polaris/docs/assets/js/20.f0ee04bc.js

(window.webpackJsonp=window.webpackJsonp||[]).push([[20],{376:function(t,e,a){"use strict";a.r(e);var n=a(42),s=Object(n.a)({},(function(){var t=this,e=t.$createElement,a=t._self._c||e;return a("ContentSlotsDistributor",{attrs:{"slot-key":t.$parent.slotKey}},[a("h1",{attrs:{id:"exemptions"}},[a("a",{staticClass:"header-anchor",attrs:{href:"#exemptions"}},[t._v("#")]),t._v(" Exemptions")]),t._v(" "),a("p",[t._v("Sometimes a workload really does need to do things that Polaris considers insecure. For instance,\nmany of the "),a("code",[t._v("kube-system")]),t._v(" workloads need to run as root, or need access to the host network. In these\ncases, we can add "),a("strong",[t._v("exemptions")]),t._v(" to allow the workload to pass Polaris checks.")]),t._v(" "),a("p",[t._v("Exemptions can be added in a few different ways:")]),t._v(" "),a("ul",[a("li",[t._v("Namespace: By editing the Polaris config.")]),t._v(" "),a("li",[t._v("Controller: By annotating a controller, or editing the Polaris config.")]),t._v(" "),a("li",[t._v("Container: By editing the Polaris config.")])]),t._v(" "),a("h2",{attrs:{id:"annotations"}},[a("a",{staticClass:"header-anchor",attrs:{href:"#annotations"}},[t._v("#")]),t._v(" Annotations")]),t._v(" "),a("p",[t._v("To exempt a controller from all checks via annotations, use the annotation "),a("code",[t._v("polaris.fairwinds.com/exempt=true")]),t._v(", e.g.")]),t._v(" "),a("div",{staticClass:"language- extra-class"},[a("pre",{pre:!0,attrs:{class:"language-text"}},[a("code",[t._v("kubectl annotate deployment my-deployment polaris.fairwinds.com/exempt=true\n")])])]),a("p",[t._v("To exempt a controller from a particular check via annotations, use an annotation in the form of "),a("code",[t._v("polaris.fairwinds.com/<check>-exempt=true")]),t._v(", e.g.")]),t._v(" "),a("div",{staticClass:"language- extra-class"},[a("pre",{pre:!0,attrs:{class:"language-text"}},[a("code",[t._v("kubectl annotate deployment my-deployment polaris.fairwinds.com/cpuRequestsMissing-exempt=true\n")])])]),a("h2",{attrs:{id:"config"}},[a("a",{staticClass:"header-anchor",attrs:{href:"#config"}},[t._v("#")]),t._v(" Config")]),t._v(" "),a("p",[t._v("To add exemptions via the config, you have to specify at least one or more of the following:")]),t._v(" "),a("ul",[a("li",[t._v("A namespace")]),t._v(" "),a("li",[t._v("A list of controller names")]),t._v(" "),a("li",[t._v("A list of container names")])]),t._v(" "),a("p",[t._v("You can also specify a list of particular rules. If no rules are specified then every rule is exempted.")]),t._v(" "),a("p",[t._v("Controller names and container names are matched as a prefix, so an empty string will match every controller or container respectively.")]),t._v(" "),a("p",[t._v("For example:")]),t._v(" "),a("div",{staticClass:"language-yaml extra-class"},[a("pre",{pre:!0,attrs:{class:"language-yaml"}},[a("code",[a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("exemptions")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n  "),a("span",{pre:!0,attrs:{class:"token comment"}},[t._v("# exemption valid for all rules on all containers in all controllers in default namespace")]),t._v("\n  "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("namespace")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v(" default\n  "),a("span",{pre:!0,attrs:{class:"token comment"}},[t._v("# exemption valid for hostNetworkSet rule on all containers in dns-controller controller in kube-system namespace")]),t._v("\n  "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("namespace")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v(" kube"),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v("system\n    "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("controllerNames")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n      "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" dns"),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v("controller\n    "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("rules")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n      "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" hostNetworkSet\n  "),a("span",{pre:!0,attrs:{class:"token comment"}},[t._v("# exemption valid for hostNetworkSet rule on all containers in dns-controller controller in all namespaces")]),t._v("\n  "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("controllerNames")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n      "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" dns"),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v("controller\n    "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("rules")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n      "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" hostNetworkSet\n  "),a("span",{pre:!0,attrs:{class:"token comment"}},[t._v("# exemption valid for hostNetworkSet rule on coredns container in all controllers in kube-system namespace")]),t._v("\n  "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("namespace")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v(" kube"),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v("system\n  "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("containerNames")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n      "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" coredns\n    "),a("span",{pre:!0,attrs:{class:"token key atrule"}},[t._v("rules")]),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v(":")]),t._v("\n      "),a("span",{pre:!0,attrs:{class:"token punctuation"}},[t._v("-")]),t._v(" hostNetworkSet\n")])])])])}),[],!1,null,null,null);e.default=s.exports}}]);