Repository: aquasecurity/starboard
Pull request #493 (2021-04-12 15:43:55)

fix(polaris): Remove clutter from JSON output
Resolves: #449

Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#493](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (e90cc3c) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/802cfa709ac03670332f1f597776b11022571472?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (802cfa7) will **decrease** coverage by `34.33%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/493/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #493       +/-   ##
===========================================
- Coverage   70.25%   35.92%   -34.34%     
===========================================
  Files          62       61        -1     
  Lines        3994     3864      -130     
===========================================
- Hits         2806     1388     -1418     
- Misses        892     2396     +1504     
+ Partials      296       80      -216     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/plugin/polaris/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9wb2xhcmlzL3BsdWdpbi5nbw==) | `90.44% <100.00%> (-2.32%)` | :arrow_down: |
| [pkg/cmd/get.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9nZXQuZ28=) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/find.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9maW5kLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/root.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9yb290Lmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/scan.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9zY2FuLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/polaris.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9wb2xhcmlzLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/version.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC92ZXJzaW9uLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/kube\_bench.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9rdWJlX2JlbmNoLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/kube\_hunter.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9rdWJlX2h1bnRlci5nbw==) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/find\_vulnerabilities.go](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9maW5kX3Z1bG5lcmFiaWxpdGllcy5nbw==) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| ... and [34 more](https://codecov.io/gh/aquasecurity/starboard/pull/493/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [802cfa7...e90cc3c](https://codecov.io/gh/aquasecurity/starboard/pull/493?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/pkg/plugin/polaris/plugin.go b/pkg/plugin/polaris/plugin.go
index 993fc5a..fc6cb57 100644
--- a/pkg/plugin/polaris/plugin.go
+++ b/pkg/plugin/polaris/plugin.go
@@ -91,12 +91,10 @@ func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, obj client.Object)
 						MountPath: "/etc/starboard",
 					},
 				},
-				Command: []string{"polaris"},
+				Command: []string{"sh"},
 				Args: []string{
-					"audit",
-					"--log-level", "error",
-					"--config", "/etc/starboard/polaris.config.yaml",
-					"--resource", sourceName,
+					"-c",
+					"polaris audit --log-level error --config /etc/starboard/polaris.config.yaml --resource " + sourceName + " 2> /dev/null",
 				},
 				SecurityContext: &corev1.SecurityContext{
 					Privileged:               pointer.BoolPtr(false),


Test patch:
diff --git a/pkg/plugin/polaris/plugin_test.go b/pkg/plugin/polaris/plugin_test.go
index 4a724a2..5c306d1 100644
--- a/pkg/plugin/polaris/plugin_test.go
+++ b/pkg/plugin/polaris/plugin_test.go
@@ -9,8 +9,7 @@ import (
 	"github.com/aquasecurity/starboard/pkg/ext"
 	"github.com/aquasecurity/starboard/pkg/plugin/polaris"
 	"github.com/aquasecurity/starboard/pkg/starboard"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -87,12 +86,10 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 								MountPath: "/etc/starboard",
 							},
 						},
-						Command: []string{"polaris"},
+						Command: []string{"sh"},
 						Args: []string{
-							"audit",
-							"--log-level", "error",
-							"--config", "/etc/starboard/polaris.config.yaml",
-							"--resource", "default/Deployment.apps/v1/nginx",
+							"-c",
+							"polaris audit --log-level error --config /etc/starboard/polaris.config.yaml --resource default/Deployment.apps/v1/nginx 2> /dev/null",
 						},
 						SecurityContext: &corev1.SecurityContext{
 							Privileged:               pointer.BoolPtr(false),
@@ -117,28 +114,33 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
+			g := gomega.NewGomegaWithT(t)
+
 			pluginContext := starboard.NewPluginContext().
 				WithNamespace(starboard.NamespaceName).
 				WithServiceAccountName(starboard.ServiceAccountName).
 				Build()
 			plugin := polaris.NewPlugin(fixedClock, tc.config)
 			jobSpec, secrets, err := plugin.GetScanJobSpec(pluginContext, tc.obj)
-			require.NoError(t, err, tc.name)
-			assert.Nil(t, secrets)
-			assert.Equal(t, tc.expectedJobSpec, jobSpec, tc.name)
+
+			g.Expect(err).ToNot(gomega.HaveOccurred())
+			g.Expect(secrets).To(gomega.BeNil())
+			g.Expect(jobSpec).To(gomega.Equal(tc.expectedJobSpec))
 		})
 	}
 
 }
 
 func TestPlugin_GetContainerName(t *testing.T) {
+	g := gomega.NewGomegaWithT(t)
 	plugin := polaris.NewPlugin(fixedClock, starboard.ConfigData{})
-	assert.Equal(t, "polaris", plugin.GetContainerName())
+	g.Expect(plugin.GetContainerName()).To(gomega.Equal("polaris"))
 }
 
 func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
+	g := gomega.NewGomegaWithT(t)
 	testReport, err := os.Open("testdata/polaris-report.json")
-	require.NoError(t, err)
+	g.Expect(err).ToNot(gomega.HaveOccurred())
 	defer func() {
 		_ = testReport.Close()
 	}()
@@ -148,49 +150,43 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 	}
 	plugin := polaris.NewPlugin(fixedClock, config)
 	result, err := plugin.ParseConfigAuditReportData(testReport)
-	require.NoError(t, err)
-	assert.Equal(t, metav1.NewTime(fixedTime), result.UpdateTimestamp)
-	assert.Equal(t, v1alpha1.Scanner{
+	g.Expect(err).ToNot(gomega.HaveOccurred())
+	g.Expect(result.UpdateTimestamp).To(gomega.Equal(metav1.NewTime(fixedTime)))
+	g.Expect(result.Scanner).To(gomega.Equal(v1alpha1.Scanner{
 		Name:    "Polaris",
 		Vendor:  "Fairwinds Ops",
 		Version: "3.2",
-	}, result.Scanner)
-	assert.Equal(t, v1alpha1.ConfigAuditSummary{
+	}))
+	g.Expect(result.Summary).To(gomega.Equal(v1alpha1.ConfigAuditSummary{
 		PassCount:    2,
 		DangerCount:  1,
 		WarningCount: 1,
-	}, result.Summary)
-	assert.ElementsMatch(t, []v1alpha1.Check{
-		{
-			ID:       "hostIPCSet",
-			Message:  "Host IPC is not configured",
-			Success:  false,
-			Severity: "danger",
-			Category: "Security",
-		},
-		{
-			ID:       "hostNetworkSet",
-			Message:  "Host network is not configured",
-			Success:  true,
-			Severity: "warning",
-			Category: "Networking",
-		},
-	}, result.PodChecks)
-	assert.Len(t, result.ContainerChecks, 1)
-	assert.ElementsMatch(t, []v1alpha1.Check{
-		{
-			ID:       "cpuLimitsMissing",
-			Message:  "CPU limits are set",
-			Success:  false,
-			Severity: "warning",
-			Category: "Resources",
-		},
-		{
-			ID:       "cpuRequestsMissing",
-			Message:  "CPU requests are set",
-			Success:  true,
-			Severity: "warning",
-			Category: "Resources",
-		},
-	}, result.ContainerChecks["db"])
+	}))
+	g.Expect(result.PodChecks).To(gomega.ConsistOf(v1alpha1.Check{
+		ID:       "hostIPCSet",
+		Message:  "Host IPC is not configured",
+		Success:  false,
+		Severity: "danger",
+		Category: "Security",
+	}, v1alpha1.Check{
+		ID:       "hostNetworkSet",
+		Message:  "Host network is not configured",
+		Success:  true,
+		Severity: "warning",
+		Category: "Networking",
+	}))
+	g.Expect(result.ContainerChecks).To(gomega.HaveLen(1))
+	g.Expect(result.ContainerChecks["db"]).To(gomega.ConsistOf(v1alpha1.Check{
+		ID:       "cpuLimitsMissing",
+		Message:  "CPU limits are set",
+		Success:  false,
+		Severity: "warning",
+		Category: "Resources",
+	}, v1alpha1.Check{
+		ID:       "cpuRequestsMissing",
+		Message:  "CPU requests are set",
+		Success:  true,
+		Severity: "warning",
+		Category: "Resources",
+	}))
 }