Repository: FairwindsOps/polaris
Pull request #619 (2021-08-30 14:15:09)

handle case-insensitivity for capabilities


Patch:
diff --git a/checks/dangerousCapabilities.yaml b/checks/dangerousCapabilities.yaml
index a4d1517e..f2bd6d65 100644
--- a/checks/dangerousCapabilities.yaml
+++ b/checks/dangerousCapabilities.yaml
@@ -17,10 +17,10 @@ schema:
               allOf:
                 - not:
                     contains:
-                      const: ALL
+                      pattern: '^(?i)ALL$'
                 - not:
                     contains:
-                      const: SYS_ADMIN
+                      pattern: '^(?i)SYS_ADMIN$'
                 - not:
                     contains:
-                      const: NET_ADMIN
+                      pattern: '^(?i)NET_ADMIN$'
diff --git a/checks/insecureCapabilities.yaml b/checks/insecureCapabilities.yaml
index 8f6b1713..d9ec436d 100644
--- a/checks/insecureCapabilities.yaml
+++ b/checks/insecureCapabilities.yaml
@@ -22,35 +22,35 @@ schema:
               type: array
               oneOf:
               - contains:
-                  const: ALL
+                  pattern: '^(?i)ALL$'
               - allOf:
                 - contains:
-                    const: NET_ADMIN
+                    pattern: '^(?i)NET_ADMIN$'
                 - contains:
-                    const: CHOWN
+                    pattern: '^(?i)CHOWN$'
                 - contains:
-                    const: DAC_OVERRIDE
+                    pattern: '^(?i)DAC_OVERRIDE$'
                 - contains:
-                    const: FSETID
+                    pattern: '^(?i)FSETID$'
                 - contains:
-                    const: FOWNER
+                    pattern: '^(?i)FOWNER$'
                 - contains:
-                    const: MKNOD
+                    pattern: '^(?i)MKNOD$'
                 - contains:
-                    const: NET_RAW
+                    pattern: '^(?i)NET_RAW$'
                 - contains:
-                    const: SETGID
+                    pattern: '^(?i)SETGID$'
                 - contains:
-                    const: SETUID
+                    pattern: '^(?i)SETUID$'
                 - contains:
-                    const: SETFCAP
+                    pattern: '^(?i)SETFCAP$'
                 - contains:
-                    const: SETPCAP
+                    pattern: '^(?i)SETPCAP$'
                 - contains:
-                    const: NET_BIND_SERVICE
+                    pattern: '^(?i)NET_BIND_SERVICE$'
                 - contains:
-                    const: SYS_CHROOT
+                    pattern: '^(?i)SYS_CHROOT$'
                 - contains:
-                    const: KILL
+                    pattern: '^(?i)KILL$'
                 - contains:
-                    const: AUDIT_WRITE
\ No newline at end of file
+                    pattern: '^(?i)AUDIT_WRITE$'
diff --git a/checks/pdbDisruptionsIsZero.yaml b/checks/pdbDisruptionsIsZero.yaml
index fd15b8a8..8f830b28 100644
--- a/checks/pdbDisruptionsIsZero.yaml
+++ b/checks/pdbDisruptionsIsZero.yaml
@@ -1,18 +1,22 @@
-successMessage: disruptionsAllowed is greater than zero
-failureMessage: disruptionsAllowed is not greater than zero
+successMessage: Voluntary evictions are possible
+failureMessage: Voluntary evictions are not possible
 category: Reliability
 target: policy/PodDisruptionBudget
 schema:
   '$schema': http://json-schema.org/draft-07/schema
   type: object
   required:
-  - status
+  - spec
   properties:
-    status:
+    spec:
       type: object
-      required:
-      - disruptionsAllowed
       properties:
-        disruptionsAllowed:
-          type: integer
-          minimum: 1
+          minAvailable:
+            not:
+              const: '100%'
+          maxUnavailable:
+            allOf:
+            - not:
+                const: 0
+            - not:
+                const: '0%'


Test patch:
diff --git a/pkg/validator/arbitrary_test.go b/pkg/validator/arbitrary_test.go
index 2724fb09..9687d5cf 100644
--- a/pkg/validator/arbitrary_test.go
+++ b/pkg/validator/arbitrary_test.go
@@ -45,7 +45,7 @@ func TestValidatePDB(t *testing.T) {
 	assert.False(t, results.Success)
 	assert.Equal(t, conf.SeverityWarning, results.Severity)
 	assert.Equal(t, "Reliability", results.Category)
-	assert.EqualValues(t, "disruptionsAllowed is not greater than zero", results.Message)
+	assert.EqualValues(t, "Voluntary evictions are not possible", results.Message)
 }
 
 func TestValidateIngress(t *testing.T) {
diff --git a/test/checks/dangerousCapabilities/failure.all-caps.yaml b/test/checks/dangerousCapabilities/failure.all-caps.yaml
new file mode 100644
index 00000000..c6144fc4
--- /dev/null
+++ b/test/checks/dangerousCapabilities/failure.all-caps.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add: ["all"]
diff --git a/test/checks/dangerousCapabilities/failure.case.yaml b/test/checks/dangerousCapabilities/failure.case.yaml
new file mode 100644
index 00000000..464699dc
--- /dev/null
+++ b/test/checks/dangerousCapabilities/failure.case.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add:
+        - nEt_aDmIn
diff --git a/test/checks/dangerousCapabilities/success.yaml b/test/checks/dangerousCapabilities/success.yaml
index 9c823f25..203188ea 100644
--- a/test/checks/dangerousCapabilities/success.yaml
+++ b/test/checks/dangerousCapabilities/success.yaml
@@ -6,9 +6,8 @@ metadata:
     app.kubernetes.io/name: nginx
 spec:
   containers:
-  - name: nginx 
+  - name: nginx
     image: nginx
     securityContext:
       capabilities:
         add:
-        
\ No newline at end of file
diff --git a/test/checks/insecureCapabilities/success.all.yaml b/test/checks/insecureCapabilities/success.all.yaml
new file mode 100644
index 00000000..6491089e
--- /dev/null
+++ b/test/checks/insecureCapabilities/success.all.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+        - All
diff --git a/test/checks/insecureCapabilities/success.case.yaml b/test/checks/insecureCapabilities/success.case.yaml
new file mode 100644
index 00000000..eee487b8
--- /dev/null
+++ b/test/checks/insecureCapabilities/success.case.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        drop:
+          - net_admin
+          - ChOwN
+          - DaC_OverriDE
+          - fsetid
+          - FOWNER
+          - MKNOD
+          - NET_RAW
+          - SETGID
+          - SETUID
+          - SETFCAP
+          - SETPCAP
+          - NET_BIND_SERVICE
+          - SYS_CHROOT
+          - KILL
+          - AUDIT_WRITE
+
diff --git a/test/checks/pdbDisruptionsIsZero/failure.either.yaml b/test/checks/pdbDisruptionsIsZero/failure.either.yaml
new file mode 100644
index 00000000..ba56b5c7
--- /dev/null
+++ b/test/checks/pdbDisruptionsIsZero/failure.either.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  minAvailable: 100%
+  maxUnavailable: 5
diff --git a/test/checks/pdbDisruptionsIsZero/failure.yaml b/test/checks/pdbDisruptionsIsZero/failure.max.yaml
similarity index 74%
rename from test/checks/pdbDisruptionsIsZero/failure.yaml
rename to test/checks/pdbDisruptionsIsZero/failure.max.yaml
index 6b99fc81..4b02bda9 100644
--- a/test/checks/pdbDisruptionsIsZero/failure.yaml
+++ b/test/checks/pdbDisruptionsIsZero/failure.max.yaml
@@ -4,5 +4,5 @@ metadata:
   name: nginx
   labels:
     env: test
-status:
-  disruptionsAllowed: 0
\ No newline at end of file
+spec:
+  maxUnavailable: 0
diff --git a/test/checks/pdbDisruptionsIsZero/success.yaml b/test/checks/pdbDisruptionsIsZero/failure.min.yaml
similarity index 74%
rename from test/checks/pdbDisruptionsIsZero/success.yaml
rename to test/checks/pdbDisruptionsIsZero/failure.min.yaml
index 6878c8a8..f916fc7b 100644
--- a/test/checks/pdbDisruptionsIsZero/success.yaml
+++ b/test/checks/pdbDisruptionsIsZero/failure.min.yaml
@@ -4,5 +4,5 @@ metadata:
   name: nginx
   labels:
     env: test
-status:
-  disruptionsAllowed: 1
\ No newline at end of file
+spec:
+  minAvailable: 100%
diff --git a/test/checks/pdbDisruptionsIsZero/success.both.yaml b/test/checks/pdbDisruptionsIsZero/success.both.yaml
new file mode 100644
index 00000000..22073fdf
--- /dev/null
+++ b/test/checks/pdbDisruptionsIsZero/success.both.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  minAvaiable: 5
+  maxUnavailable: 10%
diff --git a/test/checks/pdbDisruptionsIsZero/success.max.yaml b/test/checks/pdbDisruptionsIsZero/success.max.yaml
new file mode 100644
index 00000000..c10b8c2a
--- /dev/null
+++ b/test/checks/pdbDisruptionsIsZero/success.max.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  maxUnavailable: 5%
diff --git a/test/checks/pdbDisruptionsIsZero/success.min.yaml b/test/checks/pdbDisruptionsIsZero/success.min.yaml
new file mode 100644
index 00000000..de67a2ce
--- /dev/null
+++ b/test/checks/pdbDisruptionsIsZero/success.min.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec:
+  minAvaiable: 5
diff --git a/test/checks/pdbDisruptionsIsZero/success.none.yaml b/test/checks/pdbDisruptionsIsZero/success.none.yaml
new file mode 100644
index 00000000..c3a9d2e1
--- /dev/null
+++ b/test/checks/pdbDisruptionsIsZero/success.none.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  labels:
+    env: test
+spec: {}