Skip to content

Commit

Permalink
add verbose_name for kube-linter issues
Browse files Browse the repository at this point in the history
  • Loading branch information
@srijan-deepsource
srijan-deepsource committed Nov 14, 2023
1 parent 218a217 commit 74672aa
Show file tree
Hide file tree
Showing 51 changed files with 52 additions and 0 deletions.
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a subject (Group/User/ServiceAccount) has create access to Pods.
## Remediation
Where possible, remove create access to pod objects in the cluster.
"""
verbose_name = "access-to-create-pods"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. CIS
Where possible, remove get, list and watch access to secret objects in the cluster.
"""
verbose_name = "access-to-secrets"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ CIS Benchmark 5.1.1 Ensure that the cluster-admin role is only used where requir
Create and assign a separate role that has access to specific resources/actions needed for the service account.
"""
verbose_name = "cluster-admin-role-binding"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when HorizontalPodAutoscalers target a missing resource.
Confirm that your HorizontalPodAutoscaler's scaleTargetRef correctly matches one of your deployments.
"""
verbose_name = "dangling-horizontalpodautoscaler"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when ingress do not have any associated services.
Confirm that your ingress's backend correctly matches the name and port on one of your services.
"""
verbose_name = "dangling-ingress"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when networkpolicies do not have any associated deployments.
Confirm that your networkPolicy's podselector correctly matches the labels on one of your deployments.
"""
verbose_name = "dangling-networkpolicy"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when NetworkPolicyPeer in Egress/Ingress rules -in the Spec of Network
Confirm that your NetworkPolicy's Ingress/Egress peer's podselector correctly matches the labels on one of your deployments.
"""
verbose_name = "dangling-networkpolicypeer-podselector"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when services do not have any associated deployments.
Confirm that your service's selector correctly matches the labels on one of your deployments.
"""
verbose_name = "dangling-service"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when pods use the default service account.
Create a dedicated service account for your pod. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ for details.
"""
verbose_name = "default-service-account"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when deployments use the deprecated serviceAccount field.
Use the serviceAccountName field instead. If you must specify serviceAccount, ensure values for serviceAccount and serviceAccountName match.
"""
verbose_name = "deprecated-service-account-field"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on deployments that have no specified dnsConfig options
Specify dnsconfig options in your Pod specification to ensure the expected DNS setting on the Pod. Refer to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for details.
"""
verbose_name = "dnsconfig-options"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on deployments with docker.sock mounted in containers.
Ensure the Docker socket is not mounted inside any containers by removing the associated Volume and VolumeMount in deployment yaml specification. If the Docker socket is mounted inside a container it could allow processes running within the container to execute Docker commands which would effectively allow for full control of the host.
"""
verbose_name = "docker-sock"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when containers do not drop NET_RAW capability
NET_RAW makes it so that an application within the container is able to craft raw packets, use raw sockets, and bind to any address. Remove this capability in the containers under containers security contexts.
"""
verbose_name = "drop-net-raw-capability"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Check that duplicate named env vars aren't passed to a deployment like.
Confirm that your DeploymentLike doesn't have duplicate env vars names.
"""
verbose_name = "duplicate-env-var"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when objects use a secret in an environment variable.
Do not use raw secrets in environment variables. Instead, either mount the secret as a file or use a secretKeyRef. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details.
"""
verbose_name = "env-var-secret"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on services for forbidden types
Ensure containers are not exposed through a forbidden service type such as NodePort or LoadBalancer.
"""
verbose_name = "exposed-services"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on pods/deployment-likes with sharing host's IPC namespace
Ensure the host's IPC namespace is not shared.
"""
verbose_name = "host-ipc"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Alert on pods/deployment-likes with sharing host's network namespace
## Remediation
Ensure the host's network namespace is not shared.
"""
verbose_name = "host-network"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on pods/deployment-likes with sharing host's process namespace
Ensure the host's process namespace is not shared.
"""
verbose_name = "host-pid"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas
Increase the number of replicas in the HorizontalPodAutoscaler to at least three to increase fault tolerance.
"""
verbose_name = "hpa-minimum-three-replicas"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when deployments or services are using port names that are violating s
Ensure that port naming is in conjunction with the specification. For more information, please look at the Kubernetes Service specification on this page: https://kubernetes.io/docs/reference/_print/#ServiceSpec. And additional information about IANA Service naming can be found on the following page: https://www.rfc-editor.org/rfc/rfc6335.html#section-5.1.
"""
verbose_name = "invalid-target-ports"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a deployment-like object is running a container with an invalid c
Use a container image with a specific tag other than latest.
"""
verbose_name = "latest-tag"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a deployment uses less than three replicas
Increase the number of replicas in the deployment to at least three to increase the fault tolerance of the deployment.
"""
verbose_name = "minimum-three-replicas"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when deployment selectors fail to match the pod template labels.
Confirm that your deployment selector correctly matches the labels in its pod template.
"""
verbose_name = "mismatching-selector"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when deployments with multiple replicas fail to specify inter-pod anti
Specify anti-affinity in your pod specification to ensure that the orchestrator attempts to schedule replicas on different nodes. Using podAntiAffinity, specify a labelSelector that matches pods for the deployment, and set the topologyKey to kubernetes.io/hostname. Refer to https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity for details.
"""
verbose_name = "no-anti-affinity"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when objects use deprecated API versions under extensions/v1beta.
Migrate using the apps/v1 API versions for the objects. Refer to https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/ for details.
"""
verbose_name = "no-extensions-v1beta"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when containers fail to specify a liveness probe.
Specify a liveness probe in your container. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ for details.
"""
verbose_name = "no-liveness-probe"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on deployments that have no node affinity defined
Specify node-affinity in your pod specification to ensure that the orchestrator attempts to schedule replicas on specified nodes. Refer to https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity for details.
"""
verbose_name = "no-node-affinity"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when containers are running without a read-only root filesystem.
Set readOnlyRootFilesystem to true in the container securityContext.
"""
verbose_name = "no-read-only-root-fs"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when containers fail to specify a readiness probe.
Specify a readiness probe in your container. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ for details.
"""
verbose_name = "no-readiness-probe"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a deployment doesn't use a rolling update strategy
## Remediation
Use a rolling update strategy to avoid service disruption during an update. A rolling update strategy allows for pods to be systematicaly replaced in a controlled fashion to ensure no service disruption.
"""
verbose_name = "no-rolling-update-strategy"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when pods reference a service account that is not found.
Create the missing service account, or refer to an existing service account.
"""
verbose_name = "non-existent-service-account"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on deployment-like objects that are not selected by any NetworkPolicy.
Ensure pod does not accept unsafe traffic by isolating it with a NetworkPolicy. See https://cloud.redhat.com/blog/guide-to-kubernetes-ingress-network-policies for more details.
"""
verbose_name = "non-isolated-pod"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a PodDisruptionBudget has a maxUnavailable value that will always
Change the PodDisruptionBudget to have maxUnavailable set to a value greater than 0. Refer to https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more information.
"""
verbose_name = "pdb-max-unavailable"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when a PodDisruptionBudget sets a minAvailable value that will always
Change the PodDisruptionBudget to have minAvailable set to a number lower than the number of replicas in the related deployment-like objects. Refer to https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more information.
"""
verbose_name = "pdb-min-available"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on containers of allowing privilege escalation that could gain more privil
Ensure containers do not allow privilege escalation by setting allowPrivilegeEscalation=false, privileged=false and removing CAP_SYS_ADMIN capability. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details.
"""
verbose_name = "privilege-escalation-container"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when deployments have containers running in privileged mode.
## Remediation
Do not run your container as privileged unless it is required.
"""
verbose_name = "privileged-container"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Alert on deployments with privileged ports mapped in containers.
## Remediation
Ensure privileged ports [0, 1024] are not mapped within containers.
"""
verbose_name = "privileged-ports"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when a deployment reads secret from environment variables. CIS Benchma
## Remediation
If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details.
"""
verbose_name = "read-secret-from-env-var"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when objects do not have an email annotation with a valid email addres
## Remediation
Add an email annotation to your object with the email address of the object's owner.
"""
verbose_name = "required-annotation-email"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when objects do not have an email annotation with an owner label.
## Remediation
Add an email annotation to your object with the name of the object's owner.
"""
verbose_name = "required-label-owner"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when containers are running as the root user.
## Remediation
Set `runAsUser` to a non-zero number and `runAsNonRoot` to `true` in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.
"""
verbose_name = "run-as-non-root"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Alert on deployments with sensitive host system directories mounted in container
## Remediation
Ensure sensitive host system directories are not mounted in containers by removing those Volumes and VolumeMounts.
"""
verbose_name = "sensitive-host-mounts"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when deployments expose port 22, which is commonly reserved for SSH ac
## Remediation
Ensure that non-SSH services are not using port 22. Confirm that any actual SSH servers have been vetted.
"""
verbose_name = "ssh-port"
2 changes: 2 additions & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,5 @@ Alert on deployments with unsafe /proc mount (procMount=Unmasked) that will bypa
## Remediation
Ensure container does not unsafely exposes parts of /proc by setting procMount=Default. Unmasked ProcMount bypasses the default masking behavior of the container runtime. See https://kubernetes.io/docs/concepts/security/pod-security-standards/ for more details.
"""
verbose_name = "unsafe-proc-mount"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Alert on deployments specifying unsafe sysctls that may lead to severe problems
## Remediation
Ensure that containers do not allow unsafe allocation of system resources by removing unsafe kernel parameter configurations. For more details, see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ and https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime.
"""
verbose_name = "unsafe-sysctls"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when containers do not have CPU requests and limits set.
## Remediation
Set CPU requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.
"""
verbose_name = "unset-cpu-requirements"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicates when containers do not have memory requests and limits set.
## Remediation
Set memory requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.
"""
verbose_name = "unset-memory-requirements"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when a resource is deployed to the default namespace. CIS Benchmark 5.
## Remediation
Create namespaces for objects in your deployment.
"""
verbose_name = "use-namespace"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ Indicate when a wildcard is used in Role or ClusterRole rules. CIS Benchmark 5.1
## Remediation
Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions.
"""
verbose_name = "wildcard-in-rules"
1 change: 1 addition & 0 deletions analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,4 @@ Indicates when containers mount a host path as writable.
## Remediation
Set containers to mount host paths as readOnly, if you need to access files on the host.
"""
verbose_name = "writable-host-mount"

0 comments on commit 74672aa

Please sign in to comment.