Infrastructure as Code

Want to see results for all your IaC repos in one place? Check out Fairwinds Insights (opens new window)

Polaris can be used on the command line to audit local Kubernetes manifests stored in YAML files. This is particularly helpful for running Polaris against your infrastructure-as-code as part of a CI/CD pipeline. Use the available command line flags to cause CI/CD to fail if your Polaris score drops below a certain threshold, or if any danger-level issues arise.

Install the CLI

To run Polaris against your YAML manifests, e.g. as part of a Continuous Integration process, you'll need to install the CLI.

Binary releases can be downloaded from the releases page (opens new window) or can be installed with Homebrew (opens new window):

brew tap FairwindsOps/tap
brew install FairwindsOps/tap/polaris
polaris version

Running in a CI pipeline

Set minimum score for an exit code

You can tell the CLI to set an exit code if it detects certain issues with your YAML files. For example, to fail if polaris detects any danger-level issues, or if the score drops below 90%:

polaris audit --audit-path ./deploy/ \
  --set-exit-code-on-danger \
  --set-exit-code-below-score 90

Pretty-print results

By default, results are output as JSON. You can get human-readable output with the --format=pretty flag:

polaris audit --audit-path ./deploy/ \
  --format=pretty

You can also disable colors and emoji:

polaris audit --audit-path ./deploy/ \
  --format=pretty \
  --color=false

Output only showing failed tests

The CLI to gives you ability to display results containing only failed tests. For example:

polaris audit --audit-path ./deploy/ \
  --only-show-failed-tests true

Audit Helm Charts

You can audit helm charts using the --helm-chart and --helm-values flags:

polaris audit \
  --helm-chart ./deploy/chart \
  --helm-values ./deploy/chart/values.yml

As Github Action

Setup polaris action

This action downloads a version of polaris (opens new window) and adds it to the path. It makes the polaris cli (opens new window) ready to use in following steps of the same job.

Inputs

version

The release version to fetch. This has to be in the form <tag_name>.

Outputs

version

The version number of the release tag.

Example usage

uses: fairwindsops/[email protected]
with:
  version: "3.0.3"

Example inside a job:

steps:
  - uses: actions/[email protected]
  - name: Setup polaris
    uses: fairwindsops/[email protected]
    with:
      version: 3.0.3

  - name: Use command
    run: polaris version