# KubeLinter configuration
# https://docs.kubelinter.io/

checks:
  doNotAutoAddDefaults: false
  exclude:
    # Karpenter handles resource-based scheduling via NodePools
    - "unset-cpu-requirements"
    - "unset-memory-requirements"
    # Many infra containers legitimately need writable root
    - "no-read-only-root-fs"
    # Base infra doesn't always use liveness probes (Harbor, etc.)
    - "no-liveness-probe"
    # Infrastructure DaemonSets (node tuning, registry config, image-cache-janitor,
    # NVIDIA plugin, DCGM exporter) and controllers (node-compactor, HAProxy) run as root
    - "run-as-non-root"
    # Node-tuning, registry-config, and image-cache-janitor DaemonSets are privileged
    - "privileged-container"
    - "privilege-escalation-container"
    # Node-tuning needs hostIPC/hostNetwork/hostPID; registry-config needs hostNetwork/hostPID;
    # image-cache-janitor needs hostPID
    - "host-ipc"
    - "host-network"
    - "host-pid"
    # Node-tuning mounts / and /sys to configure CPU governor and sysfs
    - "sensitive-host-mounts"
    - "liveness-port"
    # Privileged containers and DCGM exporter: dropping NET_RAW is meaningless or incompatible
    - "drop-net-raw-capability"
    # BuildKit pod services reference generated Deployments not in the static kustomization
    - "dangling-service"
    # node-compactor uses placeholder image replaced at deploy time
    - "latest-tag"
    - "pdb-min-available"
    # Default unhealthy pod eviction policy is correct for critical single-replica pods
    - "pdb-unhealthy-pod-eviction-policy"
