turbot/steampipe-mod-kubernetes-compliance

Control: Deployment containers argument hostname override should not be configured

Description

This check ensures that the container in the Deployment does not have argument hostname override configured.

Usage

Run the control in your terminal:

powerpipe control run kubernetes_compliance.control.deployment_container_no_argument_hostname_override_configured

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run kubernetes_compliance.control.deployment_container_no_argument_hostname_override_configured --share

SQL

This control uses a named query:

select
coalesce(uid, concat(path, ':', start_line)) as resource,
case
when (c -> 'command') is null or not ((c -> 'command') @> '["kubelet"]') then 'ok'
when (c -> 'command') @> '["kubelet"]'
and (c ->> 'command' like '%--hostname-override%') then 'alarm'
else 'ok'
end as status,
case
when (c -> 'command') is null then c ->> 'name' || ' command not defined.'
when not ((c -> 'command') @> '["kubelet"]') then c ->> 'name' || ' kubelet not defined.'
when (c -> 'command') @> '["kubelet"]'
and (c ->> 'command' like '%--hostname-override%') then c ->> 'name' || ' hostname override set.'
else c ->> 'name' || ' hostname override not set.'
end as reason,
name as deployment_name
, coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as path
from
kubernetes_deployment,
jsonb_array_elements(template -> 'spec' -> 'containers') as c;

Tags