Skip to content

Commit b0913d9

Browse files
PeefyPeefy
committed
feat: add more check modules
Signed-off-by: peefy <[email protected]>
1 parent 34871da commit b0913d9

File tree

15 files changed

+204
-0
lines changed

15 files changed

+204
-0
lines changed

‎check-auto-mount-service-account-token/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Introduction
2+
3+
## Resource
4+
5+
Code source and document is [here](https://github.com/kcl-lang/artifacthub/tree/main/check-auto-mount-service-account-token)

‎check-auto-mount-service-account-token/kcl.mod

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[package]
2+
name = "check-auto-mount-service-account-token"
3+
version = "0.1.0"
4+
description = "`check-auto-mount-service-account-token` is a kcl validation package"

‎check-auto-mount-service-account-token/main.k

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
"""Requires container images to begin with a string from the specified list.
2+
3+
Ref: https://github.com/open-policy-agent/gatekeeper-library/blob/master/src/general/allowedrepos/constraint.tmpl
4+
"""
5+
6+
# The list of prefixes a container image is allowed to have.
7+
repos: [str] = option("params").repos or []
8+
9+
# Define the validation function
10+
validate = lambda item {
11+
containers = []
12+
automountServiceAccountToken = False
13+
if item.kind == "Pod" and repos:
14+
containers = (item.spec.containers or []) + (item.spec.initContainers or [])
15+
automountServiceAccountToken = item.spec.automountServiceAccountToken
16+
elif item.kind == "Deployment":
17+
containers = (item.spec.template.spec.containers or []) + (item.spec.template.spec.initContainers or [])
18+
automountServiceAccountToken = item.spec.template.spec.automountServiceAccountToken
19+
if automountServiceAccountToken == True:
20+
assert all c in containers {
21+
all m in c.volumeMounts {
22+
m.mountPath == "/var/run/secrets/kubernetes.io/serviceaccount"
23+
}
24+
}, """Automounting service account token is disallowed for ${item.kind}: ${item.metadata.name}"""
25+
# Return the resource
26+
item
27+
}
28+
# Validate All resource
29+
items = [validate(i) for i in option("items")]

‎check-container-limits/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Introduction
2+
3+
## Resource
4+
5+
Code source and document is [here](https://github.com/kcl-lang/artifacthub/tree/main/check-container-limits)

‎check-container-limits/kcl.mod

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[package]
2+
name = "check-container-limits"
3+
version = "0.1.0"
4+
description = "`check-container-limits` is a kcl validation package"

‎check-container-limits/main.k

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
"""Requires containers to have memory and CPU limits set and constrains
2+
limits to be within the specified maximum values.
3+
4+
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
5+
"""
6+
7+
schema Params:
8+
cpu?: str
9+
memory?: str
10+
11+
params: Params = option("params")
12+
13+
canonify_cpu = lambda cpu: str -> float {
14+
result = 0
15+
if cpu:
16+
if cpu[-1] == "m":
17+
result = int(cpu[:-1])
18+
else:
19+
result = int(cpu) * 1000
20+
result
21+
}
22+
23+
# Define the validation function
24+
validate = lambda item {
25+
cpu = ""
26+
memory = ""
27+
if item.kind == "Pod":
28+
containers = (item.spec.containers or []) + (item.spec.initContainers or [])
29+
elif item.kind == "Deployment":
30+
containers = (item.spec.template.spec.containers or []) + (item.spec.template.spec.initContainers or [])
31+
if containers:
32+
cpu_list: [str] = [c.resources.limits.cpu for c in containers if c?.resources?.limits?.cpu]
33+
memory_list: [str] = [c.resources.limits.memory for c in containers if c?.resources?.limits?.memory]
34+
if params.cpu:
35+
disallowed_cpu_list = [cpu for cpu in cpu_list if canonify_cpu(cpu) > canonify_cpu(params.cpu)]
36+
assert not disallowed_cpu_list, "container cpu limit list '${disallowed_cpu_list}' is higher than the maximum allowed of ${params.cpu}"
37+
if params.memory:
38+
disallowed_memory_list = [memory for memory in memory_list if int(memory) > int(params.memory)]
39+
assert not disallowed_memory_list, "container memory limit list '${disallowed_memory_list}' is higher than the maximum allowed of ${params.memory}"
40+
# Return the resource
41+
item
42+
}
43+
# Validate All resource
44+
items = [validate(i) for i in option("items")]

‎check-container-requests/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Introduction
2+
3+
## Resource
4+
5+
Code source and document is [here](https://github.com/kcl-lang/artifacthub/tree/main/check-container-requests)

‎check-container-requests/kcl.mod

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[package]
2+
name = "check-container-requests"
3+
version = "0.1.0"
4+
description = "`check-container-requests` is a kcl validation package"

‎check-container-requests/main.k

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
"""Requires containers to have memory and CPU requests set and constrains
2+
requests to be within the specified maximum values.
3+
4+
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
5+
"""
6+
7+
schema Params:
8+
cpu?: str
9+
memory?: str
10+
11+
params: Params = option("params")
12+
13+
canonify_cpu = lambda cpu: str -> float {
14+
result = 0
15+
if cpu:
16+
if cpu[-1] == "m":
17+
result = int(cpu[:-1])
18+
else:
19+
result = int(cpu) * 1000
20+
result
21+
}
22+
23+
# Define the validation function
24+
validate = lambda item {
25+
cpu = ""
26+
memory = ""
27+
if item.kind == "Pod":
28+
containers = (item.spec.containers or []) + (item.spec.initContainers or [])
29+
elif item.kind == "Deployment":
30+
containers = (item.spec.template.spec.containers or []) + (item.spec.template.spec.initContainers or [])
31+
if containers:
32+
cpu_list: [str] = [c.resources.requests.cpu for c in containers if c?.resources?.requests?.cpu]
33+
memory_list: [str] = [c.resources.requests.memory for c in containers if c?.resources?.requests?.memory]
34+
if params.cpu:
35+
disallowed_cpu_list = [cpu for cpu in cpu_list if canonify_cpu(cpu) > canonify_cpu(params.cpu)]
36+
assert not disallowed_cpu_list, "container cpu limit list '${disallowed_cpu_list}' is higher than the maximum allowed of ${params.cpu}"
37+
if params.memory:
38+
disallowed_memory_list = [memory for memory in memory_list if int(memory) > int(params.memory)]
39+
assert not disallowed_memory_list, "container memory limit list '${disallowed_memory_list}' is higher than the maximum allowed of ${params.memory}"
40+
# Return the resource
41+
item
42+
}
43+
# Validate All resource
44+
items = [validate(i) for i in option("items")]

‎check-deprecated-api/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Introduction
2+
3+
## Resource
4+
5+
Code source and document is [here](https://github.com/kcl-lang/artifacthub/tree/main/check-deprecated-api)

‎check-deprecated-api/kcl.mod

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[package]
2+
name = "check-deprecated-api"
3+
version = "0.1.0"
4+
description = "`check-deprecated-api` is a kcl validation package"

‎check-deprecated-api/main.k

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
"""Verifies deprecated Kubernetes APIs to ensure all the API versions are up to date.
2+
This template does not apply to audit as audit looks at the resources which are already
3+
present in the cluster with non-deprecated API versions.
4+
Ref: https://open-policy-agent.github.io/gatekeeper-library/website/validation/verifydeprecatedapi
5+
"""
6+
7+
schema Params:
8+
kvs: [KV]
9+
k8sVersion: int | float | str
10+
11+
schema KV:
12+
deprecatedAPI: str
13+
kinds: [str]
14+
targetAPI: str
15+
16+
params: Params = option("params")
17+
18+
# Define the validation function
19+
validate = lambda item {
20+
if params.kvs:
21+
[lambda item, kv: KV {
22+
if item.kind in kv.kinds:
23+
assert item.apiVersion != kv.deprecatedAPI, "API {} for {} is deprecated in Kubernetes version {}, please use {} instead".format(item.kind, item.apiVersion, params.k8sVersion, kv.targetAPI)
24+
kv
25+
}(item, kv) for kv in params.kvs]
26+
item
27+
}
28+
# Validate All resource
29+
items = [validate(i) for i in option("items")]

‎check-probes/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Introduction
2+
3+
## Resource
4+
5+
Code source and document is [here](https://github.com/kcl-lang/artifacthub/tree/main/check-probes)

‎check-probes/kcl.mod

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[package]
2+
name = "check-probes"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`check-probes` is a kcl validation package"

‎check-probes/main.k

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Define the validation function
2+
kinds = ["Deployment", "DaemonSet", "StatefulSet"]
3+
validate = lambda item {
4+
if item.kind in kinds:
5+
containers = item.spec.template.spec.containers or []
6+
assert all c in containers {
7+
(c?.readinessProbe or {}) != (c?.livenessProbe or {})
8+
} if containers, "Liveness and readiness probes cannot be the same for ${item.kind}: ${item.metadata.name}"
9+
item
10+
}
11+
# Validate All resource
12+
items = [validate(i) for i in option("items")]

0 commit comments

Comments
 (0)