Shopify / kubeaudit

kubeaudit helps you audit your Kubernetes clusters against common security controls
MIT License
1.89k stars 183 forks source link

support for new override labels #527

Closed dani-santos-code closed 1 year ago

dani-santos-code commented 1 year ago
Description

This PR addresses feedback from the kubernetes community on using unregistered annotations.

We have purchased a domain (kubeaudit.io) as suggested for our own purpose: override labels.

Backwards compatibility testing

This should be backwards compatible. I added 3 tests for the 3 old labels that should capture that. I also ran kubeaudit locally using both the old and the new labels and correctly applied the override label. I also tested using a random label (e.g kubeau.io) and it didn't work, as expected. šŸŽ‰

Deprecation Warning

Now we print a general deprecation warning to let users know that it will be deprecated.

Screenshot 2023-02-24 at 2 55 05 PM Screenshot 2023-02-24 at 3 00 53 PM

Actual deprecation

Left comments in the code base with TODOs so we can come back and delete the deprecated annotations when we think it's the right time. When should we do so?

Fixes # https://github.com/Shopify/kubeaudit/issues/457

Type of change
Checklist:
dani-santos-code commented 1 year ago

@genevieveluyt

Excellent point and great suggestions! Thank you! ā¤ļø

I like kubeaudit.io/[override identifier] for pod and namespace resources, which allow for adding labels, but container.kubeaudit.io/[container name].[override identifier] for container annotations!

applied your feedback here: https://github.com/Shopify/kubeaudit/pull/527/commits/896f2b6e50553209a65958a9a8edfc07f02f50c8

more specifically: https://github.com/Shopify/kubeaudit/blob/896f2b6e50553209a65958a9a8edfc07f02f50c8/pkg/override/override.go