mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-11 11:47:12 +00:00
01d7a8ac00
* Add `rolePodExecAttach` and `clusterrolePodExecAttach` checks * Add schema tests * Add clusterrolebindingPodExecAttach, rolebindingRolePodExecAttach, and rolebindingClusterRolePodExecAttach checks + schema-tests * Add the new checks to the full example config * Update checks' success/failure messages and add some helpful comments * Update binding-related check messaging RE: roleRef pointing to a nonexistent resource, and add tests for this case * Update rolebindingClusterRolePodExecAttach and rolebindingRolePodExecAttach to pass if a binding roleRef is a different kind, and schema tests to include a namespace * Add additional schema tests, remove "ignore default ClusterRole|Role bindings" code from checks that actually have no default bindings
88 lines
2.4 KiB
Go
88 lines
2.4 KiB
Go
// Copyright 2022 FairwindsOps, Inc.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package config
|
|
|
|
import (
|
|
"github.com/gobuffalo/packr/v2"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
var (
|
|
// BuiltInChecks contains the checks that come pre-installed w/ Polaris
|
|
BuiltInChecks = map[string]SchemaCheck{}
|
|
schemaBox = (*packr.Box)(nil)
|
|
// We explicitly set the order to avoid thrash in the
|
|
// tests as we migrate toward JSON schema
|
|
checkOrder = []string{
|
|
// Controller Checks
|
|
"deploymentMissingReplicas",
|
|
// Pod checks
|
|
"hostIPCSet",
|
|
"hostPIDSet",
|
|
"hostNetworkSet",
|
|
"automountServiceAccountToken",
|
|
// Container checks
|
|
"memoryLimitsMissing",
|
|
"memoryRequestsMissing",
|
|
"cpuLimitsMissing",
|
|
"cpuRequestsMissing",
|
|
"readinessProbeMissing",
|
|
"livenessProbeMissing",
|
|
"pullPolicyNotAlways",
|
|
"tagNotSpecified",
|
|
"hostPortSet",
|
|
"runAsRootAllowed",
|
|
"runAsPrivileged",
|
|
"notReadOnlyRootFilesystem",
|
|
"privilegeEscalationAllowed",
|
|
"dangerousCapabilities",
|
|
"insecureCapabilities",
|
|
"priorityClassNotSet",
|
|
"linuxHardening",
|
|
"sensitiveContainerEnvVar",
|
|
// Other checks
|
|
"tlsSettingsMissing",
|
|
"pdbDisruptionsIsZero",
|
|
"metadataAndNameMismatched",
|
|
"missingPodDisruptionBudget",
|
|
"missingNetworkPolicy",
|
|
"sensitiveConfigmapContent",
|
|
"clusterrolePodExecAttach",
|
|
"rolePodExecAttach",
|
|
"clusterrolebindingPodExecAttach",
|
|
"rolebindingClusterRolePodExecAttach",
|
|
"rolebindingRolePodExecAttach",
|
|
"clusterrolebindingClusterAdmin",
|
|
"rolebindingClusterAdminClusterRole",
|
|
"rolebindingClusterAdminRole",
|
|
}
|
|
)
|
|
|
|
func init() {
|
|
schemaBox = packr.New("Schemas", "../../checks")
|
|
for _, checkID := range checkOrder {
|
|
contents, err := schemaBox.Find(checkID + ".yaml")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
check, err := ParseCheck(checkID, contents)
|
|
if err != nil {
|
|
logrus.Errorf("Error while parsing check %s", checkID)
|
|
panic(err)
|
|
}
|
|
BuiltInChecks[checkID] = check
|
|
}
|
|
}
|