Compare commits

...

15 Commits

Author SHA1 Message Date
gitea-actions[bot] 66903ca5e5 ci: update artifact hub metadata for v0.2.0-dev.3 2026-02-09 16:12:41 +00:00
gitea-actions[bot] 1273f94ae5 ci: update artifact hub metadata for v0.2.0-dev.2 2026-02-09 16:03:25 +00:00
gitea-actions[bot] 99bac773cc ci: update artifact hub metadata for v0.2.0-dev.1 2026-02-09 15:26:20 +00:00
gitea-actions[bot] 9fdb7c04cd ci: update artifact hub metadata for v0.2.0-dev.1 2026-02-09 14:34:11 +00:00
gitea-actions[bot] 975a31d1f3 ci: update artifact hub metadata for v0.2.0-dev.1 2026-02-09 14:26:59 +00:00
gitea-actions[bot] e54630410e ci: update artifact hub metadata for v0.2.0-dev.1 2026-02-09 14:18:16 +00:00
gitea-actions[bot] 4838b22a02 ci: update artifact hub metadata for v0.1.6 2026-02-08 03:15:02 +00:00
Chris Farhood c67bcb1804 chore: bump version to 0.1.6 2026-02-07 22:13:19 -05:00
Chris Farhood c19bb2fa87 fix: use "Polaris" as plugin settings display name
Changed from "headlamp-polaris-plugin" to "Polaris" in the
registerPluginSettings call. This makes the plugin name appear
cleanly in Settings > Plugins.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
2026-02-07 22:12:55 -05:00
Chris Farhood 253d1277d9 docs: document skipped count limitation
Added "Known Limitations" section explaining that the skipped count
only reflects Severity=ignore checks and does not include
annotation-based exemptions.

Explains why (exempted checks omitted from results.json) and what
would be required to support exemption counting (direct K8s resource
queries with broader RBAC).

Points users to the "View in Polaris Dashboard" link as a workaround.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
2026-02-07 22:12:55 -05:00
Chris Farhood f69c91acf9 feat: add tooltip to skipped count explaining limitation
The skipped count only reflects checks with Severity=ignore from
the Polaris API. Annotation-based exemptions (e.g.,
polaris.fairwinds.com/*-exempt) are not included because:

1. Exempted checks are completely omitted from results.json
2. The Polaris dashboard UI counts exemptions client-side by
   querying Kubernetes resources for annotations
3. Our plugin only has access to the processed audit results

Added HTML title tooltip to explain this limitation to users.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
2026-02-07 22:12:55 -05:00
Chris Farhood 5659026959 fix: add :80 port to dashboard proxy constant
The POLARIS_DASHBOARD_PROXY constant was missing :80, causing
dashboard links in the UI to fail with "no endpoints available".
This matches the fix already applied to POLARIS_API_PATH.

Fixes external dashboard link in namespace detail view.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
2026-02-07 22:12:55 -05:00
gitea-actions[bot] 6ae632f577 ci: update artifact hub metadata for v0.1.5 2026-02-08 01:48:09 +00:00
Chris Farhood e0cfb4e808 chore: bump version to 0.1.5 2026-02-07 20:46:32 -05:00
Chris Farhood c4c43cef40 fix: restore :80 port in service proxy URL
The removal of :80 in commit 39d85a3 broke service proxy requests.
Kubernetes API requires explicit port specification when services
have named ports. Without it, the API server returns "no endpoints
available" even though endpoints exist.

Root cause: polaris-dashboard service defines port as named
"http-dashboard" on port 80. The proxy sub-resource requires
either :80 or :http-dashboard suffix to resolve correctly.

Fixes the "Polaris dashboard not reachable" error on v0.1.4.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>
2026-02-07 20:46:13 -05:00
7 changed files with 41 additions and 9 deletions
+20
View File
@@ -222,6 +222,26 @@ AuditData
Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"`, `"danger"`, or `"ignore"`). Checks with `Severity: "ignore"` and `Success: false` are counted as skipped. The cluster score is computed client-side as `pass / total * 100`.
## Known Limitations
### Skipped Count and Annotation-Based Exemptions
The **Skipped** count shown in the plugin only reflects checks with `Severity: "ignore"` in the Polaris API response. It does **not** include annotation-based exemptions (e.g., `polaris.fairwinds.com/privilegeEscalationAllowed-exempt: "true"`).
**Why?** Polaris completely omits exempted checks from the `results.json` endpoint. The native Polaris dashboard UI computes the "skipped" count client-side by:
1. Querying Kubernetes resources (Deployments, DaemonSets, StatefulSets, Pods) directly
2. Parsing their annotations for `polaris.fairwinds.com/*-exempt` keys
3. Counting how many checks were exempted
This plugin only has access to the processed audit results via the service proxy and does not query raw Kubernetes resources. To show accurate exemption counts, the plugin would need to:
- Request cluster-wide read access to all workload types (requires additional RBAC grants beyond `services/proxy`)
- Parse annotations on every workload in every namespace
- Cross-reference with the Polaris check catalog to count exemptions
This is a significant architectural change and is not currently implemented. Hover over the "Skipped" count in the UI to see a tooltip explaining this limitation.
**Workaround:** Use the "View in Polaris Dashboard" link from any namespace detail view to see the full exemption count in the native dashboard.
## Releasing
Releases are automated via CI. To cut a release:
+3 -3
View File
@@ -1,4 +1,4 @@
version: 0.1.4
version: 0.2.0-dev.3
name: headlamp-polaris-plugin
displayName: Polaris
createdAt: "2026-02-05T19:00:00Z"
@@ -28,7 +28,7 @@ maintainers:
- name: cpfarhood
email: "chris@farhood.org"
annotations:
headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.1.4/headlamp-polaris-plugin-0.1.4.tar.gz"
headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.2.0-dev.3/headlamp-polaris-plugin-0.2.0-dev.3.tar.gz"
headlamp/plugin/version-compat: ">=0.26"
headlamp/plugin/archive-checksum: sha256:932e875310e1d3cd51a2b87ceff457582f6877395d2c521b75501849ac4af0ae
headlamp/plugin/archive-checksum: sha256:6025df1457916fa7a82738c0e36a7fe44094bd7a1a5ef8d3126265be07b51b62
headlamp/plugin/distro-compat: in-cluster
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "headlamp-polaris-plugin",
"version": "0.1.4",
"version": "0.1.6",
"description": "Headlamp plugin for Fairwinds Polaris audit results",
"scripts": {
"start": "headlamp-plugin start",
+3 -2
View File
@@ -146,7 +146,7 @@ export function setRefreshInterval(seconds: number): void {
// --- Polaris dashboard proxy URL ---
export const POLARIS_DASHBOARD_PROXY =
'/api/v1/namespaces/polaris/services/polaris-dashboard/proxy/';
'/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/';
// --- Score computation ---
@@ -157,7 +157,8 @@ export function computeScore(counts: ResultCounts): number {
// --- Data fetching hook ---
const POLARIS_API_PATH = '/api/v1/namespaces/polaris/services/polaris-dashboard/proxy/results.json';
const POLARIS_API_PATH =
'/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json';
interface PolarisDataState {
data: AuditData | null;
+8 -1
View File
@@ -51,7 +51,14 @@ function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
name: 'Danger',
value: <StatusLabel status="error">{counts.danger}</StatusLabel>,
},
{ name: 'Skipped', value: String(counts.skipped) },
{
name: 'Skipped',
value: (
<span title="Only counts checks with Severity=ignore. Annotation-based exemptions are not included.">
{counts.skipped}
</span>
),
},
]}
/>
</SectionBox>
+5 -1
View File
@@ -120,7 +120,11 @@ export default function NamespaceDetailView() {
},
{
name: 'Skipped',
value: String(counts.skipped),
value: (
<span title="Only counts checks with Severity=ignore. Annotation-based exemptions are not included.">
{counts.skipped}
</span>
),
},
]}
/>
+1 -1
View File
@@ -74,4 +74,4 @@ registerRoute({
),
});
registerPluginSettings('headlamp-polaris-plugin', PolarisSettings, true);
registerPluginSettings('polaris', PolarisSettings, true);