polaris.yaml

checks:
  # reliability
  deploymentMissingReplicas: ignore
  priorityClassNotSet: warning
  tagNotSpecified: danger
  pullPolicyNotAlways: warning
  readinessProbeMissing: warning
  livenessProbeMissing: warning
  metadataAndNameMismatched: ignore
  pdbDisruptionsIsZero: warning
  missingPodDisruptionBudget: ignore
  topologySpreadConstraint: warning

  # efficiency
  cpuRequestsMissing: warning
  cpuLimitsMissing: ignore
  memoryRequestsMissing: warning
  memoryLimitsMissing: warning

  # security
  automountServiceAccountToken: warning
  hostIPCSet: danger
  hostPIDSet: danger
  linuxHardening: warning
  missingNetworkPolicy: warning
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
  insecureCapabilities: warning
  hostNetworkSet: danger
  hostPortSet: warning
  tlsSettingsMissing: warning
  sensitiveContainerEnvVar: danger
  sensitiveConfigmapContent: danger
  clusterrolePodExecAttach: danger
  rolePodExecAttach: danger
  clusterrolebindingPodExecAttach: danger
  rolebindingClusterRolePodExecAttach: danger
  rolebindingRolePodExecAttach: danger
  clusterrolebindingClusterAdmin: danger
  rolebindingClusterAdminClusterRole: danger
  rolebindingClusterAdminRole: danger

exemptions:
  - controllerNames:
      - release-name-prometheus-node-exporter
      - release-name-prometheus-node-exporter
    rules:
      - hostPIDSet
      - hostNetworkSet
  - controllerNames:
      - release-name-vector-agent
    rules:
      - runAsRootAllowed
  - controllerNames:
      - release-name-test
      - release-name-prometheus-operator-admission-patch
      - release-name-prometheus-operator-admission-create
      - release-name-opentelemetry-operator-cert-manager # OpenTelemetry Operator chart test
      - release-name-opentelemetry-operator-metrics      # OpenTelemetry Operator chart test
      - release-name-opentelemetry-operator-webhook      # OpenTelemetry Operator chart test
      - release-name-opentelemetry-operator-cert-manager
      - release-name-opentelemetry-operator-metrics
      - release-name-opentelemetry-operator-webhook