@@ -18,7 +18,7 @@ use serde_json::json;
1818use std:: path:: PathBuf ;
1919
2020use crate :: analyzer:: kubelint:: {
21- lint , lint_content , lint_file , KubelintConfig , LintResult , Severity ,
21+ KubelintConfig , LintResult , Severity , lint , lint_content , lint_file ,
2222} ;
2323
2424/// Arguments for the kubelint tool
@@ -86,35 +86,62 @@ impl KubelintTool {
8686 fn get_check_category ( code : & str ) -> & ' static str {
8787 match code {
8888 // Security checks
89- "privileged-container" | "privilege-escalation" | "run-as-non-root"
90- | "read-only-root-fs" | "drop-net-raw-capability" | "hostnetwork" | "hostpid"
91- | "hostipc" | "host-mounts" | "writable-host-mount" | "docker-sock"
92- | "unsafe-proc-mount" | "scc-deny-privileged-container" => "security" ,
89+ "privileged-container"
90+ | "privilege-escalation"
91+ | "run-as-non-root"
92+ | "read-only-root-fs"
93+ | "drop-net-raw-capability"
94+ | "hostnetwork"
95+ | "hostpid"
96+ | "hostipc"
97+ | "host-mounts"
98+ | "writable-host-mount"
99+ | "docker-sock"
100+ | "unsafe-proc-mount"
101+ | "scc-deny-privileged-container" => "security" ,
93102
94103 // Best practice checks
95- "latest-tag" | "no-liveness-probe" | "no-readiness-probe" | "unset-cpu-requirements"
96- | "unset-memory-requirements" | "minimum-replicas" | "no-anti-affinity"
97- | "no-rolling-update-strategy" | "default-service-account"
98- | "deprecated-service-account" | "env-var-secret" | "read-secret-from-env-var"
99- | "priority-class-name" | "no-node-affinity" | "restart-policy" | "sysctls"
104+ "latest-tag"
105+ | "no-liveness-probe"
106+ | "no-readiness-probe"
107+ | "unset-cpu-requirements"
108+ | "unset-memory-requirements"
109+ | "minimum-replicas"
110+ | "no-anti-affinity"
111+ | "no-rolling-update-strategy"
112+ | "default-service-account"
113+ | "deprecated-service-account"
114+ | "env-var-secret"
115+ | "read-secret-from-env-var"
116+ | "priority-class-name"
117+ | "no-node-affinity"
118+ | "restart-policy"
119+ | "sysctls"
100120 | "dnsconfig-options" => "best-practice" ,
101121
102122 // RBAC checks
103- "access-to-secrets" | "access-to-create-pods" | "cluster-admin-role-binding"
123+ "access-to-secrets"
124+ | "access-to-create-pods"
125+ | "cluster-admin-role-binding"
104126 | "wildcard-in-rules" => "rbac" ,
105127
106128 // Validation checks
107- "dangling-service" | "dangling-ingress" | "dangling-horizontalpodautoscaler"
108- | "dangling-networkpolicy" | "mismatching-selector" | "duplicate-env-var"
109- | "invalid-target-ports" | "non-existent-service-account" | "non-isolated-pod"
110- | "use-namespace" | "env-var-value-from" | "job-ttl-seconds-after-finished" => {
111- "validation"
112- }
129+ "dangling-service"
130+ | "dangling-ingress"
131+ | "dangling-horizontalpodautoscaler"
132+ | "dangling-networkpolicy"
133+ | "mismatching-selector"
134+ | "duplicate-env-var"
135+ | "invalid-target-ports"
136+ | "non-existent-service-account"
137+ | "non-isolated-pod"
138+ | "use-namespace"
139+ | "env-var-value-from"
140+ | "job-ttl-seconds-after-finished" => "validation" ,
113141
114142 // Port checks
115- "ssh-port" | "privileged-ports" | "liveness-port" | "readiness-port" | "startup-port" => {
116- "ports"
117- }
143+ "ssh-port" | "privileged-ports" | "liveness-port" | "readiness-port"
144+ | "startup-port" => "ports" ,
118145
119146 // PDB checks
120147 "pdb-max-unavailable" | "pdb-min-available" | "pdb-unhealthy-pod-eviction-policy" => {
@@ -383,8 +410,8 @@ impl Tool for KubelintTool {
383410 "deployment" ,
384411 "helm" ,
385412 "charts" ,
386- "test-lint" , // For testing
387- "test-lint/k8s" , // For testing
413+ "test-lint" , // For testing
414+ "test-lint/k8s" , // For testing
388415 "." ,
389416 ] ;
390417
@@ -402,14 +429,12 @@ impl Tool for KubelintTool {
402429 }
403430 // Check for YAML files
404431 if let Ok ( entries) = std:: fs:: read_dir ( & candidate_path) {
405- let has_yaml = entries
406- . filter_map ( |e| e. ok ( ) )
407- . any ( |e| {
408- e. path ( )
409- . extension ( )
410- . map ( |ext| ext == "yaml" || ext == "yml" )
411- . unwrap_or ( false )
412- } ) ;
432+ let has_yaml = entries. filter_map ( |e| e. ok ( ) ) . any ( |e| {
433+ e. path ( )
434+ . extension ( )
435+ . map ( |ext| ext == "yaml" || ext == "yml" )
436+ . unwrap_or ( false )
437+ } ) ;
413438 if has_yaml {
414439 found = Some ( ( candidate_path, candidate. to_string ( ) ) ) ;
415440 break ;
@@ -471,10 +496,7 @@ spec:
471496 let args = KubelintArgs {
472497 path : None ,
473498 content : Some ( yaml. to_string ( ) ) ,
474- include : vec ! [
475- "privileged-container" . to_string( ) ,
476- "latest-tag" . to_string( ) ,
477- ] ,
499+ include : vec ! [ "privileged-container" . to_string( ) , "latest-tag" . to_string( ) ] ,
478500 exclude : vec ! [ ] ,
479501 threshold : None ,
480502 } ;
@@ -523,10 +545,7 @@ spec:
523545 let args = KubelintArgs {
524546 path : None ,
525547 content : Some ( yaml. to_string ( ) ) ,
526- include : vec ! [
527- "privileged-container" . to_string( ) ,
528- "latest-tag" . to_string( ) ,
529- ] ,
548+ include : vec ! [ "privileged-container" . to_string( ) , "latest-tag" . to_string( ) ] ,
530549 exclude : vec ! [ ] ,
531550 threshold : None ,
532551 } ;
@@ -582,7 +601,12 @@ spec:
582601 let result = tool. call ( args) . await . unwrap ( ) ;
583602 let parsed: serde_json:: Value = serde_json:: from_str ( & result) . unwrap ( ) ;
584603
585- assert ! ( parsed[ "source" ] . as_str( ) . unwrap( ) . contains( "deployment.yaml" ) ) ;
604+ assert ! (
605+ parsed[ "source" ]
606+ . as_str( )
607+ . unwrap( )
608+ . contains( "deployment.yaml" )
609+ ) ;
586610 assert ! ( parsed[ "summary" ] [ "objects_analyzed" ] . as_u64( ) . unwrap_or( 0 ) >= 1 ) ;
587611 }
588612
@@ -613,7 +637,7 @@ spec:
613637 let args = KubelintArgs {
614638 path : None ,
615639 content : Some ( yaml. to_string ( ) ) ,
616- include : vec ! [ ] , // Use all defaults + builtin
640+ include : vec ! [ ] , // Use all defaults + builtin
617641 exclude : vec ! [ ] ,
618642 threshold : None ,
619643 } ;
@@ -624,11 +648,19 @@ spec:
624648 let parsed: serde_json:: Value = serde_json:: from_str ( & result) . unwrap ( ) ;
625649
626650 // Verify structure
627- assert ! ( parsed[ "summary" ] [ "total_issues" ] . as_u64( ) . unwrap( ) > 0 ,
628- "Expected issues but got none. Output: {}" , result) ;
629- assert ! ( !parsed[ "action_plan" ] [ "critical" ] . as_array( ) . unwrap( ) . is_empty( ) ||
630- !parsed[ "action_plan" ] [ "high" ] . as_array( ) . unwrap( ) . is_empty( ) ,
631- "Expected critical or high priority issues" ) ;
651+ assert ! (
652+ parsed[ "summary" ] [ "total_issues" ] . as_u64( ) . unwrap( ) > 0 ,
653+ "Expected issues but got none. Output: {}" ,
654+ result
655+ ) ;
656+ assert ! (
657+ !parsed[ "action_plan" ] [ "critical" ]
658+ . as_array( )
659+ . unwrap( )
660+ . is_empty( )
661+ || !parsed[ "action_plan" ] [ "high" ] . as_array( ) . unwrap( ) . is_empty( ) ,
662+ "Expected critical or high priority issues"
663+ ) ;
632664 }
633665
634666 #[ tokio:: test]
@@ -659,10 +691,7 @@ spec:
659691 path : None ,
660692 content : Some ( yaml. to_string ( ) ) ,
661693 include : vec ! [ ] ,
662- exclude : vec ! [
663- "privileged-container" . to_string( ) ,
664- "latest-tag" . to_string( ) ,
665- ] ,
694+ exclude : vec ! [ "privileged-container" . to_string( ) , "latest-tag" . to_string( ) ] ,
666695 threshold : None ,
667696 } ;
668697
@@ -680,9 +709,11 @@ spec:
680709 } )
681710 . collect ( ) ;
682711
683- assert ! ( !all_issues
684- . iter( )
685- . any( |i| i[ "check" ] == "privileged-container" ) ) ;
712+ assert ! (
713+ !all_issues
714+ . iter( )
715+ . any( |i| i[ "check" ] == "privileged-container" )
716+ ) ;
686717 assert ! ( !all_issues. iter( ) . any( |i| i[ "check" ] == "latest-tag" ) ) ;
687718 }
688719}
0 commit comments