k8s_containers resource
Use the k8s_containers Chef InSpec audit resource to test the configurations of all Containers in a namespace.
Installation
Syntax
describe k8s_containers do
#...
end
Parameter
namespace- Namespace of the resource.
Properties
names- Name of the Container.
images- Container image name.
commands- Entrypoint array.
args- Arguments to the entrypoint.
resources- Compute Resources required by this container.
volumeMounts- Pod volumes to mount into the container’s filesystem
livenessProbes- Periodic probe of container liveness
readinessProbes- Periodic probe of container service readiness
imagePullPolicies- Image pull policy, One of Always, Never, IfNotPresent
securityContexts- Security options the pod should run with
Examples
Containers for default namespace must exist
describe k8s_containers do
it { should exist }
end
Containers for specified namespace must exist
describe k8s_containers(namespace: 'kube-system') do
it { should exist }
end
Containers with readOnlyRootFilesystem exists
describe k8s_containers(namespace: 'kube-system').where{ securityContext && securityContext[:readOnlyRootFilesystem] == true } do
it { should exist }
end