feat: add OpenShift exceptions

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-Please read [CONTRIBUTING.md](CONTRIBUTING.md) for additional information on contributing to this repository!
+<!-- Please read [CONTRIBUTING.md](CONTRIBUTING.md) for additional information on contributing to this repository! -->
 
 <!--
   !!!! README !!!! Please fill this out.
@@ -10,15 +10,17 @@ Please read [CONTRIBUTING.md](CONTRIBUTING.md) for additional information on con
 
 <!-- A short description of what your PR does and what it solves. -->
 
-## What this PR does / why we need it
+## What this PR does / why we need it?
 
 ## PR Checklist
 
 - [ ] This PR adds K8s exceptions (false positives)
 - [ ] This PR adds new code
-- [ ] This PR includes test for any new code
+- [ ] This PR includes tests for new/existing code
+- [ ] This PR adds docs
+<!-- - [ ] This PR does something else -->
 
-## Github Issue
+## GitHub Issue
 
 [XX-XX]
 

README.md

@@ -170,7 +170,7 @@ kor [subcommand] --help
 | CRDs            | CRDs not used the cluster                                                                                                                                                                                                         |                                                                                                                                                                       |
 | Pvs             | PVs not bound to a PVC                                                                                                                                                                                                            |                                                                                                                                                                       |
 | Pdbs            | PDBs not used in Deployments<br/> PDBs not used in StatefulSets                                                                                                                                                                   |                                                                                                                                                                       |
-| Jobs            | Jobs status is completed                                                                                                                                                                                                          |                                                                                                                                                                       |
+| Jobs            | Jobs status is completed<br/>  Jobs failed with no retries left                                                                                                                                                                                                         |                                                                                                                                                                       |
 | ReplicaSets     | replicaSets that specify replicas to 0 and has already completed it's work                                                                                                                                                        |
 | DaemonSets      | DaemonSets not scheduled on any nodes                                                                                                                                                                                             |
 | StorageClasses  | StorageClasses not used by any PVs/PVCs                                                                                                                                                                                           |

charts/kor/Chart.yaml

@@ -1,24 +1,6 @@
 apiVersion: v2
 name: kor
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+description: A Kubernetes Helm Chart to discover orphaned resources using kor
 type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.5
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
+version: 0.1.6
 appVersion: "0.4.0"

charts/kor/README.md

@@ -1,8 +1,8 @@
 # kor
 
-![Version: 0.1.5](https://img.shields.io/badge/Version-0.1.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.4.0](https://img.shields.io/badge/AppVersion-0.3.4-informational?style=flat-square)
+![Version: 0.1.6](https://img.shields.io/badge/Version-0.1.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.4.0](https://img.shields.io/badge/AppVersion-0.4.0-informational?style=flat-square)
 
-A Helm chart for Kubernetes
+A Kubernetes Helm Chart to discover orphaned resources using kor
 
 ## Values
 
@@ -39,21 +39,20 @@ A Helm chart for Kubernetes
 | prometheusExporter.enabled | bool | `true` |  |
 | prometheusExporter.exporterInterval | string | `""` |  |
 | prometheusExporter.name | string | `"kor-exporter"` |  |
-| prometheusExporter.service.enabled | bool | `true` |  |
-| prometheusExporter.service.interval | string | `"30s"` |  |
-| prometheusExporter.service.labels | object | `{}` |  |
-| prometheusExporter.service.metricRelabelings | list | `[]` |  |
-| prometheusExporter.service.namespace | string | `""` |  |
 | prometheusExporter.service.port | int | `8080` |  |
-| prometheusExporter.service.relabelings | list | `[]` |  |
-| prometheusExporter.service.serviceMonitor | string | `nil` |  |
-| prometheusExporter.service.targetLabels | list | `[]` |  |
-| prometheusExporter.service.telemetryPath | string | `"/metrics"` |  |
-| prometheusExporter.service.timeout | string | `"10s"` |  |
 | prometheusExporter.service.type | string | `"ClusterIP"` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.create | bool | `true` |  |
-| serviceAccount.name | string | `""` |  |
+| prometheusExporter.serviceMonitor.enabled | bool | `true` |  |
+| prometheusExporter.serviceMonitor.interval | string | `"30s"` | Set how frequently Prometheus should scrape |
+| prometheusExporter.serviceMonitor.labels | object | `{}` | Service monitor labels |
+| prometheusExporter.serviceMonitor.metricRelabelings | list | `[]` |  |
+| prometheusExporter.serviceMonitor.namespace | string | `""` | Set the namespace the ServiceMonitor should be deployed, if empty namespace will be `.Release.Namespace` |
+| prometheusExporter.serviceMonitor.relabelings | list | `[]` |  |
+| prometheusExporter.serviceMonitor.targetLabels | list | `[]` | Set of labels to transfer on the Kubernetes Service onto the target. |
+| prometheusExporter.serviceMonitor.telemetryPath | string | `"/metrics"` |  |
+| prometheusExporter.serviceMonitor.timeout | string | `"10s"` | Set timeout for scrape |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1)

charts/kor/values.yaml

@@ -61,28 +61,28 @@ prometheusExporter:
 
   serviceMonitor:
     enabled: true
-    # Set the namespace the ServiceMonitor should be deployed, if empty namespace will be .Release.Namespace
+    # -- Set the namespace the ServiceMonitor should be deployed, if empty namespace will be `.Release.Namespace`
     namespace: ""
-    # Service monitor labels
+    # -- Service monitor labels
     labels: {}
-    # Set how frequently Prometheus should scrape
+    # -- Set how frequently Prometheus should scrape
     interval: 30s
     telemetryPath: /metrics
-    # Set timeout for scrape
+    # -- Set timeout for scrape
     timeout: 10s
     relabelings: []
-    # Set of labels to transfer on the Kubernetes Service onto the target.
+    # -- Set of labels to transfer on the Kubernetes Service onto the target.
     targetLabels: []
     metricRelabelings: []
 
-# Custom labels to add into metadata
+# -- Custom labels to add into metadata
 additionalLabels: {}
 
 serviceAccount:
-  # Specifies whether a service account should be created
+  # -- Specifies whether a service account should be created
   create: true
-  # Annotations to add to the service account
+  # -- Annotations to add to the service account
   annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
+  # -- The name of the service account to use.
+  # -- If not set and create is true, a name is generated using the fullname template
   name: ""

pkg/kor/configmaps_test.go

@@ -168,7 +168,9 @@ func TestRetrieveUsedCM(t *testing.T) {
 	expectedVolumesCM := []string{
 		"configmap-1",
 		"kube-root-ca.crt",
+		"openshift-service-ca.crt",
 	}
+
 	if !equalSlices(volumesCM, expectedVolumesCM) {
 		t.Errorf("Expected volume configmaps %v, got %v", expectedVolumesCM, volumesCM)
 	}

pkg/kor/exceptions/clusterroles/clusterroles.json

@@ -83,6 +83,186 @@
     {
       "Namespace": "",
       "ResourceName": "view"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:node-bootstrapper"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:aggregated-metrics-reader"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "alert-routing-edit"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "cluster-debugger"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "global-operators-admin"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "global-operators-edit"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "global-operators-view"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "monitoring-edit"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "monitoring-rules-edit"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "monitoring-rules-view"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "olm-operators-admin"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "olm-operators-edit"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "olm-operators-view"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-cluster-monitoring-admin"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-cluster-monitoring-edit"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-cluster-monitoring-view"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-main-attacher-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-main-provisioner-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-main-resizer-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-main-snapshotter-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-provisioner-configmap-and-secret-reader-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-provisioner-volumeattachment-reader-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-provisioner-volumesnapshot-reader-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-resizer-infrastructure-reader-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "openshift-csi-resizer-storageclass-reader-role"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "resource-metrics-server-resources"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "storage-admin"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "sudoer"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:build-strategy-custom"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:image-auditor"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:image-pusher"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:image-signer"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:node-reader"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:aggregate-snapshots-to-storage-admin"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:aggregate-to-storage-admin"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:hostaccess"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:hostmount"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:hostnetwork"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:nonroot"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:nonroot-v2"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:privileged"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:scc:restricted"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:openshift:templateservicebroker-client"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:router"
+    },
+    {
+      "Namespace": "",
+      "ResourceName": "system:sdn-manager"
     }
   ]
 }

pkg/kor/exceptions/configmaps/configmaps.json

@@ -4,6 +4,10 @@
       "Namespace": "*",
       "ResourceName": "kube-root-ca.crt"
     },
+    {
+      "Namespace": "*",
+      "ResourceName": "openshift-service-ca.crt"
+    },
     {
       "Namespace": "gmp-system",
       "ResourceName": "config-images"
@@ -76,6 +80,22 @@
       "Namespace": "kube-system",
       "ResourceName": "overlay-upgrade-data"
     },
+    {
+      "Namespace": "kube-system",
+      "ResourceName": "cluster-dns"
+    },
+    {
+      "Namespace": "kube-system",
+      "ResourceName": "bootstrap"
+    },
+    {
+      "Namespace": "kube-system",
+      "ResourceName": "cluster-config-v1"
+    },
+    {
+      "Namespace": "kube-system",
+      "ResourceName": "root-ca"
+    },
     {
       "Namespace": "kubernetes-dashboard",
       "ResourceName": "kubernetes-dashboard-settings"