mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-22 00:54:06 +00:00
467d06f4db
* Enable these checks in the default configuration file, which may produce many new results: * automountServiceAccountToken * linuxHardening * sensitiveConfigmapContent and sensitiveContainerEnvVar * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and rolebindingRolePodExecAttach * Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default * `hasPrefix` and `hasSuffix` functions are now available in the go template * Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment variable names when those variables use `valueFrom` to reference an external resource. * Add the `*ClusterAdmin` checks to `examples/config-full.yaml`. * Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)
103 lines
2.7 KiB
YAML
103 lines
2.7 KiB
YAML
checks:
|
|
# reliability
|
|
deploymentMissingReplicas: warning
|
|
priorityClassNotSet: warning
|
|
tagNotSpecified: danger
|
|
pullPolicyNotAlways: warning
|
|
readinessProbeMissing: warning
|
|
livenessProbeMissing: warning
|
|
# efficiency
|
|
cpuRequestsMissing: warning
|
|
cpuLimitsMissing: warning
|
|
memoryRequestsMissing: warning
|
|
memoryLimitsMissing: warning
|
|
# security
|
|
automountServiceAccountToken: warning
|
|
hostIPCSet: danger
|
|
hostPIDSet: danger
|
|
linuxHardening: danger
|
|
missingNetworkPolicy: warning
|
|
notReadOnlyRootFilesystem: warning
|
|
privilegeEscalationAllowed: danger
|
|
runAsRootAllowed: danger
|
|
runAsPrivileged: danger
|
|
dangerousCapabilities: danger
|
|
insecureCapabilities: warning
|
|
hostNetworkSet: danger
|
|
hostPortSet: warning
|
|
sensitiveContainerEnvVar: danger
|
|
sensitiveConfigmapContent: danger
|
|
clusterrolePodExecAttach: danger
|
|
rolePodExecAttach: danger
|
|
clusterrolebindingPodExecAttach: danger
|
|
rolebindingClusterRolePodExecAttach: danger
|
|
rolebindingRolePodExecAttach: danger
|
|
clusterrolebindingClusterAdmin: danger
|
|
rolebindingClusterAdminClusterRole: danger
|
|
rolebindingClusterAdminRole: danger
|
|
# custom
|
|
resourceLimits: warning
|
|
imageRegistry: danger
|
|
|
|
|
|
exemptions:
|
|
- controllerNames:
|
|
- my-network-controller
|
|
rules:
|
|
- hostNetworkSet
|
|
- hostPortSet
|
|
- namespace: kube-system
|
|
controllerNames:
|
|
- my-network-controller
|
|
rules:
|
|
- hostNetworkSet
|
|
- hostPortSet
|
|
|
|
customChecks:
|
|
resourceLimits:
|
|
containers:
|
|
exclude:
|
|
- initContainer
|
|
successMessage: Resource limits are within the required range
|
|
failureMessage: Resource limits should be within the required range
|
|
category: Resources
|
|
target: Container
|
|
schema:
|
|
'$schema': http://json-schema.org/draft-07/schema
|
|
type: object
|
|
required:
|
|
- resources
|
|
properties:
|
|
resources:
|
|
type: object
|
|
required:
|
|
- limits
|
|
properties:
|
|
limits:
|
|
type: object
|
|
required:
|
|
- memory
|
|
- cpu
|
|
properties:
|
|
memory:
|
|
type: string
|
|
resourceMinimum: 100M
|
|
resourceMaximum: 6G
|
|
cpu:
|
|
type: string
|
|
resourceMinimum: 100m
|
|
resourceMaximum: "2"
|
|
imageRegistry:
|
|
successMessage: Image comes from allowed registries
|
|
failureMessage: Image should not be from disallowed registry
|
|
category: Images
|
|
target: Container
|
|
schema:
|
|
'$schema': http://json-schema.org/draft-07/schema
|
|
type: object
|
|
properties:
|
|
image:
|
|
type: string
|
|
not:
|
|
pattern: ^quay.io
|