From 04e73531edefb47ec59d5dd01d33d0a17c97333d Mon Sep 17 00:00:00 2001 From: Srijan Saurav Date: Thu, 26 Oct 2023 15:46:19 +0530 Subject: [PATCH 1/3] chore: improve kube-linter issue titles --- .../kube-linter/.deepsource/issues/KUBELIN-W1001.toml | 2 +- .../kube-linter/.deepsource/issues/KUBELIN-W1002.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1003.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1004.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1005.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1006.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1007.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1008.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1009.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1010.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1011.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1012.toml | 9 +++++---- .../kube-linter/.deepsource/issues/KUBELIN-W1013.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1014.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1015.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1016.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1017.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1018.toml | 3 +-- .../kube-linter/.deepsource/issues/KUBELIN-W1019.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1020.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1021.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1022.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1023.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1024.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1025.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1026.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1027.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1028.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1029.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1030.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1031.toml | 2 +- .../kube-linter/.deepsource/issues/KUBELIN-W1032.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1033.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1034.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1035.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1036.toml | 7 ++++--- .../kube-linter/.deepsource/issues/KUBELIN-W1037.toml | 1 - .../kube-linter/.deepsource/issues/KUBELIN-W1038.toml | 1 - .../kube-linter/.deepsource/issues/KUBELIN-W1039.toml | 1 - .../kube-linter/.deepsource/issues/KUBELIN-W1040.toml | 2 +- .../kube-linter/.deepsource/issues/KUBELIN-W1041.toml | 2 +- .../kube-linter/.deepsource/issues/KUBELIN-W1042.toml | 7 +++---- .../kube-linter/.deepsource/issues/KUBELIN-W1043.toml | 3 +-- .../kube-linter/.deepsource/issues/KUBELIN-W1044.toml | 3 +-- .../kube-linter/.deepsource/issues/KUBELIN-W1045.toml | 3 +-- .../kube-linter/.deepsource/issues/KUBELIN-W1046.toml | 4 ++-- .../kube-linter/.deepsource/issues/KUBELIN-W1047.toml | 3 +-- .../kube-linter/.deepsource/issues/KUBELIN-W1048.toml | 2 +- .../kube-linter/.deepsource/issues/KUBELIN-W1049.toml | 5 ++--- .../kube-linter/.deepsource/issues/KUBELIN-W1050.toml | 2 +- .../kube-linter/.deepsource/issues/KUBELIN-W1051.toml | 3 +-- 51 files changed, 152 insertions(+), 130 deletions(-) diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml index 514e143d..42e2e552 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1001.toml @@ -1,5 +1,5 @@ -title = "access-to-create-pods" +title = "Unrestricted access to create pods" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml index 55e00d6f..a5f4ee6c 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml @@ -1,8 +1,8 @@ - -title = "access-to-secrets" +title = "Unrestricted access to Secrets" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. CIS Benchmark 5.1.2: Access to secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation. @@ -10,4 +10,5 @@ Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. CIS ## Remediation Where possible, remove get, list and watch access to secret objects in the cluster. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml index 64b83812..c368bbfe 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml @@ -1,8 +1,8 @@ - -title = "cluster-admin-role-binding" +title = "`cluster admin` role should be used only where required" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ CIS Benchmark 5.1.1 Ensure that the cluster-admin role is only used where required @@ -10,4 +10,5 @@ CIS Benchmark 5.1.1 Ensure that the cluster-admin role is only used where requir ## Remediation Create and assign a separate role that has access to specific resources/actions needed for the service account. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml index f5d180c4..5df3153b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml @@ -1,8 +1,8 @@ - -title = "dangling-horizontalpodautoscaler" +title = "Missing `scaleTargetRef` in `HorizontalPodAutoscaler`" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when HorizontalPodAutoscalers target a missing resource. @@ -10,4 +10,5 @@ Indicates when HorizontalPodAutoscalers target a missing resource. ## Remediation Confirm that your HorizontalPodAutoscaler's scaleTargetRef correctly matches one of your deployments. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml index 0311a71b..0e21d4e4 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml @@ -1,8 +1,8 @@ - -title = "dangling-ingress" +title = "Ingress without associated services" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when ingress do not have any associated services. @@ -10,4 +10,5 @@ Indicates when ingress do not have any associated services. ## Remediation Confirm that your ingress's backend correctly matches the name and port on one of your services. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml index 45967185..b6b29a0a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml @@ -1,8 +1,8 @@ - -title = "dangling-networkpolicy" +title = "NetworkPolicy without associated deployments" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when networkpolicies do not have any associated deployments. @@ -10,4 +10,5 @@ Indicates when networkpolicies do not have any associated deployments. ## Remediation Confirm that your networkPolicy's podselector correctly matches the labels on one of your deployments. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml index d1a9ceaa..1bf2d437 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml @@ -1,8 +1,8 @@ - -title = "dangling-networkpolicypeer-podselector" +title = "Misconfigured NetworkPolicyPeer podSelectors" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when NetworkPolicyPeer in Egress/Ingress rules -in the Spec of NetworkPolicy- do not have any associated deployments. Applied on peer specified with podSelectors only. @@ -10,4 +10,5 @@ Indicates when NetworkPolicyPeer in Egress/Ingress rules -in the Spec of Network ## Remediation Confirm that your NetworkPolicy's Ingress/Egress peer's podselector correctly matches the labels on one of your deployments. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml index bf04c48b..9547ec56 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml @@ -1,8 +1,8 @@ - -title = "dangling-service" +title = "Missing deployment for service" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when services do not have any associated deployments. @@ -10,4 +10,5 @@ Indicates when services do not have any associated deployments. ## Remediation Confirm that your service's selector correctly matches the labels on one of your deployments. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml index c8a7b813..2be3e1e5 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml @@ -1,8 +1,8 @@ - -title = "default-service-account" +title = "Pods using default service account" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when pods use the default service account. @@ -10,4 +10,5 @@ Indicates when pods use the default service account. ## Remediation Create a dedicated service account for your pod. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml index 0293329e..7e95beaa 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml @@ -1,8 +1,8 @@ - -title = "deprecated-service-account-field" +title = "Use of deprecated `serviceAccount` field in deployments" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when deployments use the deprecated serviceAccount field. @@ -10,4 +10,5 @@ Indicates when deployments use the deprecated serviceAccount field. ## Remediation Use the serviceAccountName field instead. If you must specify serviceAccount, ensure values for serviceAccount and serviceAccountName match. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml index ebe3b0f9..71a66873 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml @@ -1,8 +1,8 @@ - -title = "dnsconfig-options" +title = "Missing `dnsConfig` options in deployments" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on deployments that have no specified dnsConfig options @@ -10,4 +10,5 @@ Alert on deployments that have no specified dnsConfig options ## Remediation Specify dnsconfig options in your Pod specification to ensure the expected DNS setting on the Pod. Refer to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml index b833b879..0e10038a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml @@ -1,13 +1,14 @@ - -title = "docker-sock" +title = "`docker.sock` volume mounted in containers" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ -Alert on deployments with docker.sock mounted in containers. +Alert on deployments with docker.sock mounted in containers. ## Remediation Ensure the Docker socket is not mounted inside any containers by removing the associated Volume and VolumeMount in deployment yaml specification. If the Docker socket is mounted inside a container it could allow processes running within the container to execute Docker commands which would effectively allow for full control of the host. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml index 402c40cb..63b46fee 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml @@ -1,8 +1,8 @@ - -title = "drop-net-raw-capability" +title = "Container with `NET_RAW` capability" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when containers do not drop NET_RAW capability @@ -10,4 +10,5 @@ Indicates when containers do not drop NET_RAW capability ## Remediation NET_RAW makes it so that an application within the container is able to craft raw packets, use raw sockets, and bind to any address. Remove this capability in the containers under containers security contexts. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml index 9a393edb..436e580e 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml @@ -1,8 +1,8 @@ - -title = "duplicate-env-var" +title = "Duplicate env vars dedicated" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Check that duplicate named env vars aren't passed to a deployment like. @@ -10,4 +10,5 @@ Check that duplicate named env vars aren't passed to a deployment like. ## Remediation Confirm that your DeploymentLike doesn't have duplicate env vars names. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml index 33aabef1..b30febfa 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml @@ -1,13 +1,14 @@ - -title = "env-var-secret" +title = "Insecure use of secrets in environment variables" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when objects use a secret in an environment variable. ## Remediation + Do not use raw secrets in environment variables. Instead, either mount the secret as a file or use a secretKeyRef. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets for details. """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml index a4ec9971..9d1630d8 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml @@ -1,8 +1,8 @@ - -title = "exposed-services" +title = "Forbidden service types for exposed services" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on services for forbidden types @@ -10,4 +10,5 @@ Alert on services for forbidden types ## Remediation Ensure containers are not exposed through a forbidden service type such as NodePort or LoadBalancer. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml index ab96130a..bc7eaf8a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml @@ -1,8 +1,8 @@ - -title = "host-ipc" +title = "Sharing host's IPC namespace" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on pods/deployment-likes with sharing host's IPC namespace @@ -10,4 +10,5 @@ Alert on pods/deployment-likes with sharing host's IPC namespace ## Remediation Ensure the host's IPC namespace is not shared. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml index 8b6d78dc..6a7b40be 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1018.toml @@ -1,5 +1,4 @@ - -title = "host-network" +title = "Pods sharing host's network namespace" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml index 8755d24e..26509c14 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml @@ -1,8 +1,8 @@ - -title = "host-pid" +title = "Sharing host's process namespace" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on pods/deployment-likes with sharing host's process namespace @@ -10,4 +10,5 @@ Alert on pods/deployment-likes with sharing host's process namespace ## Remediation Ensure the host's process namespace is not shared. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml index 345ed443..248045bb 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml @@ -1,8 +1,8 @@ - -title = "hpa-minimum-three-replicas" +title = "Insufficient `minReplicas` in `HorizontalPodAutoscaler`" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas @@ -10,4 +10,5 @@ Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas ## Remediation Increase the number of replicas in the HorizontalPodAutoscaler to at least three to increase fault tolerance. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml index 099154fd..a673b960 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml @@ -1,8 +1,8 @@ - -title = "invalid-target-ports" +title = "Invalid port names in deployments or services" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when deployments or services are using port names that are violating specifications. @@ -10,4 +10,5 @@ Indicates when deployments or services are using port names that are violating s ## Remediation Ensure that port naming is in conjunction with the specification. For more information, please look at the Kubernetes Service specification on this page: https://kubernetes.io/docs/reference/_print/#ServiceSpec. And additional information about IANA Service naming can be found on the following page: https://www.rfc-editor.org/rfc/rfc6335.html#section-5.1. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml index 4a172075..d75cbcd0 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml @@ -1,8 +1,8 @@ - -title = "latest-tag" +title = "Invalid container image" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when a deployment-like object is running a container with an invalid container image @@ -10,4 +10,5 @@ Indicates when a deployment-like object is running a container with an invalid c ## Remediation Use a container image with a specific tag other than latest. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml index b6788d41..02b3adc1 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml @@ -1,8 +1,8 @@ - -title = "minimum-three-replicas" +title = "Insufficient number of replicas" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when a deployment uses less than three replicas @@ -10,4 +10,5 @@ Indicates when a deployment uses less than three replicas ## Remediation Increase the number of replicas in the deployment to at least three to increase the fault tolerance of the deployment. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml index 4ee17c2d..55898c63 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml @@ -1,8 +1,8 @@ - -title = "mismatching-selector" +title = "Mismatching deployment selector and pod template labels" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when deployment selectors fail to match the pod template labels. @@ -10,4 +10,5 @@ Indicates when deployment selectors fail to match the pod template labels. ## Remediation Confirm that your deployment selector correctly matches the labels in its pod template. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml index 6e45a50f..d31e9a0f 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml @@ -1,8 +1,8 @@ - -title = "no-anti-affinity" +title = "Missing inter-pod anti-affinity in deployments with multiple replicas" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when deployments with multiple replicas fail to specify inter-pod anti-affinity, to ensure that the orchestrator attempts to schedule replicas on different nodes. @@ -10,4 +10,5 @@ Indicates when deployments with multiple replicas fail to specify inter-pod anti ## Remediation Specify anti-affinity in your pod specification to ensure that the orchestrator attempts to schedule replicas on different nodes. Using podAntiAffinity, specify a labelSelector that matches pods for the deployment, and set the topologyKey to kubernetes.io/hostname. Refer to https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml index aea5f008..733b27b9 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml @@ -1,8 +1,8 @@ - -title = "no-extensions-v1beta" +title = "Deprecated API versions used under `extensions/v1beta`" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when objects use deprecated API versions under extensions/v1beta. @@ -10,4 +10,5 @@ Indicates when objects use deprecated API versions under extensions/v1beta. ## Remediation Migrate using the apps/v1 API versions for the objects. Refer to https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/ for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml index 15a2fdd4..b0130803 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml @@ -1,8 +1,8 @@ - -title = "no-liveness-probe" +title = "Missing liveness probe in containers" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when containers fail to specify a liveness probe. @@ -10,4 +10,5 @@ Indicates when containers fail to specify a liveness probe. ## Remediation Specify a liveness probe in your container. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml index 6e80f34e..33711f31 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml @@ -1,8 +1,8 @@ - -title = "no-node-affinity" +title = "Missing node affinity in deployments" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on deployments that have no node affinity defined @@ -10,4 +10,5 @@ Alert on deployments that have no node affinity defined ## Remediation Specify node-affinity in your pod specification to ensure that the orchestrator attempts to schedule replicas on specified nodes. Refer to https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml index 1cbfaf32..517d84b7 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml @@ -1,8 +1,8 @@ - -title = "no-read-only-root-fs" +title = "Containers running without a read-only root filesystem" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when containers are running without a read-only root filesystem. @@ -10,4 +10,5 @@ Indicates when containers are running without a read-only root filesystem. ## Remediation Set readOnlyRootFilesystem to true in the container securityContext. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml index e996a0ac..79fcd9fe 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml @@ -1,8 +1,8 @@ - -title = "no-readiness-probe" +title = "Missing readiness probe" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when containers fail to specify a readiness probe. @@ -10,4 +10,5 @@ Indicates when containers fail to specify a readiness probe. ## Remediation Specify a readiness probe in your container. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ for details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml index 5529dd2d..ae420614 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1031.toml @@ -1,5 +1,5 @@ -title = "no-rolling-update-strategy" +title = "Missing rolling update strategy" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml index 9d8f2c05..f937760d 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml @@ -1,8 +1,8 @@ - -title = "non-existent-service-account" +title = "Invalid service account reference" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when pods reference a service account that is not found. @@ -10,4 +10,5 @@ Indicates when pods reference a service account that is not found. ## Remediation Create the missing service account, or refer to an existing service account. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml index 8f131b40..52f17a7f 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml @@ -1,8 +1,8 @@ - -title = "non-isolated-pod" +title = "Missing NetworkPolicy for deployment-like objects" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on deployment-like objects that are not selected by any NetworkPolicy. @@ -10,4 +10,5 @@ Alert on deployment-like objects that are not selected by any NetworkPolicy. ## Remediation Ensure pod does not accept unsafe traffic by isolating it with a NetworkPolicy. See https://cloud.redhat.com/blog/guide-to-kubernetes-ingress-network-policies for more details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml index 26e96b5f..65be893b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml @@ -1,8 +1,8 @@ - -title = "pdb-max-unavailable" +title = "`PodDisruptionBudget` with `maxUnavailable` value preventing disruptions" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when a PodDisruptionBudget has a maxUnavailable value that will always prevent disruptions of pods created by related deployment-like objects. @@ -10,4 +10,5 @@ Indicates when a PodDisruptionBudget has a maxUnavailable value that will always ## Remediation Change the PodDisruptionBudget to have maxUnavailable set to a value greater than 0. Refer to https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more information. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml index 09555323..3bdd2cac 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml @@ -1,8 +1,8 @@ - -title = "pdb-min-available" +title = "Misconfigured `minAvailable` in `PodDisruptionBudget`" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Indicates when a PodDisruptionBudget sets a minAvailable value that will always prevent disruptions of pods created by related deployment-like objects. @@ -10,4 +10,5 @@ Indicates when a PodDisruptionBudget sets a minAvailable value that will always ## Remediation Change the PodDisruptionBudget to have minAvailable set to a number lower than the number of replicas in the related deployment-like objects. Refer to https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more information. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml index 2ea5b918..b40a9bd8 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml @@ -1,8 +1,8 @@ - -title = "privilege-escalation-container" +title = "Container allows privilege escalation" +weight = 70 severity = "major" category = "antipattern" -weight = 70 +verbose_name = "" description = """ Alert on containers of allowing privilege escalation that could gain more privileges than its parent process. @@ -10,4 +10,5 @@ Alert on containers of allowing privilege escalation that could gain more privil ## Remediation Ensure containers do not allow privilege escalation by setting allowPrivilegeEscalation=false, privileged=false and removing CAP_SYS_ADMIN capability. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details. + """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml index 3de10365..34c27496 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml @@ -1,4 +1,3 @@ - title = "privileged-container" severity = "major" category = "antipattern" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml index 42ef6c90..b40b7419 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml @@ -1,4 +1,3 @@ - title = "privileged-ports" severity = "major" category = "antipattern" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml index 26cc670f..21b3a41b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml @@ -1,4 +1,3 @@ - title = "read-secret-from-env-var" severity = "major" category = "antipattern" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml index 6cec6a35..6a86475e 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1040.toml @@ -1,5 +1,5 @@ -title = "required-annotation-email" +title = "Invalid email annotation" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml index f916f5e7..595139d5 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1041.toml @@ -1,5 +1,5 @@ -title = "required-label-owner" +title = "Owner object without email annotation" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml index 71c5c8d0..2c859959 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1042.toml @@ -1,13 +1,12 @@ - -title = "run-as-non-root" +title = "Containers running as root" severity = "major" category = "antipattern" weight = 70 description = """ -Indicates when containers are not set to runAsNonRoot. +Indicates when containers are running as the root user. ## Remediation -Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details. +Set `runAsUser` to a non-zero number and `runAsNonRoot` to `true` in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details. """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml index d50beb96..8f929efc 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1043.toml @@ -1,5 +1,4 @@ - -title = "sensitive-host-mounts" +title = "Sensitive host system directories mounted in containers" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml index 96daf6dc..1abc8ba7 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1044.toml @@ -1,5 +1,4 @@ - -title = "ssh-port" +title = "Non-SSH services using port 22" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml index cb913e92..0277f52a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1045.toml @@ -1,5 +1,5 @@ -title = "unsafe-proc-mount" +title = "Containers with unsafe `/proc` mount" severity = "major" category = "antipattern" weight = 70 @@ -10,4 +10,3 @@ Alert on deployments with unsafe /proc mount (procMount=Unmasked) that will bypa ## Remediation Ensure container does not unsafely exposes parts of /proc by setting procMount=Default. Unmasked ProcMount bypasses the default masking behavior of the container runtime. See https://kubernetes.io/docs/concepts/security/pod-security-standards/ for more details. -""" diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml index f47437a2..dc31a103 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1046.toml @@ -1,5 +1,5 @@ -title = "unsafe-sysctls" +title = "Unsafe kernel parameters configured in containers" severity = "major" category = "antipattern" weight = 70 @@ -9,5 +9,5 @@ Alert on deployments specifying unsafe sysctls that may lead to severe problems ## Remediation -Ensure container does not allow unsafe allocation of system resources by removing unsafe sysctls configurations. For more details see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime. +Ensure that containers do not allow unsafe allocation of system resources by removing unsafe kernel parameter configurations. For more details, see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ and https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime. """ diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml index 724dd10e..e788a782 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1047.toml @@ -1,5 +1,4 @@ - -title = "unset-cpu-requirements" +title = "Containers without CPU resource requests and limits" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml index 96d4aea5..5f67156f 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1048.toml @@ -1,5 +1,5 @@ -title = "unset-memory-requirements" +title = "Containers without memory resource requests and limits" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml index 215ed943..e429c6ac 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1049.toml @@ -1,10 +1,9 @@ - -title = "use-namespace" +title = "Resources deployed to default namespace" severity = "major" category = "antipattern" weight = 70 description = """ -Indicates when a resource is deployed to the default namespace. CIS Benchmark 5.7.1: Create administrative boundaries between resources using namespaces. CIS Benchmark 5.7.4: The default namespace should not be used. +Indicates when a resource is deployed to the default namespace. CIS Benchmark 5.7.1: Create administrative boundaries between resources using namespaces. CIS Benchmark 5.7.4: The default namespace should not be used. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml index 64fb8bb3..6dda954a 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1050.toml @@ -1,5 +1,5 @@ -title = "wildcard-in-rules" +title = "Use of wildcards in `Role` or `ClusterRole` rules" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml index 8863c266..a22cd5cb 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1051.toml @@ -1,5 +1,4 @@ - -title = "writable-host-mount" +title = "Containers with writable host path mounts" severity = "major" category = "antipattern" weight = 70 From 10b5fc8740747daa8fd280c2e10c1f8788ff6f05 Mon Sep 17 00:00:00 2001 From: Srijan Saurav Date: Thu, 26 Oct 2023 16:27:03 +0530 Subject: [PATCH 2/3] chore: update readme and add ci snippet for kube-linter --- README.md | 42 ++++++++++++++++ analyzers/kube-linter/CI/github-actions.yaml | 50 ++++++++++++++++++++ 2 files changed, 92 insertions(+) create mode 100644 analyzers/kube-linter/CI/github-actions.yaml diff --git a/README.md b/README.md index 328507a1..15c841a1 100644 --- a/README.md +++ b/README.md @@ -14,6 +14,48 @@ Hub of all open-sourced third-party static analyzers supported by DeepSource. ## Development Guide +### Adding a new analyzer + +To add a new analyzer, create a new directory with the analyzer shortcode under the `analyzers` folder. +The following are very important to sync analyzers with DeepSource: + +1. `.deepsource/analyzer` directory under `analyzer/` directory. + + a. It should contain an `analyzer.toml` file with the following fields: + + - `category`: One of "conf" (Configuration-as-code), "lang" (Language), "covg" (Coverage), "sec" (security) + - `name`: Name for the Analyzer. Analyzer on DeepSource dashboard and the checks on VCS would show up as this name. + - `shortcode`: shortcode for the analyzer. This should be same as of the analyzer's directory name. This is the name of the analyzer in the `.deepsource.toml` file. + - `status`: "active" if analyzer should be live else "draft". + - `tool_latest_version`: Analyzer's latest version for which issues are synced on DeepSource. + - `description`: A readable descrioption for this analyzer. + + b. It should contain am `example.toml` file with a snippet to activate this analyzer in `.deepsource.toml` config. + + c. `logo.svg` file. + + +2. `.deepsource/issues` directory. This contains all issues detected by the analyzer. Each issue's filemane should be `.toml` or `` with the following fields: + + - `title`: Title of the issue. No periods are allowed in the title. + - `category`: Category of the issue. Allowed values are: "bug-risk", "doc", "style", "antipattern", "coverage", "security", "performance", "typecheck", and, "secrets". + - `description`: Description of the issue. This showld explain the problem in as much detail as possible with possible remediation steps. + - `severity`: Severity of the issue. Allowed values are: "critical", "major" and "minor". + +3. `CI` directory: + +Put example configs of all CIs under this directory. These worlflow / CI configs should run the analyzer, create a sarif report and send it to DeepSource. +Each file should be names as `.`. Example: `github.yml`, `circleci.yml`, etc.` + +4. `utils` directory: + +It should contain all the utilities required for the analyzer like issue genrator, issue-map, etc. +For example, please check out `analyzers/kube-linter/utils`. + +### Syncing analyzers and their issues with DeepSource + +Push a tag after merging all the changes to the default (master) branch. The `Sync community analyzers` workflow triggers on tag pushes matching `v*` and will sync the analyzers and their issues with DeepSource. + ### Running tests - Create and activate a virtual environment diff --git a/analyzers/kube-linter/CI/github-actions.yaml b/analyzers/kube-linter/CI/github-actions.yaml new file mode 100644 index 00000000..af1d817f --- /dev/null +++ b/analyzers/kube-linter/CI/github-actions.yaml @@ -0,0 +1,50 @@ +# A copy-paste Github Actions config to run kube-linter and report the artifact to DeepSource +name: Scan with kube-linter + +on: + # Note that both `push` and `pull_request` triggers should be present for GitHub to consistently present kube-linter + # SARIF reports. + push: + branches: [ main, master ] + pull_request: + +jobs: + scan: + runs-on: ubuntu-latest + env: + DEEPSOURCE_DSN: ${{ secrets.DEEPSOURCE_DSN }} + steps: + - uses: actions/checkout@v3 + with: + ref: ${{ github.event.pull_request.head.sha }} + + - name: Scan files with kube-linter + uses: stackrox/kube-linter-action@v1.0.4 + id: kube-linter-action-scan + with: + # Adjust this directory to the location where your kubernetes resources and helm charts are located. + directory: . + # Adjust this to the location of kube-linter config you're using, or remove the setting if you'd like to use + # the default config. + # config: sample/.kube-linter-config.yaml + # The following two settings make kube-linter produce scan analysis in SARIF format + format: sarif + output-file: ./kube-linter.sarif + # The following line prevents aborting the workflow immediately in case your files fail kube-linter checks. + # This allows the following upload-sarif action to still upload the results. + continue-on-error: true + + - name: Upload SARIF report files to DeepSource + run: | + # Install the CLI + curl https://deepsource.io/cli | sh + + # Send the report to DeepSource + ./bin/deepsource report --analyzer kube-linter --value-file ./kube-linter.sarif + + # Ensure the workflow eventually fails if files did not pass kube-linter checks. + - name: Verify kube-linter-action succeeded + shell: bash + run: | + echo "If this step fails, kube-linter found issues. Check the output of the scan step above." + [[ "${{ steps.kube-linter-action-scan.outcome }}" == "success" ]] From a6698522c9c6e3b3a63f7e0c5ec4a50bce045ddd Mon Sep 17 00:00:00 2001 From: Srijan Saurav Date: Thu, 26 Oct 2023 17:09:57 +0530 Subject: [PATCH 3/3] more fixes --- analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml | 1 - analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml | 2 +- analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml | 4 ++-- analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml | 2 +- 36 files changed, 4 insertions(+), 37 deletions(-) diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml index a5f4ee6c..ad6bd686 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1002.toml @@ -2,7 +2,6 @@ title = "Unrestricted access to Secrets" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when a subject (Group/User/ServiceAccount) has access to Secrets. CIS Benchmark 5.1.2: Access to secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml index c368bbfe..4d8e9d18 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1003.toml @@ -2,7 +2,6 @@ title = "`cluster admin` role should be used only where required" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ CIS Benchmark 5.1.1 Ensure that the cluster-admin role is only used where required diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml index 5df3153b..9126ec18 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1004.toml @@ -2,7 +2,6 @@ title = "Missing `scaleTargetRef` in `HorizontalPodAutoscaler`" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when HorizontalPodAutoscalers target a missing resource. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml index 0e21d4e4..501dd5f3 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1005.toml @@ -2,7 +2,6 @@ title = "Ingress without associated services" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when ingress do not have any associated services. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml index b6b29a0a..f876e3ad 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1006.toml @@ -2,7 +2,6 @@ title = "NetworkPolicy without associated deployments" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when networkpolicies do not have any associated deployments. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml index 1bf2d437..af8bed07 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1007.toml @@ -2,7 +2,6 @@ title = "Misconfigured NetworkPolicyPeer podSelectors" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when NetworkPolicyPeer in Egress/Ingress rules -in the Spec of NetworkPolicy- do not have any associated deployments. Applied on peer specified with podSelectors only. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml index 9547ec56..497b4f54 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1008.toml @@ -2,7 +2,6 @@ title = "Missing deployment for service" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when services do not have any associated deployments. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml index 2be3e1e5..591a86a4 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1009.toml @@ -2,7 +2,6 @@ title = "Pods using default service account" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when pods use the default service account. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml index 7e95beaa..1529009b 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1010.toml @@ -2,7 +2,6 @@ title = "Use of deprecated `serviceAccount` field in deployments" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when deployments use the deprecated serviceAccount field. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml index 71a66873..264db205 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1011.toml @@ -2,7 +2,6 @@ title = "Missing `dnsConfig` options in deployments" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on deployments that have no specified dnsConfig options diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml index 0e10038a..04318ed5 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1012.toml @@ -2,7 +2,6 @@ title = "`docker.sock` volume mounted in containers" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on deployments with docker.sock mounted in containers. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml index 63b46fee..c3cc2380 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1013.toml @@ -2,7 +2,6 @@ title = "Container with `NET_RAW` capability" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when containers do not drop NET_RAW capability diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml index 436e580e..b92463bf 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1014.toml @@ -2,7 +2,6 @@ title = "Duplicate env vars dedicated" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Check that duplicate named env vars aren't passed to a deployment like. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml index b30febfa..e15d8d90 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1015.toml @@ -2,7 +2,6 @@ title = "Insecure use of secrets in environment variables" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when objects use a secret in an environment variable. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml index 9d1630d8..051304de 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1016.toml @@ -2,7 +2,6 @@ title = "Forbidden service types for exposed services" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on services for forbidden types diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml index bc7eaf8a..5437daa1 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1017.toml @@ -2,7 +2,6 @@ title = "Sharing host's IPC namespace" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on pods/deployment-likes with sharing host's IPC namespace diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml index 26509c14..0d9ea7c4 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1019.toml @@ -2,7 +2,6 @@ title = "Sharing host's process namespace" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on pods/deployment-likes with sharing host's process namespace diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml index 248045bb..4e95a538 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1020.toml @@ -2,7 +2,6 @@ title = "Insufficient `minReplicas` in `HorizontalPodAutoscaler`" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when a HorizontalPodAutoscaler specifies less than three minReplicas diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml index a673b960..666fec7e 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1021.toml @@ -2,7 +2,6 @@ title = "Invalid port names in deployments or services" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when deployments or services are using port names that are violating specifications. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml index d75cbcd0..255100f7 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1022.toml @@ -2,7 +2,6 @@ title = "Invalid container image" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when a deployment-like object is running a container with an invalid container image diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml index 02b3adc1..9b6a1149 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1023.toml @@ -2,7 +2,6 @@ title = "Insufficient number of replicas" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when a deployment uses less than three replicas diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml index 55898c63..a6c078ef 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1024.toml @@ -2,7 +2,6 @@ title = "Mismatching deployment selector and pod template labels" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when deployment selectors fail to match the pod template labels. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml index d31e9a0f..ebd54b07 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1025.toml @@ -2,7 +2,6 @@ title = "Missing inter-pod anti-affinity in deployments with multiple replicas" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when deployments with multiple replicas fail to specify inter-pod anti-affinity, to ensure that the orchestrator attempts to schedule replicas on different nodes. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml index 733b27b9..43b8a268 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1026.toml @@ -2,7 +2,6 @@ title = "Deprecated API versions used under `extensions/v1beta`" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when objects use deprecated API versions under extensions/v1beta. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml index b0130803..6dec279c 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1027.toml @@ -2,7 +2,6 @@ title = "Missing liveness probe in containers" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when containers fail to specify a liveness probe. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml index 33711f31..4c191fc6 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1028.toml @@ -2,7 +2,6 @@ title = "Missing node affinity in deployments" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on deployments that have no node affinity defined diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml index 517d84b7..29951812 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1029.toml @@ -2,7 +2,6 @@ title = "Containers running without a read-only root filesystem" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when containers are running without a read-only root filesystem. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml index 79fcd9fe..9361a294 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1030.toml @@ -2,7 +2,6 @@ title = "Missing readiness probe" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when containers fail to specify a readiness probe. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml index f937760d..4ca8e020 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1032.toml @@ -2,7 +2,6 @@ title = "Invalid service account reference" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when pods reference a service account that is not found. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml index 52f17a7f..c9df15f8 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1033.toml @@ -2,7 +2,6 @@ title = "Missing NetworkPolicy for deployment-like objects" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on deployment-like objects that are not selected by any NetworkPolicy. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml index 65be893b..2d161ab0 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1034.toml @@ -2,7 +2,6 @@ title = "`PodDisruptionBudget` with `maxUnavailable` value preventing disruption weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when a PodDisruptionBudget has a maxUnavailable value that will always prevent disruptions of pods created by related deployment-like objects. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml index 3bdd2cac..4d735fe7 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1035.toml @@ -2,7 +2,6 @@ title = "Misconfigured `minAvailable` in `PodDisruptionBudget`" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Indicates when a PodDisruptionBudget sets a minAvailable value that will always prevent disruptions of pods created by related deployment-like objects. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml index b40a9bd8..0db25761 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1036.toml @@ -2,7 +2,6 @@ title = "Container allows privilege escalation" weight = 70 severity = "major" category = "antipattern" -verbose_name = "" description = """ Alert on containers of allowing privilege escalation that could gain more privileges than its parent process. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml index 34c27496..3b593bda 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1037.toml @@ -1,4 +1,4 @@ -title = "privileged-container" +title = "Containers running in privileged mode" severity = "major" category = "antipattern" weight = 70 diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml index b40b7419..bd6dcd78 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1038.toml @@ -1,9 +1,9 @@ -title = "privileged-ports" +title = "Containers mapping privileged ports" severity = "major" category = "antipattern" weight = 70 description = """ -Alert on deployments with privileged ports mapped in containers +Alert on deployments with privileged ports mapped in containers. diff --git a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml index 21b3a41b..00f2a501 100644 --- a/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml +++ b/analyzers/kube-linter/.deepsource/issues/KUBELIN-W1039.toml @@ -1,4 +1,4 @@ -title = "read-secret-from-env-var" +title = "Reading secrets from environment variables" severity = "major" category = "antipattern" weight = 70