add check for validating improper container image tags

docs/generated/checks.md

@@ -210,6 +210,22 @@ KubeLinter includes the following built-in checks:
 {}
 ```
 
+## latest-tag
+
+**Enabled by default**: Yes
+
+**Description**: Indicates when a deployment-like object is running a container with a floating image tag, "latest"
+
+**Remediation**: Use a container image with a proper image tag, outside the set blocked tag regex ".*:(latest)$".
+
+**Template**: [latest-tag](generated/templates.md#latest-tag)
+
+**Parameters**:
+
+```json
+{"BlockList":[".*:(latest)$"]}
+```
+
 ## minimum-three-replicas
 
 **Enabled by default**: No

docs/generated/templates.md

@@ -318,6 +318,30 @@ KubeLinter supports the following templates:
 []
 ```
 
+## Latest Tag
+
+**Key**: `latest-tag`
+
+**Description**: Flag applications running containers with floating container image tag, "latest"
+
+**Supported Objects**: DeploymentLike
+
+**Parameters**:
+
+```json
+[
+  {
+    "name": "blockList",
+    "type": "array",
+    "description": "list of regular expressions for blocked or bad container image tags",
+    "required": false,
+    "regexAllowed": true,
+    "negationAllowed": true,
+    "arrayElemType": "string"
+  }
+]
+```
+
 ## Liveness Probe Not Specified
 
 **Key**: `liveness-probe`

internal/defaultchecks/default_checks.go

@@ -16,6 +16,7 @@ var (
 		"sensitive-host-mounts",
 		"host-network",
 		"host-pid",
+		"latest-tag",
 		"mismatching-selector",
 		"no-anti-affinity",
 		"no-extensions-v1beta",

pkg/builtinchecks/yamls/latest-tag.yaml

@@ -0,0 +1,9 @@
+name: "latest-tag"
+description: "Indicates when a deployment-like object is running a container with a floating image tag, \"latest\""
+remediation: "Use a container image with a proper image tag, outside the set blocked tag regex \".*:(latest)$\"."
+scope:
+  objectKinds:
+    - DeploymentLike
+template: "latest-tag"
+params:
+  BlockList: [".*:(latest)$" ]

pkg/templates/all/all.go

@@ -15,6 +15,7 @@ import (
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostmounts"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostnetwork"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostpid"
+	_ "golang.stackrox.io/kube-linter/pkg/templates/latesttag"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/livenessprobe"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/memoryrequirements"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/mismatchingselector"

pkg/templates/latesttag/internal/params/params.go

@@ -0,0 +1,8 @@
+package params
+
+// Params represents the params accepted by this template.
+type Params struct {
+
+	// list of regular expressions for blocked or bad container image tags
+	BlockList []string
+}

pkg/templates/latesttag/template.go

@@ -0,0 +1,73 @@
+package latesttag
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/pkg/errors"
+	"golang.stackrox.io/kube-linter/pkg/check"
+	"golang.stackrox.io/kube-linter/pkg/config"
+	"golang.stackrox.io/kube-linter/pkg/diagnostic"
+	"golang.stackrox.io/kube-linter/pkg/extract"
+	"golang.stackrox.io/kube-linter/pkg/lintcontext"
+	"golang.stackrox.io/kube-linter/pkg/objectkinds"
+	"golang.stackrox.io/kube-linter/pkg/templates"
+	"golang.stackrox.io/kube-linter/pkg/templates/latesttag/internal/params"
+)
+
+const (
+	templateKey = "latest-tag"
+)
+
+func init() {
+	templates.Register(check.Template{
+		HumanName:   "Latest Tag",
+		Key:         templateKey,
+		Description: "Flag applications running containers with floating container image tag, \"latest\"",
+		SupportedObjectKinds: config.ObjectKindsDesc{
+			ObjectKinds: []string{objectkinds.DeploymentLike},
+		},
+		Parameters:             params.ParamDescs,
+		ParseAndValidateParams: params.ParseAndValidate,
+		Instantiate: params.WrapInstantiateFunc(func(p params.Params) (check.Func, error) {
+
+			blockedRegexes := make([]*regexp.Regexp, 0, len(p.BlockList))
+			for _, res := range p.BlockList {
+				rg, err := regexp.Compile(res)
+				if err != nil {
+					return nil, errors.Wrapf(err, "invalid regex %s", res)
+				}
+				blockedRegexes = append(blockedRegexes, rg)
+			}
+
+			return func(_ lintcontext.LintContext, object lintcontext.Object) []diagnostic.Diagnostic {
+				podSpec, found := extract.PodSpec(object.K8sObject)
+				if !found {
+					return nil
+				}
+
+				var results []diagnostic.Diagnostic
+
+				for _, container := range podSpec.Containers {
+					if isInList(blockedRegexes, container.Image) {
+						results = append(results, diagnostic.Diagnostic{Message: fmt.Sprintf("The container %q is using a floating image tag, %q.", container.Name, container.Image)})
+					}
+
+				}
+
+				return results
+
+			}, nil
+		}),
+	})
+}
+
+// isInList returns true if a match found in the list for the given name
+func isInList(regexlist []*regexp.Regexp, name string) bool {
+	for _, regex := range regexlist {
+		if regex.MatchString(name) {
+			return true
+		}
+	}
+	return false
+}

pkg/templates/latesttag/template_test.go

@@ -0,0 +1,83 @@
+package latesttag
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/suite"
+
+	"golang.stackrox.io/kube-linter/pkg/diagnostic"
+	"golang.stackrox.io/kube-linter/pkg/lintcontext/mocks"
+	"golang.stackrox.io/kube-linter/pkg/templates"
+	"golang.stackrox.io/kube-linter/pkg/templates/latesttag/internal/params"
+
+	v1 "k8s.io/api/core/v1"
+)
+
+var (
+	containerName = "test-container"
+)
+
+func TestContainerImage(t *testing.T) {
+	suite.Run(t, new(ContainerImageTestSuite))
+}
+
+type ContainerImageTestSuite struct {
+	templates.TemplateTestSuite
+
+	ctx *mocks.MockLintContext
+}
+
+func (s *ContainerImageTestSuite) SetupTest() {
+	s.Init(templateKey)
+	s.ctx = mocks.NewMockContext()
+}
+
+func (s *ContainerImageTestSuite) addDeploymentWithContainerImage(name, containerImage string) {
+	s.ctx.AddMockDeployment(s.T(), name)
+	s.ctx.AddContainerToDeployment(s.T(), name, v1.Container{Name: containerName, Image: containerImage})
+}
+
+func (s *ContainerImageTestSuite) TestImproperContainerTag() {
+	const (
+		depWithLatestAsContainerImageTag = "dep-with-latest-as-container-image-tag"
+	)
+
+	s.addDeploymentWithContainerImage(depWithLatestAsContainerImageTag, "example.com/test:latest")
+
+	s.Validate(s.ctx, []templates.TestCase{
+		{
+			Param: params.Params{
+				BlockList: []string{".*:(latest)$"},
+			},
+			Diagnostics: map[string][]diagnostic.Diagnostic{
+				depWithLatestAsContainerImageTag: {
+					{Message: "The container \"test-container\" is using a floating image tag, \"example.com/test:latest\"."},
+				},
+			},
+			ExpectInstantiationError: false,
+		},
+	})
+}
+
+func (s *ContainerImageTestSuite) TestAcceptableContainerImage() {
+	const (
+		depWithLatestAsContainerImageName = "dep-with-latest-as-container-image-name"
+		depWithAcceptableContainerImage   = "dep-with-acceptable-container-image"
+	)
+
+	s.addDeploymentWithContainerImage(depWithLatestAsContainerImageName, "example.com/latest:v1.0.0")
+	s.addDeploymentWithContainerImage(depWithAcceptableContainerImage, "example.com/test:v1.0.0")
+
+	s.Validate(s.ctx, []templates.TestCase{
+		{
+			Param: params.Params{
+				BlockList: []string{".*:(latest)$"},
+			},
+			Diagnostics: map[string][]diagnostic.Diagnostic{
+				depWithLatestAsContainerImageName: nil,
+				depWithAcceptableContainerImage:   nil,
+			},
+			ExpectInstantiationError: false,
+		},
+	})
+}