Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Farhood
|
7271d62077 | ||
|
Chris Farhood
|
87fc96e691 |
@@ -1,3 +0,0 @@
|
|||||||
module.exports = {
|
|
||||||
extends: ['@headlamp-k8s/eslint-config'],
|
|
||||||
};
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
name: AI Code Review
|
|
||||||
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
ai-review:
|
|
||||||
name: AI Code Review
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
container:
|
|
||||||
image: catthehacker/ubuntu:act-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: AI Review
|
|
||||||
uses: Nikita-Filonov/ai-review@v0.56.0
|
|
||||||
with:
|
|
||||||
review-command: run
|
|
||||||
env:
|
|
||||||
LLM__PROVIDER: "OPENAI"
|
|
||||||
LLM__META__MODEL: ${{ vars.AI_REVIEW_MODEL }}
|
|
||||||
LLM__META__MAX_TOKENS: "15000"
|
|
||||||
LLM__META__TEMPERATURE: "0.3"
|
|
||||||
LLM__HTTP_CLIENT__API_URL: "https://api.openai.com/v1"
|
|
||||||
LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.OPENAI_API_KEY }}
|
|
||||||
VCS__PROVIDER: "GITEA"
|
|
||||||
VCS__PIPELINE__OWNER: ${{ github.repository_owner }}
|
|
||||||
VCS__PIPELINE__REPO: ${{ github.event.repository.name }}
|
|
||||||
VCS__PIPELINE__PULL_NUMBER: ${{ github.event.pull_request.number }}
|
|
||||||
VCS__HTTP_CLIENT__API_URL: ${{ github.server_url }}/api/v1
|
|
||||||
VCS__HTTP_CLIENT__API_TOKEN: ${{ secrets.AI_REVIEW_GITEA_TOKEN }}
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
name: CI
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
pull_request:
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
lint:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
container: node:20
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: Install dependencies
|
|
||||||
run: npm ci
|
|
||||||
|
|
||||||
- name: Build
|
|
||||||
run: npx @kinvolk/headlamp-plugin build
|
|
||||||
|
|
||||||
- name: Lint
|
|
||||||
run: npx eslint --ext .ts,.tsx src/
|
|
||||||
|
|
||||||
- name: Type-check
|
|
||||||
run: npx tsc --noEmit
|
|
||||||
|
|
||||||
- name: Format check
|
|
||||||
run: npx prettier --check src/
|
|
||||||
+14
-157
@@ -12,174 +12,31 @@ jobs:
|
|||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Check if release is already finalized
|
|
||||||
run: |
|
|
||||||
VERSION=${GITHUB_REF_NAME#v}
|
|
||||||
TARBALL_URL="https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/${GITHUB_REF_NAME}/headlamp-polaris-plugin-${VERSION}.tar.gz"
|
|
||||||
HTTP_CODE=$(curl -sL -o /tmp/release.tar.gz -w "%{http_code}" "$TARBALL_URL" 2>/dev/null)
|
|
||||||
if [ "$HTTP_CODE" = "200" ]; then
|
|
||||||
ACTUAL="sha256:$(sha256sum /tmp/release.tar.gz | awk '{print $1}')"
|
|
||||||
EXPECTED=$(grep 'archive-checksum' artifacthub-pkg.yml | awk '{print $2}')
|
|
||||||
echo "Release tarball checksum: $ACTUAL"
|
|
||||||
echo "Metadata checksum: $EXPECTED"
|
|
||||||
if [ "$ACTUAL" = "$EXPECTED" ]; then
|
|
||||||
echo "SKIP_BUILD=true" >> $GITHUB_ENV
|
|
||||||
echo "Checksums match - release is finalized, nothing to do"
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
echo "No existing release (HTTP $HTTP_CODE) - will build"
|
|
||||||
fi
|
|
||||||
rm -f /tmp/release.tar.gz
|
|
||||||
|
|
||||||
- name: Install dependencies
|
- name: Install dependencies
|
||||||
run: |
|
run: npm ci
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
npm ci
|
|
||||||
|
|
||||||
- name: Build plugin
|
- name: Build plugin
|
||||||
run: |
|
run: npx @kinvolk/headlamp-plugin build
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
npx @kinvolk/headlamp-plugin build
|
|
||||||
|
|
||||||
- name: Package tarball
|
- name: Package tarball
|
||||||
run: |
|
run: npx @kinvolk/headlamp-plugin package
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
npx @kinvolk/headlamp-plugin package
|
|
||||||
|
|
||||||
- name: Compute tarball checksum
|
|
||||||
run: |
|
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
TARBALL=$(ls *.tar.gz)
|
|
||||||
CHECKSUM=$(sha256sum "$TARBALL" | awk '{print $1}')
|
|
||||||
echo "TARBALL=$TARBALL" >> $GITHUB_ENV
|
|
||||||
echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
|
|
||||||
echo "Tarball: $TARBALL"
|
|
||||||
echo "Checksum: sha256:$CHECKSUM"
|
|
||||||
|
|
||||||
- name: Install Docker CLI
|
- name: Install Docker CLI
|
||||||
run: |
|
run: apt-get update && apt-get install -y docker.io
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
apt-get update && apt-get install -y docker.io
|
|
||||||
|
|
||||||
- name: Build and push Docker image
|
- name: Build Docker image
|
||||||
|
run: docker build -t git.farh.net/${{ github.repository }}:${{ github.ref_name }} -t git.farh.net/${{ github.repository }}:latest .
|
||||||
|
|
||||||
|
- name: Push Docker image
|
||||||
run: |
|
run: |
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
docker build -t git.farh.net/${{ github.repository }}:${{ github.ref_name }} -t git.farh.net/${{ github.repository }}:latest .
|
|
||||||
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
|
||||||
docker push git.farh.net/${{ github.repository }}:${{ github.ref_name }}
|
docker push git.farh.net/${{ github.repository }}:${{ github.ref_name }}
|
||||||
docker push git.farh.net/${{ github.repository }}:latest
|
docker push git.farh.net/${{ github.repository }}:latest
|
||||||
|
|
||||||
- name: Create Gitea release
|
- name: Create release
|
||||||
run: |
|
uses: akkuman/gitea-release-action@v1
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
with:
|
||||||
API_URL="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
|
files: |
|
||||||
# Create release (or get existing)
|
*.tar.gz
|
||||||
RELEASE=$(curl -s -X POST \
|
token: ${{ github.token }}
|
||||||
-H "Authorization: token ${{ github.token }}" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
"${API_URL}/releases" \
|
|
||||||
-d "{\"tag_name\":\"${GITHUB_REF_NAME}\",\"name\":\"${GITHUB_REF_NAME}\"}")
|
|
||||||
RELEASE_ID=$(echo "$RELEASE" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
|
||||||
if [ "$RELEASE_ID" = "undefined" ]; then
|
|
||||||
RELEASE=$(curl -sf \
|
|
||||||
-H "Authorization: token ${{ github.token }}" \
|
|
||||||
"${API_URL}/releases/tags/${GITHUB_REF_NAME}")
|
|
||||||
RELEASE_ID=$(echo "$RELEASE" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
|
||||||
fi
|
|
||||||
echo "Gitea Release ID: $RELEASE_ID"
|
|
||||||
# Delete existing assets
|
|
||||||
ASSETS=$(curl -sf \
|
|
||||||
-H "Authorization: token ${{ github.token }}" \
|
|
||||||
"${API_URL}/releases/${RELEASE_ID}/assets")
|
|
||||||
echo "$ASSETS" | node -e "
|
|
||||||
process.stdin.resume();let d='';
|
|
||||||
process.stdin.on('data',c=>d+=c);
|
|
||||||
process.stdin.on('end',()=>{
|
|
||||||
JSON.parse(d).forEach(a=>console.log(a.id));
|
|
||||||
})" | while read -r ASSET_ID; do
|
|
||||||
curl -sf -X DELETE \
|
|
||||||
-H "Authorization: token ${{ github.token }}" \
|
|
||||||
"${API_URL}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
|
|
||||||
done
|
|
||||||
# Upload tarball
|
|
||||||
curl -sf -X POST \
|
|
||||||
-H "Authorization: token ${{ github.token }}" \
|
|
||||||
-F "attachment=@${TARBALL}" \
|
|
||||||
"${API_URL}/releases/${RELEASE_ID}/assets?name=${TARBALL}"
|
|
||||||
echo "Gitea release updated"
|
|
||||||
|
|
||||||
- name: Create GitHub release
|
|
||||||
continue-on-error: true
|
|
||||||
run: |
|
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
GH_API="https://api.github.com/repos/cpfarhood/headlamp-polaris-plugin"
|
|
||||||
# Create release or fetch existing one
|
|
||||||
BODY=$(curl -s -X POST \
|
|
||||||
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
|
||||||
-H "Accept: application/vnd.github+json" \
|
|
||||||
"${GH_API}/releases" \
|
|
||||||
-d "{\"tag_name\":\"${GITHUB_REF_NAME}\",\"name\":\"${GITHUB_REF_NAME}\",\"generate_release_notes\":true}")
|
|
||||||
RELEASE_ID=$(echo "$BODY" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
|
||||||
if [ "$RELEASE_ID" = "undefined" ]; then
|
|
||||||
echo "Release already exists, fetching it..."
|
|
||||||
BODY=$(curl -sf \
|
|
||||||
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
|
||||||
-H "Accept: application/vnd.github+json" \
|
|
||||||
"${GH_API}/releases/tags/${GITHUB_REF_NAME}")
|
|
||||||
RELEASE_ID=$(echo "$BODY" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
|
||||||
fi
|
|
||||||
echo "GitHub Release ID: $RELEASE_ID"
|
|
||||||
# Delete existing assets with the same name
|
|
||||||
ASSETS=$(curl -sf \
|
|
||||||
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
|
||||||
-H "Accept: application/vnd.github+json" \
|
|
||||||
"${GH_API}/releases/${RELEASE_ID}/assets")
|
|
||||||
echo "$ASSETS" | node -e "
|
|
||||||
process.stdin.resume();let d='';
|
|
||||||
process.stdin.on('data',c=>d+=c);
|
|
||||||
process.stdin.on('end',()=>{
|
|
||||||
const assets=JSON.parse(d);
|
|
||||||
assets.filter(a=>a.name==='${TARBALL}').forEach(a=>console.log(a.id));
|
|
||||||
})" | while read -r ASSET_ID; do
|
|
||||||
echo "Deleting existing asset $ASSET_ID..."
|
|
||||||
curl -sf -X DELETE \
|
|
||||||
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
|
||||||
"${GH_API}/releases/assets/${ASSET_ID}"
|
|
||||||
done
|
|
||||||
# Upload tarball
|
|
||||||
curl -sf -X POST \
|
|
||||||
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
|
||||||
-H "Content-Type: application/gzip" \
|
|
||||||
"https://uploads.github.com/repos/cpfarhood/headlamp-polaris-plugin/releases/${RELEASE_ID}/assets?name=${TARBALL}" \
|
|
||||||
--data-binary "@${TARBALL}"
|
|
||||||
echo "GitHub release updated with same tarball"
|
|
||||||
|
|
||||||
- name: Update metadata and align tag
|
|
||||||
run: |
|
|
||||||
[ "$SKIP_BUILD" = "true" ] && exit 0
|
|
||||||
VERSION=${GITHUB_REF_NAME#v}
|
|
||||||
git config user.name "gitea-actions[bot]"
|
|
||||||
git config user.email "gitea-actions[bot]@git.farh.net"
|
|
||||||
git fetch origin main
|
|
||||||
git checkout origin/main -B main
|
|
||||||
sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
|
|
||||||
sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/${GITHUB_REF_NAME}/headlamp-polaris-plugin-${VERSION}.tar.gz\"|" artifacthub-pkg.yml
|
|
||||||
sed -i "s|^version:.*|version: ${VERSION}|" artifacthub-pkg.yml
|
|
||||||
git add artifacthub-pkg.yml
|
|
||||||
git diff --cached --quiet || {
|
|
||||||
git commit -m "ci: update artifact hub metadata for ${GITHUB_REF_NAME}"
|
|
||||||
git push origin main
|
|
||||||
}
|
|
||||||
# Force-move tag to the commit with correct checksum.
|
|
||||||
# This triggers a new CI run, but the guard step will detect
|
|
||||||
# that the release checksum already matches and skip the build.
|
|
||||||
git tag -f ${GITHUB_REF_NAME}
|
|
||||||
git push -f origin ${GITHUB_REF_NAME}
|
|
||||||
# Also push to GitHub directly to avoid waiting for mirror sync
|
|
||||||
git remote add github https://x-access-token:${{ secrets.GH_PAT }}@github.com/cpfarhood/headlamp-polaris-plugin.git 2>/dev/null || true
|
|
||||||
git push github main 2>/dev/null || true
|
|
||||||
git push -f github ${GITHUB_REF_NAME} 2>/dev/null || true
|
|
||||||
echo "Tag ${GITHUB_REF_NAME} aligned with updated metadata"
|
|
||||||
|
|||||||
@@ -0,0 +1,37 @@
|
|||||||
|
name: GitHub Release
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
tags:
|
||||||
|
- 'v*'
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: write
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
release:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Setup Node.js
|
||||||
|
uses: actions/setup-node@v4
|
||||||
|
with:
|
||||||
|
node-version: '20'
|
||||||
|
cache: 'npm'
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: npm ci
|
||||||
|
|
||||||
|
- name: Build plugin
|
||||||
|
run: npx @kinvolk/headlamp-plugin build
|
||||||
|
|
||||||
|
- name: Package tarball
|
||||||
|
run: npx @kinvolk/headlamp-plugin package
|
||||||
|
|
||||||
|
- name: Create GitHub Release
|
||||||
|
uses: softprops/action-gh-release@v2
|
||||||
|
with:
|
||||||
|
files: "*.tar.gz"
|
||||||
|
generate_release_notes: true
|
||||||
@@ -2,4 +2,3 @@ node_modules/
|
|||||||
dist/
|
dist/
|
||||||
.headlamp-plugin/
|
.headlamp-plugin/
|
||||||
.mcp.json
|
.mcp.json
|
||||||
*.tar.gz
|
|
||||||
|
|||||||
@@ -1 +0,0 @@
|
|||||||
module.exports = require('@headlamp-k8s/eslint-config/prettier-config');
|
|
||||||
+1
-2
@@ -6,5 +6,4 @@ COPY src/ src/
|
|||||||
RUN npx @kinvolk/headlamp-plugin build
|
RUN npx @kinvolk/headlamp-plugin build
|
||||||
|
|
||||||
FROM alpine:3.20
|
FROM alpine:3.20
|
||||||
COPY --from=build /app/dist/ /plugins/headlamp-polaris-plugin/
|
COPY --from=build /app/dist/ /plugins/polaris-headlamp-plugin/
|
||||||
COPY --from=build /app/package.json /plugins/headlamp-polaris-plugin/
|
|
||||||
|
|||||||
@@ -1,159 +1,34 @@
|
|||||||
# headlamp-polaris-plugin
|
# polaris-headlamp-plugin
|
||||||
|
|
||||||
[](https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin)
|
|
||||||
|
|
||||||
A [Headlamp](https://headlamp.dev/) plugin that surfaces [Fairwinds Polaris](https://polaris.docs.fairwinds.com/) audit results directly in the Headlamp UI.
|
A [Headlamp](https://headlamp.dev/) plugin that surfaces [Fairwinds Polaris](https://polaris.docs.fairwinds.com/) audit results directly in the Headlamp UI.
|
||||||
|
|
||||||
## What It Does
|
## What It Does
|
||||||
|
|
||||||
Adds a **Polaris** top-level sidebar section to Headlamp with the following views:
|
Adds a **Polaris** sidebar entry to Headlamp that displays:
|
||||||
|
|
||||||
- **Overview** -- cluster score as a percentage (color-coded green/amber/red), check summary (pass/warning/danger/skipped counts), and cluster info (nodes, pods, namespaces, controllers)
|
- **Cluster Score** -- overall Polaris score as a percentage (color-coded green/amber/red)
|
||||||
- **Namespaces** -- table of all namespaces with per-namespace score, pass/warning/danger/skipped counts; click a namespace to drill down
|
- **Check Summary** -- total, pass, warning, and danger counts across all workloads
|
||||||
- **Namespace detail** -- per-namespace score, check counts, and a resource table showing pass/warning/danger per workload
|
- **Cluster Info** -- node, pod, namespace, and controller counts
|
||||||
- **External link** -- quick jump to the native Polaris dashboard via the Kubernetes service proxy (from namespace detail view)
|
|
||||||
|
|
||||||
Data is fetched from the Polaris dashboard API through the Kubernetes service proxy (`/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json`). The plugin is read-only -- it never writes to the cluster.
|
Data is read from the `ConfigMap/polaris-dashboard` in the `polaris` namespace (key: `dashboard.json`), which is created by the standard Polaris Helm chart. The plugin is read-only -- it never writes to the cluster.
|
||||||
|
|
||||||
Results are refreshed on a user-configurable interval (1 / 5 / 10 / 30 minutes, default 5). The setting is available in **Settings > Plugins > Polaris** and persists in the browser's localStorage.
|
Results are cached and refreshed on a user-configurable interval (1 / 5 / 10 / 30 minutes, default 5). The setting persists in the browser's localStorage.
|
||||||
|
|
||||||
Error states are handled explicitly: RBAC denied (403), Polaris not installed (404/503), malformed JSON, and loading.
|
Error states are handled explicitly: RBAC denied (403), Polaris not installed (404), malformed JSON, and loading.
|
||||||
|
|
||||||
## Prerequisites
|
## Prerequisites
|
||||||
|
|
||||||
| Requirement | Minimum version |
|
- **Headlamp** >= v0.26 deployed in your cluster
|
||||||
|-------------|----------------|
|
- **Polaris** installed via the [official Helm chart](https://github.com/FairwindsOps/polaris) with the dashboard component enabled
|
||||||
| Headlamp | v0.26+ |
|
- The Headlamp service account must have RBAC permission to `get` ConfigMaps in the `polaris` namespace
|
||||||
| Polaris (with dashboard enabled) | Any recent release |
|
|
||||||
| Kubernetes | v1.24+ |
|
|
||||||
|
|
||||||
Polaris must be deployed in the `polaris` namespace with the dashboard component enabled (`dashboard.enabled: true` in the Helm chart, which is the default). The plugin reads from the `polaris-dashboard` ClusterIP service on port 80.
|
|
||||||
|
|
||||||
## Installing
|
|
||||||
|
|
||||||
### Option 1: Artifact Hub + Headlamp plugin manager (recommended)
|
|
||||||
|
|
||||||
The plugin is published on [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin). Configure Headlamp's `pluginsManager` in your Helm values to install it automatically:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
pluginsManager:
|
|
||||||
sources:
|
|
||||||
- url: https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin
|
|
||||||
```
|
|
||||||
|
|
||||||
Headlamp will fetch and install the plugin on startup.
|
|
||||||
|
|
||||||
### Option 2: Docker init container
|
|
||||||
|
|
||||||
The plugin ships as a container image at `git.farh.net/farhoodliquor/headlamp-polaris-plugin`.
|
|
||||||
|
|
||||||
Add it as an init container in your Headlamp Helm values:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
initContainers:
|
|
||||||
- name: polaris-plugin
|
|
||||||
image: git.farh.net/farhoodliquor/headlamp-polaris-plugin:latest
|
|
||||||
command: ["sh", "-c", "cp -r /plugins/* /headlamp/plugins/"]
|
|
||||||
volumeMounts:
|
|
||||||
- name: plugins
|
|
||||||
mountPath: /headlamp/plugins
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- name: plugins
|
|
||||||
emptyDir: {}
|
|
||||||
|
|
||||||
volumeMounts:
|
|
||||||
- name: plugins
|
|
||||||
mountPath: /headlamp/plugins
|
|
||||||
```
|
|
||||||
|
|
||||||
### Option 3: Manual tarball install
|
|
||||||
|
|
||||||
Download the `.tar.gz` from the [GitHub releases page](https://github.com/cpfarhood/headlamp-polaris-plugin/releases) or the [Gitea releases page](https://git.farh.net/farhoodliquor/headlamp-polaris-plugin/releases), then extract into Headlamp's plugin directory:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
tar xzf headlamp-polaris-plugin-<version>.tar.gz -C /headlamp/plugins/
|
|
||||||
```
|
|
||||||
|
|
||||||
### Option 4: Build from source
|
|
||||||
|
|
||||||
```bash
|
|
||||||
npm install
|
|
||||||
npm run build
|
|
||||||
npx @kinvolk/headlamp-plugin extract . /headlamp/plugins
|
|
||||||
```
|
|
||||||
|
|
||||||
## RBAC / Security Setup
|
|
||||||
|
|
||||||
The plugin fetches audit data through the Kubernetes API server's **service proxy** sub-resource. The identity making the request (Headlamp's service account, or the user's own token in token-auth mode) must be granted:
|
|
||||||
|
|
||||||
| Verb | API Group | Resource | Resource Name | Namespace |
|
|
||||||
|------|-----------|----------|---------------|-----------|
|
|
||||||
| `get` | `""` (core) | `services/proxy` | `polaris-dashboard` | `polaris` |
|
|
||||||
|
|
||||||
### Minimal RBAC manifests
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: polaris-proxy-reader
|
|
||||||
namespace: polaris
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["services/proxy"]
|
|
||||||
resourceNames: ["polaris-dashboard"]
|
|
||||||
verbs: ["get"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: headlamp-polaris-proxy
|
|
||||||
namespace: polaris
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: headlamp # adjust to match your Headlamp service account
|
|
||||||
namespace: kube-system # adjust to match the namespace Headlamp runs in
|
|
||||||
roleRef:
|
|
||||||
kind: Role
|
|
||||||
name: polaris-proxy-reader
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
```
|
|
||||||
|
|
||||||
Apply with `kubectl apply -f polaris-rbac.yaml`.
|
|
||||||
|
|
||||||
### Token-auth mode
|
|
||||||
|
|
||||||
When Headlamp is configured for user-supplied tokens (rather than a fixed service account), **each user** must have the RoleBinding above attached to their own identity. A 403 error in the plugin means the currently logged-in user lacks this binding.
|
|
||||||
|
|
||||||
### NetworkPolicy
|
|
||||||
|
|
||||||
If the `polaris` namespace enforces network policies, ensure ingress is allowed from the Kubernetes API server (which performs the proxy hop) to `polaris-dashboard` on port 80.
|
|
||||||
|
|
||||||
### Read-only access
|
|
||||||
|
|
||||||
The plugin only performs `GET` requests through the service proxy. No `create`, `update`, `delete`, or `patch` verbs are required. Do not grant broader access than `get` on `services/proxy`.
|
|
||||||
|
|
||||||
### Audit logging
|
|
||||||
|
|
||||||
Every proxied request is recorded in Kubernetes API audit logs as a `get` on `services/proxy` in the `polaris` namespace. If the auto-refresh interval generates more audit volume than desired, increase the refresh interval in the plugin settings or adjust your audit policy.
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
| Symptom | Likely cause | Fix |
|
|
||||||
|---------|-------------|-----|
|
|
||||||
| **403 Access Denied** | Missing RBAC binding for `services/proxy` | Apply the Role + RoleBinding from the RBAC section above |
|
|
||||||
| **404 or 503** | Polaris not installed, or dashboard disabled | Install Polaris with `dashboard.enabled: true` in the `polaris` namespace |
|
|
||||||
| **No data** | Polaris running but no workloads scanned yet | Wait for the next Polaris audit cycle or restart the Polaris pod |
|
|
||||||
| **Stale data** | Refresh interval too long | Lower the interval in **Settings > Plugins > Polaris** |
|
|
||||||
|
|
||||||
## Development
|
## Development
|
||||||
|
|
||||||
### Setup
|
### Setup
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
git clone https://github.com/cpfarhood/headlamp-polaris-plugin.git
|
git clone https://git.farh.net/farhoodliquor/polaris-headlamp-plugin.git
|
||||||
cd headlamp-polaris-plugin
|
cd polaris-headlamp-plugin
|
||||||
npm install
|
npm install
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -169,48 +44,140 @@ This starts the Headlamp plugin dev server. Point a running Headlamp instance at
|
|||||||
|
|
||||||
```bash
|
```bash
|
||||||
npm run build # outputs dist/main.js
|
npm run build # outputs dist/main.js
|
||||||
npm run package # creates headlamp-polaris-plugin-<version>.tar.gz
|
npm run package # creates polaris-headlamp-plugin-<version>.tar.gz
|
||||||
```
|
```
|
||||||
|
|
||||||
### Type-check, lint, format, and test
|
### Type-check
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
npm run tsc # type-check without emitting
|
npm run tsc
|
||||||
npm run lint # eslint
|
|
||||||
npm run format:check # prettier check
|
|
||||||
npm test # vitest unit tests
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Project Structure
|
## Project Structure
|
||||||
|
|
||||||
```
|
```
|
||||||
src/
|
src/
|
||||||
index.tsx -- Entry point. Registers sidebar entries and routes.
|
index.tsx -- Entry point. Registers sidebar entry and route at /polaris.
|
||||||
api/
|
api/
|
||||||
polaris.ts -- TypeScript types (AuditData schema), usePolarisData hook,
|
polaris.ts -- TypeScript types matching the Polaris AuditData schema,
|
||||||
countResults utilities, refresh interval settings.
|
usePolarisData() hook with caching, countResults() utility,
|
||||||
polaris.test.ts -- Unit tests for utility functions (vitest).
|
and refresh interval settings (localStorage).
|
||||||
PolarisDataContext.tsx -- React context provider; shared data fetch across views.
|
|
||||||
components/
|
components/
|
||||||
DashboardView.tsx -- Overview page (score, check summary with skipped, cluster info).
|
PolarisView.tsx -- Main page component. Score badge, check summary cards,
|
||||||
NamespacesListView.tsx -- Namespace list with scores and links to detail views.
|
cluster info, error states, refresh interval selector.
|
||||||
NamespaceDetailView.tsx -- Per-namespace drill-down with resource table.
|
```
|
||||||
PolarisSettings.tsx -- Plugin settings page (refresh interval selector).
|
|
||||||
vitest.config.mts -- Vitest configuration (jsdom environment).
|
## Deploying to Headlamp
|
||||||
|
|
||||||
|
### Option 1: Docker init container (recommended for Kubernetes)
|
||||||
|
|
||||||
|
The plugin ships as a container image at `git.farh.net/farhoodliquor/polaris-headlamp-plugin`.
|
||||||
|
|
||||||
|
Add it as an init container in your Headlamp Helm values:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
initContainers:
|
||||||
|
- name: polaris-plugin
|
||||||
|
image: git.farh.net/farhoodliquor/polaris-headlamp-plugin:v0.0.1
|
||||||
|
command: ["sh", "-c", "cp -r /plugins/* /headlamp/plugins/"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: plugins
|
||||||
|
mountPath: /headlamp/plugins
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: plugins
|
||||||
|
emptyDir: {}
|
||||||
|
|
||||||
|
volumeMounts:
|
||||||
|
- name: plugins
|
||||||
|
mountPath: /headlamp/plugins
|
||||||
|
```
|
||||||
|
|
||||||
|
### Option 2: Manual tarball install
|
||||||
|
|
||||||
|
Download the `.tar.gz` from the [releases page](https://git.farh.net/farhoodliquor/polaris-headlamp-plugin/releases), then extract into Headlamp's plugin directory:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
tar xzf polaris-headlamp-plugin-0.0.1.tar.gz -C /headlamp/plugins/
|
||||||
|
```
|
||||||
|
|
||||||
|
### Option 3: Build from source
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm install
|
||||||
|
npm run build
|
||||||
|
npx @kinvolk/headlamp-plugin extract . /headlamp/plugins
|
||||||
|
```
|
||||||
|
|
||||||
|
## Releasing
|
||||||
|
|
||||||
|
Releases are automated via Gitea Actions. To cut a release:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Bump version in package.json, then:
|
||||||
|
git add package.json package-lock.json
|
||||||
|
git commit -m "chore: bump version to 0.0.2"
|
||||||
|
git tag v0.0.2
|
||||||
|
git push origin main v0.0.2
|
||||||
|
```
|
||||||
|
|
||||||
|
The CI pipeline (`.gitea/workflows/release.yaml`) will:
|
||||||
|
|
||||||
|
1. Build the plugin in a `node:20` container
|
||||||
|
2. Package a `.tar.gz` tarball
|
||||||
|
3. Build and push a Docker image to `git.farh.net/farhoodliquor/polaris-headlamp-plugin:{tag}` and `:latest`
|
||||||
|
4. Create a Gitea release with the tarball attached
|
||||||
|
|
||||||
|
### CI secrets
|
||||||
|
|
||||||
|
| Secret | Purpose |
|
||||||
|
|---|---|
|
||||||
|
| `REGISTRY_TOKEN` | Gitea personal access token with `package:write` scope, used to push Docker images to the container registry |
|
||||||
|
|
||||||
|
The release creation itself uses the built-in `github.token` -- no extra secret needed for that.
|
||||||
|
|
||||||
|
## RBAC
|
||||||
|
|
||||||
|
The plugin reads a single ConfigMap. Minimum RBAC required for the Headlamp service account:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: headlamp-polaris-reader
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
resourceNames: ["polaris-dashboard"]
|
||||||
|
verbs: ["get"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: headlamp-polaris-reader
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: headlamp-polaris-reader
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp
|
||||||
```
|
```
|
||||||
|
|
||||||
## Data Source
|
## Data Source
|
||||||
|
|
||||||
The plugin fetches live audit results from the Polaris dashboard HTTP API via the Kubernetes service proxy:
|
The plugin reads from:
|
||||||
|
|
||||||
```
|
- **ConfigMap**: `polaris-dashboard`
|
||||||
GET /api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json
|
- **Namespace**: `polaris`
|
||||||
```
|
- **Key**: `dashboard.json`
|
||||||
|
|
||||||
This endpoint is served by the `polaris-dashboard` ClusterIP service, which is created by the Polaris Helm chart when `dashboard.enabled: true`. The JSON response matches Polaris's `AuditData` schema (`pkg/validator/output.go`):
|
This ConfigMap is created automatically when Polaris is installed with the dashboard enabled. The JSON structure matches Polaris's `AuditData` schema (`pkg/validator/output.go`):
|
||||||
|
|
||||||
```
|
```
|
||||||
AuditData
|
AuditData
|
||||||
|
Score -- cluster score (0-100)
|
||||||
ClusterInfo -- nodes, pods, namespaces, controllers
|
ClusterInfo -- nodes, pods, namespaces, controllers
|
||||||
Results[] -- per-workload results
|
Results[] -- per-workload results
|
||||||
Results{} -- top-level check results (ResultSet)
|
Results{} -- top-level check results (ResultSet)
|
||||||
@@ -220,46 +187,7 @@ AuditData
|
|||||||
Results{} -- container-level check results
|
Results{} -- container-level check results
|
||||||
```
|
```
|
||||||
|
|
||||||
Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"`, `"danger"`, or `"ignore"`). Checks with `Severity: "ignore"` and `Success: false` are counted as skipped. The cluster score is computed client-side as `pass / total * 100`.
|
Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"` or `"danger"`).
|
||||||
|
|
||||||
## Releasing
|
|
||||||
|
|
||||||
Releases are automated via CI. To cut a release:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Bump version in package.json and artifacthub-pkg.yml (version + archive-url), then:
|
|
||||||
git add package.json artifacthub-pkg.yml
|
|
||||||
git commit -m "chore: bump version to X.Y.Z"
|
|
||||||
git tag vX.Y.Z
|
|
||||||
git push origin main vX.Y.Z
|
|
||||||
```
|
|
||||||
|
|
||||||
This triggers the **Gitea Actions** release workflow (`.gitea/workflows/release.yaml`):
|
|
||||||
1. Build the plugin in a `node:20` container
|
|
||||||
2. Package a `.tar.gz` tarball
|
|
||||||
3. Build and push a Docker image to `git.farh.net/farhoodliquor/headlamp-polaris-plugin:{tag}` and `:latest`
|
|
||||||
4. Create a Gitea release with the tarball attached
|
|
||||||
5. Create a GitHub release with the same tarball (for Artifact Hub)
|
|
||||||
6. Update `artifacthub-pkg.yml` checksum on main and force-move the tag to match
|
|
||||||
|
|
||||||
A guard step prevents infinite loops: if the release tarball checksum already matches the metadata, the build is skipped.
|
|
||||||
|
|
||||||
### CI secrets
|
|
||||||
|
|
||||||
| Secret | Where | Purpose |
|
|
||||||
|---|---|---|
|
|
||||||
| `REGISTRY_TOKEN` | Gitea | Personal access token with `package:write` scope for Docker image push |
|
|
||||||
| `GH_PAT` | Gitea | GitHub personal access token for creating GitHub releases |
|
|
||||||
|
|
||||||
The Gitea release uses the built-in `github.token`. The `archive-checksum` in `artifacthub-pkg.yml` is updated automatically by the release workflow.
|
|
||||||
|
|
||||||
## Links
|
|
||||||
|
|
||||||
- [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin)
|
|
||||||
- [GitHub (mirror)](https://github.com/cpfarhood/headlamp-polaris-plugin)
|
|
||||||
- [Gitea (source of truth)](https://git.farh.net/farhoodliquor/headlamp-polaris-plugin)
|
|
||||||
- [Headlamp](https://headlamp.dev/)
|
|
||||||
- [Fairwinds Polaris](https://polaris.docs.fairwinds.com/)
|
|
||||||
|
|
||||||
## License
|
## License
|
||||||
|
|
||||||
|
|||||||
+8
-14
@@ -1,16 +1,10 @@
|
|||||||
version: 0.1.3
|
version: 0.0.1
|
||||||
name: headlamp-polaris-plugin
|
name: polaris-headlamp-plugin
|
||||||
displayName: Polaris
|
displayName: Polaris
|
||||||
createdAt: "2026-02-05T19:00:00Z"
|
createdAt: "2026-02-05T19:00:00Z"
|
||||||
description: >-
|
description: Surfaces Fairwinds Polaris audit results inside the Headlamp UI.
|
||||||
Surfaces Fairwinds Polaris audit results inside the Headlamp UI.
|
|
||||||
Shows cluster score, check summary, and per-namespace drill-downs
|
|
||||||
with per-resource pass/warning/danger breakdowns. Data is fetched
|
|
||||||
read-only via the Kubernetes service proxy to the Polaris dashboard.
|
|
||||||
Requires a Role granting `get` on `services/proxy` for the
|
|
||||||
`polaris-dashboard` service in the `polaris` namespace.
|
|
||||||
license: MIT
|
license: MIT
|
||||||
homeURL: "https://github.com/cpfarhood/headlamp-polaris-plugin"
|
homeURL: "https://github.com/cpfarhood/polaris-headlamp-plugin"
|
||||||
category: security
|
category: security
|
||||||
keywords:
|
keywords:
|
||||||
- polaris
|
- polaris
|
||||||
@@ -21,14 +15,14 @@ keywords:
|
|||||||
- kubernetes
|
- kubernetes
|
||||||
links:
|
links:
|
||||||
- name: Source
|
- name: Source
|
||||||
url: "https://github.com/cpfarhood/headlamp-polaris-plugin"
|
url: "https://github.com/cpfarhood/polaris-headlamp-plugin"
|
||||||
- name: Polaris
|
- name: Polaris
|
||||||
url: "https://polaris.docs.fairwinds.com/"
|
url: "https://polaris.docs.fairwinds.com/"
|
||||||
maintainers:
|
maintainers:
|
||||||
- name: cpfarhood
|
- name: cpfarhood
|
||||||
email: "chris@farhood.org"
|
email: ""
|
||||||
annotations:
|
annotations:
|
||||||
headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.1.3/headlamp-polaris-plugin-0.1.3.tar.gz"
|
headlamp/plugin/archive-url: "https://github.com/cpfarhood/polaris-headlamp-plugin/releases/download/v0.0.1/polaris-headlamp-plugin-0.0.1.tar.gz"
|
||||||
headlamp/plugin/version-compat: ">=0.26"
|
headlamp/plugin/version-compat: ">=0.26"
|
||||||
headlamp/plugin/archive-checksum: sha256:ddb92d40475d9c2ee1e755f4c83744529d86a1318dea729e6de8b4360d7890c7
|
headlamp/plugin/archive-checksum: sha256:456f09cf8b126816b80c723b6c6f300b2af0c2e1288ee67da13f435b0e35c04d
|
||||||
headlamp/plugin/distro-compat: in-cluster
|
headlamp/plugin/distro-compat: in-cluster
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
repositoryID: fc3397f6-a75a-4950-ab50-da75c08a8089
|
repositoryID: polaris-headlamp-plugin
|
||||||
owners:
|
owners:
|
||||||
- name: cpfarhood
|
- name: cpfarhood
|
||||||
email: "chris@farhood.org"
|
email: ""
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
|
|||||||
|
|
||||||
## Project Overview
|
## Project Overview
|
||||||
|
|
||||||
Headlamp plugin that surfaces Fairwinds Polaris audit results inside the Headlamp UI. Queries the Polaris dashboard API via the Kubernetes service proxy (`/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json`). Target Headlamp ≥ v0.26.
|
Headlamp plugin that surfaces Fairwinds Polaris audit results inside the Headlamp UI. Reads from `ConfigMap/polaris-dashboard` in the `polaris` namespace (key: `dashboard.json`). Target Headlamp ≥ v0.26.
|
||||||
|
|
||||||
## Build & Development Commands
|
## Build & Development Commands
|
||||||
|
|
||||||
@@ -23,79 +23,24 @@ npx tsc --noEmit
|
|||||||
|
|
||||||
# Lint
|
# Lint
|
||||||
npx eslint src/
|
npx eslint src/
|
||||||
|
|
||||||
# Run tests
|
|
||||||
npm test
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Architecture
|
## Architecture
|
||||||
|
|
||||||
```
|
```
|
||||||
src/
|
src/
|
||||||
├── index.tsx # Entry point: registers sidebar entries + routes
|
├── index.tsx # Entry point: registerSidebarEntry + registerRoute for /polaris
|
||||||
├── api/
|
├── api/
|
||||||
│ ├── polaris.ts # Types (AuditData schema), usePolarisData hook, countResults utilities, refresh settings
|
│ └── polaris.ts # Types (AuditData schema), usePolarisData hook, countResults utility, refresh settings
|
||||||
│ ├── polaris.test.ts # Unit tests for utility functions (vitest)
|
|
||||||
│ └── PolarisDataContext.tsx # React context provider for shared data fetch
|
|
||||||
└── components/
|
└── components/
|
||||||
├── DashboardView.tsx # Overview page (score, check summary with skipped count, cluster info)
|
└── PolarisView.tsx # Main page: score badge, check summary, cluster info, error states, refresh interval selector
|
||||||
├── NamespacesListView.tsx # Namespace list with scores and links to detail views
|
|
||||||
├── NamespaceDetailView.tsx # Per-namespace drill-down with resource table
|
|
||||||
└── PolarisSettings.tsx # Plugin settings (refresh interval selector)
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Top-level sidebar section at `/polaris` with sub-routes for namespaces list (`/polaris/namespaces`) and per-namespace views (`/polaris/ns/:namespace`). Data is fetched via `ApiProxy.request` to the Polaris dashboard service proxy and refreshed on a user-configurable interval (stored in localStorage under `polaris-plugin-refresh-interval`, default 5 minutes). Score is computed from result counts (pass/total). Skipped checks are always displayed in summaries.
|
Single sidebar page at `/polaris`. Data is cached in React state and refreshed on a user-configurable interval (stored in localStorage under `polaris-plugin-refresh-interval`, default 5 minutes). The `usePolarisData` hook wraps `ConfigMap.useGet` with caching so stale data is shown while refreshing.
|
||||||
|
|
||||||
**Sidebar limitation**: Headlamp's sidebar only supports 2-level nesting (parent → children). The `Collapse` component is driven by route-based selection, not click-to-toggle, so 3-level hierarchies don't expand properly. Namespace navigation is handled via the in-content table on the Namespaces page instead.
|
|
||||||
|
|
||||||
## Security / RBAC Requirements
|
|
||||||
|
|
||||||
The plugin reaches Polaris through the Kubernetes API server's service proxy sub-resource (`/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/...`). The Headlamp service account (or the user's bearer token when Headlamp runs in token-auth mode) must be granted:
|
|
||||||
|
|
||||||
| Verb | API Group | Resource | Resource Name | Namespace |
|
|
||||||
|------|-----------|----------|---------------|-----------|
|
|
||||||
| `get` | `""` (core) | `services/proxy` | `polaris-dashboard` | `polaris` |
|
|
||||||
|
|
||||||
Minimal RBAC example:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: polaris-proxy-reader
|
|
||||||
namespace: polaris
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["services/proxy"]
|
|
||||||
resourceNames: ["polaris-dashboard"]
|
|
||||||
verbs: ["get"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: headlamp-polaris-proxy
|
|
||||||
namespace: polaris
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: headlamp # adjust to match your Headlamp SA
|
|
||||||
namespace: kube-system
|
|
||||||
roleRef:
|
|
||||||
kind: Role
|
|
||||||
name: polaris-proxy-reader
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
```
|
|
||||||
|
|
||||||
Additional considerations:
|
|
||||||
|
|
||||||
- **NetworkPolicy**: If the `polaris` namespace enforces network policies, allow ingress from the Headlamp pod (or the API server, since it performs the proxy hop) to `polaris-dashboard` on port 80.
|
|
||||||
- **Polaris dashboard listen address**: The Polaris Helm chart exposes the dashboard on a ClusterIP service (`polaris-dashboard:80`). If the chart is installed with `dashboard.enabled: false`, the service will not be created, resulting in a 404 error for proxy requests.
|
|
||||||
- **No write operations**: The plugin only performs `GET` requests through the proxy. No `create`, `update`, or `delete` verbs are required. Do not grant broader service proxy access than `get`.
|
|
||||||
- **Token-auth mode**: When Headlamp is configured for user-supplied tokens (rather than a fixed service account), each user's own RBAC bindings must include the role above. A 403 from the plugin means the logged-in user lacks the binding.
|
|
||||||
- **Audit logging**: Kubernetes API audit logs will record every proxied request as a `get` on `services/proxy` in the `polaris` namespace. Set an appropriate audit policy level if request volume from the auto-refresh interval is a concern.
|
|
||||||
|
|
||||||
## Key Constraints
|
## Key Constraints
|
||||||
|
|
||||||
- **Data source**: Polaris dashboard API via K8s service proxy. Requires Polaris deployed in the `polaris` namespace with a `polaris-dashboard` service. No CRDs, no cluster write operations.
|
- **Data source**: `ConfigMap/polaris-dashboard` in `polaris` namespace, key `dashboard.json`. No CRDs, no external API calls, no cluster write operations.
|
||||||
- **UI components**: Use only Headlamp-provided components (`@kinvolk/headlamp-plugin/lib/CommonComponents`). Do not import raw MUI packages. No custom theming.
|
- **UI components**: Use only Headlamp-provided components (`@kinvolk/headlamp-plugin/lib/CommonComponents`). Do not import raw MUI packages. No custom theming.
|
||||||
- **Error handling**: Must handle 403 (RBAC denied), 404 (Polaris not installed), malformed JSON, and loading states with distinct visual states.
|
- **Error handling**: Must handle 403 (RBAC denied), 404 (Polaris not installed), malformed JSON, and loading states with distinct visual states.
|
||||||
- **TypeScript strictness**: No `any`, no implicit `unknown` casting, no dead code, no unused imports.
|
- **TypeScript strictness**: No `any`, no implicit `unknown` casting, no dead code, no unused imports.
|
||||||
|
|||||||
Generated
+4
-4
@@ -1,12 +1,12 @@
|
|||||||
{
|
{
|
||||||
"name": "headlamp-polaris-plugin",
|
"name": "polaris-headlamp-plugin",
|
||||||
"version": "0.1.1",
|
"version": "0.0.1",
|
||||||
"lockfileVersion": 3,
|
"lockfileVersion": 3,
|
||||||
"requires": true,
|
"requires": true,
|
||||||
"packages": {
|
"packages": {
|
||||||
"": {
|
"": {
|
||||||
"name": "headlamp-polaris-plugin",
|
"name": "polaris-headlamp-plugin",
|
||||||
"version": "0.1.1",
|
"version": "0.0.1",
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@kinvolk/headlamp-plugin": "^0.13.0"
|
"@kinvolk/headlamp-plugin": "^0.13.0"
|
||||||
}
|
}
|
||||||
|
|||||||
+3
-9
@@ -1,18 +1,12 @@
|
|||||||
{
|
{
|
||||||
"name": "headlamp-polaris-plugin",
|
"name": "polaris-headlamp-plugin",
|
||||||
"version": "0.1.3",
|
"version": "0.0.1",
|
||||||
"description": "Headlamp plugin for Fairwinds Polaris audit results",
|
"description": "Headlamp plugin for Fairwinds Polaris audit results",
|
||||||
"scripts": {
|
"scripts": {
|
||||||
"start": "headlamp-plugin start",
|
"start": "headlamp-plugin start",
|
||||||
"build": "headlamp-plugin build",
|
"build": "headlamp-plugin build",
|
||||||
"package": "headlamp-plugin package",
|
"package": "headlamp-plugin package",
|
||||||
"tsc": "tsc --noEmit",
|
"tsc": "tsc --noEmit"
|
||||||
"lint": "eslint --ext .ts,.tsx src/",
|
|
||||||
"lint:fix": "eslint --ext .ts,.tsx --fix src/",
|
|
||||||
"format": "prettier --write src/",
|
|
||||||
"format:check": "prettier --check src/",
|
|
||||||
"test": "vitest run",
|
|
||||||
"test:watch": "vitest"
|
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@kinvolk/headlamp-plugin": "^0.13.0"
|
"@kinvolk/headlamp-plugin": "^0.13.0"
|
||||||
|
|||||||
@@ -1,25 +0,0 @@
|
|||||||
import React from 'react';
|
|
||||||
import { AuditData, getRefreshInterval, usePolarisData } from './polaris';
|
|
||||||
|
|
||||||
interface PolarisDataContextValue {
|
|
||||||
data: AuditData | null;
|
|
||||||
loading: boolean;
|
|
||||||
error: string | null;
|
|
||||||
}
|
|
||||||
|
|
||||||
const PolarisDataContext = React.createContext<PolarisDataContextValue | null>(null);
|
|
||||||
|
|
||||||
export function PolarisDataProvider(props: { children: React.ReactNode }) {
|
|
||||||
const interval = getRefreshInterval();
|
|
||||||
const state = usePolarisData(interval);
|
|
||||||
|
|
||||||
return <PolarisDataContext.Provider value={state}>{props.children}</PolarisDataContext.Provider>;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function usePolarisDataContext(): PolarisDataContextValue {
|
|
||||||
const ctx = React.useContext(PolarisDataContext);
|
|
||||||
if (ctx === null) {
|
|
||||||
throw new Error('usePolarisDataContext must be used within a PolarisDataProvider');
|
|
||||||
}
|
|
||||||
return ctx;
|
|
||||||
}
|
|
||||||
@@ -1,264 +0,0 @@
|
|||||||
import { describe, expect, it, vi } from 'vitest';
|
|
||||||
|
|
||||||
vi.mock('@kinvolk/headlamp-plugin/lib', () => ({
|
|
||||||
ApiProxy: { request: vi.fn() },
|
|
||||||
}));
|
|
||||||
|
|
||||||
import {
|
|
||||||
AuditData,
|
|
||||||
computeScore,
|
|
||||||
countResults,
|
|
||||||
countResultsForItems,
|
|
||||||
filterResultsByNamespace,
|
|
||||||
getNamespaces,
|
|
||||||
Result,
|
|
||||||
ResultCounts,
|
|
||||||
} from './polaris';
|
|
||||||
|
|
||||||
// --- Fixtures ---
|
|
||||||
|
|
||||||
function makeResult(overrides: Partial<Result> = {}): Result {
|
|
||||||
return {
|
|
||||||
Name: 'my-deploy',
|
|
||||||
Namespace: 'default',
|
|
||||||
Kind: 'Deployment',
|
|
||||||
Results: {},
|
|
||||||
CreatedTime: '2025-01-01T00:00:00Z',
|
|
||||||
...overrides,
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
function makeAuditData(results: Result[]): AuditData {
|
|
||||||
return {
|
|
||||||
PolarisOutputVersion: '1.0',
|
|
||||||
AuditTime: '2025-01-01T00:00:00Z',
|
|
||||||
SourceType: 'Cluster',
|
|
||||||
SourceName: 'test',
|
|
||||||
DisplayName: 'test',
|
|
||||||
ClusterInfo: { Version: '1.28', Nodes: 3, Pods: 10, Namespaces: 2, Controllers: 5 },
|
|
||||||
Results: results,
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- computeScore ---
|
|
||||||
|
|
||||||
describe('computeScore', () => {
|
|
||||||
it('returns 0 when total is 0', () => {
|
|
||||||
const counts: ResultCounts = { total: 0, pass: 0, warning: 0, danger: 0, skipped: 0 };
|
|
||||||
expect(computeScore(counts)).toBe(0);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('returns 100 when all checks pass', () => {
|
|
||||||
const counts: ResultCounts = { total: 10, pass: 10, warning: 0, danger: 0, skipped: 0 };
|
|
||||||
expect(computeScore(counts)).toBe(100);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('rounds to nearest integer', () => {
|
|
||||||
const counts: ResultCounts = { total: 3, pass: 1, warning: 1, danger: 1, skipped: 0 };
|
|
||||||
expect(computeScore(counts)).toBe(33);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('includes skipped in total denominator', () => {
|
|
||||||
const counts: ResultCounts = { total: 10, pass: 5, warning: 2, danger: 1, skipped: 2 };
|
|
||||||
expect(computeScore(counts)).toBe(50);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
|
|
||||||
// --- countResults / countResultsForItems ---
|
|
||||||
|
|
||||||
describe('countResults', () => {
|
|
||||||
it('returns zero counts for empty results', () => {
|
|
||||||
const data = makeAuditData([]);
|
|
||||||
const counts = countResults(data);
|
|
||||||
expect(counts).toEqual({ total: 0, pass: 0, warning: 0, danger: 0, skipped: 0 });
|
|
||||||
});
|
|
||||||
|
|
||||||
it('counts top-level result set entries', () => {
|
|
||||||
const result = makeResult({
|
|
||||||
Results: {
|
|
||||||
check1: {
|
|
||||||
ID: 'check1',
|
|
||||||
Message: 'ok',
|
|
||||||
Details: [],
|
|
||||||
Success: true,
|
|
||||||
Severity: 'warning',
|
|
||||||
Category: 'Security',
|
|
||||||
},
|
|
||||||
check2: {
|
|
||||||
ID: 'check2',
|
|
||||||
Message: 'bad',
|
|
||||||
Details: [],
|
|
||||||
Success: false,
|
|
||||||
Severity: 'danger',
|
|
||||||
Category: 'Security',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
});
|
|
||||||
const counts = countResults(makeAuditData([result]));
|
|
||||||
expect(counts.total).toBe(2);
|
|
||||||
expect(counts.pass).toBe(1);
|
|
||||||
expect(counts.danger).toBe(1);
|
|
||||||
expect(counts.warning).toBe(0);
|
|
||||||
expect(counts.skipped).toBe(0);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('counts skipped (severity=ignore, success=false) entries', () => {
|
|
||||||
const result = makeResult({
|
|
||||||
Results: {
|
|
||||||
skipped1: {
|
|
||||||
ID: 'skipped1',
|
|
||||||
Message: 'skipped',
|
|
||||||
Details: [],
|
|
||||||
Success: false,
|
|
||||||
Severity: 'ignore',
|
|
||||||
Category: 'Security',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
});
|
|
||||||
const counts = countResults(makeAuditData([result]));
|
|
||||||
expect(counts.total).toBe(1);
|
|
||||||
expect(counts.skipped).toBe(1);
|
|
||||||
expect(counts.pass).toBe(0);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('counts PodResult and ContainerResults', () => {
|
|
||||||
const result = makeResult({
|
|
||||||
Results: {
|
|
||||||
top: {
|
|
||||||
ID: 'top',
|
|
||||||
Message: 'ok',
|
|
||||||
Details: [],
|
|
||||||
Success: true,
|
|
||||||
Severity: 'warning',
|
|
||||||
Category: 'Reliability',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
PodResult: {
|
|
||||||
Name: 'pod-1',
|
|
||||||
Results: {
|
|
||||||
podCheck: {
|
|
||||||
ID: 'podCheck',
|
|
||||||
Message: 'warn',
|
|
||||||
Details: [],
|
|
||||||
Success: false,
|
|
||||||
Severity: 'warning',
|
|
||||||
Category: 'Reliability',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
ContainerResults: [
|
|
||||||
{
|
|
||||||
Name: 'container-1',
|
|
||||||
Results: {
|
|
||||||
containerCheck: {
|
|
||||||
ID: 'containerCheck',
|
|
||||||
Message: 'danger',
|
|
||||||
Details: [],
|
|
||||||
Success: false,
|
|
||||||
Severity: 'danger',
|
|
||||||
Category: 'Security',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
],
|
|
||||||
},
|
|
||||||
});
|
|
||||||
const counts = countResults(makeAuditData([result]));
|
|
||||||
expect(counts.total).toBe(3);
|
|
||||||
expect(counts.pass).toBe(1);
|
|
||||||
expect(counts.warning).toBe(1);
|
|
||||||
expect(counts.danger).toBe(1);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('aggregates across multiple results', () => {
|
|
||||||
const r1 = makeResult({
|
|
||||||
Name: 'deploy-a',
|
|
||||||
Results: {
|
|
||||||
c1: {
|
|
||||||
ID: 'c1',
|
|
||||||
Message: '',
|
|
||||||
Details: [],
|
|
||||||
Success: true,
|
|
||||||
Severity: 'warning',
|
|
||||||
Category: 'X',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
});
|
|
||||||
const r2 = makeResult({
|
|
||||||
Name: 'deploy-b',
|
|
||||||
Results: {
|
|
||||||
c2: {
|
|
||||||
ID: 'c2',
|
|
||||||
Message: '',
|
|
||||||
Details: [],
|
|
||||||
Success: false,
|
|
||||||
Severity: 'warning',
|
|
||||||
Category: 'X',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
});
|
|
||||||
const counts = countResults(makeAuditData([r1, r2]));
|
|
||||||
expect(counts.total).toBe(2);
|
|
||||||
expect(counts.pass).toBe(1);
|
|
||||||
expect(counts.warning).toBe(1);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
|
|
||||||
describe('countResultsForItems', () => {
|
|
||||||
it('works on a subset of results', () => {
|
|
||||||
const results: Result[] = [
|
|
||||||
makeResult({
|
|
||||||
Results: {
|
|
||||||
a: {
|
|
||||||
ID: 'a',
|
|
||||||
Message: '',
|
|
||||||
Details: [],
|
|
||||||
Success: false,
|
|
||||||
Severity: 'danger',
|
|
||||||
Category: 'X',
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}),
|
|
||||||
];
|
|
||||||
const counts = countResultsForItems(results);
|
|
||||||
expect(counts.danger).toBe(1);
|
|
||||||
expect(counts.total).toBe(1);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
|
|
||||||
// --- getNamespaces ---
|
|
||||||
|
|
||||||
describe('getNamespaces', () => {
|
|
||||||
it('returns empty array for no results', () => {
|
|
||||||
expect(getNamespaces(makeAuditData([]))).toEqual([]);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('returns sorted unique namespaces', () => {
|
|
||||||
const data = makeAuditData([
|
|
||||||
makeResult({ Namespace: 'beta' }),
|
|
||||||
makeResult({ Namespace: 'alpha' }),
|
|
||||||
makeResult({ Namespace: 'beta' }),
|
|
||||||
makeResult({ Namespace: 'gamma' }),
|
|
||||||
]);
|
|
||||||
expect(getNamespaces(data)).toEqual(['alpha', 'beta', 'gamma']);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
|
|
||||||
// --- filterResultsByNamespace ---
|
|
||||||
|
|
||||||
describe('filterResultsByNamespace', () => {
|
|
||||||
it('returns only results matching the namespace', () => {
|
|
||||||
const data = makeAuditData([
|
|
||||||
makeResult({ Name: 'a', Namespace: 'ns1' }),
|
|
||||||
makeResult({ Name: 'b', Namespace: 'ns2' }),
|
|
||||||
makeResult({ Name: 'c', Namespace: 'ns1' }),
|
|
||||||
]);
|
|
||||||
const filtered = filterResultsByNamespace(data, 'ns1');
|
|
||||||
expect(filtered).toHaveLength(2);
|
|
||||||
expect(filtered.map(r => r.Name)).toEqual(['a', 'c']);
|
|
||||||
});
|
|
||||||
|
|
||||||
it('returns empty array for non-existent namespace', () => {
|
|
||||||
const data = makeAuditData([makeResult({ Namespace: 'ns1' })]);
|
|
||||||
expect(filterResultsByNamespace(data, 'ns-missing')).toEqual([]);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
+78
-89
@@ -1,4 +1,4 @@
|
|||||||
import { ApiProxy } from '@kinvolk/headlamp-plugin/lib';
|
import { K8s } from '@kinvolk/headlamp-plugin/lib';
|
||||||
import React from 'react';
|
import React from 'react';
|
||||||
|
|
||||||
// --- Polaris AuditData schema (matches pkg/validator/output.go) ---
|
// --- Polaris AuditData schema (matches pkg/validator/output.go) ---
|
||||||
@@ -52,6 +52,7 @@ export interface AuditData {
|
|||||||
DisplayName: string;
|
DisplayName: string;
|
||||||
ClusterInfo: ClusterInfo;
|
ClusterInfo: ClusterInfo;
|
||||||
Results: Result[];
|
Results: Result[];
|
||||||
|
Score: number;
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- Result counting ---
|
// --- Result counting ---
|
||||||
@@ -61,7 +62,6 @@ export interface ResultCounts {
|
|||||||
pass: number;
|
pass: number;
|
||||||
warning: number;
|
warning: number;
|
||||||
danger: number;
|
danger: number;
|
||||||
skipped: number;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
function countResultSet(rs: ResultSet, counts: ResultCounts): void {
|
function countResultSet(rs: ResultSet, counts: ResultCounts): void {
|
||||||
@@ -70,8 +70,6 @@ function countResultSet(rs: ResultSet, counts: ResultCounts): void {
|
|||||||
counts.total++;
|
counts.total++;
|
||||||
if (msg.Success) {
|
if (msg.Success) {
|
||||||
counts.pass++;
|
counts.pass++;
|
||||||
} else if (msg.Severity === 'ignore') {
|
|
||||||
counts.skipped++;
|
|
||||||
} else if (msg.Severity === 'warning') {
|
} else if (msg.Severity === 'warning') {
|
||||||
counts.warning++;
|
counts.warning++;
|
||||||
} else if (msg.Severity === 'danger') {
|
} else if (msg.Severity === 'danger') {
|
||||||
@@ -80,9 +78,9 @@ function countResultSet(rs: ResultSet, counts: ResultCounts): void {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
function countResultItems(results: Result[]): ResultCounts {
|
export function countResults(data: AuditData): ResultCounts {
|
||||||
const counts: ResultCounts = { total: 0, pass: 0, warning: 0, danger: 0, skipped: 0 };
|
const counts: ResultCounts = { total: 0, pass: 0, warning: 0, danger: 0 };
|
||||||
for (const result of results) {
|
for (const result of data.Results) {
|
||||||
countResultSet(result.Results, counts);
|
countResultSet(result.Results, counts);
|
||||||
if (result.PodResult) {
|
if (result.PodResult) {
|
||||||
countResultSet(result.PodResult.Results, counts);
|
countResultSet(result.PodResult.Results, counts);
|
||||||
@@ -94,35 +92,8 @@ function countResultItems(results: Result[]): ResultCounts {
|
|||||||
return counts;
|
return counts;
|
||||||
}
|
}
|
||||||
|
|
||||||
export function countResults(data: AuditData): ResultCounts {
|
|
||||||
return countResultItems(data.Results);
|
|
||||||
}
|
|
||||||
|
|
||||||
export function countResultsForItems(results: Result[]): ResultCounts {
|
|
||||||
return countResultItems(results);
|
|
||||||
}
|
|
||||||
|
|
||||||
export function getNamespaces(data: AuditData): string[] {
|
|
||||||
const namespaces = new Set<string>();
|
|
||||||
for (const result of data.Results) {
|
|
||||||
namespaces.add(result.Namespace);
|
|
||||||
}
|
|
||||||
return Array.from(namespaces).sort();
|
|
||||||
}
|
|
||||||
|
|
||||||
export function filterResultsByNamespace(data: AuditData, namespace: string): Result[] {
|
|
||||||
return data.Results.filter(r => r.Namespace === namespace);
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Settings ---
|
// --- Settings ---
|
||||||
|
|
||||||
export const INTERVAL_OPTIONS = [
|
|
||||||
{ label: '1 minute', value: 60 },
|
|
||||||
{ label: '5 minutes', value: 300 },
|
|
||||||
{ label: '10 minutes', value: 600 },
|
|
||||||
{ label: '30 minutes', value: 1800 },
|
|
||||||
];
|
|
||||||
|
|
||||||
const STORAGE_KEY = 'polaris-plugin-refresh-interval';
|
const STORAGE_KEY = 'polaris-plugin-refresh-interval';
|
||||||
const DEFAULT_INTERVAL_SECONDS = 300; // 5 minutes
|
const DEFAULT_INTERVAL_SECONDS = 300; // 5 minutes
|
||||||
|
|
||||||
@@ -141,23 +112,8 @@ export function setRefreshInterval(seconds: number): void {
|
|||||||
localStorage.setItem(STORAGE_KEY, String(seconds));
|
localStorage.setItem(STORAGE_KEY, String(seconds));
|
||||||
}
|
}
|
||||||
|
|
||||||
// --- Polaris dashboard proxy URL ---
|
|
||||||
|
|
||||||
export const POLARIS_DASHBOARD_PROXY =
|
|
||||||
'/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/';
|
|
||||||
|
|
||||||
// --- Score computation ---
|
|
||||||
|
|
||||||
export function computeScore(counts: ResultCounts): number {
|
|
||||||
if (counts.total === 0) return 0;
|
|
||||||
return Math.round((counts.pass / counts.total) * 100);
|
|
||||||
}
|
|
||||||
|
|
||||||
// --- Data fetching hook ---
|
// --- Data fetching hook ---
|
||||||
|
|
||||||
const POLARIS_API_PATH =
|
|
||||||
'/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json';
|
|
||||||
|
|
||||||
interface PolarisDataState {
|
interface PolarisDataState {
|
||||||
data: AuditData | null;
|
data: AuditData | null;
|
||||||
loading: boolean;
|
loading: boolean;
|
||||||
@@ -165,54 +121,87 @@ interface PolarisDataState {
|
|||||||
}
|
}
|
||||||
|
|
||||||
export function usePolarisData(refreshIntervalSeconds: number): PolarisDataState {
|
export function usePolarisData(refreshIntervalSeconds: number): PolarisDataState {
|
||||||
const [data, setData] = React.useState<AuditData | null>(null);
|
const [configMap, fetchError] = K8s.ResourceClasses.ConfigMap.useGet(
|
||||||
const [loading, setLoading] = React.useState(true);
|
'polaris-dashboard',
|
||||||
const [error, setError] = React.useState<string | null>(null);
|
'polaris'
|
||||||
const [tick, setTick] = React.useState(0);
|
);
|
||||||
|
const [cachedData, setCachedData] = React.useState<AuditData | null>(null);
|
||||||
|
const [parseError, setParseError] = React.useState<string | null>(null);
|
||||||
|
const [lastFetchTime, setLastFetchTime] = React.useState<number>(0);
|
||||||
|
const [, setTick] = React.useState(0);
|
||||||
|
|
||||||
|
// Parse ConfigMap data when it arrives
|
||||||
React.useEffect(() => {
|
React.useEffect(() => {
|
||||||
let cancelled = false;
|
if (!configMap) {
|
||||||
|
return;
|
||||||
async function fetchData() {
|
|
||||||
try {
|
|
||||||
const result: AuditData = await ApiProxy.request(POLARIS_API_PATH);
|
|
||||||
if (!cancelled) {
|
|
||||||
setData(result);
|
|
||||||
setError(null);
|
|
||||||
setLoading(false);
|
|
||||||
}
|
|
||||||
} catch (err: unknown) {
|
|
||||||
if (cancelled) return;
|
|
||||||
const status = (err as { status?: number }).status;
|
|
||||||
if (status === 403) {
|
|
||||||
setError(
|
|
||||||
'Access denied (403). Check that your RBAC permissions allow proxying to the Polaris service.'
|
|
||||||
);
|
|
||||||
} else if (status === 404 || status === 503) {
|
|
||||||
setError(
|
|
||||||
'Polaris dashboard not reachable. Ensure Polaris is installed in the polaris namespace.'
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
setError(`Failed to fetch Polaris data: ${String(err)}`);
|
|
||||||
}
|
|
||||||
setLoading(false);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
const dataMap = configMap.data as Record<string, string> | undefined;
|
||||||
|
const raw = dataMap?.['dashboard.json'];
|
||||||
|
if (!raw) {
|
||||||
|
setParseError('ConfigMap exists but dashboard.json key is missing.');
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
const parsed: AuditData = JSON.parse(raw);
|
||||||
|
setCachedData(parsed);
|
||||||
|
setParseError(null);
|
||||||
|
setLastFetchTime(Date.now());
|
||||||
|
} catch {
|
||||||
|
setParseError('Failed to parse dashboard.json: malformed JSON.');
|
||||||
|
}
|
||||||
|
}, [configMap]);
|
||||||
|
|
||||||
fetchData();
|
// Periodic refresh via re-render trigger
|
||||||
return () => {
|
|
||||||
cancelled = true;
|
|
||||||
};
|
|
||||||
}, [tick]);
|
|
||||||
|
|
||||||
// Periodic refresh
|
|
||||||
React.useEffect(() => {
|
React.useEffect(() => {
|
||||||
if (refreshIntervalSeconds <= 0) return;
|
if (refreshIntervalSeconds <= 0) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
const intervalId = window.setInterval(() => {
|
const intervalId = window.setInterval(() => {
|
||||||
setTick(t => t + 1);
|
setTick((t) => t + 1);
|
||||||
}, refreshIntervalSeconds * 1000);
|
}, refreshIntervalSeconds * 1000);
|
||||||
return () => window.clearInterval(intervalId);
|
return () => window.clearInterval(intervalId);
|
||||||
}, [refreshIntervalSeconds]);
|
}, [refreshIntervalSeconds]);
|
||||||
|
|
||||||
return { data, loading, error };
|
// Determine error state
|
||||||
|
if (fetchError) {
|
||||||
|
const status = (fetchError as { status?: number }).status;
|
||||||
|
if (status === 403) {
|
||||||
|
return {
|
||||||
|
data: cachedData,
|
||||||
|
loading: false,
|
||||||
|
error:
|
||||||
|
'Access denied (403). Check that your RBAC permissions allow reading ConfigMaps in the polaris namespace.',
|
||||||
|
};
|
||||||
|
}
|
||||||
|
if (status === 404) {
|
||||||
|
return {
|
||||||
|
data: cachedData,
|
||||||
|
loading: false,
|
||||||
|
error:
|
||||||
|
'Polaris dashboard ConfigMap not found (404). Ensure Polaris is installed in the polaris namespace.',
|
||||||
|
};
|
||||||
|
}
|
||||||
|
return {
|
||||||
|
data: cachedData,
|
||||||
|
loading: false,
|
||||||
|
error: `Failed to fetch Polaris data: ${String(fetchError)}`,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
if (parseError) {
|
||||||
|
return { data: cachedData, loading: false, error: parseError };
|
||||||
|
}
|
||||||
|
|
||||||
|
const isLoading = !configMap && !fetchError;
|
||||||
|
|
||||||
|
// Return cached data while loading if we have it
|
||||||
|
if (isLoading && cachedData && lastFetchTime > 0) {
|
||||||
|
return { data: cachedData, loading: false, error: null };
|
||||||
|
}
|
||||||
|
|
||||||
|
return {
|
||||||
|
data: cachedData,
|
||||||
|
loading: isLoading,
|
||||||
|
error: null,
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,114 +0,0 @@
|
|||||||
import {
|
|
||||||
Loader,
|
|
||||||
NameValueTable,
|
|
||||||
PercentageBar,
|
|
||||||
PercentageCircle,
|
|
||||||
SectionBox,
|
|
||||||
SectionHeader,
|
|
||||||
StatusLabel,
|
|
||||||
} from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
|
||||||
import React from 'react';
|
|
||||||
import { AuditData, computeScore, countResults, ResultCounts } from '../api/polaris';
|
|
||||||
import { usePolarisDataContext } from '../api/PolarisDataContext';
|
|
||||||
|
|
||||||
const COLORS = {
|
|
||||||
pass: '#4caf50',
|
|
||||||
warning: '#ff9800',
|
|
||||||
danger: '#f44336',
|
|
||||||
skipped: '#9e9e9e',
|
|
||||||
};
|
|
||||||
|
|
||||||
function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
|
|
||||||
const { counts } = props;
|
|
||||||
const score = computeScore(counts);
|
|
||||||
|
|
||||||
const chartData = [
|
|
||||||
{ name: 'Pass', value: counts.pass, fill: COLORS.pass },
|
|
||||||
{ name: 'Warning', value: counts.warning, fill: COLORS.warning },
|
|
||||||
{ name: 'Danger', value: counts.danger, fill: COLORS.danger },
|
|
||||||
{ name: 'Skipped', value: counts.skipped, fill: COLORS.skipped },
|
|
||||||
];
|
|
||||||
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionBox title="Cluster Score">
|
|
||||||
<PercentageCircle data={chartData} total={counts.total} label={`${score}%`} />
|
|
||||||
</SectionBox>
|
|
||||||
<SectionBox title="Check Distribution">
|
|
||||||
<PercentageBar data={chartData} total={counts.total} />
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{ name: 'Total Checks', value: String(counts.total) },
|
|
||||||
{
|
|
||||||
name: 'Pass',
|
|
||||||
value: <StatusLabel status="success">{counts.pass}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: 'Warning',
|
|
||||||
value: <StatusLabel status="warning">{counts.warning}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: 'Danger',
|
|
||||||
value: <StatusLabel status="error">{counts.danger}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{ name: 'Skipped', value: String(counts.skipped) },
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
<SectionBox title="Cluster Info">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{ name: 'Nodes', value: String(props.data.ClusterInfo.Nodes) },
|
|
||||||
{ name: 'Pods', value: String(props.data.ClusterInfo.Pods) },
|
|
||||||
{ name: 'Namespaces', value: String(props.data.ClusterInfo.Namespaces) },
|
|
||||||
{ name: 'Controllers', value: String(props.data.ClusterInfo.Controllers) },
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
export default function DashboardView() {
|
|
||||||
const { data, loading, error } = usePolarisDataContext();
|
|
||||||
|
|
||||||
if (loading) {
|
|
||||||
return <Loader title="Loading Polaris audit data..." />;
|
|
||||||
}
|
|
||||||
|
|
||||||
const counts = data ? countResults(data) : null;
|
|
||||||
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title="Polaris — Overview" />
|
|
||||||
|
|
||||||
{error && (
|
|
||||||
<SectionBox title="Error">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Status',
|
|
||||||
value: <StatusLabel status="error">{error}</StatusLabel>,
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
)}
|
|
||||||
|
|
||||||
{data && counts && <OverviewSection data={data} counts={counts} />}
|
|
||||||
|
|
||||||
{!data && !error && (
|
|
||||||
<SectionBox title="No Data">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Status',
|
|
||||||
value: 'No Polaris audit results found.',
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
)}
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,159 +0,0 @@
|
|||||||
import {
|
|
||||||
Loader,
|
|
||||||
NameValueTable,
|
|
||||||
SectionBox,
|
|
||||||
SectionHeader,
|
|
||||||
SimpleTable,
|
|
||||||
StatusLabel,
|
|
||||||
} from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
|
||||||
import React from 'react';
|
|
||||||
import { useParams } from 'react-router-dom';
|
|
||||||
import {
|
|
||||||
computeScore,
|
|
||||||
countResultsForItems,
|
|
||||||
filterResultsByNamespace,
|
|
||||||
POLARIS_DASHBOARD_PROXY,
|
|
||||||
Result,
|
|
||||||
ResultCounts,
|
|
||||||
} from '../api/polaris';
|
|
||||||
import { usePolarisDataContext } from '../api/PolarisDataContext';
|
|
||||||
|
|
||||||
function scoreStatus(score: number): 'success' | 'warning' | 'error' {
|
|
||||||
if (score >= 80) return 'success';
|
|
||||||
if (score >= 50) return 'warning';
|
|
||||||
return 'error';
|
|
||||||
}
|
|
||||||
|
|
||||||
function resourceCounts(result: Result): ResultCounts {
|
|
||||||
return countResultsForItems([result]);
|
|
||||||
}
|
|
||||||
|
|
||||||
export default function NamespaceDetailView() {
|
|
||||||
const { namespace } = useParams<{ namespace: string }>();
|
|
||||||
const { data, loading, error } = usePolarisDataContext();
|
|
||||||
|
|
||||||
if (loading) {
|
|
||||||
return <Loader title={`Loading Polaris data for ${namespace}...`} />;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (error) {
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title={`Polaris — ${namespace}`} />
|
|
||||||
<SectionBox title="Error">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Status',
|
|
||||||
value: <StatusLabel status="error">{error}</StatusLabel>,
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!data) {
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title={`Polaris — ${namespace}`} />
|
|
||||||
<SectionBox title="No Data">
|
|
||||||
<NameValueTable rows={[{ name: 'Status', value: 'No Polaris audit results found.' }]} />
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
const results = filterResultsByNamespace(data, namespace);
|
|
||||||
const counts = countResultsForItems(results);
|
|
||||||
const score = computeScore(counts);
|
|
||||||
const status = scoreStatus(score);
|
|
||||||
|
|
||||||
const countsPerResource = new Map<string, ResultCounts>();
|
|
||||||
for (const r of results) {
|
|
||||||
countsPerResource.set(`${r.Namespace}/${r.Kind}/${r.Name}`, resourceCounts(r));
|
|
||||||
}
|
|
||||||
|
|
||||||
function getResourceCounts(row: Result): ResultCounts {
|
|
||||||
return countsPerResource.get(`${row.Namespace}/${row.Kind}/${row.Name}`) ?? resourceCounts(row);
|
|
||||||
}
|
|
||||||
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title={`Polaris — ${namespace}`} />
|
|
||||||
|
|
||||||
<SectionBox title="External">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Polaris Dashboard',
|
|
||||||
value: (
|
|
||||||
<a href={POLARIS_DASHBOARD_PROXY} target="_blank" rel="noopener noreferrer">
|
|
||||||
View in Polaris Dashboard
|
|
||||||
</a>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
|
|
||||||
<SectionBox title="Namespace Score">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Score',
|
|
||||||
value: <StatusLabel status={status}>{score}%</StatusLabel>,
|
|
||||||
},
|
|
||||||
{ name: 'Total Checks', value: String(counts.total) },
|
|
||||||
{
|
|
||||||
name: 'Pass',
|
|
||||||
value: <StatusLabel status="success">{counts.pass}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: 'Warning',
|
|
||||||
value: <StatusLabel status="warning">{counts.warning}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: 'Danger',
|
|
||||||
value: <StatusLabel status="error">{counts.danger}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: 'Skipped',
|
|
||||||
value: String(counts.skipped),
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
|
|
||||||
<SectionBox title="Resources">
|
|
||||||
<SimpleTable
|
|
||||||
columns={[
|
|
||||||
{ label: 'Name', getter: (row: Result) => row.Name },
|
|
||||||
{ label: 'Kind', getter: (row: Result) => row.Kind },
|
|
||||||
{
|
|
||||||
label: 'Pass',
|
|
||||||
getter: (row: Result) => (
|
|
||||||
<StatusLabel status="success">{getResourceCounts(row).pass}</StatusLabel>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Warning',
|
|
||||||
getter: (row: Result) => (
|
|
||||||
<StatusLabel status="warning">{getResourceCounts(row).warning}</StatusLabel>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Danger',
|
|
||||||
getter: (row: Result) => (
|
|
||||||
<StatusLabel status="error">{getResourceCounts(row).danger}</StatusLabel>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
data={results}
|
|
||||||
emptyMessage={`No resources found in namespace "${namespace}".`}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,135 +0,0 @@
|
|||||||
import { Router } from '@kinvolk/headlamp-plugin/lib';
|
|
||||||
import {
|
|
||||||
Loader,
|
|
||||||
NameValueTable,
|
|
||||||
SectionBox,
|
|
||||||
SectionHeader,
|
|
||||||
SimpleTable,
|
|
||||||
StatusLabel,
|
|
||||||
} from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
|
||||||
import React from 'react';
|
|
||||||
import { Link } from 'react-router-dom';
|
|
||||||
import {
|
|
||||||
computeScore,
|
|
||||||
countResultsForItems,
|
|
||||||
filterResultsByNamespace,
|
|
||||||
getNamespaces,
|
|
||||||
} from '../api/polaris';
|
|
||||||
import { usePolarisDataContext } from '../api/PolarisDataContext';
|
|
||||||
|
|
||||||
function scoreStatus(score: number): 'success' | 'warning' | 'error' {
|
|
||||||
if (score >= 80) return 'success';
|
|
||||||
if (score >= 50) return 'warning';
|
|
||||||
return 'error';
|
|
||||||
}
|
|
||||||
|
|
||||||
interface NamespaceRow {
|
|
||||||
namespace: string;
|
|
||||||
score: number;
|
|
||||||
pass: number;
|
|
||||||
warning: number;
|
|
||||||
danger: number;
|
|
||||||
skipped: number;
|
|
||||||
}
|
|
||||||
|
|
||||||
export default function NamespacesListView() {
|
|
||||||
const { data, loading, error } = usePolarisDataContext();
|
|
||||||
|
|
||||||
if (loading) {
|
|
||||||
return <Loader title="Loading Polaris audit data..." />;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (error) {
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title="Polaris — Namespaces" />
|
|
||||||
<SectionBox title="Error">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Status',
|
|
||||||
value: <StatusLabel status="error">{error}</StatusLabel>,
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!data) {
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title="Polaris — Namespaces" />
|
|
||||||
<SectionBox title="No Data">
|
|
||||||
<NameValueTable rows={[{ name: 'Status', value: 'No Polaris audit results found.' }]} />
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
const namespaces = getNamespaces(data);
|
|
||||||
const rows: NamespaceRow[] = namespaces.map(ns => {
|
|
||||||
const results = filterResultsByNamespace(data, ns);
|
|
||||||
const counts = countResultsForItems(results);
|
|
||||||
const score = computeScore(counts);
|
|
||||||
return {
|
|
||||||
namespace: ns,
|
|
||||||
score,
|
|
||||||
pass: counts.pass,
|
|
||||||
warning: counts.warning,
|
|
||||||
danger: counts.danger,
|
|
||||||
skipped: counts.skipped,
|
|
||||||
};
|
|
||||||
});
|
|
||||||
|
|
||||||
return (
|
|
||||||
<>
|
|
||||||
<SectionHeader title="Polaris — Namespaces" />
|
|
||||||
<SectionBox>
|
|
||||||
<SimpleTable
|
|
||||||
columns={[
|
|
||||||
{
|
|
||||||
label: 'Namespace',
|
|
||||||
getter: (row: NamespaceRow) => (
|
|
||||||
<Link
|
|
||||||
to={Router.createRouteURL('polaris-namespace', {
|
|
||||||
namespace: row.namespace,
|
|
||||||
})}
|
|
||||||
>
|
|
||||||
{row.namespace}
|
|
||||||
</Link>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Score',
|
|
||||||
getter: (row: NamespaceRow) => (
|
|
||||||
<StatusLabel status={scoreStatus(row.score)}>{row.score}%</StatusLabel>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Pass',
|
|
||||||
getter: (row: NamespaceRow) => <StatusLabel status="success">{row.pass}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Warning',
|
|
||||||
getter: (row: NamespaceRow) => (
|
|
||||||
<StatusLabel status="warning">{row.warning}</StatusLabel>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Danger',
|
|
||||||
getter: (row: NamespaceRow) => <StatusLabel status="error">{row.danger}</StatusLabel>,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
label: 'Skipped',
|
|
||||||
getter: (row: NamespaceRow) => String(row.skipped),
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
data={rows}
|
|
||||||
emptyMessage="No namespaces found in Polaris audit data."
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
</>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
import { NameValueTable, SectionBox } from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
|
||||||
import React from 'react';
|
|
||||||
import { getRefreshInterval, INTERVAL_OPTIONS, setRefreshInterval } from '../api/polaris';
|
|
||||||
|
|
||||||
interface PluginSettingsProps {
|
|
||||||
data?: { [key: string]: string | number | boolean };
|
|
||||||
onDataChange?: (data: { [key: string]: string | number | boolean }) => void;
|
|
||||||
}
|
|
||||||
|
|
||||||
export default function PolarisSettings(props: PluginSettingsProps) {
|
|
||||||
const { data, onDataChange } = props;
|
|
||||||
const currentInterval = (data?.refreshInterval as number) ?? getRefreshInterval();
|
|
||||||
|
|
||||||
function handleChange(e: React.ChangeEvent<HTMLSelectElement>) {
|
|
||||||
const seconds = Number(e.target.value);
|
|
||||||
setRefreshInterval(seconds);
|
|
||||||
onDataChange?.({ ...data, refreshInterval: seconds });
|
|
||||||
}
|
|
||||||
|
|
||||||
return (
|
|
||||||
<SectionBox title="Polaris Settings">
|
|
||||||
<NameValueTable
|
|
||||||
rows={[
|
|
||||||
{
|
|
||||||
name: 'Refresh Interval',
|
|
||||||
value: (
|
|
||||||
<select value={currentInterval} onChange={handleChange}>
|
|
||||||
{INTERVAL_OPTIONS.map(opt => (
|
|
||||||
<option key={opt.value} value={opt.value}>
|
|
||||||
{opt.label}
|
|
||||||
</option>
|
|
||||||
))}
|
|
||||||
</select>
|
|
||||||
),
|
|
||||||
},
|
|
||||||
]}
|
|
||||||
/>
|
|
||||||
</SectionBox>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,163 @@
|
|||||||
|
import {
|
||||||
|
Loader,
|
||||||
|
SectionBox,
|
||||||
|
SectionHeader,
|
||||||
|
} from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
||||||
|
import React from 'react';
|
||||||
|
import {
|
||||||
|
AuditData,
|
||||||
|
countResults,
|
||||||
|
getRefreshInterval,
|
||||||
|
ResultCounts,
|
||||||
|
setRefreshInterval,
|
||||||
|
usePolarisData,
|
||||||
|
} from '../api/polaris';
|
||||||
|
|
||||||
|
const INTERVAL_OPTIONS = [
|
||||||
|
{ label: '1 minute', value: 60 },
|
||||||
|
{ label: '5 minutes', value: 300 },
|
||||||
|
{ label: '10 minutes', value: 600 },
|
||||||
|
{ label: '30 minutes', value: 1800 },
|
||||||
|
];
|
||||||
|
|
||||||
|
function RefreshSettings(props: {
|
||||||
|
interval: number;
|
||||||
|
onChange: (seconds: number) => void;
|
||||||
|
}) {
|
||||||
|
return (
|
||||||
|
<div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
|
||||||
|
<label htmlFor="polaris-refresh-interval">Refresh interval:</label>
|
||||||
|
<select
|
||||||
|
id="polaris-refresh-interval"
|
||||||
|
value={props.interval}
|
||||||
|
onChange={(e) => props.onChange(Number(e.target.value))}
|
||||||
|
>
|
||||||
|
{INTERVAL_OPTIONS.map((opt) => (
|
||||||
|
<option key={opt.value} value={opt.value}>
|
||||||
|
{opt.label}
|
||||||
|
</option>
|
||||||
|
))}
|
||||||
|
</select>
|
||||||
|
</div>
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
function StatCard(props: { label: string; value: number; color?: string }) {
|
||||||
|
return (
|
||||||
|
<div
|
||||||
|
style={{
|
||||||
|
padding: '16px 24px',
|
||||||
|
textAlign: 'center',
|
||||||
|
minWidth: '120px',
|
||||||
|
}}
|
||||||
|
>
|
||||||
|
<div
|
||||||
|
style={{
|
||||||
|
fontSize: '2rem',
|
||||||
|
fontWeight: 'bold',
|
||||||
|
color: props.color,
|
||||||
|
}}
|
||||||
|
>
|
||||||
|
{props.value}
|
||||||
|
</div>
|
||||||
|
<div style={{ fontSize: '0.875rem', opacity: 0.8 }}>{props.label}</div>
|
||||||
|
</div>
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
function ScoreBadge(props: { score: number }) {
|
||||||
|
const color = props.score >= 80 ? '#4caf50' : props.score >= 50 ? '#ff9800' : '#f44336';
|
||||||
|
return (
|
||||||
|
<div style={{ textAlign: 'center', marginBottom: '16px' }}>
|
||||||
|
<div style={{ fontSize: '3rem', fontWeight: 'bold', color }}>
|
||||||
|
{props.score}%
|
||||||
|
</div>
|
||||||
|
<div style={{ fontSize: '0.875rem', opacity: 0.8 }}>Cluster Score</div>
|
||||||
|
</div>
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
|
||||||
|
return (
|
||||||
|
<>
|
||||||
|
<SectionBox title="Score">
|
||||||
|
<ScoreBadge score={props.data.Score} />
|
||||||
|
</SectionBox>
|
||||||
|
<SectionBox title="Check Summary">
|
||||||
|
<div
|
||||||
|
style={{
|
||||||
|
display: 'flex',
|
||||||
|
justifyContent: 'center',
|
||||||
|
flexWrap: 'wrap',
|
||||||
|
gap: '16px',
|
||||||
|
}}
|
||||||
|
>
|
||||||
|
<StatCard label="Total" value={props.counts.total} />
|
||||||
|
<StatCard label="Pass" value={props.counts.pass} color="#4caf50" />
|
||||||
|
<StatCard label="Warning" value={props.counts.warning} color="#ff9800" />
|
||||||
|
<StatCard label="Danger" value={props.counts.danger} color="#f44336" />
|
||||||
|
</div>
|
||||||
|
</SectionBox>
|
||||||
|
<SectionBox title="Cluster Info">
|
||||||
|
<div
|
||||||
|
style={{
|
||||||
|
display: 'flex',
|
||||||
|
justifyContent: 'center',
|
||||||
|
flexWrap: 'wrap',
|
||||||
|
gap: '16px',
|
||||||
|
}}
|
||||||
|
>
|
||||||
|
<StatCard label="Nodes" value={props.data.ClusterInfo.Nodes} />
|
||||||
|
<StatCard label="Pods" value={props.data.ClusterInfo.Pods} />
|
||||||
|
<StatCard label="Namespaces" value={props.data.ClusterInfo.Namespaces} />
|
||||||
|
<StatCard label="Controllers" value={props.data.ClusterInfo.Controllers} />
|
||||||
|
</div>
|
||||||
|
</SectionBox>
|
||||||
|
</>
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
export default function PolarisView() {
|
||||||
|
const [interval, setInterval] = React.useState(getRefreshInterval);
|
||||||
|
|
||||||
|
function handleIntervalChange(seconds: number) {
|
||||||
|
setInterval(seconds);
|
||||||
|
setRefreshInterval(seconds);
|
||||||
|
}
|
||||||
|
|
||||||
|
const { data, loading, error } = usePolarisData(interval);
|
||||||
|
|
||||||
|
if (loading) {
|
||||||
|
return <Loader title="Loading Polaris audit data..." />;
|
||||||
|
}
|
||||||
|
|
||||||
|
const counts = data ? countResults(data) : null;
|
||||||
|
|
||||||
|
return (
|
||||||
|
<>
|
||||||
|
<SectionHeader title="Polaris" actions={[
|
||||||
|
<RefreshSettings
|
||||||
|
key="refresh"
|
||||||
|
interval={interval}
|
||||||
|
onChange={handleIntervalChange}
|
||||||
|
/>,
|
||||||
|
]} />
|
||||||
|
|
||||||
|
{error && (
|
||||||
|
<SectionBox title="Error">
|
||||||
|
<div style={{ padding: '16px', color: '#f44336' }}>{error}</div>
|
||||||
|
</SectionBox>
|
||||||
|
)}
|
||||||
|
|
||||||
|
{data && counts && <OverviewSection data={data} counts={counts} />}
|
||||||
|
|
||||||
|
{!data && !error && (
|
||||||
|
<SectionBox title="No Data">
|
||||||
|
<div style={{ padding: '16px' }}>
|
||||||
|
No Polaris audit results found.
|
||||||
|
</div>
|
||||||
|
</SectionBox>
|
||||||
|
)}
|
||||||
|
</>
|
||||||
|
);
|
||||||
|
}
|
||||||
+3
-58
@@ -1,16 +1,9 @@
|
|||||||
import {
|
import {
|
||||||
registerPluginSettings,
|
|
||||||
registerRoute,
|
registerRoute,
|
||||||
registerSidebarEntry,
|
registerSidebarEntry,
|
||||||
} from '@kinvolk/headlamp-plugin/lib';
|
} from '@kinvolk/headlamp-plugin/lib';
|
||||||
import React from 'react';
|
import React from 'react';
|
||||||
import { PolarisDataProvider } from './api/PolarisDataContext';
|
import PolarisView from './components/PolarisView';
|
||||||
import DashboardView from './components/DashboardView';
|
|
||||||
import NamespaceDetailView from './components/NamespaceDetailView';
|
|
||||||
import NamespacesListView from './components/NamespacesListView';
|
|
||||||
import PolarisSettings from './components/PolarisSettings';
|
|
||||||
|
|
||||||
// --- Sidebar entries ---
|
|
||||||
|
|
||||||
registerSidebarEntry({
|
registerSidebarEntry({
|
||||||
parent: null,
|
parent: null,
|
||||||
@@ -20,58 +13,10 @@ registerSidebarEntry({
|
|||||||
icon: 'mdi:shield-check',
|
icon: 'mdi:shield-check',
|
||||||
});
|
});
|
||||||
|
|
||||||
registerSidebarEntry({
|
|
||||||
parent: 'polaris',
|
|
||||||
name: 'polaris-overview',
|
|
||||||
label: 'Overview',
|
|
||||||
url: '/polaris',
|
|
||||||
icon: 'mdi:view-dashboard',
|
|
||||||
});
|
|
||||||
|
|
||||||
registerSidebarEntry({
|
|
||||||
parent: 'polaris',
|
|
||||||
name: 'polaris-namespaces',
|
|
||||||
label: 'Namespaces',
|
|
||||||
url: '/polaris/namespaces',
|
|
||||||
icon: 'mdi:dns',
|
|
||||||
});
|
|
||||||
|
|
||||||
// --- Routes ---
|
|
||||||
|
|
||||||
registerRoute({
|
registerRoute({
|
||||||
path: '/polaris',
|
path: '/polaris',
|
||||||
sidebar: 'polaris-overview',
|
sidebar: 'polaris',
|
||||||
name: 'polaris',
|
name: 'polaris',
|
||||||
exact: true,
|
exact: true,
|
||||||
component: () => (
|
component: () => <PolarisView />,
|
||||||
<PolarisDataProvider>
|
|
||||||
<DashboardView />
|
|
||||||
</PolarisDataProvider>
|
|
||||||
),
|
|
||||||
});
|
});
|
||||||
|
|
||||||
registerRoute({
|
|
||||||
path: '/polaris/namespaces',
|
|
||||||
sidebar: 'polaris-namespaces',
|
|
||||||
name: 'polaris-namespaces',
|
|
||||||
exact: true,
|
|
||||||
component: () => (
|
|
||||||
<PolarisDataProvider>
|
|
||||||
<NamespacesListView />
|
|
||||||
</PolarisDataProvider>
|
|
||||||
),
|
|
||||||
});
|
|
||||||
|
|
||||||
registerRoute({
|
|
||||||
path: '/polaris/ns/:namespace',
|
|
||||||
sidebar: 'polaris-namespaces',
|
|
||||||
name: 'polaris-namespace',
|
|
||||||
exact: true,
|
|
||||||
component: () => (
|
|
||||||
<PolarisDataProvider>
|
|
||||||
<NamespaceDetailView />
|
|
||||||
</PolarisDataProvider>
|
|
||||||
),
|
|
||||||
});
|
|
||||||
|
|
||||||
registerPluginSettings('headlamp-polaris-plugin', PolarisSettings, true);
|
|
||||||
|
|||||||
@@ -1,4 +0,0 @@
|
|||||||
{
|
|
||||||
"extends": "@kinvolk/headlamp-plugin/config/plugins-tsconfig.json",
|
|
||||||
"include": ["src"]
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
import { defineConfig } from 'vitest/config';
|
|
||||||
|
|
||||||
export default defineConfig({
|
|
||||||
test: {
|
|
||||||
globals: true,
|
|
||||||
environment: 'jsdom',
|
|
||||||
},
|
|
||||||
});
|
|
||||||
Reference in New Issue
Block a user