mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-14 13:16:54 +00:00
2b15f11d57
* first pass at adding exemptions * Update config.yaml * make config_test more reliable * add flag to disallow exemptions in dashboard * add disallow-exemptions flag to CLI * add comments * fix exemptions flag * fix alert on dashboard * minor style changes
136 lines
2.6 KiB
YAML
136 lines
2.6 KiB
YAML
resources:
|
|
cpuRequestsMissing: warning
|
|
cpuRequestRanges:
|
|
warning:
|
|
below: 50m
|
|
above: 1000m
|
|
error:
|
|
below: 500m
|
|
above: 2000m
|
|
cpuLimitsMissing: warning
|
|
cpuLimitRanges:
|
|
warning:
|
|
below: 50m
|
|
above: 1000m
|
|
error:
|
|
below: 500m
|
|
above: 2000m
|
|
memoryRequestsMissing: warning
|
|
memoryRequestRanges:
|
|
warning:
|
|
below: 50M
|
|
above: 2G
|
|
error:
|
|
below: 100M
|
|
above: 4G
|
|
memoryLimitsMissing: warning
|
|
memoryLimitRanges:
|
|
warning:
|
|
below: 50M
|
|
above: 2G
|
|
error:
|
|
below: 100M
|
|
above: 4G
|
|
images:
|
|
tagNotSpecified: error
|
|
pullPolicyNotAlways: warning
|
|
whitelist:
|
|
error:
|
|
- gcr.io/*
|
|
blacklist:
|
|
warning:
|
|
- docker.io/*
|
|
healthChecks:
|
|
readinessProbeMissing: warning
|
|
livenessProbeMissing: warning
|
|
networking:
|
|
hostNetworkSet: error
|
|
hostPortSet: error
|
|
security:
|
|
hostIPCSet: error
|
|
hostPIDSet: error
|
|
runAsRootAllowed: warning
|
|
runAsPrivileged: error
|
|
notReadOnlyRootFileSystem: warning
|
|
privilegeEscalationAllowed: error
|
|
capabilities:
|
|
error:
|
|
ifAnyAdded:
|
|
- SYS_ADMIN
|
|
- ALL
|
|
ifAnyNotDropped:
|
|
- ALL
|
|
warning:
|
|
ifAnyAddedBeyond:
|
|
- NONE
|
|
exemptions:
|
|
- controllerNames:
|
|
- dns-controller
|
|
- datadog-datadog
|
|
- kube-flannel-ds
|
|
- kube2iam
|
|
- aws-iam-authenticator
|
|
- datadog
|
|
- kube2iam
|
|
rules:
|
|
- hostNetworkSet
|
|
- controllerNames:
|
|
- aws-iam-authenticator
|
|
- aws-cluster-autoscaler
|
|
- kube-state-metrics
|
|
- dns-controller
|
|
- external-dns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- kubernetes-dashboard
|
|
- install-cni
|
|
- kube2iam
|
|
rules:
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
- controllerNames:
|
|
- aws-iam-authenticator
|
|
- nginx-ingress-controller
|
|
- nginx-ingress-default-backend
|
|
- aws-cluster-autoscaler
|
|
- kube-state-metrics
|
|
- dns-controller
|
|
- external-dns
|
|
- kubedns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- tiller
|
|
- kube2iam
|
|
rules:
|
|
- runAsRootAllowed
|
|
- controllerNames:
|
|
- aws-iam-authenticator
|
|
- nginx-ingress-controller
|
|
- nginx-ingress-default-backend
|
|
- aws-cluster-autoscaler
|
|
- kube-state-metrics
|
|
- dns-controller
|
|
- external-dns
|
|
- kubedns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- tiller
|
|
- kube2iam
|
|
rules:
|
|
- notReadOnlyRootFileSystem
|
|
- controllerNames:
|
|
- cert-manager
|
|
- dns-controller
|
|
- kubedns
|
|
- dnsmasq
|
|
- autoscaler
|
|
rules:
|
|
- cpuRequestsMissing
|
|
- cpuLimitsMissing
|
|
- memoryRequestsMissing
|
|
- memoryLimitsMissing
|
|
- controllerNames:
|
|
- kube2iam
|
|
rules:
|
|
- runAsPrivileged
|