add some exemptions for kube-system (FairwindsOps#292)

michaelniemand · May 18, 2020 · cf10a96 · cf10a96
1 parent c571b97
commit cf10a96
Showing 1 changed file with 41 additions and 0 deletions.
diff --git a/examples/config.yaml b/examples/config.yaml
@@ -22,7 +22,48 @@ checks:
  runAsPrivileged: error
  dangerousCapabilities: error
  insecureCapabilities: warning
+
 exemptions:
+ - controllerNames:
+ - kube-apiserver
+ - kube-proxy
+ - kube-scheduler
+ - etcd-manager-events
+ - kube-controller-manager
+ - kube-dns
+ - etcd-manager-main
+ rules:
+ - hostPortSet
+ - hostNetworkSet
+ - readinessProbeMissing
+ - livenessProbeMissing
+ - cpuRequestsMissing
+ - cpuLimitsMissing
+ - memoryRequestsMissing
+ - memoryLimitsMissing
+ - runAsRootAllowed
+ - runAsPrivileged
+ - notReadOnlyRootFilesystem
+ - hostPIDSet
+
+ - controllerNames:
+ - kube-flannel-ds
+ rules:
+ - notReadOnlyRootFilesystem
+ - runAsRootAllowed
+ - notReadOnlyRootFilesystem
+ - readinessProbeMissing
+ - livenessProbeMissing
+ - cpuLimitsMissing
+
+ - controllerNames:
+ - vpa
+ rules:
+ - runAsRootAllowed
+ - readinessProbeMissing
+ - livenessProbeMissing
+ - notReadOnlyRootFilesystem
+
  - controllerNames:
  - dns-controller
  - datadog-datadog