Skip to content

Commit

Permalink
change message variable names
Browse files Browse the repository at this point in the history
  • Loading branch information
@rbren
rbren committed Apr 12, 2019
1 parent bcff5f1 commit 8326a49
Show file tree
Hide file tree
Showing 3 changed files with 107 additions and 107 deletions.
62 changes: 31 additions & 31 deletions pkg/validator/container.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,25 +64,25 @@ func (cv *ContainerValidation) validateResources(resConf *conf.Resources) {
res := cv.Container.Resources

if resConf.CPURequestsMissing.IsActionable() && res.Requests.Cpu().MilliValue() == 0 {
cv.addFailure(messages.CPURequestsMissing, resConf.CPURequestsMissing)
cv.addFailure(messages.CPURequestsFailure, resConf.CPURequestsMissing)
} else {
cv.validateResourceRange(messages.CPURequestsLabel, &resConf.CPURequestRanges, res.Requests.Cpu())
}

if resConf.CPULimitsMissing.IsActionable() && res.Limits.Cpu().MilliValue() == 0 {
cv.addFailure(messages.CPULimitsMissing, resConf.CPULimitsMissing)
cv.addFailure(messages.CPULimitsFailure, resConf.CPULimitsMissing)
} else {
cv.validateResourceRange(messages.CPULimitsLabel, &resConf.CPULimitRanges, res.Requests.Cpu())
}

if resConf.MemoryRequestsMissing.IsActionable() && res.Requests.Memory().MilliValue() == 0 {
cv.addFailure(messages.MemoryRequestsMissing, resConf.MemoryRequestsMissing)
cv.addFailure(messages.MemoryRequestsFailure, resConf.MemoryRequestsMissing)
} else {
cv.validateResourceRange(messages.MemoryRequestsLabel, &resConf.MemoryRequestRanges, res.Requests.Memory())
}

if resConf.MemoryLimitsMissing.IsActionable() && res.Limits.Memory().MilliValue() == 0 {
cv.addFailure(messages.MemoryLimitsMissing, resConf.MemoryLimitsMissing)
cv.addFailure(messages.MemoryLimitsFailure, resConf.MemoryLimitsMissing)
} else {
cv.validateResourceRange(messages.MemoryLimitsLabel, &resConf.MemoryLimitRanges, res.Limits.Memory())
}
Expand All @@ -95,32 +95,32 @@ func (cv *ContainerValidation) validateResourceRange(resourceName string, rangeC
errorBelow := rangeConf.Error.Below

if errorAbove != nil && errorAbove.MilliValue() < res.MilliValue() {
cv.addError(fmt.Sprintf(messages.ResourceAmountTooHigh, resourceName, errorAbove.String()))
cv.addError(fmt.Sprintf(messages.ResourceAmountTooHighFailure, resourceName, errorAbove.String()))
} else if warnAbove != nil && warnAbove.MilliValue() < res.MilliValue() {
cv.addWarning(fmt.Sprintf(messages.ResourceAmountTooHigh, resourceName, warnAbove.String()))
cv.addWarning(fmt.Sprintf(messages.ResourceAmountTooHighFailure, resourceName, warnAbove.String()))
} else if errorBelow != nil && errorBelow.MilliValue() > res.MilliValue() {
cv.addError(fmt.Sprintf(messages.ResourceAmountTooLow, resourceName, errorBelow.String()))
cv.addError(fmt.Sprintf(messages.ResourceAmountTooLowFailure, resourceName, errorBelow.String()))
} else if warnBelow != nil && warnBelow.MilliValue() > res.MilliValue() {
cv.addWarning(fmt.Sprintf(messages.ResourceAmountTooLow, resourceName, warnBelow.String()))
cv.addWarning(fmt.Sprintf(messages.ResourceAmountTooLowFailure, resourceName, warnBelow.String()))
} else {
cv.addSuccess(fmt.Sprintf(messages.ResourceAmountCorrect, resourceName))
cv.addSuccess(fmt.Sprintf(messages.ResourceAmountSuccess, resourceName))
}
}

func (cv *ContainerValidation) validateHealthChecks(conf *conf.HealthChecks) {
if conf.ReadinessProbeMissing.IsActionable() {
if cv.Container.ReadinessProbe == nil {
cv.addFailure(messages.ReadinessProbeNotConfigured, conf.ReadinessProbeMissing)
cv.addFailure(messages.ReadinessProbeFailure, conf.ReadinessProbeMissing)
} else {
cv.addSuccess(messages.ReadinessProbeConfigured)
cv.addSuccess(messages.ReadinessProbeSuccess)
}
}

if conf.LivenessProbeMissing.IsActionable() {
if cv.Container.LivenessProbe == nil {
cv.addFailure(messages.LivenessProbeNotConfigured, conf.LivenessProbeMissing)
cv.addFailure(messages.LivenessProbeFailure, conf.LivenessProbeMissing)
} else {
cv.addSuccess(messages.LivenessProbeConfigured)
cv.addSuccess(messages.LivenessProbeSuccess)
}
}
}
Expand All @@ -129,9 +129,9 @@ func (cv *ContainerValidation) validateImage(imageConf *conf.Images) {
if imageConf.TagNotSpecified.IsActionable() {
img := strings.Split(cv.Container.Image, ":")
if len(img) == 1 || img[1] == "latest" {
cv.addFailure(messages.ImageTagNotSpecified, imageConf.TagNotSpecified)
cv.addFailure(messages.ImageTagFailure, imageConf.TagNotSpecified)
} else {
cv.addSuccess(messages.ImageTagSpecified)
cv.addSuccess(messages.ImageTagSuccess)
}
}
}
Expand All @@ -147,9 +147,9 @@ func (cv *ContainerValidation) validateNetworking(networkConf *conf.Networking)
}

if hostPortSet {
cv.addFailure(messages.HostPortSet, networkConf.HostAliasSet)
cv.addFailure(messages.HostPortFailure, networkConf.HostAliasSet)
} else {
cv.addSuccess(messages.HostPortNotSet)
cv.addSuccess(messages.HostPortSuccess)
}
}
}
Expand All @@ -162,33 +162,33 @@ func (cv *ContainerValidation) validateSecurity(securityConf *conf.Security) {

if securityConf.RunAsRootAllowed.IsActionable() {
if securityContext.RunAsNonRoot == (*bool)(nil) || !*securityContext.RunAsNonRoot {
cv.addFailure(messages.RunAsRootEnabled, securityConf.RunAsRootAllowed)
cv.addFailure(messages.RunAsRootFailure, securityConf.RunAsRootAllowed)
} else {
cv.addSuccess(messages.RunAsRootDisabled)
cv.addSuccess(messages.RunAsRootSuccess)
}
}

if securityConf.RunAsPrivileged.IsActionable() {
if securityContext.Privileged == (*bool)(nil) || !*securityContext.Privileged {
cv.addSuccess(messages.RunAsPrivilegedDisabled)
cv.addSuccess(messages.RunAsPrivilegedSuccess)
} else {
cv.addFailure(messages.RunAsPrivilegedEnabled, securityConf.RunAsPrivileged)
cv.addFailure(messages.RunAsPrivilegedFailure, securityConf.RunAsPrivileged)
}
}

if securityConf.NotReadOnlyRootFileSystem.IsActionable() {
if securityContext.ReadOnlyRootFilesystem == (*bool)(nil) || !*securityContext.ReadOnlyRootFilesystem {
cv.addFailure(messages.WritableFilesystem, securityConf.NotReadOnlyRootFileSystem)
cv.addFailure(messages.ReadOnlyFilesystemFailure, securityConf.NotReadOnlyRootFileSystem)
} else {
cv.addSuccess(messages.ReadOnlyFilesystem)
cv.addSuccess(messages.ReadOnlyFilesystemSuccess)
}
}

if securityConf.PrivilegeEscalationAllowed.IsActionable() {
if securityContext.AllowPrivilegeEscalation == (*bool)(nil) || !*securityContext.AllowPrivilegeEscalation {
cv.addSuccess(messages.PrivilegeEscalationDisallowed)
cv.addSuccess(messages.PrivilegeEscalationSuccess)
} else {
cv.addFailure(messages.PrivilegeEscalationAllowed, securityConf.PrivilegeEscalationAllowed)
cv.addFailure(messages.PrivilegeEscalationFailure, securityConf.PrivilegeEscalationAllowed)
}
}

Expand All @@ -204,7 +204,7 @@ func (cv *ContainerValidation) validateSecurity(securityConf *conf.Security) {
if !hasSecurityError && !hasSecurityWarning &&
(hasSecurityCheck(securityConf.Capabilities.Error) ||
hasSecurityCheck(securityConf.Capabilities.Warning)) {
cv.addSuccess(messages.SecurityCapabilitiesOK)
cv.addSuccess(messages.SecurityCapabilitiesSuccess)
}
}

Expand All @@ -219,10 +219,10 @@ func (cv *ContainerValidation) validateCapabilities(confLists conf.SecurityCapab
intersectAdds := capIntersection(capabilities.Add, confLists.IfAnyAdded)
if len(intersectAdds) > 0 {
capsString := commaSeparatedCapabilities(intersectAdds)
cv.addFailure(fmt.Sprintf(messages.HasBadSecurityCapabilities, capsString), severity)
cv.addFailure(fmt.Sprintf(messages.SecurityCapabilitiesAddedFailure, capsString), severity)
everythingOK = false
} else if capContains(capabilities.Add, "ALL") {
cv.addFailure(fmt.Sprintf(messages.HasBadSecurityCapabilities, "ALL"), severity)
cv.addFailure(fmt.Sprintf(messages.SecurityCapabilitiesAddedFailure, "ALL"), severity)
everythingOK = false
}
}
Expand All @@ -231,10 +231,10 @@ func (cv *ContainerValidation) validateCapabilities(confLists conf.SecurityCapab
differentAdds := capDifference(capabilities.Add, confLists.IfAnyAddedBeyond)
if len(differentAdds) > 0 {
capsString := commaSeparatedCapabilities(differentAdds)
cv.addFailure(fmt.Sprintf(messages.HasBadSecurityCapabilities, capsString), severity)
cv.addFailure(fmt.Sprintf(messages.SecurityCapabilitiesAddedFailure, capsString), severity)
everythingOK = false
} else if capContains(capabilities.Add, "ALL") {
cv.addFailure(fmt.Sprintf(messages.HasBadSecurityCapabilities, "ALL"), severity)
cv.addFailure(fmt.Sprintf(messages.SecurityCapabilitiesAddedFailure, "ALL"), severity)
everythingOK = false
}
}
Expand All @@ -243,7 +243,7 @@ func (cv *ContainerValidation) validateCapabilities(confLists conf.SecurityCapab
missingDrops := capDifference(confLists.IfAnyNotDropped, capabilities.Drop)
if len(missingDrops) > 0 && !capContains(capabilities.Drop, "ALL") {
capsString := commaSeparatedCapabilities(missingDrops)
cv.addFailure(fmt.Sprintf(messages.SecurityCapabilitiesNotDropped, capsString), severity)
cv.addFailure(fmt.Sprintf(messages.SecurityCapabilitiesNotDroppedFailure, capsString), severity)
everythingOK = false
}
}
Expand Down
136 changes: 68 additions & 68 deletions pkg/validator/messages/messages.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,73 +10,73 @@ const (
// MemoryLimitsLabel label
MemoryLimitsLabel = "Memory limits"

// CPURequestsMissing message
CPURequestsMissing = "CPU requests should be set"
// CPULimitsMissing message
CPULimitsMissing = "CPU limits should be set"
// MemoryRequestsMissing message
MemoryRequestsMissing = "Memory requests should be set"
// MemoryLimitsMissing message
MemoryLimitsMissing = "Memory limits should be set"
// ResourceAmountTooHigh message
ResourceAmountTooHigh = "%s should be lower than %s"
// ResourceAmountTooLow message
ResourceAmountTooLow = "%s should be higher than %s"
// ResourceAmountCorrect message
ResourceAmountCorrect = "%s are within the expected range"
// ReadinessProbeNotConfigured message
ReadinessProbeNotConfigured = "Readiness probe should be configured"
// ReadinessProbeConfigured message
ReadinessProbeConfigured = "Readiness probe configured"
// LivenessProbeNotConfigured message
LivenessProbeNotConfigured = "Liveness probe should be configured"
// LivenessProbeConfigured message
LivenessProbeConfigured = "Liveness probe is configured"
// ImageTagNotSpecified message
ImageTagNotSpecified = "Image tag should be specified"
// ImageTagSpecified message
ImageTagSpecified = "Image tag is specified"
// HostPortSet message
HostPortSet = "Host port should not be configured"
// HostPortNotSet message
HostPortNotSet = "Host port is not configured"
// RunAsRootEnabled message
RunAsRootEnabled = "Should not be running as root"
// RunAsRootDisabled message
RunAsRootDisabled = "Not running as root"
// RunAsPrivilegedEnabled message
RunAsPrivilegedEnabled = "Should not be running as privileged"
// RunAsPrivilegedDisabled message
RunAsPrivilegedDisabled = "Not running as privileged"
// ReadOnlyFilesystem message
ReadOnlyFilesystem = "Filesystem is read only"
// WritableFilesystem message
WritableFilesystem = "Filesystem should be read only"
// PrivilegeEscalationAllowed message
PrivilegeEscalationAllowed = "Privilege escalation should not be allowed"
// PrivilegeEscalationDisallowed message
PrivilegeEscalationDisallowed = "Privilege escalation not allowed"
// HasBadSecurityCapabilities message
HasBadSecurityCapabilities = "The following security capabilities should not be added: %v"
// SecurityCapabilitiesOK message
SecurityCapabilitiesOK = "Security capabilities are within the configured limits"
// SecurityCapabilitiesNotDropped message
SecurityCapabilitiesNotDropped = "The following security capabilities should be dropped: %v"
// CPURequestsFailure message
CPURequestsFailure = "CPU requests should be set"
// CPULimitsFailure message
CPULimitsFailure = "CPU limits should be set"
// MemoryRequestsFailure message
MemoryRequestsFailure = "Memory requests should be set"
// MemoryLimitsFailure message
MemoryLimitsFailure = "Memory limits should be set"
// ResourceAmountTooHighFailure message
ResourceAmountTooHighFailure = "%s should be lower than %s"
// ResourceAmountTooLowFailure message
ResourceAmountTooLowFailure = "%s should be higher than %s"
// ResourceAmountSuccess message
ResourceAmountSuccess = "%s are within the expected range"
// ReadinessProbeFailure message
ReadinessProbeFailure = "Readiness probe should be configured"
// ReadinessProbeSuccess message
ReadinessProbeSuccess = "Readiness probe configured"
// LivenessProbeFailure message
LivenessProbeFailure = "Liveness probe should be configured"
// LivenessProbeSuccess message
LivenessProbeSuccess = "Liveness probe is configured"
// ImageTagFailure message
ImageTagFailure = "Image tag should be specified"
// ImageTagSuccess message
ImageTagSuccess = "Image tag is specified"
// HostPortFailure message
HostPortFailure = "Host port should not be configured"
// HostPortSuccess message
HostPortSuccess = "Host port is not configured"
// RunAsRootFailure message
RunAsRootFailure = "Should not be running as root"
// RunAsRootSuccess message
RunAsRootSuccess = "Not running as root"
// RunAsPrivilegedFailure message
RunAsPrivilegedFailure = "Should not be running as privileged"
// RunAsPrivilegedSuccess message
RunAsPrivilegedSuccess = "Not running as privileged"
// ReadOnlyFilesystemSuccess message
ReadOnlyFilesystemSuccess = "Filesystem is read only"
// ReadOnlyFilesystemFailure message
ReadOnlyFilesystemFailure = "Filesystem should be read only"
// PrivilegeEscalationFailure message
PrivilegeEscalationFailure = "Privilege escalation should not be allowed"
// PrivilegeEscalationSuccess message
PrivilegeEscalationSuccess = "Privilege escalation not allowed"
// SecurityCapabilitiesAddedFailure message
SecurityCapabilitiesAddedFailure = "The following security capabilities should not be added: %v"
// SecurityCapabilitiesNotDroppedFailure message
SecurityCapabilitiesNotDroppedFailure = "The following security capabilities should be dropped: %v"
// SecurityCapabilitiesSuccess message
SecurityCapabilitiesSuccess = "Security capabilities are within the configured limits"

// HostAliasConfigured message
HostAliasConfigured = "Host alias should not be configured"
// HostAliasNotConfigured message
HostAliasNotConfigured = "Host alias is not configured"
// HostIPCConfigured message
HostIPCConfigured = "Host IPC should not be configured"
// HostIPCNotConfigured message
HostIPCNotConfigured = "Host IPC is not configured"
// HostPIDConfigured message
HostPIDConfigured = "Host PID should not be configured"
// HostPIDNotConfigured message
HostPIDNotConfigured = "Host PID is not configured"
// HostNetworkConfigured message
HostNetworkConfigured = "Host network should not be configured"
// HostNetworkNotConfigured message
HostNetworkNotConfigured = "Host network is not configured"
// HostAliasFailure message
HostAliasFailure = "Host alias should not be configured"
// HostAliasSuccess message
HostAliasSuccess = "Host alias is not configured"
// HostIPCFailure message
HostIPCFailure = "Host IPC should not be configured"
// HostIPCSuccess message
HostIPCSuccess = "Host IPC is not configured"
// HostPIDFailure message
HostPIDFailure = "Host PID should not be configured"
// HostPIDSuccess message
HostPIDSuccess = "Host PID is not configured"
// HostNetworkFailure message
HostNetworkFailure = "Host network should not be configured"
// HostNetworkSuccess message
HostNetworkSuccess = "Host network is not configured"
)
16 changes: 8 additions & 8 deletions pkg/validator/pod.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,39 +88,39 @@ func (pv *PodValidation) validateHostAlias(networkConf *conf.Networking) {
}

if hostAliasSet {
pv.addFailure(messages.HostAliasConfigured, networkConf.HostAliasSet)
pv.addFailure(messages.HostAliasFailure, networkConf.HostAliasSet)
} else {
pv.addSuccess(messages.HostAliasNotConfigured)
pv.addSuccess(messages.HostAliasSuccess)
}
}
}

func (pv *PodValidation) validateHostIPC(networkConf *conf.Networking) {
if networkConf.HostIPCSet.IsActionable() {
if pv.Pod.HostIPC {
pv.addFailure(messages.HostIPCConfigured, networkConf.HostIPCSet)
pv.addFailure(messages.HostIPCFailure, networkConf.HostIPCSet)
} else {
pv.addSuccess(messages.HostIPCNotConfigured)
pv.addSuccess(messages.HostIPCSuccess)
}
}
}

func (pv *PodValidation) validateHostPID(networkConf *conf.Networking) {
if networkConf.HostPIDSet.IsActionable() {
if pv.Pod.HostPID {
pv.addFailure(messages.HostPIDConfigured, networkConf.HostPIDSet)
pv.addFailure(messages.HostPIDFailure, networkConf.HostPIDSet)
} else {
pv.addSuccess(messages.HostPIDNotConfigured)
pv.addSuccess(messages.HostPIDSuccess)
}
}
}

func (pv *PodValidation) validateHostNetwork(networkConf *conf.Networking) {
if networkConf.HostNetworkSet.IsActionable() {
if pv.Pod.HostNetwork {
pv.addFailure(messages.HostNetworkConfigured, networkConf.HostNetworkSet)
pv.addFailure(messages.HostNetworkFailure, networkConf.HostNetworkSet)
} else {
pv.addSuccess(messages.HostNetworkNotConfigured)
pv.addSuccess(messages.HostNetworkSuccess)
}
}
}

0 comments on commit 8326a49

Please sign in to comment.