derrickburns

import yaml
import sys
from decimal import Decimal, getcontext
from collections import defaultdict

# Set the precision
getcontext().prec = 100

def calculate_probability(N: int, M: int) -> float:
    return 1 - (Decimal(1)/Decimal(M))**N

derrickburns

import sys
import yaml
import csv
from collections import defaultdict

def supports_anti_affinity_across_zones(deployment):
    affinity = deployment.get('spec', {}).get('template', {}).get('spec', {}).get('affinity', {})
    pod_anti_affinity = affinity.get('podAntiAffinity', {})
    required_during_scheduling_ignored_during_execution = pod_anti_affinity.get('requiredDuringSchedulingIgnoredDuringExecution', [])

derrickburns

import sys
import yaml
import csv
from collections import defaultdict

def check_security_best_practices(deployment, stats):
    spec = deployment.get('spec', {})
    pod_spec = spec.get('template', {}).get('spec', {})
    containers = pod_spec.get('containers', [])
    

derrickburns

I then ran a rather simple script to identify whether each Deployment resource has the necessary (though not sufficient!) configuration to support a high availability deployment, by which I mean:

more than one replica, 
an anti-affinity rule,
a liveness probe, and
a readiness probe.

I did not review the actual content returned, so it is entirely possible that there are not enough replicas, the anti-affinity rule is incorrect, or one of the probes is incorrect.

However, this cursory audit reveals that of the 270 total Deployment resources, only 20 have anti-affinity rules.  Of these 20, only 18 have more than one replica.  Of these 18, 16 have readiness probes, 15 have liveness probes, and 14 have both readiness and liveness probes.  

derrickburns

# get api token with proper perms, ensure full "repos" for private repo access.

$ export auth="Authorization: token 123345465hfghfghfghgfhgfhfg"
$ export org="your_org"

# get the last page in the Link header. github API limits per_page to 100. Anything over this will require pagination.
$ curl -I -H "$auth" https://api.github.com/orgs/$org/repos

# go over all pages. Put this in a script, and save it.
#!/bin/bash