Check for clusterlint specific annotation to disable checks for special objects.

checks/basic/namespace.go

@@ -78,7 +78,7 @@ func (nc *defaultNamespaceCheck) Description() string {
 }
 
 // checkPods checks if there are pods in the default namespace
-func checkPods(items *corev1.PodList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkPods(items *corev1.PodList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() {
 			alert.warn(checks.Pod, item.ObjectMeta)
@@ -87,7 +87,7 @@ func checkPods(items *corev1.PodList, alert *alert) {
 }
 
 // checkPodTemplates checks if there are pod templates in the default namespace
-func checkPodTemplates(items *corev1.PodTemplateList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkPodTemplates(items *corev1.PodTemplateList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() {
 			alert.warn(checks.PodTemplate, item.ObjectMeta)
@@ -96,7 +96,7 @@ func checkPodTemplates(items *corev1.PodTemplateList, alert *alert) {
 }
 
 // checkPVCs checks if there are pvcs in the default namespace
-func checkPVCs(items *corev1.PersistentVolumeClaimList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkPVCs(items *corev1.PersistentVolumeClaimList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() {
 			alert.warn(checks.PersistentVolumeClaim, item.ObjectMeta)
@@ -105,7 +105,7 @@ func checkPVCs(items *corev1.PersistentVolumeClaimList, alert *alert) {
 }
 
 // checkConfigMaps checks if there are config maps in the default namespace
-func checkConfigMaps(items *corev1.ConfigMapList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkConfigMaps(items *corev1.ConfigMapList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() {
 			alert.warn(checks.ConfigMap, item.ObjectMeta)
@@ -114,7 +114,7 @@ func checkConfigMaps(items *corev1.ConfigMapList, alert *alert) {
 }
 
 // checkServices checks if there are user created services in the default namespace
-func checkServices(items *corev1.ServiceList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkServices(items *corev1.ServiceList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() && item.GetName() != "kubernetes" {
 			alert.warn(checks.Service, item.ObjectMeta)
@@ -123,7 +123,7 @@ func checkServices(items *corev1.ServiceList, alert *alert) {
 }
 
 // checkSecrets checks if there are user created secrets in the default namespace
-func checkSecrets(items *corev1.SecretList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkSecrets(items *corev1.SecretList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() && item.Type != corev1.SecretTypeServiceAccountToken {
 			alert.warn(checks.Secret, item.ObjectMeta)
@@ -132,7 +132,7 @@ func checkSecrets(items *corev1.SecretList, alert *alert) {
 }
 
 // checkSA checks if there are user created SAs in the default namespace
-func checkSA(items *corev1.ServiceAccountList, alert *alert) {
+func (nc *defaultNamespaceCheck) checkSA(items *corev1.ServiceAccountList, alert *alert) {
 	for _, item := range items.Items {
 		if corev1.NamespaceDefault == item.GetNamespace() && item.GetName() != "default" {
 			alert.warn(checks.ServiceAccount, item.ObjectMeta)
@@ -147,37 +147,37 @@ func (nc *defaultNamespaceCheck) Run(objects *kube.Objects) ([]checks.Diagnostic
 	alert := &alert{}
 	var g errgroup.Group
 	g.Go(func() error {
-		checkPods(objects.Pods, alert)
+		nc.checkPods(objects.Pods, alert)
 		return nil
 	})
 
 	g.Go(func() error {
-		checkPodTemplates(objects.PodTemplates, alert)
+		nc.checkPodTemplates(objects.PodTemplates, alert)
 		return nil
 	})
 
 	g.Go(func() error {
-		checkPVCs(objects.PersistentVolumeClaims, alert)
+		nc.checkPVCs(objects.PersistentVolumeClaims, alert)
 		return nil
 	})
 
 	g.Go(func() error {
-		checkConfigMaps(objects.ConfigMaps, alert)
+		nc.checkConfigMaps(objects.ConfigMaps, alert)
 		return nil
 	})
 
 	g.Go(func() error {
-		checkServices(objects.Services, alert)
+		nc.checkServices(objects.Services, alert)
 		return nil
 	})
 
 	g.Go(func() error {
-		checkSecrets(objects.Secrets, alert)
+		nc.checkSecrets(objects.Secrets, alert)
 		return nil
 	})
 
 	g.Go(func() error {
-		checkSA(objects.ServiceAccounts, alert)
+		nc.checkSA(objects.ServiceAccounts, alert)
 		return nil
 	})
 

checks/check.go

@@ -16,7 +16,14 @@ limitations under the License.
 
 package checks
 
-import "github.com/digitalocean/clusterlint/kube"
+import (
+	"strings"
+
+	"github.com/digitalocean/clusterlint/kube"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const checkAnnotation string = "clusterlint.disable.checks"
 
 // Check is a check that can run on Kubernetes objects.
 type Check interface {
@@ -34,3 +41,11 @@ type Check interface {
 	// well as an error value indicating that the check failed to run.
 	Run(*kube.Objects) ([]Diagnostic, error)
 }
+
+func IsEnabled(name string, item metav1.ObjectMeta) bool {
+	annotations := item.GetAnnotations()
+	if value, ok := annotations[checkAnnotation]; ok && strings.Contains(value, name) {
+		return false
+	}
+	return true
+}

checks/check_test.go

@@ -0,0 +1,41 @@
+package checks
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestCheckIsDisabled(t *testing.T) {
+	const name string = "pod_foo"
+	pod := initPod(name)
+	assert.False(t, IsEnabled(name, pod.ObjectMeta))
+}
+
+func TestCheckIsEnabled(t *testing.T) {
+	const name string = "pod_foo"
+	pod := initPod("")
+	assert.True(t, IsEnabled(name, pod.ObjectMeta))
+}
+
+func TestNoClusterlintAnnotation(t *testing.T) {
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "pod_foo", Annotations: map[string]string{"porg": "star wars"},
+		},
+	}
+	assert.True(t, IsEnabled("pod_foo", pod.ObjectMeta))
+}
+
+func initPod(name string) *corev1.Pod {
+	pod := &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "pod_foo", Annotations: map[string]string{"clusterlint.disable.checks": fmt.Sprintf("%s, bar, baz", name)},
+		},
+	}
+	return pod
+}