Repository: aquasecurity/starboard
Pull request #653 (2021-08-02 15:35:48)

chore(polaris): Rename properties to configure resource requirements and limits
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#653](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (443374f) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/cc79d00b40edacd9433efd88bab27e1d755895af?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (cc79d00) will **decrease** coverage by `22.15%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/653/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #653       +/-   ##
===========================================
- Coverage   68.25%   46.09%   -22.16%     
===========================================
  Files          58       41       -17     
  Lines        4571     3716      -855     
===========================================
- Hits         3120     1713     -1407     
- Misses       1074     1885      +811     
+ Partials      377      118      -259     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/plugin/polaris/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9wb2xhcmlzL3BsdWdpbi5nbw==) | `83.42% <100.00%> (-1.11%)` | :arrow_down: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-80.51%)` | :arrow_down: |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-80.49%)` | :arrow_down: |
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-70.77%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-70.54%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-68.06%)` | :arrow_down: |
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-65.17%)` | :arrow_down: |
| [pkg/kube/runnable\_job.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvcnVubmFibGVfam9iLmdv) | `0.00% <0.00%> (-64.39%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-61.71%)` | :arrow_down: |
| [pkg/kubehunter/model.go](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvbW9kZWwuZ28=) | `0.00% <0.00%> (-61.54%)` | :arrow_down: |
| ... and [30 more](https://codecov.io/gh/aquasecurity/starboard/pull/653/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [cc79d00...443374f](https://codecov.io/gh/aquasecurity/starboard/pull/653?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index df93327..8195353 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -106,6 +106,14 @@ kubeBench:
 
 polaris:
   imageRef: quay.io/fairwinds/polaris:3.2
+  # resources resource requests and limits
+  resources:
+    requests:
+      cpu: 50m
+      memory: 50M
+    limits:
+      cpu: 300m
+      memory: 300M
   config:
     checks:
       # reliability
diff --git a/deploy/static/05-starboard-operator.config.yaml b/deploy/static/05-starboard-operator.config.yaml
index 906a636..e90b65c 100644
--- a/deploy/static/05-starboard-operator.config.yaml
+++ b/deploy/static/05-starboard-operator.config.yaml
@@ -44,10 +44,10 @@ metadata:
     "app.kubernetes.io/managed-by": "starboard"
 data:
   polaris.imageRef: quay.io/fairwinds/polaris:3.2
-  polaris.resources.request.cpu: "50m"
-  polaris.resources.request.memory: "50M"
-  polaris.resources.limit.cpu: "300m"
-  polaris.resources.limit.memory: "300M"
+  polaris.resources.requests.cpu: "50m"
+  polaris.resources.requests.memory: "50M"
+  polaris.resources.limits.cpu: "300m"
+  polaris.resources.limits.memory: "300M"
   polaris.config.yaml: |
     checks:
       # reliability
diff --git a/docs/integrations/config-checkers/polaris.md b/docs/integrations/config-checkers/polaris.md
index b9a2b8a..cee3924 100644
--- a/docs/integrations/config-checkers/polaris.md
+++ b/docs/integrations/config-checkers/polaris.md
@@ -10,6 +10,17 @@ The [default][config-default] Polaris [configuration] can be customized to do th
 - Add new [custom checks]
 - Add [exemptions] for particular workloads or namespaces
 
+## Settings
+
+| CONFIGMAP KEY                        | DEFAULT                                                | DESCRIPTION |
+| ------------------------------------ | ------------------------------------------------------ | ----------- |
+| `polaris.imageRef`                   | `quay.io/fairwinds/polaris:3.2`                        | Polaris image reference |
+| `polaris.config.yaml`                | [Check the default value here][default-polaris-config] | Polaris configuration file |
+| `polaris.resources.request.cpu`      | `50m`                                                  | The minimum amount of CPU required to run Polaris scanner pod. |
+| `polaris.resources.request.memory`   | `50M`                                                  | The minimum amount of memory required to run Polaris scanner pod. |
+| `polaris.resources.limit.cpu`        | `300m`                                                 | The maximum amount of CPU allowed to run Polaris scanner pod. |
+| `polaris.resources.limit.memory`     | `300M`                                                 | The maximum amount of memory allowed to run polaris scanner pod. |
+
 ## What's Next?
 
 - See the Polaris documentation for the list of [security], [efficiency], and [reliability] checks.
diff --git a/docs/settings.md b/docs/settings.md
index a50e1ee..81f9456 100644
--- a/docs/settings.md
+++ b/docs/settings.md
@@ -56,23 +56,17 @@ The following tables list available configuration settings with their default va
     used if `vulnerabilityReports.scanner` is set to `Trivy`). Check
     [integrations](./integrations/vulnerability-scanners/index.md) page to see example configuration settings for common use cases.
 
-| CONFIGMAP KEY                        | DEFAULT                                                | DESCRIPTION |
-| ------------------------------------ | ------------------------------------------------------ | ----------- |
-| `vulnerabilityReports.scanner`       | `Trivy`                                                | The name of the plugin that generates vulnerability reports. Either `Trivy` or `Aqua`. |
-| `configAuditReports.scanner`         | `Polaris`                                              | The name of the plugin that generates config audit reports. Either `Polaris` or `Conftest`. |
-| `scanJob.tolerations`                | N/A                                                    | JSON representation of the [tolerations] to be applied to the scanner pods so that they can run on nodes with matching taints. Example: `'[{"key":"key1", "operator":"Equal", "value":"value1", "effect":"NoSchedule"}]'` |
-| `scanJob.annotations`                | N/A                                                    | One-line comma-separated representation of the annotations which the user wants the scanner pods to be annotated with. Example: `foo=bar,env=stage` will annotate the scanner pods with the annotations `foo: bar` and `env: stage` |
-| `kube-bench.imageRef`                | `docker.io/aquasec/kube-bench:0.6.3`                   | kube-bench image reference |
-| `kube-hunter.imageRef`               | `docker.io/aquasec/kube-hunter:0.4.1`                  | kube-hunter image reference |
-| `kube-hunter.quick`                  | `"false"`                                              | Whether to use kube-hunter's "quick" scanning mode (subnet 24). Set to `"true"` to enable. |
-| `polaris.imageRef`                   | `quay.io/fairwinds/polaris:3.2`                        | Polaris image reference |
-| `polaris.config.yaml`                | [Check the default value here][default-polaris-config] | Polaris configuration file |
-| `polaris.resources.request.cpu`      | `50m`                                                  | The minimum amount of CPU required to run Polaris scanner pod. |
-| `polaris.resources.request.memory`   | `50M`                                                  | The minimum amount of memory required to run Polaris scanner pod. |
-| `polaris.resources.limit.cpu`        | `300m`                                                 | The maximum amount of CPU allowed to run Polaris scanner pod. |
-| `polaris.resources.limit.memory`     | `300M`                                                 | The maximum amount of memory allowed to run polaris scanner pod. |
-| `aqua.imageRef`                      | `docker.io/aquasec/scanner:5.3`                        | Aqua scanner image reference. The tag determines the version of the `scanner` binary executable and it must be compatible with version of Aqua console. |
-| `aqua.serverURL`                     | N/A                                                    | The endpoint URL of Aqua management console |
+| CONFIGMAP KEY                  | DEFAULT                               | DESCRIPTION |
+| ------------------------------ | ------------------------------------- | ----------- |
+| `vulnerabilityReports.scanner` | `Trivy`                               | The name of the plugin that generates vulnerability reports. Either `Trivy` or `Aqua`. |
+| `configAuditReports.scanner`   | `Polaris`                             | The name of the plugin that generates config audit reports. Either `Polaris` or `Conftest`. |
+| `scanJob.tolerations`          | N/A                                   | JSON representation of the [tolerations] to be applied to the scanner pods so that they can run on nodes with matching taints. Example: `'[{"key":"key1", "operator":"Equal", "value":"value1", "effect":"NoSchedule"}]'` |
+| `scanJob.annotations`          | N/A                                   | One-line comma-separated representation of the annotations which the user wants the scanner pods to be annotated with. Example: `foo=bar,env=stage` will annotate the scanner pods with the annotations `foo: bar` and `env: stage` |
+| `kube-bench.imageRef`          | `docker.io/aquasec/kube-bench:0.6.3`  | kube-bench image reference |
+| `kube-hunter.imageRef`         | `docker.io/aquasec/kube-hunter:0.4.1` | kube-hunter image reference |
+| `kube-hunter.quick`            | `"false"`                             | Whether to use kube-hunter's "quick" scanning mode (subnet 24). Set to `"true"` to enable. |
+| `aqua.imageRef`                | `docker.io/aquasec/scanner:5.3`       | Aqua scanner image reference. The tag determines the version of the `scanner` binary executable and it must be compatible with version of Aqua console. |
+| `aqua.serverURL`               | N/A                                   | The endpoint URL of Aqua management console |
 
 | SECRET KEY                  | DESCRIPTION |
 | --------------------------- | ----------- |
@@ -88,5 +82,4 @@ The following tables list available configuration settings with their default va
       -p '[{"op": "remove", "path": "/data/trivy.httpProxy"}]'
     ```
 
-[default-polaris-config]: https://raw.githubusercontent.com/aquasecurity/starboard/{{ var.tag }}/deploy/static/05-starboard-operator.config.yaml
-[tolerations]: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration
\ No newline at end of file
+[tolerations]: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration
diff --git a/pkg/plugin/polaris/plugin.go b/pkg/plugin/polaris/plugin.go
index 553b84d..a4c1e2d 100644
--- a/pkg/plugin/polaris/plugin.go
+++ b/pkg/plugin/polaris/plugin.go
@@ -26,10 +26,10 @@ const (
 const (
 	keyImageRef                = "polaris.imageRef"
 	keyConfigYaml              = "polaris.config.yaml"
-	keyResourcesRequestsCPU    = "polaris.resources.request.cpu"
-	keyResourcesRequestsMemory = "polaris.resources.request.memory"
-	keyResourcesLimitCPU       = "polaris.resources.limit.cpu"
-	keyResourcesLimitMemory    = "polaris.resources.limit.memory"
+	keyResourcesRequestsCPU    = "polaris.resources.requests.cpu"
+	keyResourcesRequestsMemory = "polaris.resources.requests.memory"
+	keyResourcesLimitsCPU      = "polaris.resources.limits.cpu"
+	keyResourcesLimitsMemory   = "polaris.resources.limits.memory"
 )
 
 const (
@@ -247,12 +247,12 @@ func (c Config) GetResourceRequirements() (corev1.ResourceRequirements, error) {
 		return requirements, err
 	}
 
-	err = c.setResourceLimit(keyResourcesLimitCPU, &requirements.Limits, corev1.ResourceCPU)
+	err = c.setResourceLimit(keyResourcesLimitsCPU, &requirements.Limits, corev1.ResourceCPU)
 	if err != nil {
 		return requirements, err
 	}
 
-	err = c.setResourceLimit(keyResourcesLimitMemory, &requirements.Limits, corev1.ResourceMemory)
+	err = c.setResourceLimit(keyResourcesLimitsMemory, &requirements.Limits, corev1.ResourceMemory)
 	if err != nil {
 		return requirements, err
 	}
@@ -292,8 +292,8 @@ func (p *plugin) Init(ctx starboard.PluginContext) error {
 			keyConfigYaml:              DefaultConfigYAML,
 			keyResourcesRequestsCPU:    "50m",
 			keyResourcesRequestsMemory: "50M",
-			keyResourcesLimitCPU:       "300m",
-			keyResourcesLimitMemory:    "300M",
+			keyResourcesLimitsCPU:      "300m",
+			keyResourcesLimitsMemory:   "300M",
 		},
 	})
 }


Test patch:
diff --git a/pkg/plugin/polaris/plugin_test.go b/pkg/plugin/polaris/plugin_test.go
index ca11a9f..3f0f181 100644
--- a/pkg/plugin/polaris/plugin_test.go
+++ b/pkg/plugin/polaris/plugin_test.go
@@ -31,13 +31,13 @@ var (
 func TestConfig_GetResourceRequirements(t *testing.T) {
 	testCases := []struct {
 		name                 string
-		configData           polaris.Config
+		config               polaris.Config
 		expectedError        string
 		expectedRequirements corev1.ResourceRequirements
 	}{
 		{
 			name:          "Should return empty requirements by default",
-			configData:    polaris.Config{PluginConfig: starboard.PluginConfig{}},
+			config:        polaris.Config{PluginConfig: starboard.PluginConfig{}},
 			expectedError: "",
 			expectedRequirements: corev1.ResourceRequirements{
 				Requests: corev1.ResourceList{},
@@ -46,12 +46,12 @@ func TestConfig_GetResourceRequirements(t *testing.T) {
 		},
 		{
 			name: "Should return configured resource requirement",
-			configData: polaris.Config{PluginConfig: starboard.PluginConfig{
+			config: polaris.Config{PluginConfig: starboard.PluginConfig{
 				Data: map[string]string{
-					"polaris.resources.request.cpu":    "800m",
-					"polaris.resources.request.memory": "200M",
-					"polaris.resources.limit.cpu":      "600m",
-					"polaris.resources.limit.memory":   "700M",
+					"polaris.resources.requests.cpu":    "800m",
+					"polaris.resources.requests.memory": "200M",
+					"polaris.resources.limits.cpu":      "600m",
+					"polaris.resources.limits.memory":   "700M",
 				},
 			}},
 			expectedError: "",
@@ -68,15 +68,12 @@ func TestConfig_GetResourceRequirements(t *testing.T) {
 		},
 		{
 			name: "Should return error if resource is not parseable",
-			configData: polaris.Config{PluginConfig: starboard.PluginConfig{
+			config: polaris.Config{PluginConfig: starboard.PluginConfig{
 				Data: map[string]string{
-					"polaris.resources.request.cpu":    "roughly 100",
-					"polaris.resources.request.memory": "200M",
-					"polaris.resources.limit.cpu":      "600m",
-					"polaris.resources.limit.memory":   "700M",
+					"polaris.resources.requests.cpu": "roughly 100",
 				},
 			}},
-			expectedError: "parsing resource definition polaris.resources.request.cpu: roughly 100 quantities must match the regular expression '^([+-]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$'",
+			expectedError: "parsing resource definition polaris.resources.requests.cpu: roughly 100 quantities must match the regular expression '^([+-]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$'",
 			expectedRequirements: corev1.ResourceRequirements{
 				Requests: corev1.ResourceList{
 					corev1.ResourceCPU:    resource.MustParse("800m"),
@@ -91,7 +88,7 @@ func TestConfig_GetResourceRequirements(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			resourceRequirement, err := tc.configData.GetResourceRequirements()
+			resourceRequirement, err := tc.config.GetResourceRequirements()
 			if tc.expectedError != "" {
 				require.EqualError(t, err, tc.expectedError)
 			} else {
@@ -141,12 +138,12 @@ func TestPlugin_Init(t *testing.T) {
 				ResourceVersion: "1",
 			},
 			Data: map[string]string{
-				"polaris.imageRef":                 "quay.io/fairwinds/polaris:3.2",
-				"polaris.config.yaml":              polaris.DefaultConfigYAML,
-				"polaris.resources.request.cpu":    "50m",
-				"polaris.resources.request.memory": "50M",
-				"polaris.resources.limit.cpu":      "300m",
-				"polaris.resources.limit.memory":   "300M",
+				"polaris.imageRef":                  "quay.io/fairwinds/polaris:3.2",
+				"polaris.config.yaml":               polaris.DefaultConfigYAML,
+				"polaris.resources.requests.cpu":    "50m",
+				"polaris.resources.requests.memory": "50M",
+				"polaris.resources.limits.cpu":      "300m",
+				"polaris.resources.limits.memory":   "300M",
 			},
 		}))
 	})
@@ -216,11 +213,11 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 		{
 			name: "Should return job spec for Deployment",
 			config: map[string]string{
-				"polaris.imageRef":                 "quay.io/fairwinds/polaris:3.2",
-				"polaris.resources.request.cpu":    "50m",
-				"polaris.resources.request.memory": "50M",
-				"polaris.resources.limit.cpu":      "300m",
-				"polaris.resources.limit.memory":   "300M",
+				"polaris.imageRef":                  "quay.io/fairwinds/polaris:3.2",
+				"polaris.resources.requests.cpu":    "50m",
+				"polaris.resources.requests.memory": "50M",
+				"polaris.resources.limits.cpu":      "300m",
+				"polaris.resources.limits.memory":   "300M",
 			},
 			obj: &appsv1.Deployment{
 				TypeMeta: metav1.TypeMeta{