Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 4838b22a02 | |||
| c67bcb1804 | |||
| c19bb2fa87 | |||
| 253d1277d9 | |||
| f69c91acf9 | |||
| 5659026959 | |||
| 6ae632f577 | |||
| e0cfb4e808 | |||
| c4c43cef40 |
@@ -222,6 +222,26 @@ AuditData
|
||||
|
||||
Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"`, `"danger"`, or `"ignore"`). Checks with `Severity: "ignore"` and `Success: false` are counted as skipped. The cluster score is computed client-side as `pass / total * 100`.
|
||||
|
||||
## Known Limitations
|
||||
|
||||
### Skipped Count and Annotation-Based Exemptions
|
||||
|
||||
The **Skipped** count shown in the plugin only reflects checks with `Severity: "ignore"` in the Polaris API response. It does **not** include annotation-based exemptions (e.g., `polaris.fairwinds.com/privilegeEscalationAllowed-exempt: "true"`).
|
||||
|
||||
**Why?** Polaris completely omits exempted checks from the `results.json` endpoint. The native Polaris dashboard UI computes the "skipped" count client-side by:
|
||||
1. Querying Kubernetes resources (Deployments, DaemonSets, StatefulSets, Pods) directly
|
||||
2. Parsing their annotations for `polaris.fairwinds.com/*-exempt` keys
|
||||
3. Counting how many checks were exempted
|
||||
|
||||
This plugin only has access to the processed audit results via the service proxy and does not query raw Kubernetes resources. To show accurate exemption counts, the plugin would need to:
|
||||
- Request cluster-wide read access to all workload types (requires additional RBAC grants beyond `services/proxy`)
|
||||
- Parse annotations on every workload in every namespace
|
||||
- Cross-reference with the Polaris check catalog to count exemptions
|
||||
|
||||
This is a significant architectural change and is not currently implemented. Hover over the "Skipped" count in the UI to see a tooltip explaining this limitation.
|
||||
|
||||
**Workaround:** Use the "View in Polaris Dashboard" link from any namespace detail view to see the full exemption count in the native dashboard.
|
||||
|
||||
## Releasing
|
||||
|
||||
Releases are automated via CI. To cut a release:
|
||||
|
||||
+3
-3
@@ -1,4 +1,4 @@
|
||||
version: 0.1.4
|
||||
version: 0.1.6
|
||||
name: headlamp-polaris-plugin
|
||||
displayName: Polaris
|
||||
createdAt: "2026-02-05T19:00:00Z"
|
||||
@@ -28,7 +28,7 @@ maintainers:
|
||||
- name: cpfarhood
|
||||
email: "chris@farhood.org"
|
||||
annotations:
|
||||
headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.1.4/headlamp-polaris-plugin-0.1.4.tar.gz"
|
||||
headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.1.6/headlamp-polaris-plugin-0.1.6.tar.gz"
|
||||
headlamp/plugin/version-compat: ">=0.26"
|
||||
headlamp/plugin/archive-checksum: sha256:932e875310e1d3cd51a2b87ceff457582f6877395d2c521b75501849ac4af0ae
|
||||
headlamp/plugin/archive-checksum: sha256:2d20571107863b8c5197f207e6bea6dcad6ae5401fa701f1415405cfa63ab58b
|
||||
headlamp/plugin/distro-compat: in-cluster
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "headlamp-polaris-plugin",
|
||||
"version": "0.1.4",
|
||||
"version": "0.1.6",
|
||||
"description": "Headlamp plugin for Fairwinds Polaris audit results",
|
||||
"scripts": {
|
||||
"start": "headlamp-plugin start",
|
||||
|
||||
+3
-2
@@ -146,7 +146,7 @@ export function setRefreshInterval(seconds: number): void {
|
||||
// --- Polaris dashboard proxy URL ---
|
||||
|
||||
export const POLARIS_DASHBOARD_PROXY =
|
||||
'/api/v1/namespaces/polaris/services/polaris-dashboard/proxy/';
|
||||
'/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/';
|
||||
|
||||
// --- Score computation ---
|
||||
|
||||
@@ -157,7 +157,8 @@ export function computeScore(counts: ResultCounts): number {
|
||||
|
||||
// --- Data fetching hook ---
|
||||
|
||||
const POLARIS_API_PATH = '/api/v1/namespaces/polaris/services/polaris-dashboard/proxy/results.json';
|
||||
const POLARIS_API_PATH =
|
||||
'/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json';
|
||||
|
||||
interface PolarisDataState {
|
||||
data: AuditData | null;
|
||||
|
||||
@@ -51,7 +51,14 @@ function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
|
||||
name: 'Danger',
|
||||
value: <StatusLabel status="error">{counts.danger}</StatusLabel>,
|
||||
},
|
||||
{ name: 'Skipped', value: String(counts.skipped) },
|
||||
{
|
||||
name: 'Skipped',
|
||||
value: (
|
||||
<span title="Only counts checks with Severity=ignore. Annotation-based exemptions are not included.">
|
||||
{counts.skipped}
|
||||
</span>
|
||||
),
|
||||
},
|
||||
]}
|
||||
/>
|
||||
</SectionBox>
|
||||
|
||||
@@ -120,7 +120,11 @@ export default function NamespaceDetailView() {
|
||||
},
|
||||
{
|
||||
name: 'Skipped',
|
||||
value: String(counts.skipped),
|
||||
value: (
|
||||
<span title="Only counts checks with Severity=ignore. Annotation-based exemptions are not included.">
|
||||
{counts.skipped}
|
||||
</span>
|
||||
),
|
||||
},
|
||||
]}
|
||||
/>
|
||||
|
||||
+1
-1
@@ -74,4 +74,4 @@ registerRoute({
|
||||
),
|
||||
});
|
||||
|
||||
registerPluginSettings('headlamp-polaris-plugin', PolarisSettings, true);
|
||||
registerPluginSettings('polaris', PolarisSettings, true);
|
||||
|
||||
Reference in New Issue
Block a user