diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml index 42e2e552..c68d105c 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml @@ -11,3 +11,4 @@ Indicates when a subject (Group/User/ServiceAccount) has create access to Pods. ## Remediation Where possible, remove create access to pod objects in the cluster. """ +verbose_name = "access-to-create-pods" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml index ad6bd686..19a27ccd 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml @@ -11,3 +11,4 @@ Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. CIS Where possible, remove get, list and watch access to secret objects in the cluster. """ +verbose_name = "access-to-secrets" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml index 4d8e9d18..f257f6d0 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml @@ -11,3 +11,4 @@ CIS Benchmark 5.1.1 Ensure that the cluster-admin role is only used where requir Create and assign a separate role that has access to specific resources/actions needed for the service account. """ +verbose_name = "cluster-admin-role-binding" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml index 9126ec18..4dbf587b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml @@ -11,3 +11,4 @@ Indicates when HorizontalPodAutoscalers target a missing resource. Confirm that your HorizontalPodAutoscaler's scaleTargetRef correctly matches one of your deployments. """ +verbose_name = "dangling-horizontalpodautoscaler" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml index 501dd5f3..d5c4cd0f 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml @@ -11,3 +11,4 @@ Indicates when ingress do not have any associated services. Confirm that your ingress's backend correctly matches the name and port on one of your services. """ +verbose_name = "dangling-ingress" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml index f876e3ad..81319272 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml @@ -11,3 +11,4 @@ Indicates when networkpolicies do not have any associated deployments. Confirm that your networkPolicy's podselector correctly matches the labels on one of your deployments. """ +verbose_name = "dangling-networkpolicy" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml index af8bed07..a411db98 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml @@ -11,3 +11,4 @@ Indicates when NetworkPolicyPeer in Egress/Ingress rules -in the Spec of Network Confirm that your NetworkPolicy's Ingress/Egress peer's podselector correctly matches the labels on one of your deployments. """ +verbose_name = "dangling-networkpolicypeer-podselector" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml index 497b4f54..1ff21845 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml @@ -11,3 +11,4 @@ Indicates when services do not have any associated deployments. Confirm that your service's selector correctly matches the labels on one of your deployments. """ +verbose_name = "dangling-service" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml index 591a86a4..6db2ee72 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml @@ -11,3 +11,4 @@ Indicates when pods use the default service account. Create a dedicated service account for your pod. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ for details. """ +verbose_name = "default-service-account" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml index 1529009b..bd8f7fd3 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml @@ -11,3 +11,4 @@ Indicates when deployments use the deprecated serviceAccount field. Use the serviceAccountName field instead. If you must specify serviceAccount, ensure values for serviceAccount and serviceAccountName match. """ +verbose_name = "deprecated-service-account-field" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml index 264db205..fbd32dd4 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml @@ -11,3 +11,4 @@ Alert on deployments that have no specified dnsConfig options Specify dnsconfig options in your Pod specification to ensure the expected DNS setting on the Pod. Refer to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for details. """ +verbose_name = "dnsconfig-options" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml index 04318ed5..1fc73a82 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml @@ -11,3 +11,4 @@ Alert on deployments with docker.sock mounted in containers. Ensure the Docker socket is not mounted inside any containers by removing the associated Volume and VolumeMount in deployment yaml specification. If the Docker socket is mounted inside a container it could allow processes running within the container to execute Docker commands which would effectively allow for full control of the host. """ +verbose_name = "docker-sock" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml index c3cc2380..9822ce79 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml @@ -11,3 +11,4 @@ Indicates when containers do not drop NET_RAW capability NET_RAW makes it so that an application within the container is able to craft raw packets, use raw sockets, and bind to any address. Remove this capability in the containers under containers security contexts. """ +verbose_name = "drop-net-raw-capability" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml index b92463bf..a14de2a2 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml @@ -11,3 +11,4 @@ Check that duplicate named env vars aren't passed to a deployment like. Confirm that your DeploymentLike doesn't have duplicate env vars names. """ +verbose_name = "duplicate-env-var" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml index e15d8d90..8db420ff 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml @@ -11,3 +11,4 @@ Indicates when objects use a secret in an environment variable. Do not use raw secrets in environment variables. Instead, either mount the secret as a file or use a secretKeyRef. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details. """ +verbose_name = "env-var-secret" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml index 051304de..ef1757cb 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml @@ -11,3 +11,4 @@ Alert on services for forbidden types Ensure containers are not exposed through a forbidden service type such as NodePort or LoadBalancer. """ +verbose_name = "exposed-services" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml index 5437daa1..3e18d611 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml @@ -11,3 +11,4 @@ Alert on pods/deployment-likes with sharing host's IPC namespace Ensure the host's IPC namespace is not shared. """ +verbose_name = "host-ipc" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml index 6a7b40be..e703e897 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml @@ -10,3 +10,4 @@ Alert on pods/deployment-likes with sharing host's network namespace ## Remediation Ensure the host's network namespace is not shared. """ +verbose_name = "host-network" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml index 0d9ea7c4..de0da2f7 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml @@ -11,3 +11,4 @@ Alert on pods/deployment-likes with sharing host's process namespace Ensure the host's process namespace is not shared. """ +verbose_name = "host-pid" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml index 4e95a538..63b1ce46 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml @@ -11,3 +11,4 @@ Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas Increase the number of replicas in the HorizontalPodAutoscaler to at least three to increase fault tolerance. """ +verbose_name = "hpa-minimum-three-replicas" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml index 666fec7e..b6e51cc9 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml @@ -11,3 +11,4 @@ Indicates when deployments or services are using port names that are violating s Ensure that port naming is in conjunction with the specification. For more information, please look at the Kubernetes Service specification on this page: https://kubernetes.io/docs/reference/_print/#ServiceSpec. And additional information about IANA Service naming can be found on the following page: https://www.rfc-editor.org/rfc/rfc6335.html#section-5.1. """ +verbose_name = "invalid-target-ports" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml index 255100f7..31b8b96e 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml @@ -11,3 +11,4 @@ Indicates when a deployment-like object is running a container with an invalid c Use a container image with a specific tag other than latest. """ +verbose_name = "latest-tag" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml index 9b6a1149..d8086c8d 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml @@ -11,3 +11,4 @@ Indicates when a deployment uses less than three replicas Increase the number of replicas in the deployment to at least three to increase the fault tolerance of the deployment. """ +verbose_name = "minimum-three-replicas" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml index a6c078ef..8178d0f3 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml @@ -11,3 +11,4 @@ Indicates when deployment selectors fail to match the pod template labels. Confirm that your deployment selector correctly matches the labels in its pod template. """ +verbose_name = "mismatching-selector" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml index ebd54b07..78c3f49e 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml @@ -11,3 +11,4 @@ Indicates when deployments with multiple replicas fail to specify inter-pod anti Specify anti-affinity in your pod specification to ensure that the orchestrator attempts to schedule replicas on different nodes. Using podAntiAffinity, specify a labelSelector that matches pods for the deployment, and set the topologyKey to kubernetes.io/hostname. Refer to https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity for details. """ +verbose_name = "no-anti-affinity" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml index 43b8a268..df535ebf 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml @@ -11,3 +11,4 @@ Indicates when objects use deprecated API versions under extensions/v1beta. Migrate using the apps/v1 API versions for the objects. Refer to https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/ for details. """ +verbose_name = "no-extensions-v1beta" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml index 6dec279c..5affdfe4 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml @@ -11,3 +11,4 @@ Indicates when containers fail to specify a liveness probe. Specify a liveness probe in your container. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ for details. """ +verbose_name = "no-liveness-probe" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml index 4c191fc6..9ed12b14 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml @@ -11,3 +11,4 @@ Alert on deployments that have no node affinity defined Specify node-affinity in your pod specification to ensure that the orchestrator attempts to schedule replicas on specified nodes. Refer to https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity for details. """ +verbose_name = "no-node-affinity" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml index 29951812..6ef09387 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml @@ -11,3 +11,4 @@ Indicates when containers are running without a read-only root filesystem. Set readOnlyRootFilesystem to true in the container securityContext. """ +verbose_name = "no-read-only-root-fs" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml index 9361a294..9a31437a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml @@ -11,3 +11,4 @@ Indicates when containers fail to specify a readiness probe. Specify a readiness probe in your container. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ for details. """ +verbose_name = "no-readiness-probe" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml index ae420614..ee99ca3f 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml @@ -11,3 +11,4 @@ Indicates when a deployment doesn't use a rolling update strategy ## Remediation Use a rolling update strategy to avoid service disruption during an update. A rolling update strategy allows for pods to be systematicaly replaced in a controlled fashion to ensure no service disruption. """ +verbose_name = "no-rolling-update-strategy" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml index 4ca8e020..cc11fef0 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml @@ -11,3 +11,4 @@ Indicates when pods reference a service account that is not found. Create the missing service account, or refer to an existing service account. """ +verbose_name = "non-existent-service-account" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml index c9df15f8..52b796e8 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml @@ -11,3 +11,4 @@ Alert on deployment-like objects that are not selected by any NetworkPolicy. Ensure pod does not accept unsafe traffic by isolating it with a NetworkPolicy. See https://cloud.redhat.com/blog/guide-to-kubernetes-ingress-network-policies for more details. """ +verbose_name = "non-isolated-pod" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml index 2d161ab0..18241cbb 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml @@ -11,3 +11,4 @@ Indicates when a PodDisruptionBudget has a maxUnavailable value that will always Change the PodDisruptionBudget to have maxUnavailable set to a value greater than 0. Refer to https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more information. """ +verbose_name = "pdb-max-unavailable" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml index 4d735fe7..b5430b61 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml @@ -11,3 +11,4 @@ Indicates when a PodDisruptionBudget sets a minAvailable value that will always Change the PodDisruptionBudget to have minAvailable set to a number lower than the number of replicas in the related deployment-like objects. Refer to https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more information. """ +verbose_name = "pdb-min-available" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml index 0db25761..b91a6f9e 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml @@ -11,3 +11,4 @@ Alert on containers of allowing privilege escalation that could gain more privil Ensure containers do not allow privilege escalation by setting allowPrivilegeEscalation=false, privileged=false and removing CAP_SYS_ADMIN capability. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details. """ +verbose_name = "privilege-escalation-container" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml index 3b593bda..27add470 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml @@ -10,3 +10,4 @@ Indicates when deployments have containers running in privileged mode. ## Remediation Do not run your container as privileged unless it is required. """ +verbose_name = "privileged-container" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml index bd6dcd78..6f06d21b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml @@ -10,3 +10,4 @@ Alert on deployments with privileged ports mapped in containers. ## Remediation Ensure privileged ports [0, 1024] are not mapped within containers. """ +verbose_name = "privileged-ports" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml index 00f2a501..40945e93 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml @@ -10,3 +10,4 @@ Indicates when a deployment reads secret from environment variables. CIS Benchma ## Remediation If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details. """ +verbose_name = "read-secret-from-env-var" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml index 6a86475e..d3ddc5a1 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml @@ -11,3 +11,4 @@ Indicates when objects do not have an email annotation with a valid email addres ## Remediation Add an email annotation to your object with the email address of the object's owner. """ +verbose_name = "required-annotation-email" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml index 595139d5..a7ee3941 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml @@ -11,3 +11,4 @@ Indicates when objects do not have an email annotation with an owner label. ## Remediation Add an email annotation to your object with the name of the object's owner. """ +verbose_name = "required-label-owner" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml index 2c859959..3a5fd70a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml @@ -10,3 +10,4 @@ Indicates when containers are running as the root user. ## Remediation Set `runAsUser` to a non-zero number and `runAsNonRoot` to `true` in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details. """ +verbose_name = "run-as-non-root" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml index 8f929efc..efba0906 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml @@ -10,3 +10,4 @@ Alert on deployments with sensitive host system directories mounted in container ## Remediation Ensure sensitive host system directories are not mounted in containers by removing those Volumes and VolumeMounts. """ +verbose_name = "sensitive-host-mounts" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml index 1abc8ba7..76013ab0 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml @@ -10,3 +10,4 @@ Indicates when deployments expose port 22, which is commonly reserved for SSH ac ## Remediation Ensure that non-SSH services are not using port 22. Confirm that any actual SSH servers have been vetted. """ +verbose_name = "ssh-port" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml index 0277f52a..b34cb62b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml @@ -10,3 +10,5 @@ Alert on deployments with unsafe /proc mount (procMount=Unmasked) that will bypa ## Remediation Ensure container does not unsafely exposes parts of /proc by setting procMount=Default. Unmasked ProcMount bypasses the default masking behavior of the container runtime. See https://kubernetes.io/docs/concepts/security/pod-security-standards/ for more details. +""" +verbose_name = "unsafe-proc-mount" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml index dc31a103..9a4afd20 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml @@ -11,3 +11,4 @@ Alert on deployments specifying unsafe sysctls that may lead to severe problems ## Remediation Ensure that containers do not allow unsafe allocation of system resources by removing unsafe kernel parameter configurations. For more details, see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ and https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime. """ +verbose_name = "unsafe-sysctls" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml index e788a782..75ad79c7 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml @@ -10,3 +10,4 @@ Indicates when containers do not have CPU requests and limits set. ## Remediation Set CPU requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details. """ +verbose_name = "unset-cpu-requirements" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml index 5f67156f..b6420405 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml @@ -11,3 +11,4 @@ Indicates when containers do not have memory requests and limits set. ## Remediation Set memory requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details. """ +verbose_name = "unset-memory-requirements" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml index e429c6ac..5ed7fc57 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml @@ -10,3 +10,4 @@ Indicates when a resource is deployed to the default namespace. CIS Benchmark 5. ## Remediation Create namespaces for objects in your deployment. """ +verbose_name = "use-namespace" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml index 6dda954a..2933c817 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml @@ -11,3 +11,4 @@ Indicate when a wildcard is used in Role or ClusterRole rules. CIS Benchmark 5.1 ## Remediation Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions. """ +verbose_name = "wildcard-in-rules" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml index a22cd5cb..ea97b6d5 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml @@ -10,3 +10,4 @@ Indicates when containers mount a host path as writable. ## Remediation Set containers to mount host paths as readOnly, if you need to access files on the host. """ +verbose_name = "writable-host-mount"