polaris
polaris copied to clipboard
FWI-2719: Enable and add exemptions for recently-added checks
Checklist
- [x] I have signed the CLA
- [x] I have updated/added any relevant documentation
Description
What's the goal of this PR?
These checks are now enabled in the default Polaris configuration:
- automountServiceAccountToken
- linuxHardening
- missingNetworkPolicy
- sensitiveConfigmapContent and sensitiveContainerEnvVar
- clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole
- clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and rolebindingRolePodExecAttach
Fixed the sensitiveContainerEnvVar check to ignore sensitive environment
variable names when those variables use valueFrom to reference an
external resource.
Added the *ClusterAdmin checks to examples/config-full.yaml.
I'm waiting to merge this (making these checks live for the Polaris community) until a deeper round of initial testing has completed.
Thanks for adding all the new test cases!