Unverified Commit 1a8fb44b authored by Robert Brennan's avatar Robert Brennan Committed by GitHub
Browse files

Migrate docs to Vuepress (#442)

* first pass

* fix up homepage

* more work

* housekeeping

* add script to modify home link

* add check docs

* build docs site

* Create CNAME

* fix path to check-docs

* update from template

* fix logo in readme

* fix link

* remove logspam

* remove old folders

* fix all links

* fix up readme

* change up Insights description

* add customization docs

* phrasing

* title

* titles

* titles

* change webhook docs

* refresh template

* rebuild site

* refresh from template repo

* phrasing

* add tagline

* update readme\, add readme sync script

* fix logo

* rebuild

* fix readme script

* rebuild
Showing with 543 additions and 125 deletions
+543 -125
# This file is generated from FairwindsOps/documentation-template
# DO NOT EDIT MANUALLY
name: Build Website
on:
push:
branches: [ master ]
jobs:
build:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [14.x]
steps:
- uses: actions/checkout@v2
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v1
with:
node-version: ${{ matrix.node-version }}
- run: cd docs-md
- run: npm ci
- run: npm run check-links
- run: |
username="GitHub Actions"
git config user.email "opensource@fairwinds.com"
git config user.name $username
npm run build
HAS_CHANGE=$(git diff .)
if [ -n "${HAS_CHANGE}" ]; then
if [ "$(git log -1 --pretty=format:'%an')" == $username ]; then
echo "Build created a diff, but the last commit was a build."
exit 1
fi
git add docs/
git commit -m "[CI] rebuild website"
git push
fi
env:
CI: true
......@@ -24,3 +24,5 @@ dist
.vscode
*-test.yaml
node_modules
<div align="center">
<img src="/img/polaris-logo.png" alt="Polaris Logo" />
<div align="center" class="no-border">
<img src="https://polaris.docs.fairwinds.com/img/polaris-logo.png" alt="Polaris Logo">
<br>
[![Version][version-image]][version-link] [![CircleCI][circleci-image]][circleci-link] [![Go Report Card][goreport-image]][goreport-link]
<h3>Best Practices for Kubernetes Workload Configuration</h3>
<a href="https://github.com/FairwindsOps/polaris">
<img src="https://img.shields.io/static/v1.svg?label=Version&message=1.2.0&color=239922">
</a>
<a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
<img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
</a>
<a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
<img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
</a>
</div>
[version-image]: https://img.shields.io/static/v1.svg?label=Version&message=1.2.0&color=239922
[version-link]: https://github.com/FairwindsOps/polaris
[goreport-image]: https://goreportcard.com/badge/github.com/FairwindsOps/polaris
[goreport-link]: https://goreportcard.com/report/github.com/FairwindsOps/polaris
[circleci-image]: https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg
[circleci-link]: https://circleci.com/gh/FairwindsOps/polaris.svg
Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
Kubernetes pods and controllers are configured using best practices, helping you avoid
problems in the future. Polaris can be run in a few different modes:
Polaris can be run in three different modes:
* As a [dashboard](#dashboard), so you can audit what's running inside your cluster.
* As a [validating webhook](#webhook), so you can automatically reject workloads that don't adhere to your organization's policies.
* As a [command-line tool](#cli), so you can test local YAML files, e.g. as part of a CI/CD process.
* As a [dashboard](https://polaris.docs.fairwinds.com/dashboard), so you can audit what's running inside your cluster.
* As an [admission controller](https://polaris.docs.fairwinds.com/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
* As a [command-line tool](https://polaris.docs.fairwinds.com/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
**Want to learn more?** Reach out on [the Slack channel](https://fairwindscommunity.slack.com/messages/polaris) ([request invite](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)), send an email to `opensource@fairwinds.com`, or join us for [office hours on Zoom](https://fairwindscommunity.slack.com/messages/office-hours)
---
**Get more from Polaris** with [Fairwinds Insights](https://www.fairwinds.com/insights?utm_campaign=Hosted%20Polaris%20&utm_source=polaris&utm_term=polaris&utm_content=polaris) -
Insights can help you track Polaris findings over time, send new findings to Slack and Datadog, and integrate other
Kubernetes auditing tools such as
[Trivy](https://github.com/aquasecurity/trivy) and [Goldilocks](https://github.com/FairwindsOps/goldilocks/)
---
## Documentation
Check out the [documentation at docs.fairwinds.com](https://polaris.docs.fairwinds.com)
# Dashboard Quickstart
## Integration with Fairwinds Insights
[Fairwinds Insights](https://www.fairwinds.com/insights?utm_campaign=Hosted%20Polaris%20&utm_source=polaris&utm_term=polaris&utm_content=polaris)
is a platform for auditing Kubernetes clusters and enforcing policy. If you'd like to:
* manage Polaris across a fleet of clusters
* track findings over time
* send results to services like Slack and Datadog
* add additional checks from tools like
[Trivy](https://github.com/aquasecurity/trivy),
[Goldilocks](https://github.com/FairwindsOps/goldilocks/), and
[OPA](https://www.openpolicyagent.org)
```bash
kubectl apply -f https://github.com/FairwindsOps/polaris/releases/latest/download/dashboard.yaml
kubectl port-forward --namespace polaris svc/polaris-dashboard 8080:80
```
With the port forwarding in place, you can open http://localhost:8080 in your browser to view the dashboard.
you can sign up for a [free account here](https://insights.fairwinds.com?source=polaris).
* * *
## Contributing
PRs welcome! Check out the [Contributing Guidelines](https://polaris.docs.fairwinds.com/contributing/) and [Code of Conduct](https://polaris.docs.fairwinds.com/code-of-conduct) for more information.
# Components
## Further Information
A history of changes to this project can be viewed in the [Changelog](https://polaris.docs.fairwinds.com/changelog/)
## Dashboard
> [View installation instructions](docs/usage.md#dashboard)
If you'd like to learn more about Polaris, or if you'd like to speak with
a Kubernetes expert, you can contact `info@fairwinds.com` or [visit our website](https://fairwinds.com)
The Polaris dashboard is a way to get a simple visual overview of the current state of your Kubernetes workloads as well as a roadmap for what can be improved. The dashboard provides a cluster wide overview as well as breaking out results by category, namespace, and workload.
---
<p align="center">
<img src="/img/dashboard-screenshot.png" alt="Polaris Dashboard" width="550"/>
<img src="https://polaris.docs.fairwinds.com/img/dashboard-screenshot.png" alt="Polaris Dashboard" width="550"/>
</p>
Our default standards in Polaris are rather high, so don’t be surprised if your score is lower than you might expect. A key goal for Polaris was to set a high standard and aim for great configuration by default. If the defaults we’ve included are too strict, it’s easy to adjust the configuration as part of the deployment configuration to better suit your workloads.
## Admission Controller: Validating Webhook
> [View installation instructions](docs/usage.md#webhook)
Polaris can be run as an admission controller that acts as a validating webhook. This accepts the same configuration as the dashboard, and can run the same validations. This webhook will reject any workloads that trigger a danger-level check. This is indicative of the greater goal of Polaris, not just to encourage better configuration through dashboard visibility, but to actually enforce it with this webhook. Polaris will not fix your workloads, only block them.
The webhook only supports a fixed set of controller types. You can see the
[list of supported controllers here](https://github.com/FairwindsOps/polaris/blob/master/cmd/polaris/webhook.go#L40)
Unfortunately we have not found a way to display warnings as part of `kubectl` output unless we are rejecting a workload altogether. That means that any checks with a severity of `warning` will still pass webhook validation, and the only evidence of that warning will either be in the Polaris dashboard or the Polaris webhook logs.
## CLI
> [View installation instructions](docs/usage.md#cli)
Polaris can also be used on the command line, either to audit local files or a running cluster.
This is particularly helpful for running Polaris against your infrastructure-as-code as part of a
CI/CD pipeline. Use the available [command line flags](docs/usage.md#running-with-ci-cd)
to cause CI/CD to fail if your Polaris score drops below a certain threshold, or if any danger-level issues arise.
# Installation and Usage
See the [Usage Guide](/docs/usage.md) for details on different methods for installing and using Polaris.
# Contributing
PRs welcome! Check out the [Contributing Guidelines](CONTRIBUTING.md),
[Code of Conduct](CODE_OF_CONDUCT.md), and [Roadmap](ROADMAP.md) for more information.
# Further Information
A history of changes to this project can be viewed in the [Changelog](CHANGELOG.md)
If you'd like to learn more about Polaris, or if you'd like to speak with
a Kubernetes expert, you can contact `info@fairwinds.com` or [visit our website](https://fairwinds.com)
# License
Apache License 2.0
# Polaris Roadmap
We plan to continue expanding the list of checks available to Polaris users,
as well as the project's overall functionality.
If you have ideas for a new check, or for new Polaris features,
you can submit a pull request for this file, or open an issue in GitHub.
## Check non-controllers
We would like to implement checks for non-controller types, such as:
* Ingresses
* Services
* RBAC roles/bindings
## Expand list of checks
We'd like to increase our library of checks. Not all checks need to be enabled by default,
so anything that would be useful across different organizations is worth checking in.
## Support more controllers in the validating webhook
Currently the webhook only checks for a fixed set of controllers.
While we can't listen for _all_ possible controller types, we can block Pods that violate policy.
We've chosen not to do this for now, because it could prevent existing controllers from scaling.
However, there may be a way to check for the owner's age, in order to determine if it's a new
controller or a pre-existing controller.
module.exports = {
title: "Fairwinds Polaris Documentation",
description: "Documentation for Fairwinds Polaris - audit and enforce Kubernetes best practices for your workloads",
themeConfig: {
docsRepo: "FairwindsOps/polaris",
sidebar: [
{
title: "Polaris",
path: "/",
sidebarDepth: 0,
collapsable: false,
children: [
{
title: "Changelog",
path: "/changelog",
},
{
title: "Code of Conduct",
path: "/code-of-conduct",
},
{
title: "Contributing",
path: "/contributing",
},
],
},
{
title: "Ways to Run Polaris",
collapsable: false,
children: [
"/dashboard",
"/admission-controller",
"/infrastructure-as-code",
],
},
{
title: "Customization",
collapsable: false,
children: [
"/customization/configuration",
"/customization/checks",
"/customization/custom-checks",
"/customization/exemptions",
]
},
{
title: "Checks",
collapsable: false,
sidebarDepth: 0,
children: [
"/checks/security",
"/checks/efficiency",
"/checks/reliability",
],
},
]
}
}
// This file is generated from FairwindsOps/documentation-template
// DO NOT EDIT MANUALLY
const fs = require('fs');
const npath = require('path');
const CONFIG_FILE = npath.join(__dirname, 'config-extras.js');
const BASE_DIR = npath.join(__dirname, '..');
const extras = require(CONFIG_FILE);
if (!extras.title || !extras.description || !extras.themeConfig.docsRepo) {
throw new Error("Please specify 'title', 'description', and 'themeConfig.docsRepo' in config-extras.js");
}
const docFiles = fs.readdirSync(BASE_DIR)
.filter(f => f !== "README.md")
.filter(f => f !== ".vuepress")
.filter(f => f !== "node_modules")
.filter(f => npath.extname(f) === '.md' || npath.extname(f) === '');
const sidebar = [['/', 'Home']].concat(docFiles.map(f => {
const ext = npath.extname(f);
if (ext === '') {
// this is a directory
const title = f;
const children = fs.readdirSync(npath.join(BASE_DIR, f)).map(subf => {
return '/' + f + '/' + npath.basename(subf);
});
return {title, children};
}
const path = npath.basename(f);
return path;
}));
const baseConfig = {
title: "",
description: "",
head: [
['link', { rel: 'icon', href: '/favicon.png' }],
['script', { src: '/scripts/modify.js' }],
['script', { src: '/scripts/leadlander.js' }],
],
themeConfig: {
docsRepo: "",
docsDir: 'docs-md',
editLinks: true,
editLinkText: "Help us improve this page",
logo: '/img/fairwinds-logo.svg',
heroText: "",
sidebar,
nav: [
{text: 'View on GitHub', link: 'https://github.com/' + extras.themeConfig.docsRepo},
],
},
plugins: {
'vuepress-plugin-clean-urls': {
normalSuffix: '/',
notFoundPath: '/404.html',
},
'check-md': {},
},
}
let config = JSON.parse(JSON.stringify(baseConfig))
if (!fs.existsSync(CONFIG_FILE)) {
throw new Error("Please add config-extras.js to specify your project details");
}
for (let key in extras) {
if (!config[key]) config[key] = extras[key];
else if (key === 'head') config[key] = config[key].concat(extras[key]);
else Object.assign(config[key], extras[key]);
}
module.exports = config;
docs-md/.vuepress/public/favicon.png

400 Bytes

<?xml version="1.0" encoding="UTF-8"?>
<!-- Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 486.5 92.3" style="enable-background:new 0 0 486.5 92.3;" xml:space="preserve">
<style type="text/css">
.st0{fill:#FFFFFF;}
</style>
<g>
<g>
<path class="st0" d="M72.5,24.3H0.4V0.4h84.4V12C84.8,18.8,79.3,24.3,72.5,24.3z"/>
<path class="st0" d="M41.8,58H0.4V34.1h53.7v11.6C54.1,52.5,48.6,58,41.8,58z"/>
<path class="st0" d="M12,91.7H0.4V67.8h23.9v11.6C24.2,86.2,18.7,91.7,12,91.7z"/>
</g>
<g>
<path class="st0" d="M121.7,77V16.9h36.9v4.2c0,3.7-3,6.8-6.8,6.8h-18.4v13.5H150v3.5c0,4.1-3.3,7.5-7.5,7.5h-9.1v19.1 c0,3-2.5,5.5-5.5,5.5H121.7z"/>
<path class="st0" d="M161.1,64.7c0-2,0.3-3.7,1-5.1c0.7-1.5,1.6-2.7,2.9-3.6c1.3-1,2.7-1.7,4.2-2.3c1.6-0.6,3.3-1,5.4-1.3l11.3-2 v-1.5c0-2-0.5-3.5-1.6-4.6c-1-1.1-2.6-1.6-4.5-1.6s-3.4,0.5-4.6,1.4c-1.2,1-1.8,2.2-1.8,3.8h-10.8c0.3-4.5,1.9-8.2,5.1-11 c3.1-2.8,7.2-4.3,12.3-4.3c5.3,0,9.5,1.3,12.6,4s4.7,6.6,4.7,11.8V77h-4.7c-2.8,0-5.1-2.1-5.5-4.8l-0.1-1.1 c-2.7,4.6-6.9,6.8-12.4,6.8c-3.9,0-7.1-1.2-9.6-3.6C162.4,72,161.1,68.8,161.1,64.7z M172.3,64c0,1.2,0.4,2.1,1.3,2.8 c0.9,0.7,2.1,1,3.7,1c1.4,0,2.7-0.3,3.9-0.9c1.2-0.6,2.2-1.5,3-2.7c1-1.4,1.5-3.2,1.5-5.3v-1.2l-8.7,1.8c-1.6,0.3-2.8,0.8-3.6,1.5 C172.7,61.8,172.3,62.7,172.3,64z"/>
<path class="st0" d="M207,20.9c0-1.8,0.7-3.6,2-4.9c1.3-1.2,2.8-1.9,4.6-1.9c1.8,0,3.6,0.6,4.9,1.9c1.4,1.3,2.1,2.9,2.1,4.8 s-0.7,3.4-2,4.7c-1.3,1.3-2.9,1.9-4.8,1.9s-3.5-0.6-4.8-1.9C207.7,24.2,207.1,22.7,207,20.9z M208.2,77V33.5h11.2v38 c0,3-2.5,5.5-5.5,5.5H208.2z"/>
<path class="st0" d="M230.4,77V33.5h9.6l1.1,6.8c0.8-2.1,2.3-3.9,4.4-5.2c2.1-1.4,4.9-2.1,8.3-2.1v11c-3.5,0-6.4,0.9-8.6,2.6 s-3.4,4.4-3.5,8.1v16.7c0,3-2.5,5.5-5.5,5.5L230.4,77L230.4,77z"/>
<path class="st0" d="M259.6,33.5h11.9l6.6,26.1l0.8,4.6l1-4.6l7.4-26.1h9.9l7.4,26.1l0.9,4.6l0.8-4.6l6.7-26.1h11.9L313,72.9 c-0.7,2.4-3,4.1-5.5,4.1H300l-7.9-25.6L285,73c-0.8,2.3-3,3.9-5.4,3.9h-7L259.6,33.5z"/>
<path class="st0" d="M330.5,20.7c0-1.8,0.7-3.4,2-4.7c1.3-1.3,2.9-1.9,4.8-1.9c1.8,0,3.4,0.6,4.8,1.9c1.3,1.3,2,2.8,2,4.7 c0,1.9-0.7,3.4-2,4.7c-1.3,1.3-2.9,1.9-4.8,1.9s-3.5-0.6-4.8-1.9C331.2,24.2,330.5,22.6,330.5,20.7z M331.7,77V33.5h11.2v38 c0,3-2.5,5.5-5.5,5.5H331.7z"/>
<path class="st0" d="M354.8,77V33.5h9.6l0.9,5.8c1.1-2,2.6-3.6,4.6-4.9c2-1.2,4.4-1.9,7.2-1.9c4.5,0,8,1.4,10.4,4.3 s3.6,6.8,3.6,11.9v22.5c0,3.2-2.6,5.7-5.7,5.7h-5.5V51.4c0-2.5-0.5-4.5-1.6-5.8c-1-1.3-2.6-2-4.6-2c-2.3,0-4.1,0.9-5.5,2.7 c-1.4,1.8-2.2,4.4-2.2,7.9v17.1c0,3.2-2.6,5.7-5.7,5.7L354.8,77L354.8,77z"/>
<path class="st0" d="M399.1,55.2c0-6.4,1.9-11.8,5.7-16.1c3.8-4.3,8.7-6.5,14.5-6.5c2.9,0,5.5,0.5,7.8,1.6s4,2.4,5.2,4.1V14.4 h11.2V77h-4.8c-2.7,0-5-2-5.4-4.7l-0.2-1.2c-3.1,4.5-7.7,6.8-13.9,6.8c-3.8,0-7.3-1-10.4-3s-5.5-4.7-7.2-8.2 C399.9,63.3,399.1,59.4,399.1,55.2z M410.5,55.2c0,3.7,1,6.6,3.1,8.9c2.1,2.3,4.7,3.4,7.8,3.4c2.9,0,5.5-1.1,7.7-3.2 c2.2-2.2,3.3-5.1,3.3-8.8V55c0-2.5-0.6-4.6-1.7-6.5s-2.5-3.2-4.1-4.1s-3.4-1.3-5.2-1.3c-3.1,0-5.7,1.1-7.8,3.4 S410.5,51.6,410.5,55.2z"/>
<path class="st0" d="M452.2,63.8h6.9c2,0,3.7,1.2,4.8,2.9c0.2,0.4,0.6,0.7,0.9,1c1.1,0.9,2.6,1.4,4.5,1.4c1.7,0,3-0.4,4-1.1 c0.9-0.7,1.4-1.8,1.4-3c0-1.4-0.5-2.5-1.6-3.3s-3.2-1.5-6.2-2.1c-4.8-0.8-8.3-2.3-10.5-4.4c-2.3-2.1-3.4-4.9-3.4-8.5 c0-4,1.4-7.4,4.2-10.1c2.8-2.7,6.8-4.1,11.9-4.1c4.6,0,8.4,1.3,11.3,3.8c2.9,2.5,4.5,5.8,4.7,9.9H474c-0.1-3.3-1.7-5-5-5 c-1.5,0-2.7,0.4-3.5,1.2c-0.8,0.8-1.3,1.8-1.3,3.1c0,1.4,0.5,2.4,1.6,3.1s3.1,1.3,6,1.8c5.1,0.9,8.8,2.4,10.9,4.5 c2.2,2.1,3.2,5,3.2,8.7c0,2.4-0.4,4.5-1.3,6.4c-0.9,1.8-2.1,3.3-3.7,4.4c-1.6,1.1-3.3,2-5.3,2.5c-2,0.6-4.1,0.8-6.5,0.8 c-5.3,0-9.4-1.3-12.3-3.8C453.9,71.6,452.3,68.2,452.2,63.8z"/>
</g>
</g>
</svg>
File moved
/*
* This file is generated from FairwindsOps/documentation-template
* DO NOT EDIT MANUALLY
*/
var llcookieless = true;
var sf14gv = 32793;
(function() {
var sf14g = document.createElement('script');
sf14g.src = 'https://lltrck.com/lt-v2.min.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(sf14g, s);
})();
/*
* This file is generated from FairwindsOps/documentation-template
* DO NOT EDIT MANUALLY
*/
document.addEventListener("DOMContentLoaded", function(){
setTimeout(function() {
var link = document.getElementsByClassName('home-link')[0];
linkClone = link.cloneNode(true);
linkClone.href = "https://fairwinds.com";
link.setAttribute('target', '_blank');
link.parentNode.replaceChild(linkClone, link);
}, 1000);
});
/*
* This file is generated from FairwindsOps/documentation-template
* DO NOT EDIT MANUALLY
*/
.github-only {
display: none;
}
.text-primary {
color: $primaryColor;
}
.text-danger {
color: $dangerColor;
}
.text-warning {
color: $warningColor;
}
.text-info {
color: $infoColor;
}
.text-success {
color: $successColor;
}
.theme-default-content:not(.custom),
.page-nav,
.page-edit,
footer {
margin: 0 !important;
}
.theme-default-content:not(.custom) > h2 {
padding-top: 7rem;
}
.navbar .site-name {
display: none;
}
.navbar, .navbar .links {
background-color: $primaryColor !important;
}
.navbar .links a {
color: #fff;
}
.navbar .links a svg {
display: none;
}
img {
border: 5px solid #f7f7f7;
}
.no-border img,
img.no-border,
header img {
border: none;
}
.mini-img {
text-align: center;
}
.theme-default-content:not(.custom) .mini-img img {
max-width: 300px;
}
.page {
padding-bottom: 0 !important;
}
/*
* This file is generated from FairwindsOps/documentation-template
* DO NOT EDIT MANUALLY
*/
$primaryColor = #23103A
$dangerColor = #A0204C
$warningColor = #FF6C00
$infoColor = #8BD2DC
$successColor = #28a745
$accentColor = #FF6C00
$textColor = #2c3e50
$borderColor = #eaecef
$codeBgColor = #282c34
$arrowBgColor = #ccc
$badgeTipColor = #42b983
$badgeWarningColor = darken(#ffe564, 35%)
$badgeErrorColor = #DA5961
// layout
$navbarHeight = 3.6rem
$sidebarWidth = 20rem
$contentWidth = 740px
$homePageWidth = 960px
// responsive breakpoints
$MQNarrow = 959px
$MQMobile = 719px
$MQMobileNarrow = 419px
module.exports = {
extend: '@vuepress/theme-default'
}
<template>
<ParentLayout>
<template #page-bottom>
<div class="custom-footer">
<div class="left-footer">
<a href="https://fairwinds.com" target="_blank">Learn more about Fairwinds</a>
<a href="https://fairwinds.com/insights" target="_blank">Try Fairwinds Insights</a>
</div>
<div class="right-footer">
<a href="https://www.fairwinds.com/privacy-policy" target="_blank">Privacy Policy</a>
</div>
</div>
</template>
</ParentLayout>
</template>
<script>
import ParentLayout from '@parent-theme/layouts/Layout.vue'
export default {
name: 'Layout',
components: {
ParentLayout
}
}
</script>
<style>
div.custom-footer {
display: flex;
justify-content: space-between;
border-top: 1px solid #eaecef;
padding: 2rem 2.5rem;
}
.custom-footer .left-footer {
margin-top: 0 !important;
}
.custom-footer .left-footer a:first-of-type {
margin-right: 1.5rem;
}
.custom-footer a {
color: #4e6e8e;
}
</style>
<div align="center" class="no-border">
<img src="/img/polaris-logo.png" alt="Polaris Logo">
<br>
<h3>Best Practices for Kubernetes Workload Configuration</h3>
<a href="https://github.com/FairwindsOps/polaris">
<img src="https://img.shields.io/static/v1.svg?label=Version&message=1.2.0&color=239922">
</a>
<a href="https://goreportcard.com/report/github.com/FairwindsOps/polaris">
<img src="https://goreportcard.com/badge/github.com/FairwindsOps/polaris">
</a>
<a href="https://circleci.com/gh/FairwindsOps/polaris.svg">
<img src="https://circleci.com/gh/FairwindsOps/polaris.svg?style=svg">
</a>
</div>
Fairwinds' Polaris keeps your clusters sailing smoothly. It runs a variety of checks to ensure that
Kubernetes pods and controllers are configured using best practices, helping you avoid
problems in the future. Polaris can be run in a few different modes:
Polaris can be run in three different modes:
* As a [dashboard](/dashboard), so you can audit what's running inside your cluster.
* As an [admission controller](/admission-controller), so you can automatically reject workloads that don't adhere to your organization's policies.
* As a [command-line tool](/infrastructure-as-code), so you can test local YAML files, e.g. as part of a CI/CD process.
**Want to learn more?** Reach out on [the Slack channel](https://fairwindscommunity.slack.com/messages/polaris) ([request invite](https://join.slack.com/t/fairwindscommunity/shared_invite/zt-e3c6vj4l-3lIH6dvKqzWII5fSSFDi1g)), send an email to `opensource@fairwinds.com`, or join us for [office hours on Zoom](https://fairwindscommunity.slack.com/messages/office-hours)
## Integration with Fairwinds Insights
[Fairwinds Insights](https://www.fairwinds.com/insights?utm_campaign=Hosted%20Polaris%20&utm_source=polaris&utm_term=polaris&utm_content=polaris)
is a platform for auditing Kubernetes clusters and enforcing policy. If you'd like to:
* manage Polaris across a fleet of clusters
* track findings over time
* send results to services like Slack and Datadog
* add additional checks from tools like
[Trivy](https://github.com/aquasecurity/trivy),
[Goldilocks](https://github.com/FairwindsOps/goldilocks/), and
[OPA](https://www.openpolicyagent.org)
you can sign up for a [free account here](https://insights.fairwinds.com?source=polaris).
## Contributing
PRs welcome! Check out the [Contributing Guidelines](/contributing/) and [Code of Conduct](/code-of-conduct) for more information.
## Further Information
A history of changes to this project can be viewed in the [Changelog](/changelog/)
If you'd like to learn more about Polaris, or if you'd like to speak with
a Kubernetes expert, you can contact `info@fairwinds.com` or [visit our website](https://fairwinds.com)
---
<p align="center">
<img src="/img/dashboard-screenshot.png" alt="Polaris Dashboard" width="550"/>
</p>
# Admission Controller
Polaris can be run as an admission controller that acts as a validating webhook.
This accepts the same configuration as the dashboard, and can run the same validations.
The webhook will reject any workloads that trigger a danger-level check.
This is indicative of the greater goal of Polaris, not just to encourage better
configuration through dashboard visibility, but to actually enforce it with this webhook.
Note that Polaris will not alter your workloads, only block workloads that don't conform to the configured policies.
## Installation
### kubectl
```bash
kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/webhook.yaml
```
### Helm
```bash
helm repo add fairwindsops-stable https://charts.fairwindsops.com/stable
helm upgrade --install polaris fairwindsops-stable/polaris --namespace polaris \
--set webhook.enable=true --set dashboard.enable=false
```
## Workload Types
The webhook comes with built-in support for a handful of known controller types,
such as Deployments, Jobs, and DaemonSets. To add new controller types,
you can set `webhook.rules` in the
[Helm chart](https://github.com/FairwindsOps/charts/tree/master/stable/polaris)
## Warnings
Unfortunately we have not found a way to display warnings as part of `kubectl`
output unless we are rejecting a workload altogether.
This means that any checks with a severity of `warning` will still pass webhook validation,
and the only evidence of that warning will either be in the Polaris dashboard or the
Polaris webhook logs. This will change in a future version of Kubernetes.
# x.x.x (next release)
---
sidebarDepth: 0
---
## Upcoming
* Standardize categories of checks into Security, Reliability, and Efficiency
# 1.2.1
## 1.2.1
* Update date on dashboard footer
# 1.2.0
## 1.2.0
* Add ability to audit a single workload
* Enable `pullPolicyAlways` by default
* Fix for finding parent resources
# 1.1.1
## 1.1.1
* Show controller checks on dashboard
* Fix for orphaned pods w/ controller checks
# 1.1.0
## 1.1.0
* Add namespace filter in UI
* Add priorityClass check
* Support reading from STDIN
......@@ -23,92 +26,92 @@
* Fixed case where parent resources trigger error
* Fixed UI zero-state
# 1.0.3
## 1.0.3
* Fixed case where parent resources trigger error
* Fixed dashboard link when `--base-path` is set
# 1.0.2
## 1.0.2
* Fixed case where custom CRDs are not covered by RBAC
# 1.0.1
## 1.0.1
* Added ARM binaries to releases
# 1.0.0
## New Features
## 1.0.0
### New Features
* Added support for custom checks using JSON Schema
* Added support for arbitrary controllers, rather than a pre-configured set
* removed support for `controllers_to_scan` in config
* Added the ability to exempt a particular controller from a particular check.
* Docker image now includes the default config
## Breaking Changes
* Breaking changes in both input and output formats. See [Examples](/examples) for examples of the new formats.
### Breaking Changes
* Breaking changes in both input and output formats. See [Examples](https://github.com/FairwindsOps/polaris/tree/master/examples) for examples of the new formats.
* removed config-level configuration for checks like max/min memory settings
* changed severity `error` to `danger`
* Breaking changes [to the CLI](/docs/usage.md#cli-options)
* Breaking changes to the CLI
* CLI flag `--set-exit-code-on-error` is now `--set-exit-code-on-danger`
* Flags `--version`, `--dashboard`, `--webhook`, and `--audit` are now arguments
* Port flags are now just `--port`
# 0.6.0
## 0.6.0
* Fixed webhook support in Kubernetes 1.16
* this also removes support for 1.8
* Added support for exemptions via controller annotations
# 0.5.2
## 0.5.2
* Fixed missing success messages for resource requests/limits
# 0.5.1
## 0.5.1
* Added a few more exemptions
* Started checking exemptions based on controller name prefix
* `runAsUser != 0` now passes the `runAsNonRoot` check
# 0.5.0
## 0.5.0
* Added `--load-audit-file` flag to run the dashboard from an existing audit
* Added an `ID` field to each check in the output
* Skip health checks for jobs, cronjobs, initcontainers
* Added support for exemptions
* Fixed dashboard base path option
# 0.4.0
## 0.4.0
* Added additional Pod Controllers to scan PodSpec (`jobs`, `cronjobs`, `daemonsets`, `replicationcontrollers`)
# 0.3.1
## 0.3.1
* Changed dashboard branding to refer to new org name Fairwinds
# 0.3.0
## 0.3.0
* Added `--set-exit-code-on-error` and `--set-exit-code-below-score` flags to better support CI/CD
# 0.2.1
## 0.2.1
* [Fix](https://github.com/FairwindsOps/polaris/issues/146): Fixed logic on RunAsNonRoot check to incorporate settings in podSpec
# 0.2.0
## 0.2.0
* Added `--output-format` flag for better CI/CD support
* Added `--display-name` flag
* Added support for StatefulSets
* Show error message if no kubeconfig is set
# 0.1.5
## 0.1.5
* [Fix](https://github.com/FairwindsOps/polaris/issues/125): ignore limits/requests for initContainers
* [Fix](https://github.com/FairwindsOps/polaris/issues/132): support custom base path
# 0.1.4
## 0.1.4
* [Fix](https://github.com/FairwindsOps/polaris/issues/116): details pages getting template errors
* [Fix](https://github.com/FairwindsOps/polaris/issues/114): support all auth providers
* [Fix](https://github.com/FairwindsOps/polaris/issues/112): Ignore readiness probe for initContainers
# 0.1.3
## 0.1.3
* [Fix](https://github.com/FairwindsOps/polaris/issues/109): dashboard not updating when running persistently
# 0.1.2
## 0.1.2
* Stored all third-party assets (e.g. Charts.js) to local files to support offline dashboard viewing
* Fix: custom configs in `ConfigMap` not respected
# 0.1.1
## 0.1.1
* [Fix](https://github.com/FairwindsOps/polaris/issues/93): missing `config.yaml` and dashboard assets in binary releases
* Added some tests and better error handling
# 0.1.0
## 0.1.0
* Dashboard fully functional
* Validating webhook functional, but still considered beta
* Checks:
......
# Efficiency
Polaris supports a number of checks related to CPU and Memory requests and limits.
These checks ensure that CPU and memory settings are configured, so that
Kubernetes can schedule your workload effectively.
## Presence Checks
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment