adding feature for apparmor annotation

score/apparmor/apparmor.go

@@ -0,0 +1,31 @@
+package apparmor
+
+import (
+ "strings"
+
+ "github.com/zegl/kube-score/score/checks"
+ "github.com/zegl/kube-score/scorecard"
+ appsv1 "k8s.io/api/apps/v1"
+)
+
+func Register( allChecks *checks.Checks ) {
+ allChecks.RegisterDeploymentCheck( "Deployment sets apparmor annotation", `Makes sure that all Deployments set apparmor annotation`, deploymentHas() )
+}
+
+func deploymentHas() func( appsv1.Deployment ) ( scorecard.TestScore, error ) {
+ return func( deployment appsv1.Deployment ) ( score scorecard.TestScore, err error ) {
+ if armor, found := deployment.Spec.Template.GetObjectMeta().GetAnnotations()[ "container.apparmor.security.beta.kubernetes.io" ]; found {
+ if strings.Index( armor, "localhost/docker-default" ) != -1 {
+ score.Grade = scorecard.GradeAlmostOK
+ score.AddComment( "", "apparmor annotation is set:", "It is recommended to not use docker-default and instead customize a profile" )
+ return
+ }
+ score.Grade = scorecard.GradeAllOK
+ score.AddComment( "", "apparmor annotation is set:", armor )
+ return
+ }
+ score.Grade = scorecard.GradeCritical
+ score.AddComment( "", "apparmor annotation is not set", "It is recommended to set apparmor annotation and customize a profile" )
+ return
+ }
+}

score/apparmor_test.go

@@ -0,0 +1,13 @@
+package score
+
+import "testing"
+
+func TestApparmorAnnotation(t *testing.T) {
+ testExpectedScore(t, "deployment-sets-apparmor.yaml", "Deployment sets apparmor annotation", 10)
+}
+func TestNoApparmorAnnotation(t *testing.T) {
+ testExpectedScore(t, "deployment-sets-no-apparmor.yaml", "Deployment sets apparmor annotation", 1)
+}
+func TestDefaultApparmorAnnotation(t *testing.T) {
+ testExpectedScore(t, "deployment-sets-default-apparmor.yaml", "Deployment sets apparmor annotation", 7)
+}

score/score.go

@@ -4,6 +4,7 @@ import (
  "github.com/zegl/kube-score/config"
  ks "github.com/zegl/kube-score/domain"
  "github.com/zegl/kube-score/score/apps"
+ "github.com/zegl/kube-score/score/apparmor"
  "github.com/zegl/kube-score/score/checks"
  "github.com/zegl/kube-score/score/container"
  "github.com/zegl/kube-score/score/cronjob"
@@ -33,6 +34,7 @@ func RegisterAllChecks(allObjects ks.AllTypes, cnf config.Configuration) *checks
  service.Register(allChecks, allObjects, allObjects)
  stable.Register(allChecks)
  apps.Register(allChecks)
+ apparmor.Register(allChecks)
  meta.Register(allChecks)
 
  return allChecks

score/testdata/deployment-sets-apparmor.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: my-service
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: my-service
+ template:
+ metadata:
+ annotations:
+ container.apparmor.security.beta.kubernetes.io: localhost/docker-custom
+ labels:
+ app: my-service
+ spec:
+ containers:
+ - name: my-service
+ image: "alpine:latest"
+ imagePullPolicy: Always
+ ports:
+ - containerPort: 8080
+ protocol: TCP
+ name: "http-node"
+ resources:
+ limits:
+ cpu: 50m
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 128Mi

score/testdata/deployment-sets-default-apparmor.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: my-service
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: my-service
+ template:
+ metadata:
+ annotations:
+ container.apparmor.security.beta.kubernetes.io: localhost/docker-default
+ labels:
+ app: my-service
+ spec:
+ containers:
+ - name: my-service
+ image: "alpine:latest"
+ imagePullPolicy: Always
+ ports:
+ - containerPort: 8080
+ protocol: TCP
+ name: "http-node"
+ resources:
+ limits:
+ cpu: 50m
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 128Mi

score/testdata/deployment-sets-no-apparmor.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: my-service
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: my-service
+ template:
+ metadata:
+ labels:
+ app: my-service
+ spec:
+ containers:
+ - name: my-service
+ image: "alpine:latest"
+ imagePullPolicy: Always
+ ports:
+ - containerPort: 8080
+ protocol: TCP
+ name: "http-node"
+ resources:
+ limits:
+ cpu: 50m
+ memory: 128Mi
+ requests:
+ cpu: 50m
+ memory: 128Mi