.polaris.yaml

checks:
  # reliability
  deploymentMissingReplicas: ignore
  priorityClassNotSet: ignore
  tagNotSpecified: danger
  pullPolicyNotAlways: ignore
  readinessProbeMissing: warning
  livenessProbeMissing: warning
  metadataAndInstanceMismatched: ignore
  pdbDisruptionsIsZero: warning
  missingPodDisruptionBudget: ignore
  topologySpreadConstraint: ignore

  # efficiency
  cpuRequestsMissing: danger
  cpuLimitsMissing: danger
  memoryRequestsMissing: danger
  memoryLimitsMissing: danger

  # security
  automountServiceAccountToken: danger
  hostIPCSet: danger
  hostPIDSet: danger
  linuxHardening: danger
  missingNetworkPolicy: ignore
  notReadOnlyRootFilesystem: warning
  privilegeEscalationAllowed: danger
  runAsRootAllowed: danger
  runAsPrivileged: danger
  dangerousCapabilities: danger
  insecureCapabilities: danger
  hostNetworkSet: danger
  hostPortSet: danger
  tlsSettingsMissing: ignore
  sensitiveContainerEnvVar: ignore
  sensitiveConfigmapContent: danger
  clusterrolePodExecAttach: danger
  rolePodExecAttach: danger
  clusterrolebindingPodExecAttach: danger
  rolebindingClusterRolePodExecAttach: warning
  rolebindingRolePodExecAttach: warning
  clusterrolebindingClusterAdmin: danger
  rolebindingClusterAdminClusterRole: warning
  rolebindingClusterAdminRole: danger