Vyom-Yadav

Generic Policies For Enhancing Security Posture

1. check-deprecated-apis
2. disallow-container-sock-mounts
3. disallow-empty-ingress-host
4. disallow-latest-tag
5. restrict-nodeport
6. require-requests-limits
7. require-pod-probes
8. drop-cap-net-raw

Vyom-Yadav

❯ ./karmor recommend
INFO[0000] Found outdated version of policy-templates    Current Version=v0.0.1
INFO[0000] Downloading latest version [v0.1.9]          
INFO[0002] policy-templates updated                      Updated Version=v0.1.9
INFO[0002] pulling image                                 image="accuknox/knoxautopolicy:stable"
stable: Pulling from accuknox/knoxautopolicy
Digest: sha256:f0faa8950563e09f8a6880774bf8e9b2a9c25e2d4d380d61c052dbb15be5d975
Status: Image is up to date for accuknox/knoxautopolicy:stable
INFO[0007] dumped image to tar                           tar=/tmp/karmor249792473/YSqOziIe.tar
Distribution ubuntu

Vyom-Yadav

[INFO] Error stacktraces are turned on.
[INFO] Scanning for projects...
[INFO] Inspecting build with total of 1 modules...
[INFO] Installing Nexus Staging features:
[INFO]   ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
[INFO] 
[INFO] ------------------< com.puppycrawl.tools:checkstyle >-------------------
[INFO] Building checkstyle 10.7.1-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 

Vyom-Yadav

[INFO] Error stacktraces are turned on.
[INFO] Scanning for projects...
[INFO] Inspecting build with total of 1 modules...
[INFO] Installing Nexus Staging features:
[INFO]   ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
[INFO] 
[INFO] ------------------< com.puppycrawl.tools:checkstyle >-------------------
[INFO] Building checkstyle 10.7.1-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 

Vyom-Yadav

LFX Mentorship Fall 2022

More support for subresources (Documentation Changes)

1. New pattern for specifying match.(any/all).resources.kinds-

Supported formats:

• Group/Version/Kind

Vyom-Yadav

LFX Mentorship Fall 2022

More support for subresources

flowchart TB
subgraph ide1 [policy/validate.go]
    A["validateKinds(..), Background scanning not allowed for subresources"]
end

Vyom-Yadav

Project Requirements

Vyom-Yadav

Google Summer of Code 2022 Final Report

Project - Practice What You Preach

Student - Vyom Yadav

Organisation - Checkstyle

Mentors - Nick Mancuso, Roman Ivanov, Richard Veach, Baratali Izmailov, Pavel Bludov

Vyom-Yadav

java.lang.AssertionError: Architecture Violation [Priority: MEDIUM] - Rule 'slices matching 'com.puppycrawl.tools.checkstyle.(**)' should be free of cycles' was violated (15 times):
Cycle detected: Slice api -> 
                Slice checks.naming -> 
                Slice api
  1. Dependencies of Slice api
    - Field <com.puppycrawl.tools.checkstyle.api.AutomaticBean$RelaxedAccessModifierArrayConverter.EMPTY_MODIFIER_ARRAY> depends on component type <com.puppycrawl.tools.checkstyle.checks.naming.AccessModifierOption> in (AutomaticBean.java:0)
    - Method <com.puppycrawl.tools.checkstyle.api.AutomaticBean.registerCustomTypes(org.apache.commons.beanutils.ConvertUtilsBean)> depends on component type <com.puppycrawl.tools.checkstyle.checks.naming.AccessModifierOption> in (AutomaticBean.java:168)
    - Method <com.puppycrawl.tools.checkstyle.api.AutomaticBean$RelaxedAccessModifierArrayConverter.convert(java.lang.Class, java.lang.Object)> calls method <com.puppycrawl.tools.checkstyle.checks.naming.AccessModifier

Vyom-Yadav

In short, the logical branch names should match between the build configuration and the versioned settings root.

Your versioned settings root and the root attached to the [PR configuration](https://teamcity.jetbrains.com/admin/editBuildTypeVcsRoots.html?init=1&id=buildType:Checkstyle_IdeaInspectionsPullRequest&_gl=1*mduotk*_ga*MTYzMTM1MzI2MS4xNjU5Nzc1MzUw*_ga_9J976DJZ68*MTY2MDk3NzYwNS4x