search

datreeio / datree

Prevent Kubernetes misconfigurations from reaching production (again 😤 )! From code to cloud, Datree provides an E2E policy enforcement solution to run automatic checks for rule violations. See our docs: https://hub.datree.io
https://datree.io
Apache License 2.0
6.39k stars 363 forks source link

Print rule name in CLI output needed for skip rule annotations #729

Open HariSekhon opened 2 years ago

HariSekhon commented 2 years ago

When you get a policy rule violation output in the CLI or CI/CD, it would be nice if it printed the rule name needed to set an ignore - relates to #726.

This would save having to go to the dashboard, figure out which rule it is, and click the i for information to get the rule name to put into an ignore annotation.

adifayer commented 2 years ago

@HariSekhon I get your point, though I wonder if presenting this identifier can create more noise than value, since it's relevant mainly for users that have Policy-As-Code mode on, or users that want to skip a rule, therefore it may confuse other users.

I suggest that we add the PAC identifier to the output when using the --verbose flag, that way each user can decide whether to have it or not. WDYT?

HariSekhon commented 2 years ago

Agreed, this should probably be in the first level of verbose mode.

adifayer commented 2 years ago

These are the product requirements:

Is your feature request related to a problem? Please describe. Skipping a rule on a specific resource is done by adding an annotation in the manifest. The annotation syntax is the following: datree.skip/[identifier] while the identifier is the unique rule identifier (policy as code identifier). The PAC identifier is available only within the dashboard, which creates an extra step to the process of skipping a rule.

Describe the solution you'd like When passing the --verbose flag within datree test run, display each rule's Policy-as-code. Output example:

❌  Ensure each container image has a pinned (tag) version  [9 occurrences]
      Policy as code identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
      How to fix: https://hub.datree.io/ensure-image-pinned-version
       - metadata.name: N/A (kind: Pod)
💡  Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
Meyazhagan commented 1 year ago

@adifayer @eyarz shall I work on this