feat: glob ignores for workload checks (#160)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bryantbiggs

Cargo.lock

@@ -59,6 +59,9 @@ Options:
       --config <CONFIG>
           Path to an eksup configuration file (default: .eksup.yaml in cwd)
 
+      --show-suppressed
+          Include findings suppressed by .eksup.yaml ignore rules
+
   -h, --help
           Print help (see a summary with '-h')
 
@@ -127,6 +130,8 @@ Options:
           Exclude recommendations from the output
       --config <CONFIG>
           Path to an eksup configuration file (default: .eksup.yaml in cwd)
+      --show-suppressed
+          Include findings suppressed by .eksup.yaml ignore rules
   -h, --help
           Print help
   -V, --version
@@ -150,25 +155,80 @@ eksup analyze --cluster my-cluster --config /path/to/config.yaml
 #### Configuration Format
 
 ```yaml
+# .eksup.yaml — full example
 checks:
+  all:                          # applies to every workload check
+    ignore:
+      - name: "*"
+        namespace: "*-dev*"     # skip all dev namespaces
+
   K8S002:
-    min_replicas: 3  # Global minimum replica threshold (default: 2)
-    ignore:          # Resources to skip entirely
-      - name: metrics-server
-        namespace: kube-system
-    overrides:       # Per-resource threshold overrides
-      - name: critical-app
-        namespace: production
+    min_replicas: 3             # default minimum
+    ignore:                     # globs supported
+      - name: "preview-*"
+        namespace: "preview"
+    overrides:                  # globs supported here too
+      - name: "stateful-*"
+        namespace: "prod"
         min_replicas: 5
-  K8S004:
-    ignore:          # Resources to skip PDB check
-      - name: singleton-worker
-        namespace: batch
+
+  K8S003: { ignore: [{ name: "*-batch", namespace: "*" }] }
+  K8S004: { ignore: [{ name: "singleton-*", namespace: "default" }] }
+  K8S005: { ignore: [{ name: "*-logger*", namespace: "*monitoring*" }] }
+  # ... K8S006, K8S007, K8S008, K8S013 all use the same `ignore:` shape
 ```
 
 - `K8S002.min_replicas`: Global minimum replica threshold (default: 2). Must be >= 1.
-- `K8S002.ignore`: List of resources (by name + namespace) to exclude from the minimum replicas check.
-- `K8S002.overrides`: Per-resource minimum replica threshold. Overrides the global default.
-- `K8S004.ignore`: List of resources (by name + namespace) to exclude from the PodDisruptionBudget check.
-- Ignore takes precedence over overrides when both match the same resource.
+- `K8S002.overrides`: Per-resource minimum replica threshold (globs supported). Overrides the global default.
+- `ignore` takes precedence over `overrides` when both match the same resource.
 - Unknown fields in the configuration file are rejected with an error.
+
+#### The `checks.all` block
+
+`checks.all.ignore` applies across **every** workload check. Selectors listed here are merged with each check's own `ignore` list, so you can suppress noisy namespaces or naming patterns in one place instead of repeating the same entry under every code.
+
+#### Glob syntax
+
+`name` and `namespace` selectors support standard glob syntax:
+
+- `*` — matches any sequence of characters (including empty)
+- `?` — matches exactly one character
+- `[abc]` / `[a-z]` — character classes
+- `{a,b,c}` — brace expansion (alternation)
+
+Literal strings still work and continue to behave as exact matches — existing configs without globs remain valid.
+
+#### Workload checks that support `ignore`
+
+The following workload checks accept the `ignore:` shape shown above (each rule is matched against the resource's `name` + `namespace`):
+
+- `K8S002` — minimum replicas
+- `K8S003` — minimum ready seconds
+- `K8S004` — PodDisruptionBudget present
+- `K8S005` — pod topology spread / anti-affinity
+- `K8S006` — readiness probe configured
+- `K8S007` — termination grace period
+- `K8S008` — Docker socket mount
+- `K8S013` — `ingress-nginx` controller retirement
+
+#### Cluster-level checks (no `ignore` support)
+
+Cluster-level checks do not support `ignore` because their findings have no resource `name` + `namespace` to match against:
+
+- `AWS001` – `AWS005` — AWS-side checks
+- `EKS001` – `EKS010` — EKS-side checks
+- `K8S001` — Kubernetes version skew
+- `K8S009` — Pod Security Policies
+- `K8S010` — EBS CSI driver
+- `K8S011` — kube-proxy / kubelet version skew
+- `K8S012` — kube-proxy IPVS mode (singleton DaemonSet; finding has no per-resource fields)
+
+The right control for a cluster-level check is "disable the check entirely" — a separate, future feature.
+
+#### `--show-suppressed` flag
+
+Both `eksup analyze` and `eksup create playbook` accept `--show-suppressed`. By default, suppressed findings are hidden and a single-line summary (e.g. `3 findings suppressed by .eksup.yaml (use --show-suppressed to view)`) is printed. With the flag set, suppressed findings are rendered inline under a `Suppressed by .eksup.yaml (N):` section so you can audit exactly what your config is filtering out.
+
+#### JSON output: `suppressed` key
+
+The JSON output (`--format json`) always includes a top-level `suppressed:` key alongside the regular findings, regardless of `--show-suppressed`. Programmatic consumers can inspect every suppressed finding without re-running the analysis. The `--show-suppressed` flag only affects human-readable stdout/playbook rendering.

completions/_eksup

@@ -35,6 +35,7 @@ clap = { version = "4.6", default-features = false, features = ["std", "derive",
 clap-verbosity-flag = { version = "3.0", default-features = false, features = ["tracing"] }
 clap_complete = { version = "4.5", default-features = false }
 clap_mangen = { version = "0.2", default-features = false }
+globset = { version = "0.4", default-features = false }
 indicatif = { version = "0.18", default-features = false, features = ["unicode-width"] }
 handlebars = { version = "6.4", default-features = false, features = ["rust-embed"] }
 # https://kube.rs/kubernetes-version/

completions/_eksup.ps1

@@ -17,6 +17,8 @@ pub struct Results {
   pub data_plane: eks::DataPlaneFindings,
   pub addons: eks::AddonFindings,
   pub kubernetes: k8s::KubernetesFindings,
+  #[serde(rename = "suppressed")]
+  pub kubernetes_suppressed: k8s::KubernetesSuppressed,
   pub service_limits: eks::ServiceLimitFindings,
   pub insights: eks::InsightsFindings,
 }
@@ -125,7 +127,9 @@ impl Results {
   }
 
   /// Renders all findings as a formatted stdout table string
-  pub fn to_stdout_table(&self) -> Result<String> {
+  pub fn to_stdout_table(&self, show_suppressed: bool) -> Result<String> {
+    use std::fmt::Write;
+
     let mut output = String::new();
 
     output.push_str(&self.subnets.pod_ips.to_stdout_table()?);
@@ -155,6 +159,26 @@ impl Results {
     output.push_str(&self.insights.upgrade_readiness.to_stdout_table()?);
     output.push_str(&self.insights.misconfiguration.to_stdout_table()?);
 
+    let suppressed_total = self.kubernetes_suppressed.total();
+    if suppressed_total > 0 {
+      if show_suppressed {
+        writeln!(output, "\nSuppressed by .eksup.yaml ({suppressed_total}):")?;
+        output.push_str(&self.kubernetes_suppressed.min_replicas.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.min_ready_seconds.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.readiness_probe.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.pod_topology_distribution.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.termination_grace_period.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.docker_socket.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.ingress_nginx_retirement.to_stdout_table()?);
+        output.push_str(&self.kubernetes_suppressed.pod_disruption_budgets.to_stdout_table()?);
+      } else {
+        writeln!(
+          output,
+          "\n{suppressed_total} findings suppressed by .eksup.yaml (use --show-suppressed to view)"
+        )?;
+      }
+    }
+
     Ok(output)
   }
 }
@@ -177,30 +201,26 @@ pub async fn analyze(
     subnet_findings,
     addon_findings,
     dataplane_findings,
-    kubernetes_findings,
+    kubernetes_result,
     service_limit_findings,
     insights_findings,
   ) = tokio::try_join!(
     eks::get_subnet_findings(aws, k8s, cluster),
     eks::get_addon_findings(aws, cluster_name, cluster_version, target_minor),
     eks::get_data_plane_findings(aws, cluster, target_minor),
-    k8s::get_kubernetes_findings(
-      k8s,
-      control_plane_minor,
-      target_minor,
-      &config.checks.k8s002,
-      &config.checks.k8s004
-    ),
+    k8s::get_kubernetes_findings(k8s, control_plane_minor, target_minor, &config.checks),
     eks::get_service_limit_findings(aws),
     eks::get_insights_findings(aws, cluster_name),
   )?;
+  let (kubernetes_findings, kubernetes_suppressed) = kubernetes_result;
 
   Ok(Results {
     cluster: cluster_findings,
     subnets: subnet_findings,
     addons: addon_findings,
     data_plane: dataplane_findings,
     kubernetes: kubernetes_findings,
+    kubernetes_suppressed,
     service_limits: service_limit_findings,
     insights: insights_findings,
   })