apiVersion: v1
kind: ConfigMap
metadata:
  name:         polaris
  namespace:    dev

data:
  config.yaml: |
    checks:
      # reliability
      #readinessProbeMissing: warning
      #livenessProbeMissing: warning
      #pdbDisruptionsIsZero: warning
      #missingPodDisruptionBudget: danger

      cpuRequestsMissing: warning
      cpuLimitsMissing: warning
      memoryRequestsMissing: warning
      memoryLimitsMissing: warning
      #topologySpreadConstraints: warning
      resourceLimits: ignore
      multipleReplicasForDeployment: warning
      HPALimits: ignore
      multipleReplicasForDeployment: warning
      wastageCost: warning
    customChecks:
      wastageCost:
        successMessage: No wastage.
        failureMessage: Wastage cost is $130/m (memory/CPU requests - actual usage) ($260 - $130)
        category: Resources
        target: Container
        schema:
          '$schema': http://json-schema.org/draft-07/schema
          type: object
          required:
          - resources
          properties:
            resources:
              type: object
              required:
              - limits
      resourceLimits:
        containers:
          exclude:
          - initContainer
        successMessage: Resource limits are within the required range
        failureMessage: Resource limits should be within the required range
        category: Resources
        target: Container
        schema:
          '$schema': http://json-schema.org/draft-07/schema
          type: object
          required:
          - resources
          properties:
            resources:
              type: object
              required:
              - limits
              properties:
                limits:
                  type: object
                  required:
                  - memory
                  - cpu
                  properties:
                    memory:
                      type: string
                      resourceMinimum: 10M
                      resourceMaximum: 9G
                    cpu:
                      type: string
                      resourceMinimum: 100m
                      resourceMaximum: "2"
      HPALimits:
        successMessage: Replica count limits are within the required range
        failureMessage: Replica count limits should be within the required range
        category: Resources
        target: Controller
        controllers:
          include:
          - Deployment
        schema:
          '$schema': http://json-schema.org/draft-07/schema
          type: integer
          required:
          - replicas
          properties:
            replicas:
              type: integer
              minimum: 2
              maximum: 4
    exemptions:
      - namespace: kube-system
        controllerNames:
          - kube-apiserver
          - kube-proxy
          - kube-scheduler
          - etcd-manager-events
          - kube-controller-manager
          - kube-dns
          - etcd-manager-main
        rules:
          - hostPortSet
          - hostNetworkSet
          - readinessProbeMissing
          - livenessProbeMissing
          - cpuRequestsMissing
          - cpuLimitsMissing
          - memoryRequestsMissing
          - memoryLimitsMissing
          - runAsRootAllowed
          - runAsPrivileged
          - notReadOnlyRootFilesystem
          - hostPIDSet

      - controllerNames:
          - kube-flannel-ds
        rules:
          - notReadOnlyRootFilesystem
          - runAsRootAllowed
          - notReadOnlyRootFilesystem
          - readinessProbeMissing
          - livenessProbeMissing
          - cpuLimitsMissing

      - controllerNames:
          - cert-manager
        rules:
          - notReadOnlyRootFilesystem
          - runAsRootAllowed
          - readinessProbeMissing
          - livenessProbeMissing

      - controllerNames:
          - cluster-autoscaler
        rules:
          - notReadOnlyRootFilesystem
          - runAsRootAllowed
          - readinessProbeMissing

      - controllerNames:
          - vpa
        rules:
          - runAsRootAllowed
          - readinessProbeMissing
          - livenessProbeMissing
          - notReadOnlyRootFilesystem

      - controllerNames:
          - datadog
        rules:
          - runAsRootAllowed
          - readinessProbeMissing
          - livenessProbeMissing
          - notReadOnlyRootFilesystem

      - controllerNames:
          - nginx-ingress-controller
        rules:
          - privilegeEscalationAllowed
          - insecureCapabilities
          - runAsRootAllowed

      - controllerNames:
          - dns-controller
          - datadog-datadog
          - kube-flannel-ds
          - kube2iam
          - aws-iam-authenticator
          - datadog
          - kube2iam
        rules:
          - hostNetworkSet

      - controllerNames:
          - aws-iam-authenticator
          - aws-cluster-autoscaler
          - kube-state-metrics
          - dns-controller
          - external-dns
          - dnsmasq
          - autoscaler
          - kubernetes-dashboard
          - install-cni
          - kube2iam
        rules:
          - readinessProbeMissing
          - livenessProbeMissing

      - controllerNames:
          - aws-iam-authenticator
          - nginx-ingress-default-backend
          - aws-cluster-autoscaler
          - kube-state-metrics
          - dns-controller
          - external-dns
          - kubedns
          - dnsmasq
          - autoscaler
          - tiller
          - kube2iam
        rules:
          - runAsRootAllowed

      - controllerNames:
          - aws-iam-authenticator
          - nginx-ingress-controller
          - nginx-ingress-default-backend
          - aws-cluster-autoscaler
          - kube-state-metrics
          - dns-controller
          - external-dns
          - kubedns
          - dnsmasq
          - autoscaler
          - tiller
          - kube2iam
        rules:
          - notReadOnlyRootFilesystem

      - controllerNames:
          - cert-manager
          - dns-controller
          - kubedns
          - dnsmasq
          - autoscaler
          - insights-agent-goldilocks-vpa-install
          - datadog
        rules:
          - cpuRequestsMissing
          - cpuLimitsMissing
          - memoryRequestsMissing
          - memoryLimitsMissing

      - controllerNames:
          - kube2iam
          - kube-flannel-ds
        rules:
          - runAsPrivileged

      - controllerNames:
          - kube-hunter
        rules:
          - hostPIDSet

      - controllerNames:
          - polaris
          - kube-hunter
          - goldilocks
          - insights-agent-goldilocks-vpa-install
        rules:
          - notReadOnlyRootFilesystem

      - controllerNames:
          - insights-agent-goldilocks-controller
        rules:
          - livenessProbeMissing
          - readinessProbeMissing

      - controllerNames:
          - insights-agent-goldilocks-vpa-install
          - kube-hunter
        rules:
          - runAsRootAllowed

