kube-linter.yaml

checks:
  doNotAutoAddDefaults: true
  include:
    - cluster-admin-role-binding
    - dangling-service
    - default-service-account
    - deprecated-service-account-field
    - docker-sock
    - drop-net-raw-capability
    - env-var-secret
    - host-ipc
    - host-network
    - host-pid
    - latest-tag
    - mismatching-selector
    - no-anti-affinity
    - no-extensions-v1beta
    - no-liveness-probe
    - no-read-only-root-fs
    - no-readiness-probe
    - no-rolling-update-strategy
    - non-existent-service-account
    - non-isolated-pod
    - privilege-escalation-container
    - privileged-container
    - privileged-ports
    - read-secret-from-env-var
    - run-as-non-root
    - sensitive-host-mounts
    - ssh-port
    - unsafe-proc-mount
    - unsafe-sysctls
    - unset-cpu-requirements
    - unset-memory-requirements
    - use-namespace
    - wildcard-in-rules
    - writable-host-mount
  exclude:
    # Coder needs to create pods for workspaces
    - access-to-create-pods
    - access-to-secrets
    # We use a load balancer service by default
    - exposed-services
    # TODO: evaluate high availability by default
    - minimum-three-replicas
    - required-annotation-email
    - required-label-owner