.polaris.yaml

checks:
  # reliability
  deploymentMissingReplicas: ignore
  priorityClassNotSet: ignore
  tagNotSpecified: danger
  pullPolicyNotAlways: ignore
  readinessProbeMissing: danger
  livenessProbeMissing: danger
  metadataAndInstanceMismatched: ignore
  pdbDisruptionsIsZero: warning
  missingPodDisruptionBudget: ignore
  topologySpreadConstraint: ignore

  # efficiency
  cpuRequestsMissing: ignore
  cpuLimitsMissing: ignore
  memoryRequestsMissing: ignore
  memoryLimitsMissing: ignore

  # security
  # kics-scan ignore-line
  automountServiceAccountToken: ignore
  hostIPCSet: danger
  hostPIDSet: danger
  linuxHardening: danger
  missingNetworkPolicy: ignore
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
  insecureCapabilities: warning
  hostNetworkSet: danger
  hostPortSet: warning
  tlsSettingsMissing: warning
  sensitiveContainerEnvVar: ignore
  sensitiveConfigmapContent: danger
  clusterrolePodExecAttach: danger
  rolePodExecAttach: danger
  clusterrolebindingPodExecAttach: danger
  rolebindingClusterRolePodExecAttach: danger
  rolebindingRolePodExecAttach: danger
  clusterrolebindingClusterAdmin: danger
  rolebindingClusterAdminClusterRole: danger
  rolebindingClusterAdminRole: danger