private RuleDocument GetExpected()
{
var annotations = new Hashtable();
annotations["severity"] = "Critical";
annotations["category"] = "Security";
var links = new List <Link>();
links.Add(new Link {
Name = "PSRule", Uri = "https://github.com/Microsoft/PSRule"
});
links.Add(new Link {
Name = "Stable tags", Uri = "https://docs.microsoft.com/en-us/azure/container-registry/container-registry-image-tag-version#stable-tags"
});
var result = new RuleDocument(name: "Use specific tags")
{
Synopsis = new TextBlock(text: "Containers should use specific tags instead of latest."),
Annotations = TagSet.FromHashtable(annotations),
Recommendation = new TextBlock(text: @"Deployments or pods should identify a specific tag to use for container images instead of latest. When latest is used it may be hard to determine which version of the image is running.
When using variable tags such as v1.0 (which may refer to v1.0.0 or v1.0.1) consider using imagePullPolicy: Always to ensure that the an out-of-date cached image is not used.
The latest tag automatically uses imagePullPolicy: Always instead of the default imagePullPolicy: IfNotPresent."),
Links = links.ToArray()
};
return(result);
}
private static bool TryDocument(string path, out RuleDocument document)
{
var reader = new MarkdownReader(yamlHeaderOnly: false);
var stream = reader.Read(File.ReadAllText(path), path);
var lexer = new RuleLexer();
document = lexer.Process(stream);
return(document != null);
}
private RuleDocument GetExpected()
{
var annotations = new Hashtable();
annotations["severity"] = "Critical";
annotations["category"] = "Pod security";
var result = new RuleDocument(name: "Kubernetes.Deployment.NotLatestImage")
{
Synopsis = new TextBlock(text: "Containers should use specific tags instead of latest."),
Annotations = TagSet.FromHashtable(annotations),
Recommendation = new TextBlock(text: @"Deployments or pods should identify a specific tag to use for container images instead of latest. When latest is used it may be hard to determine which version of the image is running.
When using variable tags such as v1.0 (which may refer to v1.0.0 or v1.0.1) consider using imagePullPolicy: Always to ensure that the an out-of-date cached image is not used.
The latest tag automatically uses imagePullPolicy: Always instead of the default imagePullPolicy: IfNotPresent.")
};
return(result);
}
