
rules:
|
|
- hostNetworkSet
|
|
```
|
|
|