215 lines
4.2 KiB
YAML
215 lines
4.2 KiB
YAML
checks:
|
|
#resource
|
|
cpuLimitsMissing: warning
|
|
#image
|
|
tagNotSpecified: danger
|
|
#imageRegistry: warning
|
|
#healthChecks
|
|
livenessProbeMissing: warning
|
|
#network
|
|
#hostPortSet: warning
|
|
#security
|
|
runAsPrivileged: warning
|
|
|
|
customChecks:
|
|
# imageRegistry:
|
|
# successMessage: Image comes from allowed registries
|
|
# failureMessage: Image should not be from disallowed registry
|
|
# category: Images
|
|
# target: Container
|
|
# schema:
|
|
# '$schema': http://json-schema.org/draft-07/schema
|
|
# type: object
|
|
# properties:
|
|
# image:
|
|
# type: string
|
|
# not:
|
|
# pattern: ^quay.io
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
exemptions:
|
|
- controllerNames:
|
|
- kube-apiserver
|
|
- kube-proxy
|
|
- kube-scheduler
|
|
- etcd-manager-events
|
|
- kube-controller-manager
|
|
- kube-dns
|
|
- etcd-manager-main
|
|
rules:
|
|
- hostPortSet
|
|
- hostNetworkSet
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
- cpuRequestsMissing
|
|
- cpuLimitsMissing
|
|
- memoryRequestsMissing
|
|
- memoryLimitsMissing
|
|
- runAsRootAllowed
|
|
- runAsPrivileged
|
|
- notReadOnlyRootFilesystem
|
|
- hostPIDSet
|
|
|
|
- controllerNames:
|
|
- kube-flannel-ds
|
|
rules:
|
|
- notReadOnlyRootFilesystem
|
|
- runAsRootAllowed
|
|
- notReadOnlyRootFilesystem
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
- cpuLimitsMissing
|
|
|
|
- controllerNames:
|
|
- cert-manager
|
|
rules:
|
|
- notReadOnlyRootFilesystem
|
|
- runAsRootAllowed
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
|
|
- controllerNames:
|
|
- cluster-autoscaler
|
|
rules:
|
|
- notReadOnlyRootFilesystem
|
|
- runAsRootAllowed
|
|
- readinessProbeMissing
|
|
|
|
- controllerNames:
|
|
- vpa
|
|
rules:
|
|
- runAsRootAllowed
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
- notReadOnlyRootFilesystem
|
|
|
|
- controllerNames:
|
|
- datadog
|
|
rules:
|
|
- runAsRootAllowed
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
- notReadOnlyRootFilesystem
|
|
|
|
- controllerNames:
|
|
- nginx-ingress-controller
|
|
rules:
|
|
- privilegeEscalationAllowed
|
|
- insecureCapabilities
|
|
- runAsRootAllowed
|
|
|
|
- controllerNames:
|
|
- dns-controller
|
|
- datadog-datadog
|
|
- kube-flannel-ds
|
|
- kube2iam
|
|
- aws-iam-authenticator
|
|
- datadog
|
|
- kube2iam
|
|
rules:
|
|
- hostNetworkSet
|
|
|
|
- controllerNames:
|
|
- aws-iam-authenticator
|
|
- aws-cluster-autoscaler
|
|
- kube-state-metrics
|
|
- dns-controller
|
|
- external-dns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- kubernetes-dashboard
|
|
- install-cni
|
|
- kube2iam
|
|
rules:
|
|
- readinessProbeMissing
|
|
- livenessProbeMissing
|
|
|
|
- controllerNames:
|
|
- aws-iam-authenticator
|
|
- nginx-ingress-default-backend
|
|
- aws-cluster-autoscaler
|
|
- kube-state-metrics
|
|
- dns-controller
|
|
- external-dns
|
|
- kubedns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- tiller
|
|
- kube2iam
|
|
rules:
|
|
- runAsRootAllowed
|
|
|
|
- controllerNames:
|
|
- aws-iam-authenticator
|
|
- nginx-ingress-controller
|
|
- nginx-ingress-default-backend
|
|
- aws-cluster-autoscaler
|
|
- kube-state-metrics
|
|
- dns-controller
|
|
- external-dns
|
|
- kubedns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- tiller
|
|
- kube2iam
|
|
rules:
|
|
- notReadOnlyRootFilesystem
|
|
|
|
- controllerNames:
|
|
- cert-manager
|
|
- dns-controller
|
|
- kubedns
|
|
- dnsmasq
|
|
- autoscaler
|
|
- insights-agent-goldilocks-vpa-install
|
|
- datadog
|
|
rules:
|
|
- cpuRequestsMissing
|
|
- cpuLimitsMissing
|
|
- memoryRequestsMissing
|
|
- memoryLimitsMissing
|
|
|
|
- controllerNames:
|
|
- kube2iam
|
|
- kube-flannel-ds
|
|
rules:
|
|
- runAsPrivileged
|
|
|
|
- controllerNames:
|
|
- kube-hunter
|
|
rules:
|
|
- hostPIDSet
|
|
|
|
- controllerNames:
|
|
- polaris
|
|
- kube-hunter
|
|
- goldilocks
|
|
- insights-agent-goldilocks-vpa-install
|
|
rules:
|
|
- notReadOnlyRootFilesystem
|
|
|
|
- controllerNames:
|
|
- insights-agent-goldilocks-controller
|
|
rules:
|
|
- livenessProbeMissing
|
|
- readinessProbeMissing
|
|
|
|
- controllerNames:
|
|
- insights-agent-goldilocks-vpa-install
|
|
- kube-hunter
|
|
rules:
|
|
- runAsRootAllowed
|
|
|
|
|