-
Notifications
You must be signed in to change notification settings - Fork 238
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Create new check for liveness port (#661)
* Create new check for liveness port Want to ensure the port is correctly set for liveness probe since it's easy to make a typo when people are doing copy pasta. This will let you know it's failing airier and not have to wait for a failed deployment. Want to do this also for startup and readiness checks. Assume it make sense to have them as other checks and was planning on doing that in a follow up.
- Loading branch information
1 parent
f3522bd
commit d1ffb0a
Showing
12 changed files
with
461 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| name: "liveness-port" | ||
| description: "Indicates when containers have a liveness probe to a not exposed port." | ||
| remediation: >- | ||
| Check which ports you've opened and ensure they match what you have specified | ||
| in the liveness probe. | ||
| scope: | ||
| objectKinds: | ||
| - DeploymentLike | ||
| template: "liveness-http-port" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| package params | ||
|
|
||
| // Params represents the params accepted by this template. | ||
| type Params struct{} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| package livenessport | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "golang.stackrox.io/kube-linter/pkg/check" | ||
| "golang.stackrox.io/kube-linter/pkg/config" | ||
| "golang.stackrox.io/kube-linter/pkg/diagnostic" | ||
| "golang.stackrox.io/kube-linter/pkg/objectkinds" | ||
| "golang.stackrox.io/kube-linter/pkg/templates" | ||
| "golang.stackrox.io/kube-linter/pkg/templates/livenessport/internal/params" | ||
| "golang.stackrox.io/kube-linter/pkg/templates/util" | ||
| v1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/util/intstr" | ||
| ) | ||
|
|
||
| const templateKey = "liveness-http-port" | ||
|
|
||
| var sentinel = struct{}{} | ||
|
|
||
| func init() { | ||
| templates.Register(check.Template{ | ||
| HumanName: "Liveness Port Not Open", | ||
| Key: templateKey, | ||
| Description: "Flag containers with an HTTP liveness probe to not exposed port.", | ||
| SupportedObjectKinds: config.ObjectKindsDesc{ | ||
| ObjectKinds: []string{objectkinds.DeploymentLike}, | ||
| }, | ||
| Parameters: params.ParamDescs, | ||
| ParseAndValidateParams: params.ParseAndValidate, | ||
| Instantiate: params.WrapInstantiateFunc(func(_ params.Params) (check.Func, error) { | ||
| return util.PerNonInitContainerCheck(func(container *v1.Container) []diagnostic.Diagnostic { | ||
| if container.LivenessProbe == nil { | ||
| return nil | ||
| } | ||
|
|
||
| ports := map[intstr.IntOrString]struct{}{} | ||
| for _, port := range container.Ports { | ||
| if port.Protocol != "" && port.Protocol != v1.ProtocolTCP { | ||
| continue | ||
| } | ||
| ports[intstr.FromInt32(port.ContainerPort)] = sentinel | ||
| ports[intstr.FromString(port.Name)] = sentinel | ||
| } | ||
|
|
||
| if httpProbe := container.LivenessProbe.ProbeHandler.HTTPGet; httpProbe != nil { | ||
| if _, ok := ports[httpProbe.Port]; !ok { | ||
| return []diagnostic.Diagnostic{{ | ||
| Message: fmt.Sprintf("container %q does not expose port %s for the HTTPGet", container.Name, httpProbe.Port.String()), | ||
| }} | ||
| } | ||
| } | ||
|
|
||
| if tcpProbe := container.LivenessProbe.ProbeHandler.TCPSocket; tcpProbe != nil { | ||
| if _, ok := ports[tcpProbe.Port]; !ok { | ||
| return []diagnostic.Diagnostic{{ | ||
| Message: fmt.Sprintf("container %q does not expose port %s for the TCPSocket", container.Name, tcpProbe.Port.String()), | ||
| }} | ||
| } | ||
| } | ||
| return nil | ||
| }), nil | ||
| }), | ||
| }) | ||
| } |
Oops, something went wrong.