Merge pull request #218 from FairwindsOps/kind-exceptions

Checks exemption for kubehunter, polaris and goldilocks
FairwindsOps · Nov 8, 2019 · 7e35b03 · 7e35b03
2 parents 3d07ce8 + c8e4f76
commit 7e35b03
Show file tree

Hide file tree

Showing 2 changed files with 69 additions and 58 deletions.
diff --git a/examples/config.yaml b/examples/config.yaml
@@ -50,71 +50,81 @@ controllers_to_scan:
   - ReplicationControllers
 exemptions:
   - controllerNames:
-    - dns-controller
-    - datadog-datadog
-    - kube-flannel-ds
-    - kube2iam
-    - aws-iam-authenticator
-    - datadog
-    - kube2iam
+      - dns-controller
+      - datadog-datadog
+      - kube-flannel-ds
+      - kube2iam
+      - aws-iam-authenticator
+      - datadog
+      - kube2iam
     rules:
-    - hostNetworkSet
+      - hostNetworkSet
   - controllerNames:
-    - aws-iam-authenticator
-    - aws-cluster-autoscaler
-    - kube-state-metrics
-    - dns-controller
-    - external-dns
-    - dnsmasq
-    - autoscaler
-    - kubernetes-dashboard
-    - install-cni
-    - kube2iam
+      - aws-iam-authenticator
+      - aws-cluster-autoscaler
+      - kube-state-metrics
+      - dns-controller
+      - external-dns
+      - dnsmasq
+      - autoscaler
+      - kubernetes-dashboard
+      - install-cni
+      - kube2iam
     rules:
-    - readinessProbeMissing
-    - livenessProbeMissing
+      - readinessProbeMissing
+      - livenessProbeMissing
   - controllerNames:
-    - aws-iam-authenticator
-    - nginx-ingress-controller
-    - nginx-ingress-default-backend
-    - aws-cluster-autoscaler
-    - kube-state-metrics
-    - dns-controller
-    - external-dns
-    - kubedns
-    - dnsmasq
-    - autoscaler
-    - tiller
-    - kube2iam
+      - aws-iam-authenticator
+      - nginx-ingress-controller
+      - nginx-ingress-default-backend
+      - aws-cluster-autoscaler
+      - kube-state-metrics
+      - dns-controller
+      - external-dns
+      - kubedns
+      - dnsmasq
+      - autoscaler
+      - tiller
+      - kube2iam
     rules:
-    - runAsRootAllowed
+      - runAsRootAllowed
   - controllerNames:
-    - aws-iam-authenticator
-    - nginx-ingress-controller
-    - nginx-ingress-default-backend
-    - aws-cluster-autoscaler
-    - kube-state-metrics
-    - dns-controller
-    - external-dns
-    - kubedns
-    - dnsmasq
-    - autoscaler
-    - tiller
-    - kube2iam
+      - aws-iam-authenticator
+      - nginx-ingress-controller
+      - nginx-ingress-default-backend
+      - aws-cluster-autoscaler
+      - kube-state-metrics
+      - dns-controller
+      - external-dns
+      - kubedns
+      - dnsmasq
+      - autoscaler
+      - tiller
+      - kube2iam
     rules:
-    - notReadOnlyRootFileSystem
+      - notReadOnlyRootFileSystem
   - controllerNames:
-    - cert-manager
-    - dns-controller
-    - kubedns
-    - dnsmasq
-    - autoscaler
+      - cert-manager
+      - dns-controller
+      - kubedns
+      - dnsmasq
+      - autoscaler
     rules:
-    - cpuRequestsMissing
-    - cpuLimitsMissing
-    - memoryRequestsMissing
-    - memoryLimitsMissing
+      - cpuRequestsMissing
+      - cpuLimitsMissing
+      - memoryRequestsMissing
+      - memoryLimitsMissing
   - controllerNames:
-    - kube2iam
+      - kube2iam
     rules:
-    - runAsPrivileged
+      - runAsPrivileged
+  - controllerNames:
+      - kube-hunter
+    rules:
+      - hostPIDSet
+  - controllerNames:
+      - polaris
+      - kube-hunter
+      - goldilocks
+    rules:
+      - readOnlyRootFilesystem
diff --git a/pkg/config/exemptions.go b/pkg/config/exemptions.go
@@ -2,6 +2,7 @@ package config
 
 import (
 	"reflect"
+	"strings"
 )
 
 // IsActionable determines whether a check is actionable given the current configuration
@@ -21,7 +22,7 @@ func (conf *Configuration) IsActionable(subConf interface{}, ruleName, controlle
 				continue
 			}
 			for _, controller := range example.ControllerNames {
-				if controller == controllerName {
+				if strings.HasPrefix(controllerName, controller) {
 					return false
 				}
 			}