CON-5812 Extend clusterlint to raise an error-level violation when in…

…valid snapshots are found (#143)
digitalocean · Jul 4, 2022 · a8c5304 · a8c5304
1 parent 9617526
commit a8c5304
Show file tree

Hide file tree

Showing 104 changed files with 5,440 additions and 84 deletions.
diff --git a/README.md b/README.md
@@ -130,7 +130,7 @@ see the [contribution guidelines](CONTRIBUTING.md) for details.
 
 ## License
 
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/all/all.go b/checks/all/all.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/admission_controller_webhook.go b/checks/basic/admission_controller_webhook.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/admission_controller_webhook_test.go b/checks/basic/admission_controller_webhook_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/bare_pods.go b/checks/basic/bare_pods.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/bare_pods_test.go b/checks/basic/bare_pods_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/cronjob_concurrency.go b/checks/basic/cronjob_concurrency.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/cronjob_concurrency_test.go b/checks/basic/cronjob_concurrency_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/fully_qualified_image.go b/checks/basic/fully_qualified_image.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/fully_qualified_image_test.go b/checks/basic/fully_qualified_image_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/helper_test.go b/checks/basic/helper_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/hostpath.go b/checks/basic/hostpath.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/hostpath_test.go b/checks/basic/hostpath_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/latest_tag.go b/checks/basic/latest_tag.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/latest_tag_test.go b/checks/basic/latest_tag_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/namespace.go b/checks/basic/namespace.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/namespace_test.go b/checks/basic/namespace_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/pod_status.go b/checks/basic/pod_status.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/pod_status_test.go b/checks/basic/pod_status_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/resource_requests.go b/checks/basic/resource_requests.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/resource_requests_test.go b/checks/basic/resource_requests_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/unused_pv.go b/checks/basic/unused_pv.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/unused_pv_test.go b/checks/basic/unused_pv_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/unused_pvc.go b/checks/basic/unused_pvc.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/unused_pvc_test.go b/checks/basic/unused_pvc_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/unused_secrets.go b/checks/basic/unused_secrets.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/basic/unused_secrets_test.go b/checks/basic/unused_secrets_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -143,7 +143,7 @@ func initSecret() *kube.Objects {
 		ServiceAccounts: &corev1.ServiceAccountList{
 			Items: []corev1.ServiceAccount{
 				{
-					TypeMeta: metav1.TypeMeta{Kind: "ServiceAccount", APIVersion: "v1"},
+					TypeMeta:   metav1.TypeMeta{Kind: "ServiceAccount", APIVersion: "v1"},
 					ObjectMeta: metav1.ObjectMeta{Name: "default", Namespace: "k8s"},
 				},
 			},
@@ -303,7 +303,7 @@ func saSecretRefs() *kube.Objects {
 	objs := initSecret()
 	objs.ServiceAccounts.Items[0].Secrets = []corev1.ObjectReference{
 		{
-			Name: "secret_foo",
+			Name:      "secret_foo",
 			Namespace: "k8s",
 		},
 	}

diff --git a/checks/check.go b/checks/check.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/check_filter.go b/checks/check_filter.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/check_filter_test.go b/checks/check_filter_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/check_test.go b/checks/check_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/containerd/helper_test.go b/checks/containerd/helper_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/diagnostic.go b/checks/diagnostic.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -78,6 +78,10 @@ const (
 	MutatingWebhookConfiguration Kind = "mutating webhook configuration"
 	// Node identifies a Kubernetes node object.
 	Node Kind = "node"
+	// VolumeSnapshot identifies a volume snapshot object
+	VolumeSnapshot Kind = "volume snapshot"
+	// VolumeSnapshotContent identifies a volume snapshot content object
+	VolumeSnapshotContent Kind = "volume snapshot content"
 	// CronJob identifies Kubernetes objects of kind `cron job`
 	CronJob Kind = "cron job"
 )
diff --git a/checks/doks/admission_controller_webhook_replacement.go b/checks/doks/admission_controller_webhook_replacement.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/doks/admission_controller_webhook_replacement_test.go b/checks/doks/admission_controller_webhook_replacement_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/doks/node_labels_taints.go b/checks/doks/node_labels_taints.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/doks/node_labels_taints_test.go b/checks/doks/node_labels_taints_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/doks/node_name_pod_selector.go b/checks/doks/node_name_pod_selector.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/doks/node_name_pod_selector_test.go b/checks/doks/node_name_pod_selector_test.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2019 DigitalOcean
+Copyright 2022 DigitalOcean
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/checks/doks/snapshots_content_invalid.go b/checks/doks/snapshots_content_invalid.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2022 DigitalOcean
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package doks
+
+import (
+	"github.com/digitalocean/clusterlint/checks"
+	"github.com/digitalocean/clusterlint/kube"
+)
+
+func init() {
+	checks.Register(&invalidSnapshotContentCheck{})
+}
+
+type invalidSnapshotContentCheck struct{}
+
+// Name returns a unique name for this check.
+func (i *invalidSnapshotContentCheck) Name() string {
+	return "invalid-volume-snapshot-content"
+}
+
+// Groups returns a list of group names this check should be part of.
+func (i *invalidSnapshotContentCheck) Groups() []string {
+	return []string{"doks"}
+}
+
+// Description returns a detailed human-readable description of what this check
+// does.
+func (i *invalidSnapshotContentCheck) Description() string {
+	return "Checks if there are invalid volume snapshot contents that would fail webhook validation"
+}
+
+// Run runs this check on a set of Kubernetes objects. It can return warnings
+// (low-priority problems) and errors (high-priority problems) as well as an
+// error value indicating that the check failed to run.
+func (i *invalidSnapshotContentCheck) Run(objects *kube.Objects) ([]checks.Diagnostic, error) {
+	var diagnostics []checks.Diagnostic
+	errMsg := "Snapshot content has been marked as invalid by CSI validation - check volumeHandle and snapshotHandle are not both set"
+	ssLabelKey := "snapshot.storage.sigs.k8s.io/invalid-snapshot-content-resource"
+	for _, snapshot := range objects.VolumeSnapshotsV1Content.Items {
+		snapshotLabels := snapshot.Labels
+		if _, ok := snapshotLabels[ssLabelKey]; ok {
+			d := checks.Diagnostic{
+				Severity: checks.Error,
+				Message:  errMsg,
+				Kind:     checks.VolumeSnapshotContent,
+				Object:   &snapshot.ObjectMeta,
+				Owners:   snapshot.ObjectMeta.GetOwnerReferences(),
+			}
+			diagnostics = append(diagnostics, d)
+		}
+	}
+	for _, snapshot := range objects.VolumeSnapshotsBetaContent.Items {
+		snapshotLabels := snapshot.Labels
+		if _, ok := snapshotLabels[ssLabelKey]; ok {
+			d := checks.Diagnostic{
+				Severity: checks.Error,
+				Message:  errMsg,
+				Kind:     checks.VolumeSnapshotContent,
+				Object:   &snapshot.ObjectMeta,
+				Owners:   snapshot.ObjectMeta.GetOwnerReferences(),
+			}
+			diagnostics = append(diagnostics, d)
+		}
+	}
+	return diagnostics, nil
+}