fixed lint error
parent
7ae624e9d8
commit
623251bba4
|
@ -37,7 +37,7 @@ javascript:
|
|||
- code: |
|
||||
deployment = JSON.parse(template.deployment);
|
||||
deployment.spec.template.spec.containers.forEach(container => {
|
||||
if (container.securityContext && container.securityContext.seccompProfile &&
|
||||
if (container.securityContext && container.securityContext.seccompProfile &&
|
||||
(container.securityContext.seccompProfile.type === 'RuntimeDefault' || container.securityContext.seccompProfile.type === 'DockerDefault')) {
|
||||
// No action needed, configured properly
|
||||
} else {
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
id: netpol-egress-rules
|
||||
id: k8s-netpol-egress-rules
|
||||
|
||||
info:
|
||||
name: Network policies define egress rules
|
||||
|
@ -34,7 +34,7 @@ code:
|
|||
|
||||
javascript:
|
||||
- code: |
|
||||
let policyData = JSON.parse(template.policy);
|
||||
let policyData = JSON.parse(template.policy);
|
||||
if (!policyData.egress || policyData.egress.length === 0) {
|
||||
let result = (`Network policy '${policyData.policy}' does not define egress rules.`);
|
||||
Export(result);
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
id: k8s-ingress-rules
|
||||
id: k8s-network-ingress-rules
|
||||
|
||||
info:
|
||||
name: Define network ingress rules
|
||||
|
@ -35,7 +35,7 @@ code:
|
|||
|
||||
javascript:
|
||||
- code: |
|
||||
let policyData = JSON.parse(template.policy);
|
||||
let policyData = JSON.parse(template.policy);
|
||||
if (!policyData.ingress || policyData.ingress.length === 0) {
|
||||
let result = `Network policy '${policyData.policy}' does not define any ingress rules.`;
|
||||
Export(result);
|
||||
|
|
|
@ -34,7 +34,7 @@ code:
|
|||
|
||||
javascript:
|
||||
- code: |
|
||||
let podData = JSON.parse(template.container);
|
||||
let podData = JSON.parse(template.container);
|
||||
podData.containers.forEach(container => {
|
||||
if (container.securityContext && container.securityContext.allowPrivilegeEscalation === true) {
|
||||
let result = (`Container '${container.name}' in pod '${podData.pod}' running with allowPrivilegeEscalation enabled.`);
|
||||
|
|
|
@ -35,7 +35,7 @@ code:
|
|||
|
||||
javascript:
|
||||
- code: |
|
||||
let podData = JSON.parse(template.pod);
|
||||
let podData = JSON.parse(template.pod);
|
||||
podData.containers.forEach(container => {
|
||||
if (container.securityContext && container.securityContext.readOnlyRootFilesystem !== true) {
|
||||
let result = (`Container '${container.name}' in pod '${podData.pod}' is not running with a read-only root filesystem.`);
|
||||
|
|
|
@ -34,7 +34,7 @@ code:
|
|||
|
||||
javascript:
|
||||
- code: |
|
||||
let podData = JSON.parse(template.pod);
|
||||
let podData = JSON.parse(template.pod);
|
||||
podData.containers.forEach(container => {
|
||||
if (container.securityContext && container.securityContext.runAsUser === 0) {
|
||||
let result = (`Container '${container.name}' in pod '${podData.pod}' is running with root user ID.`);
|
||||
|
|
|
@ -23,13 +23,13 @@ code:
|
|||
- bash
|
||||
source: |
|
||||
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
|
||||
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- 'kube-apiserver'
|
||||
|
||||
|
||||
- type: word
|
||||
words:
|
||||
- "service-account-issuer"
|
||||
|
|
Loading…
Reference in New Issue