Fairwinds Polaris

Cluster Overview: https://10.43.0.1:443

Storms ahead, be careful

Grade: F

Score: 58%

Score is the percentage of passing checks. Warnings get half the weight of dangerous checks.

353 passing checks
360 warning checks
67 dangerous checks

Results by Category

EfficiencyScore: 45%

Configuring resource requests and limits for workloads running in Kubernetes helps ensure that every container will have access to all the resources it needs. These are also a crucial part of cluster autoscaling logic, as new nodes are only spun up when there is insufficient capacity on existing infrastructure for new pod(s). By default, Polaris validates that resource requests and limits are set, it also includes optional functionality to ensure these requests and limits fall within specified ranges. Refer to the Polaris documentation about Efficiency for more information.

ReliabilityScore: 45%

Kubernetes is built to reliabily run highly available applications. Polaris includes a number of checks to ensure that you are maximizing the reliability potential of Kubernetes. Refer to the Polaris documentation about Reliability for more information.

SecurityScore: 63%

Kubernetes provides a great deal of configurability when it comes to the security of your workloads. A key principle here involves limiting the level of access any individual workload has. Polaris has validations for a number of best practices, mostly focused on ensuring that unnecessary access has not been granted to an application workload. Refer to the Polaris documentation about Security for more information.

Cluster Resources

ClusterRole: admin

Spec: no checks applied

ClusterRole: alloy

Spec: no checks applied

ClusterRole: cert-manager-cainjector

Spec: no checks applied

ClusterRole: cert-manager-cluster-view

Spec: no checks applied

ClusterRole: cert-manager-controller-approve:cert-manager-io

Spec: no checks applied

ClusterRole: cert-manager-controller-certificates

Spec: no checks applied

ClusterRole: cert-manager-controller-certificatesigningrequests

Spec: no checks applied

ClusterRole: cert-manager-controller-challenges

Spec: no checks applied

ClusterRole: cert-manager-controller-clusterissuers

Spec: no checks applied

ClusterRole: cert-manager-controller-ingress-shim

Spec: no checks applied

ClusterRole: cert-manager-controller-issuers

Spec: no checks applied

ClusterRole: cert-manager-controller-orders

Spec: no checks applied

ClusterRole: cert-manager-edit

Spec: no checks applied

ClusterRole: cert-manager-view

Spec: no checks applied

ClusterRole: cert-manager-webhook:subjectaccessreviews

Spec: no checks applied

ClusterRole: cloudnative-pg

Spec: no checks applied

ClusterRole: cloudnative-pg-edit

Spec: no checks applied

ClusterRole: cloudnative-pg-view

Spec: no checks applied

ClusterRole: cluster-admin

Spec: no checks applied

ClusterRole: clustercidrs-node

Spec: no checks applied

ClusterRole: crd-controller-flux-system

Spec: no checks applied

ClusterRole: csi-smb-node-secret-role

Spec: no checks applied

ClusterRole: edit

Spec: no checks applied

ClusterRole: flux-edit-flux-system

Spec: no checks applied

ClusterRole: flux-view-flux-system

Spec: no checks applied

ClusterRole: hcloud-csi-controller

Spec: no checks applied

ClusterRole: keel

Spec: no checks applied

ClusterRole: kube-state-metrics

Spec: no checks applied

ClusterRole: longhorn-role

Spec: no checks applied

ClusterRole: polaris

Spec: no checks applied

ClusterRole: prometheus

Spec: no checks applied

ClusterRole: smb-external-provisioner-role

Spec: no checks applied

ClusterRole: smb-external-resizer-role

Spec: no checks applied

ClusterRole: system-upgrade-controller

Spec: no checks applied

ClusterRole: system-upgrade-controller-drainer

Spec: no checks applied

ClusterRole: system:aggregate-to-admin

Spec: no checks applied

ClusterRole: system:aggregate-to-edit

Spec: no checks applied

ClusterRole: system:aggregate-to-view

Spec: no checks applied

ClusterRole: system:auth-delegator

Spec: no checks applied

ClusterRole: system:basic-user

Spec: no checks applied

ClusterRole: system:certificates.k8s.io:certificatesigningrequests:nodeclient

Spec: no checks applied

ClusterRole: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient

Spec: no checks applied

ClusterRole: system:certificates.k8s.io:kube-apiserver-client-approver

Spec: no checks applied

ClusterRole: system:certificates.k8s.io:kube-apiserver-client-kubelet-approver

Spec: no checks applied

ClusterRole: system:certificates.k8s.io:kubelet-serving-approver

Spec: no checks applied

ClusterRole: system:certificates.k8s.io:legacy-unknown-approver

Spec: no checks applied

ClusterRole: system:controller:attachdetach-controller

Spec: no checks applied

ClusterRole: system:controller:certificate-controller

Spec: no checks applied

ClusterRole: system:controller:clusterrole-aggregation-controller

Spec: no checks applied

ClusterRole: system:controller:cronjob-controller

Spec: no checks applied

ClusterRole: system:controller:daemon-set-controller

Spec: no checks applied

ClusterRole: system:controller:deployment-controller

Spec: no checks applied

ClusterRole: system:controller:device-taint-eviction-controller

Spec: no checks applied

ClusterRole: system:controller:disruption-controller

Spec: no checks applied

ClusterRole: system:controller:endpoint-controller

Spec: no checks applied

ClusterRole: system:controller:endpointslice-controller

Spec: no checks applied

ClusterRole: system:controller:endpointslicemirroring-controller

Spec: no checks applied

ClusterRole: system:controller:ephemeral-volume-controller

Spec: no checks applied

ClusterRole: system:controller:expand-controller

Spec: no checks applied

ClusterRole: system:controller:generic-garbage-collector

Spec: no checks applied

ClusterRole: system:controller:horizontal-pod-autoscaler

Spec: no checks applied

ClusterRole: system:controller:job-controller

Spec: no checks applied

ClusterRole: system:controller:legacy-service-account-token-cleaner

Spec: no checks applied

ClusterRole: system:controller:namespace-controller

Spec: no checks applied

ClusterRole: system:controller:node-controller

Spec: no checks applied

ClusterRole: system:controller:persistent-volume-binder

Spec: no checks applied

ClusterRole: system:controller:pod-garbage-collector

Spec: no checks applied

ClusterRole: system:controller:pv-protection-controller

Spec: no checks applied

ClusterRole: system:controller:pvc-protection-controller

Spec: no checks applied

ClusterRole: system:controller:replicaset-controller

Spec: no checks applied

ClusterRole: system:controller:replication-controller

Spec: no checks applied

ClusterRole: system:controller:resource-claim-controller

Spec: no checks applied

ClusterRole: system:controller:resourcequota-controller

Spec: no checks applied

ClusterRole: system:controller:root-ca-cert-publisher

Spec: no checks applied

ClusterRole: system:controller:route-controller

Spec: no checks applied

ClusterRole: system:controller:selinux-warning-controller

Spec: no checks applied

ClusterRole: system:controller:service-account-controller

Spec: no checks applied

ClusterRole: system:controller:service-cidrs-controller

Spec: no checks applied

ClusterRole: system:controller:service-controller

Spec: no checks applied

ClusterRole: system:controller:statefulset-controller

Spec: no checks applied

ClusterRole: system:controller:ttl-after-finished-controller

Spec: no checks applied

ClusterRole: system:controller:ttl-controller

Spec: no checks applied

ClusterRole: system:controller:validatingadmissionpolicy-status-controller

Spec: no checks applied

ClusterRole: system:controller:volumeattributesclass-protection-controller

Spec: no checks applied

ClusterRole: system:coredns

Spec: no checks applied

ClusterRole: system:discovery

Spec: no checks applied

ClusterRole: system:hcloud-cloud-controller-manager

Spec: no checks applied

ClusterRole: system:heapster

Spec: no checks applied

ClusterRole: system:k3s-controller

Spec: no checks applied

ClusterRole: system:kube-aggregator

Spec: no checks applied

ClusterRole: system:kube-controller-manager

Spec: no checks applied

ClusterRole: system:kube-dns

Spec: no checks applied

ClusterRole: system:kube-scheduler

Spec: no checks applied

ClusterRole: system:kubelet-api-admin

Spec: no checks applied

ClusterRole: system:monitoring

Spec: no checks applied

ClusterRole: system:node

Spec: no checks applied

ClusterRole: system:node-bootstrapper

Spec: no checks applied

ClusterRole: system:node-problem-detector

Spec: no checks applied

ClusterRole: system:node-proxier

Spec: no checks applied

ClusterRole: system:persistent-volume-provisioner

Spec: no checks applied

ClusterRole: system:public-info-viewer

Spec: no checks applied

ClusterRole: system:service-account-issuer-discovery

Spec: no checks applied

ClusterRole: system:volume-scheduler

Spec: no checks applied

ClusterRole: traefik-ingress

Spec: no checks applied

ClusterRole: view

Spec: no checks applied

ClusterRoleBinding: alloy

Spec: no checks applied

ClusterRoleBinding: cert-manager-cainjector

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-approve:cert-manager-io

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-certificates

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-certificatesigningrequests

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-challenges

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-clusterissuers

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-ingress-shim

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-issuers

Spec: no checks applied

ClusterRoleBinding: cert-manager-controller-orders

Spec: no checks applied

ClusterRoleBinding: cert-manager-webhook:subjectaccessreviews

Spec: no checks applied

ClusterRoleBinding: cloudnative-pg

Spec: no checks applied

ClusterRoleBinding: cluster-admin

Spec: no checks applied

ClusterRoleBinding: cluster-reconciler-flux-system

Spec: no checks applied

ClusterRoleBinding: clustercidrs-node

Spec: no checks applied

ClusterRoleBinding: crd-controller-flux-system

Spec: no checks applied

ClusterRoleBinding: csi-smb-node-secret-binding

Spec: no checks applied

ClusterRoleBinding: hcloud-csi-controller

Spec: no checks applied

ClusterRoleBinding: k7s

Spec: no checks applied

ClusterRoleBinding: keel

Spec: no checks applied

ClusterRoleBinding: kube-apiserver-kubelet-admin

Spec: no checks applied

ClusterRoleBinding: kube-state-metrics

Spec: no checks applied

ClusterRoleBinding: longhorn-bind

Spec: no checks applied

ClusterRoleBinding: longhorn-support-bundle

Spec: no checks applied

ClusterRoleBinding: polaris

Spec: no checks applied

ClusterRoleBinding: polaris-view

Spec: no checks applied

ClusterRoleBinding: prometheus

Spec: no checks applied

ClusterRoleBinding: smb-csi-provisioner-binding

Spec: no checks applied

ClusterRoleBinding: smb-csi-resizer-role

Spec: no checks applied

ClusterRoleBinding: system-upgrade

Spec: no checks applied

ClusterRoleBinding: system-upgrade-drainer

Spec: no checks applied

ClusterRoleBinding: system:basic-user

Spec: no checks applied

ClusterRoleBinding: system:controller:attachdetach-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:certificate-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:clusterrole-aggregation-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:cronjob-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:daemon-set-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:deployment-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:device-taint-eviction-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:disruption-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:endpoint-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:endpointslice-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:endpointslicemirroring-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:ephemeral-volume-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:expand-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:generic-garbage-collector

Spec: no checks applied

ClusterRoleBinding: system:controller:horizontal-pod-autoscaler

Spec: no checks applied

ClusterRoleBinding: system:controller:job-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:legacy-service-account-token-cleaner

Spec: no checks applied

ClusterRoleBinding: system:controller:namespace-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:node-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:persistent-volume-binder

Spec: no checks applied

ClusterRoleBinding: system:controller:pod-garbage-collector

Spec: no checks applied

ClusterRoleBinding: system:controller:pv-protection-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:pvc-protection-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:replicaset-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:replication-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:resource-claim-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:resourcequota-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:root-ca-cert-publisher

Spec: no checks applied

ClusterRoleBinding: system:controller:route-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:selinux-warning-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:service-account-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:service-cidrs-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:service-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:statefulset-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:ttl-after-finished-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:ttl-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:validatingadmissionpolicy-status-controller

Spec: no checks applied

ClusterRoleBinding: system:controller:volumeattributesclass-protection-controller

Spec: no checks applied

ClusterRoleBinding: system:coredns

Spec: no checks applied

ClusterRoleBinding: system:discovery

Spec: no checks applied

ClusterRoleBinding: system:hcloud-cloud-controller-manager:restricted

Spec: no checks applied

ClusterRoleBinding: system:k3s-controller

Spec: no checks applied

ClusterRoleBinding: system:kube-controller-manager

Spec: no checks applied

ClusterRoleBinding: system:kube-dns

Spec: no checks applied

ClusterRoleBinding: system:kube-scheduler

Spec: no checks applied

ClusterRoleBinding: system:monitoring

Spec: no checks applied

ClusterRoleBinding: system:node

Spec: no checks applied

ClusterRoleBinding: system:node-proxier

Spec: no checks applied

ClusterRoleBinding: system:public-info-viewer

Spec: no checks applied

ClusterRoleBinding: system:service-account-issuer-discovery

Spec: no checks applied

ClusterRoleBinding: system:volume-scheduler

Spec: no checks applied

ClusterRoleBinding: traefik-ingress

Spec: no checks applied

Namespace: ai-tools

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: web-fetcher

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container web-fetcher:

Should not be allowed to run as root
CPU limits should be set
Liveness probe should be configured
Memory requests should be set
Filesystem should be read only
CPU requests should be set
Memory limits should be set
Readiness probe should be configured
Not running as privileged

Ingress: web-fetcher

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: apps

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: gastro-guide

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container gastro-guide:

Should not be allowed to run as root
Readiness probe should be configured
CPU limits should be set
CPU requests should be set
Filesystem should be read only
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Not running as privileged

Deployment: gastro-guide-jvm

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container gastro-guide:

Should not be allowed to run as root
CPU limits should be set
Liveness probe should be configured
CPU requests should be set
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Deployment: listy

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container listy:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Filesystem should be read only
Memory requests should be set
Readiness probe should be configured
Not running as privileged

Deployment: party-events

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container party-events:

Should not be allowed to run as root
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
CPU limits should be set
Not running as privileged

Deployment: quiz-api

Spec: no checks applied

Pod Spec:

Host PID is not configured
Host IPC is not configured

Container quiz-api:

Should not be allowed to run as root
Readiness probe should be configured
CPU limits should be set
CPU requests should be set
Memory requests should be set
Filesystem should be read only
Liveness probe should be configured
Memory limits should be set
Not running as privileged

Deployment: smart-reader

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container smart-reader:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Liveness probe should be configured
Not running as privileged

Deployment: sports-stats

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container sports-stats:

Should not be allowed to run as root
Filesystem should be read only
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Readiness probe should be configured
Memory limits should be set
Memory requests should be set
Not running as privileged

Deployment: tagesschau-api

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container tagesschau-api:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Filesystem should be read only
Readiness probe should be configured
Memory requests should be set
Not running as privileged

Deployment: wm-quiz

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container wm-quiz:

Should not be allowed to run as root
Memory limits should be set
Memory requests should be set
Readiness probe should be configured
CPU limits should be set
Filesystem should be read only
CPU requests should be set
Liveness probe should be configured
Not running as privileged

Ingress: gastro-guide

Spec: no checks applied

Ingress: listy

Spec: no checks applied

Ingress: party-events

Spec: no checks applied

Ingress: quiz-api

Spec: no checks applied

Ingress: smart-reader

Spec: no checks applied

Ingress: sports-stats

Spec: no checks applied

Ingress: tagesschau-api

Spec: no checks applied

Ingress: wm-quiz

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: gastro-guide

Spec: no checks applied

ServiceAccount: party-events

Spec: no checks applied

ServiceAccount: quiz-api

Spec: no checks applied

ServiceAccount: smart-reader

Spec: no checks applied

ServiceAccount: sports-stats

Spec: no checks applied

ServiceAccount: tagesschau-api

Spec: no checks applied

Namespace: collab

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: csi

ConfigMap: kube-root-ca.crt

Spec: no checks applied

DaemonSet: csi-smb-node

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container liveness-probe:

Should not be allowed to run as root
CPU limits should be set
Readiness probe should be configured
Liveness probe should be configured
CPU requests are set
Filesystem is read only
Not running as privileged
Memory limits are set
Memory requests are set

Container node-driver-registrar:

Should not be allowed to run as root
CPU limits should be set
Liveness probe should be configured
Filesystem should be read only
Readiness probe should be configured
Memory requests are set
Not running as privileged
Memory limits are set
CPU requests are set

Container smb:

Should not be running as privileged
Should not be allowed to run as root
Readiness probe should be configured
CPU limits should be set
Filesystem should be read only
Memory limits are set
Liveness probe is configured
Memory requests are set
CPU requests are set

DaemonSet: csi-smb-node-win

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container init:

Should not be allowed to run as root
Filesystem should be read only
Not running as privileged

Container node-driver-registrar:

Should not be allowed to run as root
Readiness probe should be configured
Liveness probe should be configured
Filesystem should be read only
CPU limits should be set
CPU requests are set
Not running as privileged
Memory limits are set
Memory requests are set

Container smb:

Should not be allowed to run as root
CPU limits should be set
Filesystem should be read only
Readiness probe should be configured
Liveness probe should be configured
CPU requests are set
Memory requests are set
Memory limits are set
Not running as privileged

Deployment: csi-smb-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container csi-provisioner:

Should not be allowed to run as root
Liveness probe should be configured
CPU limits should be set
Readiness probe should be configured
Memory limits are set
Memory requests are set
Filesystem is read only
CPU requests are set
Not running as privileged

Container csi-resizer:

Should not be allowed to run as root
Readiness probe should be configured
Liveness probe should be configured
Filesystem should be read only
CPU limits should be set
Memory requests are set
CPU requests are set
Memory limits are set
Not running as privileged

Container liveness-probe:

Should not be allowed to run as root
CPU limits should be set
Readiness probe should be configured
Liveness probe should be configured
Not running as privileged
CPU requests are set
Filesystem is read only
Memory limits are set
Memory requests are set

Container smb:

Should not be allowed to run as root
Should not be running as privileged
CPU limits should be set
Filesystem should be read only
Readiness probe should be configured
Liveness probe is configured
Memory limits are set
Memory requests are set
CPU requests are set

ServiceAccount: csi-smb-controller-sa

Spec: no checks applied

ServiceAccount: csi-smb-node-sa

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: data

ConfigMap: cnpg-default-monitoring

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: meilisearch-ui

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container meilisearch-ui:

Should not be allowed to run as root
CPU limits should be set
Liveness probe should be configured
Readiness probe should be configured
CPU requests should be set
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Not running as privileged

Ingress: meilisearch

Spec: no checks applied

Ingress: meilisearch-ui

Spec: no checks applied

Pod: postgres-1

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container bootstrap-controller:

Not running as privileged
Is not allowed to run as root
Filesystem is read only

Container postgres:

CPU requests should be set
CPU limits should be set
Memory limits should be set
Memory requests should be set
Not running as privileged
Readiness probe is configured
Is not allowed to run as root
Liveness probe is configured
Filesystem is read only

PodDisruptionBudget: postgres-primary

Spec: no checks applied

Role: postgres

Spec: no checks applied

RoleBinding: postgres

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: postgres

Spec: no checks applied

StatefulSet: meilisearch

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container meilisearch:

Should not be allowed to run as root
Liveness probe should be configured
Filesystem should be read only
CPU limits should be set
CPU requests should be set
Memory limits should be set
Memory requests should be set
Readiness probe should be configured
Not running as privileged

Namespace: default

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: dev

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: dev-tools

ConfigMap: forgejo-config

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: forgejo

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container forgejo:

Should not be allowed to run as root
CPU requests should be set
Memory limits should be set
Memory requests should be set
Readiness probe should be configured
CPU limits should be set
Liveness probe should be configured
Filesystem should be read only
Not running as privileged

Ingress: cm-acme-http-solver-95mjn

Spec: no checks applied

Ingress: cm-acme-http-solver-c8h8s

Spec: no checks applied

Ingress: forgejo

Spec: no checks applied

Ingress: forgejo

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: flux-system

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: helm-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container manager:

CPU requests are set
Liveness probe is configured
Memory limits are set
Is not allowed to run as root
Memory requests are set
Filesystem is read only
Readiness probe is configured
Not running as privileged
CPU limits are set

Deployment: kustomize-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container manager:

Not running as privileged
CPU limits are set
CPU requests are set
Memory requests are set
Filesystem is read only
Is not allowed to run as root
Liveness probe is configured
Memory limits are set
Readiness probe is configured

Deployment: notification-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container manager:

CPU limits are set
Liveness probe is configured
Memory requests are set
Readiness probe is configured
Not running as privileged
CPU requests are set
Memory limits are set
Filesystem is read only
Is not allowed to run as root

Deployment: source-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container manager:

Filesystem is read only
Readiness probe is configured
CPU limits are set
CPU requests are set
Memory requests are set
Not running as privileged
Is not allowed to run as root
Liveness probe is configured
Memory limits are set

NetworkPolicy: allow-egress

Spec: no checks applied

NetworkPolicy: allow-scraping

Spec: no checks applied

NetworkPolicy: allow-webhooks

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: helm-controller

Spec: no checks applied

ServiceAccount: kustomize-controller

Spec: no checks applied

ServiceAccount: notification-controller

Spec: no checks applied

ServiceAccount: source-controller

Spec: no checks applied

Namespace: iam

ConfigMap: authelia-acl

Spec: no checks applied

ConfigMap: authelia-config

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: authelia

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container authelia:

Should not be allowed to run as root
Filesystem should be read only
CPU limits are set
CPU requests are set
Memory limits are set
Memory requests are set
Not running as privileged
Liveness probe is configured
Readiness probe is configured

Deployment: lldap

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container lldap:

CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Readiness probe should be configured
CPU limits should be set
Memory requests should be set
Filesystem should be read only
Not running as privileged
Is not allowed to run as root

Ingress: authelia

Spec: no checks applied

Ingress: lldap

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: infra

ConfigMap: docker-registry-config

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: docker-registry

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container docker-registry:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Deployment: docker-registry-ui

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container docker-registry-ui:

CPU limits should be set
Filesystem should be read only
CPU requests should be set
Memory limits should be set
Memory requests should be set
Liveness probe is configured
Not running as privileged
Readiness probe is configured
Is not allowed to run as root

Deployment: keel

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container keel:

Should not be allowed to run as root
Readiness probe should be configured
Filesystem should be read only
CPU limits are set
Memory limits are set
CPU requests are set
Liveness probe is configured
Memory requests are set
Not running as privileged

Ingress: docker-registry

Spec: no checks applied

Ingress: docker-registry-ui

Spec: no checks applied

Ingress: keel

Spec: no checks applied

PodDisruptionBudget: keel

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: keel

Spec: no checks applied

Namespace: ingress

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ConfigMap: traefik-config

Spec: no checks applied

Deployment: cert-manager

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container cert-manager-controller:

CPU limits should be set
CPU requests should be set
Memory limits should be set
Memory requests should be set
Readiness probe should be configured
Filesystem is read only
Liveness probe is configured
Not running as privileged
Is not allowed to run as root

Deployment: cert-manager-cainjector

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container cert-manager-cainjector:

CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
CPU limits should be set
Readiness probe should be configured
Filesystem is read only
Not running as privileged
Is not allowed to run as root

Deployment: cert-manager-webhook

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container cert-manager-webhook:

Memory limits should be set
Memory requests should be set
CPU requests should be set
CPU limits should be set
Liveness probe is configured
Filesystem is read only
Readiness probe is configured
Not running as privileged
Is not allowed to run as root

Deployment: traefik

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container traefik:

CPU limits should be set
CPU requests should be set
Memory limits should be set
Memory requests should be set
Liveness probe is configured
Not running as privileged
Filesystem is read only
Readiness probe is configured
Is not allowed to run as root

Role: cert-manager-webhook:dynamic-serving

Spec: no checks applied

RoleBinding: cert-manager-webhook:dynamic-serving

Spec: no checks applied

ServiceAccount: cert-manager

Spec: no checks applied

ServiceAccount: cert-manager-cainjector

Spec: no checks applied

ServiceAccount: cert-manager-webhook

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: traefik

Spec: no checks applied

Namespace: kube-node-lease

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: kube-public

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Role: system:controller:bootstrap-signer

Spec: no checks applied

RoleBinding: system:controller:bootstrap-signer

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: kube-system

ConfigMap: cluster-dns

Spec: no checks applied

ConfigMap: coredns

Spec: no checks applied

ConfigMap: extension-apiserver-authentication

Spec: no checks applied

ConfigMap: kube-apiserver-legacy-service-account-token-tracking

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

DaemonSet: hcloud-csi-node

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container csi-node-driver-registrar:

Should not be allowed to run as root
Liveness probe should be configured
Memory requests should be set
Filesystem should be read only
CPU requests should be set
Memory limits should be set
Readiness probe should be configured
CPU limits should be set
Not running as privileged

Container liveness-probe:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Memory limits should be set
Filesystem should be read only
Liveness probe should be configured
Memory requests should be set
Readiness probe should be configured
Not running as privileged

Container hcloud-csi-driver:

Should not be running as privileged
Should not be allowed to run as root
Filesystem should be read only
CPU limits should be set
CPU requests should be set
Memory requests should be set
Readiness probe should be configured
Memory limits should be set
Liveness probe is configured

Deployment: coredns

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container coredns:

Should not be allowed to run as root
CPU limits should be set
Memory requests are set
Readiness probe is configured
Not running as privileged
CPU requests are set
Liveness probe is configured
Memory limits are set
Filesystem is read only

Deployment: hcloud-cloud-controller-manager

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container hcloud-cloud-controller-manager:

Should not be allowed to run as root
CPU limits should be set
Liveness probe should be configured
Readiness probe should be configured
Memory limits should be set
Filesystem should be read only
Memory requests are set
Not running as privileged
CPU requests are set

Deployment: hcloud-csi-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container hcloud-csi-driver:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged
Liveness probe is configured

Container csi-attacher:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Memory limits should be set
Memory requests should be set
Readiness probe should be configured
Liveness probe should be configured
Filesystem should be read only
Not running as privileged

Container csi-resizer:

Should not be allowed to run as root
Memory limits should be set
Filesystem should be read only
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory requests should be set
Readiness probe should be configured
Not running as privileged

Container csi-provisioner:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Container liveness-probe:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory requests should be set
Memory limits should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Role: cert-manager-cainjector:leaderelection

Spec: no checks applied

Role: cert-manager:leaderelection

Spec: no checks applied

Role: extension-apiserver-authentication-reader

Spec: no checks applied

Role: system::leader-locking-kube-controller-manager

Spec: no checks applied

Role: system::leader-locking-kube-scheduler

Spec: no checks applied

Role: system:controller:bootstrap-signer

Spec: no checks applied

Role: system:controller:cloud-provider

Spec: no checks applied

Role: system:controller:token-cleaner

Spec: no checks applied

RoleBinding: cert-manager-cainjector:leaderelection

Spec: no checks applied

RoleBinding: cert-manager:leaderelection

Spec: no checks applied

RoleBinding: system::extension-apiserver-authentication-reader

Spec: no checks applied

RoleBinding: system::leader-locking-kube-controller-manager

Spec: no checks applied

RoleBinding: system::leader-locking-kube-scheduler

Spec: no checks applied

RoleBinding: system:controller:bootstrap-signer

Spec: no checks applied

RoleBinding: system:controller:cloud-provider

Spec: no checks applied

RoleBinding: system:controller:token-cleaner

Spec: no checks applied

ServiceAccount: attachdetach-controller

Spec: no checks applied

ServiceAccount: certificate-controller

Spec: no checks applied

ServiceAccount: clusterrole-aggregation-controller

Spec: no checks applied

ServiceAccount: coredns

Spec: no checks applied

ServiceAccount: cronjob-controller

Spec: no checks applied

ServiceAccount: daemon-set-controller

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: deployment-controller

Spec: no checks applied

ServiceAccount: device-taint-eviction-controller

Spec: no checks applied

ServiceAccount: disruption-controller

Spec: no checks applied

ServiceAccount: endpoint-controller

Spec: no checks applied

ServiceAccount: endpointslice-controller

Spec: no checks applied

ServiceAccount: endpointslicemirroring-controller

Spec: no checks applied

ServiceAccount: ephemeral-volume-controller

Spec: no checks applied

ServiceAccount: expand-controller

Spec: no checks applied

ServiceAccount: generic-garbage-collector

Spec: no checks applied

ServiceAccount: hcloud-cloud-controller-manager

Spec: no checks applied

ServiceAccount: hcloud-csi-controller

Spec: no checks applied

ServiceAccount: horizontal-pod-autoscaler

Spec: no checks applied

ServiceAccount: job-controller

Spec: no checks applied

ServiceAccount: legacy-service-account-token-cleaner

Spec: no checks applied

ServiceAccount: namespace-controller

Spec: no checks applied

ServiceAccount: node-controller

Spec: no checks applied

ServiceAccount: persistent-volume-binder

Spec: no checks applied

ServiceAccount: pod-garbage-collector

Spec: no checks applied

ServiceAccount: pv-protection-controller

Spec: no checks applied

ServiceAccount: pvc-protection-controller

Spec: no checks applied

ServiceAccount: replicaset-controller

Spec: no checks applied

ServiceAccount: replication-controller

Spec: no checks applied

ServiceAccount: resource-claim-controller

Spec: no checks applied

ServiceAccount: resourcequota-controller

Spec: no checks applied

ServiceAccount: root-ca-cert-publisher

Spec: no checks applied

ServiceAccount: service-account-controller

Spec: no checks applied

ServiceAccount: service-cidrs-controller

Spec: no checks applied

ServiceAccount: statefulset-controller

Spec: no checks applied

ServiceAccount: token-cleaner

Spec: no checks applied

ServiceAccount: ttl-after-finished-controller

Spec: no checks applied

ServiceAccount: ttl-controller

Spec: no checks applied

ServiceAccount: validatingadmissionpolicy-status-controller

Spec: no checks applied

ServiceAccount: volumeattributesclass-protection-controller

Spec: no checks applied

Namespace: longhorn-system

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ConfigMap: longhorn-default-resource

Spec: no checks applied

ConfigMap: longhorn-default-setting

Spec: no checks applied

ConfigMap: longhorn-storageclass

Spec: no checks applied

DaemonSet: engine-image-ei-b4bcf0a5

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container engine-image-ei-b4bcf0a5:

Should not be allowed to run as root
Should not be running as privileged
CPU limits should be set
Memory limits should be set
Memory requests should be set
CPU requests should be set
Filesystem should be read only
Readiness probe is configured
Liveness probe is configured

DaemonSet: longhorn-csi-plugin

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container node-driver-registrar:

Should not be running as privileged
Should not be allowed to run as root
Filesystem should be read only
Readiness probe should be configured
CPU limits should be set
Liveness probe should be configured
Memory limits should be set
CPU requests should be set
Memory requests should be set

Container longhorn-liveness-probe:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Container longhorn-csi-plugin:

Should not be running as privileged
Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Memory limits should be set
Filesystem should be read only
Readiness probe should be configured
Memory requests should be set
Liveness probe is configured

DaemonSet: longhorn-manager

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container longhorn-manager:

Should not be running as privileged
Should not be allowed to run as root
CPU requests should be set
Filesystem should be read only
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
CPU limits should be set
Readiness probe is configured

Container pre-pull-share-manager-image:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Deployment: csi-attacher

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container csi-attacher:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Memory limits should be set
Filesystem should be read only
Liveness probe should be configured
Memory requests should be set
Readiness probe should be configured
Not running as privileged

Deployment: csi-provisioner

Spec: no checks applied

Pod Spec:

Host PID is not configured
Host IPC is not configured

Container csi-provisioner:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Filesystem should be read only
Readiness probe should be configured
Memory requests should be set
Not running as privileged

Deployment: csi-resizer

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container csi-resizer:

Should not be allowed to run as root
CPU requests should be set
Memory requests should be set
Readiness probe should be configured
CPU limits should be set
Liveness probe should be configured
Memory limits should be set
Filesystem should be read only
Not running as privileged

Deployment: csi-snapshotter

Spec: no checks applied

Pod Spec:

Host PID is not configured
Host IPC is not configured

Container csi-snapshotter:

Should not be allowed to run as root
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Not running as privileged

Deployment: longhorn-driver-deployer

Spec: no checks applied

Pod Spec:

Host PID is not configured
Host IPC is not configured

Container wait-longhorn-manager:

Should not be allowed to run as root
Filesystem should be read only
Not running as privileged

Container longhorn-driver-deployer:

Should not be allowed to run as root
Readiness probe should be configured
CPU limits should be set
Liveness probe should be configured
Memory limits should be set
Filesystem should be read only
CPU requests should be set
Memory requests should be set
Not running as privileged

Deployment: longhorn-ui

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container longhorn-ui:

Should not be allowed to run as root
Liveness probe should be configured
Memory limits should be set
Readiness probe should be configured
CPU limits should be set
CPU requests should be set
Memory requests should be set
Filesystem should be read only
Not running as privileged

Ingress: longhorn

Spec: no checks applied

Pod: instance-manager-01d6d71f7b86229a0f9a096242391c87

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container instance-manager:

Should not be running as privileged
Should not be allowed to run as root
Memory limits should be set
Filesystem should be read only
Readiness probe should be configured
CPU limits should be set
Memory requests should be set
Liveness probe is configured
CPU requests are set

Pod: instance-manager-c1b8a32e7b74716c7be55b178604c719

Spec: no checks applied

Pod Spec:

Host PID is not configured
Host IPC is not configured

Container instance-manager:

Should not be running as privileged
Should not be allowed to run as root
CPU limits should be set
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
CPU requests are set
Liveness probe is configured

Pod: instance-manager-d652ab70d4f2c0237e40ce8fbc16d594

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container instance-manager:

Should not be running as privileged
Should not be allowed to run as root
CPU limits should be set
Memory limits should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
CPU requests are set
Liveness probe is configured

PodDisruptionBudget: csi-attacher

Spec: no checks applied

PodDisruptionBudget: csi-provisioner

Spec: no checks applied

PodDisruptionBudget: instance-manager-01d6d71f7b86229a0f9a096242391c87

Spec: no checks applied

PodDisruptionBudget: instance-manager-c1b8a32e7b74716c7be55b178604c719

Spec: no checks applied

PodDisruptionBudget: instance-manager-d652ab70d4f2c0237e40ce8fbc16d594

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: longhorn-service-account

Spec: no checks applied

ServiceAccount: longhorn-support-bundle

Spec: no checks applied

ServiceAccount: longhorn-ui-service-account

Spec: no checks applied

Namespace: monitoring

ConfigMap: alloy

Spec: no checks applied

ConfigMap: alloy-kubernetes-events

Spec: no checks applied

ConfigMap: alloy-linux-logs

Spec: no checks applied

ConfigMap: alloy-pod-logs

Spec: no checks applied

ConfigMap: grafana-datasources

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ConfigMap: loki-config

Spec: no checks applied

ConfigMap: prometheus-config

Spec: no checks applied

DaemonSet: alloy

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container alloy:

Should not be allowed to run as root
CPU requests should be set
Memory limits should be set
Filesystem should be read only
CPU limits should be set
Liveness probe should be configured
Memory requests should be set
Readiness probe is configured
Not running as privileged

Container config-reloader:

Should not be allowed to run as root
Liveness probe should be configured
Memory limits should be set
CPU limits should be set
Filesystem should be read only
Readiness probe should be configured
CPU requests are set
Memory requests are set
Not running as privileged

DaemonSet: node-exporter

Spec: no checks applied

Pod Spec:

Host PID should not be configured
Host IPC is not configured

Container node-exporter:

Liveness probe is configured
Memory limits are set
Memory requests are set
Filesystem is read only
Readiness probe is configured
Is not allowed to run as root
CPU requests are set
Not running as privileged
CPU limits are set

Deployment: grafana-image-renderer

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container grafana-image-renderer:

Should not be allowed to run as root
Memory limits should be set
CPU limits should be set
CPU requests should be set
Memory requests should be set
Filesystem should be read only
Readiness probe should be configured
Liveness probe should be configured
Not running as privileged

Deployment: kube-state-metrics

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container kube-state-metrics:

Memory limits are set
Memory requests are set
Not running as privileged
CPU requests are set
Filesystem is read only
Readiness probe is configured
Is not allowed to run as root
CPU limits are set
Liveness probe is configured

Deployment: prometheus-config-reloader

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container prometheus-config-reloader:

Should not be allowed to run as root
Filesystem should be read only
Memory requests should be set
Readiness probe should be configured
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Memory limits should be set
Not running as privileged

Ingress: grafana

Spec: no checks applied

Ingress: prometheus

Spec: no checks applied

ServiceAccount: alloy

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: grafana

Spec: no checks applied

ServiceAccount: kube-state-metrics

Spec: no checks applied

ServiceAccount: loki

Spec: no checks applied

ServiceAccount: node-exporter

Spec: no checks applied

ServiceAccount: prometheus

Spec: no checks applied

StatefulSet: grafana

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container grafana:

Readiness probe is configured
Is not allowed to run as root
CPU requests are set
Liveness probe is configured
Memory requests are set
Not running as privileged
CPU limits are set
Memory limits are set
Filesystem is read only

StatefulSet: loki

Spec: no checks applied

Pod Spec:

Host PID is not configured
Host IPC is not configured

Container loki:

CPU limits are set
CPU requests are set
Liveness probe is configured
Memory limits are set
Filesystem is read only
Not running as privileged
Memory requests are set
Readiness probe is configured
Is not allowed to run as root

StatefulSet: prometheus

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container prometheus:

CPU requests are set
Liveness probe is configured
Memory requests are set
Filesystem is read only
Readiness probe is configured
CPU limits are set
Memory limits are set
Not running as privileged
Is not allowed to run as root

Namespace: operators

ConfigMap: cnpg-controller-manager-config

Spec: no checks applied

ConfigMap: cnpg-default-monitoring

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: cloudnative-pg

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container manager:

CPU limits should be set
Memory limits should be set
CPU requests should be set
Memory requests should be set
Readiness probe is configured
Not running as privileged
Filesystem is read only
Is not allowed to run as root
Liveness probe is configured

ServiceAccount: cloudnative-pg

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

Namespace: system-upgrade

ConfigMap: default-controller-env

Spec: no checks applied

ConfigMap: kube-root-ca.crt

Spec: no checks applied

Deployment: system-upgrade-controller

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container system-upgrade-controller:

Memory requests should be set
Memory limits should be set
Filesystem should be read only
Readiness probe should be configured
CPU limits should be set
CPU requests should be set
Liveness probe should be configured
Not running as privileged
Is not allowed to run as root

Role: system-upgrade-controller

Spec: no checks applied

RoleBinding: system-upgrade

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: system-upgrade

Spec: no checks applied

Namespace: test

ConfigMap: kube-root-ca.crt

Spec: no checks applied

ConfigMap: polaris

Spec: no checks applied

Deployment: polaris-dashboard

Spec: no checks applied

Pod Spec:

Host IPC is not configured
Host PID is not configured

Container dashboard:

Readiness probe is configured
Is not allowed to run as root
CPU limits are set
CPU requests are set
Liveness probe is configured
Memory limits are set
Memory requests are set
Filesystem is read only
Not running as privileged

Ingress: polaris

Spec: no checks applied

PodDisruptionBudget: polaris-dashboard

Spec: no checks applied

ServiceAccount: default

Spec: no checks applied

ServiceAccount: polaris