You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am deploying Trivy with their Helm chart, so Trivy is deployed as a statefulset.
The Trivy chart only allows to add annotations at the pod level (i.e. not at the statefulset level) so I added the kube-score/ignore annotation at the pod level:
But then kube-score does not ignore the container-image-tag and pod-probes checks:
apps/v1/StatefulSet trivy in trivy-staging 💥
[WARNING] Container Ephemeral Storage Request and Limit
· main -> Ephemeral Storage request is not set
Resource requests are recommended to make sure the application can
start and run without crashing. Set
resource.requests.ephemeral-storage
[CRITICAL] Pod NetworkPolicy
· The pod does not have a matching NetworkPolicy
Create a NetworkPolicy that targets this pod to control who/what
can communicate with this pod. Note, this feature needs to be
supported by the CNI implementation used in the Kubernetes cluster
to have an effect.
[CRITICAL] Container Image Tag
· main -> Image with latest tag
Using a fixed tag is recommended to avoid accidental upgrades
[CRITICAL] Pod Probes
· Container has the same readiness and liveness probe
Using the same probe for liveness and readiness is very likely
dangerous. Generally it's better to avoid the livenessProbe than
re-using the readinessProbe.
More information: https://github.com/zegl/kube-score/blob/master/README_PROBES.md
[WARNING] StatefulSet has host PodAntiAffinity
· StatefulSet does not have a host podAntiAffinity set
It's recommended to set a podAntiAffinity that stops multiple pods
from a statefulset from being scheduled on the same node. This
increases availability in case the node becomes unavailable.
[CRITICAL] StatefulSet has ServiceName
· StatefulSet does not have a valid serviceName
StatefulSets currently require a Headless Service to be responsible
for the network identity of the Pods. You are responsible for
creating this Service.
https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#limitations
[CRITICAL] StatefulSet has PodDisruptionBudget
· No matching PodDisruptionBudget was found
It's recommended to define a PodDisruptionBudget to avoid
unexpected downtime during Kubernetes maintenance operations, such
as when draining a node.
The text was updated successfully, but these errors were encountered:
I am deploying Trivy with their Helm chart, so Trivy is deployed as a statefulset.
The Trivy chart only allows to add annotations at the pod level (i.e. not at the statefulset level) so I added the
kube-score/ignore
annotation at the pod level:But then kube-score does not ignore the
container-image-tag
andpod-probes
checks:The text was updated successfully, but these errors were encountered: