Project: Polaris (Provisioning / Security & Compliance)
File: changelog.md

sidebarDepth: 0 meta: name: description content: "Fairwinds Polaris | Changelog" Change `metadataAndNameMismatched` to `metadataAndInstanceMismatched` Add category for `metadataAndNameMismatched`. Fix category for `priorityClassNotSet`. Add `insights-host` global flag to configure Fairwinds Insights host (defaults to `https://insights.fairwinds.com`). Add new `auth` sub-commands be able to authenticate on Polaris using Fairwinds Insights credentials `login` - login using Fairwinds Insights credentials via the web interface or provide a token `logout` - logout from Fairwinds Insights `status` - show relevant information regarding login state `token` - prints the token from local storage Add new `audit` flags to be able to upload Workloads and Polaris results to Fairwinds Insights `upload-insights` - indicates that the results should be uploaded to Fairwinds Insights. (defaults to `false`) `cluster-name` - cluster name that the results belongs to. Creates the cluster if it does not exist. (required if `upload-insights` is used) Change default severity from `ignore` to `warning` for `priorityClassNotSet`, `metadataAndNameMismatched`, `missingPodDisruptionBudget`, `automountServiceAccountToken`, `missingNetworkPolicy` checks. Change default severity from `warning` to `danger` for `sensitiveContainerEnvVar`, `sensitiveConfigmapContent`, `clusterrolePodExecAttach`, `rolePodExecAttach`, `clusterrolebindingPodExecAttach`, `rolebindingClusterRolePodExecAttach`, `rolebindingRolePodExecAttach`,`clusterrolebindingClusterAdmin`,`rolebindingClusterAdminClusterRole`,`rolebindingClusterAdminRole` checks. Skip https certificate verification (#920) Add a check for `topologySpreadConstraint` (#879) Enable new RBAC / sensitive content / Pod exec checks, add `hasPrefix` and `hasSuffix` functions to the GO template, exempt `system:` name prefixes for RBAC checks, sensitive content checks ignore `valueFrom`, (#832) Let Polaris modify YAML without losing comments/formatting (#821) Add checks for RBAC allowing exec or attaching to a Pod (#820) Add `clusterrolebindingClusterAdmin`, `rolebindingClusterAdminRole`, and `rolebindingClusterAdminClusterRole` checks + schema tests (#823) Fixes for pretty CLI output Some new checks (disabled by default) Some additional features in templating engine Documentation updates Better support for `polaris fix` `target: Pod` is now `target: PodSpec` (to differentiate naked Pods from Controllers) Preliminary support for `polaris fix` command Changes to how Pod owners are determined Removed YAML manifests from the `deploy/` directory - Helm is now the default install mechanism Support `--context` flag for kubecontext Treat core Kubernetes controllers (`Deployments`, `StatefulSets`, `DaemonSets`, `CronJobs`) as top-level objects, instead of following owner refs Renamed `multipleReplicasForDeployment` to `deploymentMissingReplicas` Changed `RunAsRootAllowed` and `hostNetworkSet` default severity to `danger` Changed `deploymentMissingReplicas` default severity to `warning` New flags `--disallow-(config|annotation)-exemptions` Kubernetes dependency updates Documentation updates Handle case-insentitivity in capabilities checks Change test for PDB disruptions to better handle IaC Update Alpine base image Fix support for namespace checks Fix goreleaser format Change goreleaser format Fix `--helm-values` flag Bugfix for repeated objects on the dashboard Bugfix for validating webhook and non-pod checks Fixed bad interaction between `--set-exit-score-below` and `--only-show-failed-tests` Dependency updates Support for Helm chart scanning Goreleaser fix Goreleaser fix Add support for arbitrary resources, like Ingress or PodDisruptionBudget Add support check templating (see docs) Add support for multi-resource checks (see docs) In custom checks, `jsonSchema` is now `schemaString` Check `pdbDisruptionsAllowedGreaterThanZero` is now called `pdbDisruptionsIsZero` Add `--format=pretty` option for CLI output Fix nil pointer issue with --only-output-failed-tests Fix UI display of Ingress checks Fixes for exemption annotations for the admission controller Fixes for `privilegeEscalationAllowed` and `insecureCapabilities` checks to take Kubernetes defaults into account Start checking deployment configuration using Fairwinds Insights Updated to

Added support for Ingress objects Fixes for exemptions, including support for exempting entire namespaces Breaking* - fixed inconsistency in how controller-level checks are handled Custom checks with `target: Controller` should remove `Object` from the top-level of the JSON schema (see changes to `./checks/multipleReplicasForDeployment.yaml`) Fixed Polaris deployment process Standardize categories of checks into Security, Reliability, and Efficiency Changes to the dashboard UI Update controller-runtime Update date on dashboard footer Add ability to audit a single workload Enable `pullPolicyAlways` by default Fix for finding parent resources Show controller checks on dashboard Fix for orphaned pods w/ controller checks Add namespace filter in UI Add priorityClass check Support reading from STDIN Ensure severity is set for all custom checks Support audit files which use \r or \r\n as newline character Add option to exempt an entire controller from checks via config file Fixed case where parent resources trigger error Fixed UI zero-state Fixed case where parent resources trigger error Fixed dashboard link when `--base-path` is set Fixed case where custom CRDs are not covered by RBAC Added ARM binaries to releases Added support for custom checks using JSON Schema Added support for arbitrary controllers, rather than a pre-configured set removed support for `controllerstoscan` in config Added the ability to exempt a particular controller from a particular check. Docker image now includes the default config Breaking changes in both input and output formats. See for examples of the new formats. removed config-level configuration for checks like max/min memory settings changed severity `error` to `danger` Breaking changes to the CLI CLI flag `--set-exit-code-on-error` is now `--set-exit-code-on-danger` Flags `--version`, `--dashboard`, `--webhook`, and `--audit` are now arguments Port flags are now just `--port` Fixed webhook support in Kubernetes 1.16 this also removes support for 1.8 Added support for exemptions via controller annotations Fixed missing success messages for resource requests/limits Added a few more exemptions Started checking exemptions based on controller name prefix `runAsUser != 0` now passes the `runAsNonRoot` check Added `--load-audit-file` flag to run the dashboard from an existing audit Added an `ID` field to each check in the output Skip health checks for jobs, cronjobs, initcontainers Added support for exemptions Fixed dashboard base path option Added additional Pod Controllers to scan PodSpec (`jobs`, `cronjobs`, `daemonsets`, `replicationcontrollers`) Changed dashboard branding to refer to new org name Fairwinds Added `--set-exit-code-on-error` and `--set-exit-code-below-score` flags to better support CI/CD : Fixed logic on RunAsNonRoot check to incorporate settings in podSpec Added `--output-format` flag for better CI/CD support Added `--display-name` flag Added support for StatefulSets Show error message if no kubeconfig is set : ignore limits/requests for initContainers : support custom base path : details pages getting template errors : support all auth providers : Ignore readiness probe for initContainers : dashboard not updating when running persistently Stored all third-party assets (e.g. Charts.js) to local files to support offline dashboard viewing Fix: custom configs in `ConfigMap` not respected : missing `config.yaml` and dashboard assets in binary releases Added some tests and better error handling Dashboard fully functional Validating webhook functional, but still considered beta Checks: Health readiness probe missing liveness probe missing Images tag not specified pull policy not always Networking host network set host port set Resources cpu/memory requests missing cpu/memory limits missing cpu/memory ranges exceeded Security security capabilities host IPC set host PID set not read-only fs privilege escalation allowed run as root allowed run as privileged