Skip to content

Commit 2477880

Browse files
BernieWhiteBernieWhite
authored
Update deployment rules #13 #12 #5 #18 #19 #20 #21 (#22)
1 parent afe5e24 commit 2477880

37 files changed

Lines changed: 644 additions & 114 deletions

‎.azure-pipelines/azure-pipelines.yaml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ variables:
55
version: '0.1.0'
66
buildConfiguration: 'Release'
77

8-
# Use build number format, i.e. 0.1.0-B181101
9-
name: $(version)-B$(date:yyMM)$(rev:rr)
8+
# Use build number format, i.e. 0.1.0-B1811001
9+
name: $(version)-B$(date:yyMM)$(rev:rrr)
1010

1111
trigger:
1212
branches:
@@ -32,10 +32,10 @@ stages:
3232
matrix:
3333
Linux:
3434
displayName: 'Linux'
35-
imageName: 'ubuntu-16.04'
35+
imageName: 'ubuntu-latest'
3636
MacOS:
3737
displayName: 'MacOS'
38-
imageName: 'macos-10.13'
38+
imageName: 'macOS-latest'
3939
Windows:
4040
displayName: 'Windows'
4141
imageName: 'vs2017-win2016'
@@ -102,11 +102,9 @@ stages:
102102
condition: eq(variables['coverage'], 'true')
103103

104104
# Generate artifacts
105-
- task: PublishPipelineArtifact@0
105+
- publish: out/modules/PSRule.Rules.Kubernetes
106106
displayName: 'Publish module'
107-
inputs:
108-
artifactName: PSRule.Rules.Kubernetes
109-
targetPath: out/modules/PSRule.Rules.Kubernetes
107+
artifact: PSRule.Rules.Kubernetes
110108
condition: and(succeeded(), eq(variables['publish'], 'true'))
111109

112110
# Release pipeline
@@ -118,7 +116,7 @@ stages:
118116
- job:
119117
displayName: Live
120118
pool:
121-
vmImage: 'ubuntu-16.04'
119+
vmImage: 'ubuntu-latest'
122120
variables:
123121
isPreRelease: $[contains(variables['Build.SourceBranchName'], '-B')]
124122
steps:

‎.vscode/settings.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,8 @@
2929
"text",
3030
"yaml",
3131
"yml"
32-
]
32+
],
33+
"yaml.schemas": {
34+
"kubernetes": "/tests/PSRule.Rules.Kubernetes.Tests/Resources.*.yaml"
35+
}
3336
}

‎.vscode/tasks.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@
2323
"label": "coverage",
2424
"type": "shell",
2525
"command": "Invoke-Build Test -CodeCoverage",
26-
"problemMatcher": [ "$pester" ],
26+
"problemMatcher": [
27+
"$pester"
28+
],
2729
"presentation": {
2830
"clear": true,
2931
"panel": "dedicated"

‎CHANGELOG.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,16 @@
1+
# Change log
12

23
## Unreleased
34

4-
- Update metadata rule to align to recommended labels. [#14](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/14)
5+
- Fixed `Kubernetes.AKS.PublicLB` handling of internal LB annotation. [#17](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/17)
6+
- Updated metadata rule to align to recommended labels. [#14](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/14)
7+
- Expanded deployment rules to include pods and replica sets. [#13](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/13)
8+
- Added rule documentation. [#5](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/5)
9+
- Added new rule `Kubernetes.API.Removal` to check for use of removed APIs. [#18](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/18)
10+
- Added new rule `Kubernetes.Pod.Secrets` to check if sensitive environment variables are used. [#19](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/19)
11+
- Added new rule `Kubernetes.Pod.Health` to check health probes are used. [#20](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/20)
12+
- Added new rule `Kubernetes.Pod.Replicas` to check if more then one replica is used. [#21](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/21)
13+
- **Breaking change**: Renamed deployment rules to relate to pods. [#12](https://github.com/BernieWhite/PSRule.Rules.Kubernetes/issues/12)
514

615
## v0.1.0-B190521 (pre-release)
716

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ Invoke-PSRule -Module PSRule.Rules.Kubernetes -InputObject (kubectl get services
4242

4343
The following rules are included in the `PSRule.Rules.Kubernetes` module:
4444

45-
- [PSRule.Rules.Kubernetes](docs/rules/en-US/Kubernetes.md)
45+
- [PSRule.Rules.Kubernetes](docs/rules/en-US/module.md)
4646

4747
## Changes and versioning
4848

‎RuleToc.Doc.ps1‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,21 @@
11

2-
Document 'Kubernetes' {
3-
Title 'Kubernetes rules'
2+
Document 'module' {
3+
Title 'Module rules'
44

5-
Get-PSRule -WarningAction SilentlyContinue | Table -Property @{ Name = 'RuleName'; Expression = {
6-
"[$($_.RuleName)]($($_.RuleName).md)"
7-
}}, Description
5+
Import-Module .\out\modules\PSRule.Rules.Kubernetes
6+
$rules = Get-PSRule -Module PSRule.Rules.Kubernetes -WarningAction SilentlyContinue
7+
8+
Section 'Baselines' {
9+
# 'The following baselines are included in `PSRule.Rules.Kubernetes`.'
10+
}
11+
12+
Section 'Rules' {
13+
'The following rules are included in `PSRule.Rules.Kubernetes`.'
14+
15+
$rules | Table -Property @{ Name = 'RuleName'; Expression = {
16+
"[$($_.RuleName)]($($_.RuleName).md)"
17+
}}, Description, @{ Name = 'Category'; Expression = {
18+
$_.Tag.category
19+
}}
20+
}
821
}

‎docs/rules/en-US/Kubernetes.AKS.PublicLB.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
severity: Critical
3+
category: Service exposure
4+
online version: https://github.com/BernieWhite/PSRule.Rules.Kubernetes/blob/master/docs/rules/en-US/Kubernetes.AKS.PublicLB.md
5+
---
6+
7+
# Use internal load balancer
8+
9+
## SYNOPSIS
10+
11+
Use internal Azure load balancers.
12+
13+
## DESCRIPTION
14+
15+
When creating a load balanced service, by default AKS will create and attach an Azure load balancer with a public IP address.
16+
Creating a load balancer with a public IP address may allow Internet clients to connect to applications running on AKS.
17+
18+
To create a load balanced service with an internal load balancer use the annotation `service.beta.kubernetes.io/azure-load-balancer-internal: "true"`.
19+
When this annotation is used on a load balanced service, the Azure load balancer will only be assigned a private IP address.
20+
21+
## RECOMMENDATION
22+
23+
Consider creating services with an internal load balancer instead of a public load balancer.

‎docs/rules/en-US/Kubernetes.API.Removal.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
severity: Important
3+
category: Resource APIs
4+
online version: https://github.com/BernieWhite/PSRule.Rules.Kubernetes/blob/master/docs/rules/en-US/Kubernetes.API.Removal.md
5+
---
6+
7+
# Use supported APIs
8+
9+
## SYNOPSIS
10+
11+
Avoid using legacy API endpoints.
12+
13+
## DESCRIPTION
14+
15+
In Kubernetes v1.16.0 a number of previously deprecated API endpoints have been removed.
16+
These removed endpoints will no longer work for new deployments after upgrading to Kubernetes v1.16.0 or greater.
17+
18+
To prevent deployment issues use the newer API endpoints for these resources.
19+
20+
- NetworkPolicy should use `networking.k8s.io/v1`.
21+
- PodSecurityPolicy should use `policy/v1beta1`.
22+
- DaemonSet, Deployment, StatefulSet, and ReplicaSet should use `apps/v1`.
23+
24+
## RECOMMENDATION
25+
26+
Consider updating resource deployments to use newer API endpoints prior to upgrading to Kubernetes >= v1.16.0.
27+
28+
## LINKS
29+
30+
- [Kubernetes v1.15.0 deprecations and removals](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#deprecations-and-removals)

‎docs/rules/en-US/Kubernetes.Metadata.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ Use Kubernetes common labels.
1212

1313
## DESCRIPTION
1414

15-
Kubernetes defines a common set of labels that are recommended for tool interoperability. These labels should be used to consistently apply standard metadata.
15+
Kubernetes defines a common set of labels that are recommended for tool interoperability.
16+
These labels should be used to consistently apply standard metadata.
1617

1718
## RECOMMENDATION
1819

‎docs/rules/en-US/Kubernetes.Pod.Health.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
severity: Important
3+
online version: https://github.com/BernieWhite/PSRule.Rules.Kubernetes/blob/master/docs/rules/en-US/Kubernetes.Pod.Health.md
4+
---
5+
6+
# Use probes
7+
8+
## SYNOPSIS
9+
10+
Containers should use liveness and readiness probes.
11+
12+
## DESCRIPTION
13+
14+
Just like any other application, container applications may take time to start, fail during startup or operation.
15+
Kubernetes provides a way for the cluster to determine if each container is ready to respond to requests.
16+
This is accomplished through liveness and readiness probes.
17+
18+
## RECOMMENDATION
19+
20+
Containers should use liveness and readiness probes.
21+
22+
## LINKS
23+
24+
- [Configure Liveness, Readiness and Startup Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)

0 commit comments

Comments
 (0)