From e9ea916da2f00b6e0770c2f776e43ebfe8cffd44 Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Tue, 29 Apr 2025 11:54:42 +0300 Subject: [PATCH 01/13] for CR --- .../kubernetes-cluster/templates/_helpers.tpl | 72 ++++++++++++------- .../admission-controller/_helpers.tpl | 4 ++ .../admission-controller/deployment.yaml | 22 +++--- .../templates/connector/cluster-role.yaml | 40 +++++++++++ .../templates/connector/deployment.yaml | 10 ++- .../hook-post-delete-cluster-role.yaml | 1 - .../templates/hook-post-delete-job.yaml | 25 ++++--- ...hook-pre-install-cluster-role-binding.yaml | 2 +- .../templates/hook-pre-install-job.yaml | 17 ++--- .../hook-pre-install-service-account.yaml | 2 +- .../hook-security-context-constraints.yaml | 2 +- .../kubernetes-cluster/templates/secret.yaml | 2 +- .../templates/sensor/daemonset.yaml | 10 ++- .../templates/updater/cronjob.yaml | 10 ++- .../templates/updater/role.yaml | 20 +++++- .../kubernetes-cluster/values.schema.json | 30 ++++++++ .../kubernetes-cluster/values.yaml | 16 ++++- 17 files changed, 205 insertions(+), 80 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index 41e7e96..a727b6b 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -3,7 +3,13 @@ meta.helm.sh/release-name: {{ .Release.Name }} meta.helm.sh/release-namespace: {{ .Release.Namespace }} {{- end }} +{{- define "apiKeyTokenFilePath" -}} +{{ print (.Values.containerSecrets.volumeMountPath) "/apikeytoken" }} +{{- end }} + {{- define "apiKeyTokenSecret" -}} +{{- if .root.Values.containerSecrets.enabled }} +{{- if not .root.Values.containerSecrets.apiKeyTokenName }} apiVersion: v1 kind: Secret metadata: @@ -20,36 +26,15 @@ stringData: API_KEY_TOKEN: {{ .root.Values.apiKeyToken }} type: Opaque {{- end }} - -{{- define "apiKeyTokenVolume" -}} -- name: {{ .name }} - secret: - secretName: {{ .name }} - items: - - key: API_KEY_TOKEN - path: apikeytoken {{- end }} - -{{- define "containerImage" -}} -{{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}} {{- end }} -{{- define "environmentVariables" -}} -env: - - name: SIL_LogFormat - value: Text +{{- define "apiKeyTokenSecretName"}} +{{- .Values.containerSecrets.apiKeyTokenName | default (print .Values.resourceNamePrefix "-secret" ) }} {{- end }} - -{{- define "globalResourceName" -}} -{{- print "tenable" "-" .root.Values.resourceNamePrefix "-" .name "-" (trunc 8 (sha256sum (print .root.Release.Namespace ":" .root.Release.Name))) }} -{{- end }} - -{{- define "labels" -}} -app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }} -app.kubernetes.io/version: {{ .Chart.Version }} +{{- define "containerImage" -}} +{{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}} {{- end }} {{- define "containerImagePullSecret" -}} @@ -72,3 +57,40 @@ data: type: kubernetes.io/dockerconfigjson {{- end }} {{- end }} + +{{- define "containerSecretsVolume" -}} +{{- if .Values.containerSecrets.enabled -}} +- name: {{ print .Values.resourceNamePrefix "-secret" }} + secret: + items: + - key: API_KEY_TOKEN + path: apikeytoken + secretName: {{ include "apiKeyTokenSecretName" . }} +{{- end }} +{{- end }} + +{{- define "containerSecretsVolumeMount" -}} +{{- if .Values.containerSecrets.enabled -}} +- mountPath: {{ .Values.containerSecrets.volumeMountPath | quote }} + name: {{ print .Values.resourceNamePrefix "-secret" }} + readOnly: true +{{- end }} +{{- end }} + +{{- define "environmentVariables" -}} +env: + - name: SIL_LogFormat + value: Text +{{- end }} + +{{- define "globalResourceName" -}} +{{- print "tenable" "-" .root.Values.resourceNamePrefix "-" .name "-" (trunc 8 (sha256sum (print .root.Release.Namespace ":" .root.Release.Name))) }} +{{- end }} + +{{- define "labels" -}} +app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }} +app.kubernetes.io/version: {{ .Chart.Version }} +{{- end }} + diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl index 18c74ad..d0ae045 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl @@ -14,6 +14,10 @@ app.kubernetes.io/component: admission-controller {{- print .Values.resourceNamePrefix "-admission-controller" }} {{- end }} +{{- define "admissionController.certificateVolumeMountPath" -}} +{{ .Values.admissionController.certificateSecret.volumeMountPath -}} +{{- end }} + {{- define "admissionController.tls" -}} {{- if .Values.admissionController.tls }} {{- .Values.admissionController.tls | toYaml }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml index ec01a2d..e8ba687 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml @@ -41,7 +41,7 @@ spec: containers: - args: [ "--api-key-token-file-path", - "/var/run/secrets/application/apikeytoken", + {{ include "apiKeyTokenFilePath" . | quote }}, "--api-url", {{ .Values.apiUrl | quote }}, "--health-server-port", @@ -51,7 +51,7 @@ spec: "--validating-admission-configuration-name", {{ include "admissionController.resourceNamePrefix" . }}-vwc, "--webhook-server-certificates-directory-path", - "/var/run/secrets/certificates", + {{ include "admissionController.certificateVolumeMountPath" . | quote }}, "--webhook-server-port", {{ .Values.admissionController.webhook.port | quote }} ] @@ -94,14 +94,14 @@ spec: drop: - ALL runAsNonRoot: true - runAsUser: {{ .Values.runAsUser }} + runAsUser: {{ .Values.admissionController.pod.containers.securityContext.runAsUser }} volumeMounts: - - mountPath: "/var/run/secrets/certificates" + {{- if .Values.admissionController.certificateSecret.enabled }} + - mountPath: {{ include "admissionController.certificateVolumeMountPath" .}} name: {{ include "admissionController.resourceNamePrefix" . }}-secret readOnly: true - - mountPath: "/var/run/secrets/application" - name: {{ .Values.resourceNamePrefix }}-secret - readOnly: true + {{- end }} + {{- include "containerSecretsVolumeMount" . | nindent 12 }} imagePullSecrets: {{- with .Values.containerImage.pullSecrets }} {{- toYaml . | nindent 8 }} @@ -118,9 +118,15 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: + {{- if .Values.admissionController.certificateSecret.enabled }} - name: {{ include "admissionController.resourceNamePrefix" . }}-secret secret: defaultMode: 0444 + {{- if .Values.admissionController.certificateSecret.name }} + secretName: {{ .Values.admissionController.certificateSecret.name }} + {{- else }} secretName: {{ include "admissionController.resourceNamePrefix" . }}-secret - {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 8 }} + {{- end }} + {{- end }} + {{- include "containerSecretsVolume" . | nindent 8 }} {{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml index b6e7071..45f349c 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml @@ -9,7 +9,47 @@ metadata: {{- include "connector.labels" . | nindent 4 }} name: {{ include "connector.globalResourceName" (dict "name" "cr" "root" .) }} rules: + {{- if .Values.connector.clusterRoleExplicitPermissions }} + - apiGroups: [""] + resources: + - bindings + - componentstatuses + - configmaps + - endpoints + - events + - limitranges + - namespaces + - nodes + - nodes/status + - persistentvolumeclaims + - persistentvolumes + - pods + - podtemplates + - replicationcontrollers + - resourcequotas + - serviceaccounts + - services + - services/status + verbs: ["get", "list", "watch"] + - apiGroups: + - admissionregistration.k8s.io + - apiextensions.k8s.io + - apiregistration.k8s.io + - apps + - autoscaling + - batch + - discovery.k8s.io + - events.k8s.io + - extensions + - networking.k8s.io + - policy + - rbac.authorization.k8s.io + - storage.k8s.io + resources: ["*"] + verbs: ["get", "list", "watch"] + {{- else }} - apiGroups: ["*"] resources: ["*"] verbs: ["get", "list", "watch"] + {{- end }} {{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml index cd76617..96c71cc 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml @@ -38,7 +38,7 @@ spec: - args: [ "connector", "--api-key-token-file-path", - "/var/run/secrets/application/apikeytoken", + {{ include "apiKeyTokenFilePath" . | quote }}, "--api-url", {{ .Values.apiUrl | quote }}, {{- if .Values.connector.identity }} @@ -66,11 +66,9 @@ spec: drop: - ALL runAsNonRoot: true - runAsUser: {{ .Values.runAsUser }} + runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} volumeMounts: - - mountPath: "/var/run/secrets/application" - name: {{ .Values.resourceNamePrefix }}-secret - readOnly: true + {{- include "containerSecretsVolumeMount" . | nindent 12 }} imagePullSecrets: {{- with .Values.containerImage.pullSecrets }} {{- toYaml . | nindent 8 }} @@ -86,5 +84,5 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 8 }} + {{- include "containerSecretsVolume" . | nindent 8 }} {{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml index 01a74a5..70467ef 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml @@ -9,7 +9,6 @@ metadata: labels: {{- include "labels" . | nindent 4 }} name: {{ include "globalResourceName" (dict "name" "post-delete-cr" "root" .) }} - namespace: {{ .Release.Namespace }} rules: - apiGroups: [""] resources: ["namespaces"] diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml index 0e84e3a..fd8f4de 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml @@ -31,13 +31,13 @@ spec: - args: [ "release-post-delete", "--api-key-token-file-path", - "/var/run/secrets/application/apikeytoken", + {{ include "apiKeyTokenFilePath" . | quote }}, "--api-url", - {{ .Values.apiUrl | quote }}, - {{- if .Values.proxyUrl }} + {{ .Values.apiUrl | quote }}, + {{- if .Values.proxyUrl }} "--proxy-url", - {{ .Values.proxyUrl | quote }}, - {{- end }} + {{ .Values.proxyUrl | quote }}, + {{- end }} ] {{- include "environmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} @@ -45,7 +45,7 @@ spec: name: {{ .Values.resourceNamePrefix }}-post-delete-container {{- with .Values.pod.resources }} resources: - {{- toYaml . | nindent 12 }} + {{- toYaml . | nindent 12 }} {{- end }} securityContext: allowPrivilegeEscalation: false @@ -53,9 +53,7 @@ spec: drop: - ALL volumeMounts: - - name: {{ .Values.resourceNamePrefix }}-post-delete-secret - mountPath: "/var/run/secrets/application" - readOnly: true + {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: {{- with .Values.containerImage.pullSecrets }} {{- toYaml . | nindent 8 }} @@ -65,7 +63,7 @@ spec: restartPolicy: Never securityContext: runAsNonRoot: true - runAsUser: {{ .Values.runAsUser }} + runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} seccompProfile: type: RuntimeDefault serviceAccountName: {{ .Values.resourceNamePrefix }}-post-delete-service-account @@ -74,18 +72,19 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-post-delete-secret") "root" .) | nindent 8 }} + {{- include "containerSecretsVolume" . | nindent 8 }} --- {{ $apiKeyTokenSecretAnnotations := list "helm.sh/hook: post-delete" "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" "helm.sh/hook-weight: \"-1\"" }} -{{ include "apiKeyTokenSecret" (dict "name" (print .Values.resourceNamePrefix "-post-delete-secret") "root" . "annotations" $apiKeyTokenSecretAnnotations) }} +{{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" . "annotations" $apiKeyTokenSecretAnnotations) }} + --- {{ $containerImagePullSecretAnnotations := list "helm.sh/hook: post-delete" "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" "helm.sh/hook-weight: \"-10\"" }} -{{ include "containerImagePullSecret" (dict "name" (print .Values.resourceNamePrefix "-post-delete-image-pull-secret") "root" . "annotations" $containerImagePullSecretAnnotations) }} \ No newline at end of file +{{ include "containerImagePullSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" . "annotations" $containerImagePullSecretAnnotations) }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml index ea0b156..20eaefa 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml @@ -5,7 +5,7 @@ metadata: {{- include "annotations" . | nindent 4 }} helm.sh/hook: pre-install, pre-upgrade helm.sh/hook-delete-policy: before-hook-creation, hook-succeeded - helm.sh/hook-weight: "-1" + helm.sh/hook-weight: "-4" labels: {{- include "labels" . | nindent 4 }} name: {{ include "globalResourceName" (dict "name" "pre-install-crb" "root" .) }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml index bf29ab9..a5495d1 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml @@ -5,6 +5,7 @@ metadata: {{- include "annotations" . | nindent 4 }} helm.sh/hook: pre-install, pre-upgrade helm.sh/hook-delete-policy: before-hook-creation, hook-succeeded + helm.sh/hook-weight: "-1" labels: {{- include "labels" . | nindent 4 }} name: {{ .Values.resourceNamePrefix }}-pre-install-job @@ -30,7 +31,7 @@ spec: - args: [ "release-pre-install", "--api-key-token-file-path", - "/var/run/secrets/application/apikeytoken", + {{ include "apiKeyTokenFilePath" . | quote }}, "--api-url", {{ .Values.apiUrl | quote }}, "--application-version", @@ -64,9 +65,7 @@ spec: drop: - ALL volumeMounts: - - name: {{ .Values.resourceNamePrefix }}-pre-install-secret - mountPath: "/var/run/secrets/application" - readOnly: true + {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: {{- with .Values.containerImage.pullSecrets }} {{- toYaml . | nindent 8 }} @@ -76,7 +75,7 @@ spec: restartPolicy: Never securityContext: runAsNonRoot: true - runAsUser: {{ .Values.runAsUser }} + runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} seccompProfile: type: RuntimeDefault serviceAccountName: {{ .Values.resourceNamePrefix }}-pre-install-service-account @@ -85,14 +84,16 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-pre-install-secret") "root" .) | nindent 8 }} + {{- include "containerSecretsVolume" . | nindent 8 }} + --- {{ $apiKeyTokenSecretAnnotations := list "helm.sh/hook: pre-install, pre-upgrade" "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" - "helm.sh/hook-weight: \"-1\"" }} -{{ include "apiKeyTokenSecret" (dict "name" (print .Values.resourceNamePrefix "-pre-install-secret") "root" . "annotations" $apiKeyTokenSecretAnnotations) }} + "helm.sh/hook-weight: \"-2\"" }} +{{ include "apiKeyTokenSecret" (dict "name" ( include "apiKeyTokenSecretName" .) "root" . "annotations" $apiKeyTokenSecretAnnotations) }} + --- {{ $containerImagePullSecretAnnotations := list diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml index d03639f..42463e0 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml @@ -5,7 +5,7 @@ metadata: {{- include "annotations" . | nindent 4 }} helm.sh/hook: pre-install, pre-upgrade helm.sh/hook-delete-policy: before-hook-creation, hook-succeeded - helm.sh/hook-weight: "-1" + helm.sh/hook-weight: "-5" labels: {{- include "labels" . | nindent 4 }} name: {{ .Values.resourceNamePrefix }}-pre-install-service-account diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml index cd0093a..aa11825 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml @@ -6,7 +6,7 @@ metadata: {{- include "annotations" . | nindent 4 }} helm.sh/hook: pre-install, pre-upgrade, post-delete helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded - helm.sh/hook-weight: "-1" + helm.sh/hook-weight: "-3" labels: {{- include "labels" . | nindent 4 }} name: {{ include "globalResourceName" (dict "name" "hook-scc" "root" .) }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/secret.yaml b/charts/cloud-security/kubernetes-cluster/templates/secret.yaml index 5f7d8a8..f4d6a65 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/secret.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/secret.yaml @@ -1 +1 @@ -{{ include "apiKeyTokenSecret" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) }} \ No newline at end of file +{{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" .) }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml index 4f37b8f..d220797 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml @@ -34,7 +34,7 @@ spec: containers: - args: [ "--api-key-token-file-path", - "/var/run/secrets/application/apikeytoken", + {{ include "apiKeyTokenFilePath" . | quote }}, "--api-url", {{ .Values.apiUrl | quote }}, "--data-path", @@ -51,7 +51,7 @@ spec: name: {{ include "sensor.resourceNamePrefix" . }}-container {{- with .Values.sensor.pod.resources }} resources: - {{- toYaml . | nindent 12 }} + {{- toYaml . | nindent 12 }} {{- end }} securityContext: privileged: true @@ -59,9 +59,7 @@ spec: volumeMounts: - name: {{ include "sensor.resourceNamePrefix" . }}-data mountPath: {{ .Values.sensor.dataPath }} - - name: {{ .Values.resourceNamePrefix }}-secret - mountPath: "/var/run/secrets/application" - readOnly: true + {{- include "containerSecretsVolumeMount" . | nindent 12 }} hostPID: true imagePullSecrets: {{- with .Values.containerImage.pullSecrets }} @@ -82,7 +80,7 @@ spec: hostPath: path: {{ .Values.sensor.dataPath }} type: DirectoryOrCreate - {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 6 }} + {{- include "containerSecretsVolume" . | nindent 6 }} updateStrategy: rollingUpdate: maxSurge: 0 diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml index 967b07f..ffd5b61 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml @@ -37,7 +37,7 @@ spec: - args: [ "updater", "--api-key-token-file-path", - "/var/run/secrets/application/apikeytoken", + {{ include "apiKeyTokenFilePath" . | quote }}, "--api-url", {{ .Values.apiUrl | quote }}, "--application-version", @@ -71,11 +71,9 @@ spec: drop: - ALL runAsNonRoot: true - runAsUser: {{ .Values.runAsUser }} + runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} volumeMounts: - - name: {{ .Values.resourceNamePrefix }}-secret - mountPath: "/var/run/secrets/application" - readOnly: true + {{- include "containerSecretsVolumeMount" . | nindent 16 }} imagePullSecrets: {{- with .Values.containerImage.pullSecrets }} {{- toYaml . | nindent 12 }} @@ -91,6 +89,6 @@ spec: {{- toYaml . | nindent 12 }} {{- end }} volumes: - {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 12 }} + {{- include "containerSecretsVolume" . | nindent 12 }} ttlSecondsAfterFinished: 7200 schedule: "0 * * * *" \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml index b916da2..73c87ed 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml @@ -9,6 +9,22 @@ metadata: name: {{ include "updater.resourceNamePrefix" . }}-role namespace: {{ .Release.Namespace }} rules: - - apiGroups: ["*"] + - apiGroups: + - + - admissionregistration.k8s.io + - apiextensions.k8s.io + - apiregistration.k8s.io + - apps + - autoscaling + - batch + - discovery.k8s.io + - events.k8s.io + - extensions + - policy + - rbac.authorization.k8s.io + - storage.k8s.io resources: ["*"] - verbs: ["*"] \ No newline at end of file + verbs: ["*"] + - apiGroups: ["networking.k8s.io"] + resources: ["*"] + verbs: ["get", "list", "watch"] \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/values.schema.json b/charts/cloud-security/kubernetes-cluster/values.schema.json index f513da0..412399d 100644 --- a/charts/cloud-security/kubernetes-cluster/values.schema.json +++ b/charts/cloud-security/kubernetes-cluster/values.schema.json @@ -55,6 +55,19 @@ "properties": {}, "type": "object" }, + "containers": { + "properties": { + "securityContext": { + "properties": { + "runAsUser": { + "type": "integer" + } + }, + "type": "object" + } + }, + "type": "object" + }, "labels": { "properties": {}, "type": "object" @@ -145,6 +158,9 @@ }, "connector": { "properties": { + "clusterRoleExplicitPermissions": { + "type": "boolean" + }, "enabled": { "type": "boolean" }, @@ -156,6 +172,7 @@ } }, "required": [ + "clusterRoleExplicitPermissions", "enabled", "identity", "network" @@ -214,6 +231,19 @@ "properties": {}, "type": "object" }, + "containers": { + "properties": { + "securityContext": { + "properties": { + "runAsUser": { + "type": "integer" + } + }, + "type": "object" + } + }, + "type": "object" + }, "labels": { "properties": {}, "type": "object" diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index b694aec..dc07587 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -1,5 +1,9 @@ accountId: null admissionController: + certificateSecret: + enabled: true + name: null + volumeMountPath: "/var/run/secrets/certificates" containerImage: repository: cloud-security/kubernetes-cluster-admission-controller tag: null @@ -12,6 +16,9 @@ admissionController: pod: affinity: {} annotations: {} + containers: + securityContext: + runAsUser: 1000 labels: {} resources: {} tolerations: [] @@ -28,6 +35,7 @@ admissionController: apiKeyToken: "" apiUrl: "" connector: + clusterRoleExplicitPermissions: false enabled: true identity: true network: true @@ -38,10 +46,17 @@ containerImage: registryUsername: null repository: cloud-security/kubernetes-cluster-manager tag: null +containerSecrets: + apiKeyTokenName: null + enabled: true + volumeMountPath: "/var/run/secrets/application" name: null pod: affinity: {} annotations: {} + containers: + securityContext: + runAsUser: 1000 labels: {} resources: limits: @@ -52,7 +67,6 @@ pod: memory: "256Mi" tolerations: [] resourceNamePrefix: kubernetes-cluster -runAsUser: 1000 sensor: containerImage: repository: cloud-security/kubernetes-cluster-sensor From 786cbe8da0f0a959938a627115c8a8b2a8e62331 Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Tue, 29 Apr 2025 15:13:04 +0300 Subject: [PATCH 02/13] oc permissions --- .../templates/connector/cluster-role.yaml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml index 45f349c..4be1b2b 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml @@ -35,16 +35,40 @@ rules: - admissionregistration.k8s.io - apiextensions.k8s.io - apiregistration.k8s.io + - apiserver.openshift.io - apps + - apps.openshift.io + - authorization.openshift.io - autoscaling - batch + - build.openshift.io + - cloudcredential.openshift.io + - compliance.openshift.io + - config.openshift.io + - console.openshift.io - discovery.k8s.io - events.k8s.io - extensions + - image.openshift.io + - ingress.operator.openshift.io + - machine.openshift.io + - machineconfiguration.openshift.io + - metal3.io + - monitoring.coreos.com + - network.openshift.io - networking.k8s.io + - oauth.openshift.io + - operator.openshift.io - policy + - project.openshift.io + - quota.openshift.io - rbac.authorization.k8s.io + - route.openshift.io + - security.openshift.io - storage.k8s.io + - template.openshift.io + - tuned.openshift.io + - user.openshift.io resources: ["*"] verbs: ["get", "list", "watch"] {{- else }} From 55016fef5fc33b5552a5c187170790eeee9e5540 Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Wed, 30 Apr 2025 15:30:04 +0300 Subject: [PATCH 03/13] fix permission --- .../kubernetes-cluster/templates/connector/cluster-role.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml index 4be1b2b..f05719c 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml @@ -59,6 +59,7 @@ rules: - networking.k8s.io - oauth.openshift.io - operator.openshift.io + - operators.coreos.com - policy - project.openshift.io - quota.openshift.io From 47dc9e912550ff5207589777fb186a63adf869ca Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Sun, 4 May 2025 14:40:19 +0300 Subject: [PATCH 04/13] pod and container secContext --- .../kubernetes-cluster/templates/_helpers.tpl | 24 +++++++++++++++---- .../admission-controller/deployment.yaml | 14 ++++------- .../templates/connector/deployment.yaml | 12 +++------- .../templates/hook-post-delete-job.yaml | 12 +++------- .../templates/hook-pre-install-job.yaml | 12 +++------- .../templates/sensor/daemonset.yaml | 6 ++--- .../templates/updater/cronjob.yaml | 12 +++------- 7 files changed, 37 insertions(+), 55 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index a727b6b..76078c6 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -29,7 +29,13 @@ type: Opaque {{- end }} {{- end }} -{{- define "apiKeyTokenSecretName"}} +{{- define "containerEnvironmentVariables" -}} +env: + - name: SIL_LogFormat + value: Text +{{- end }} + +{{- define "apiKeyTokenSecretName" -}} {{- .Values.containerSecrets.apiKeyTokenName | default (print .Values.resourceNamePrefix "-secret" ) }} {{- end }} @@ -77,10 +83,13 @@ type: kubernetes.io/dockerconfigjson {{- end }} {{- end }} -{{- define "environmentVariables" -}} -env: - - name: SIL_LogFormat - value: Text +{{- define "containerSecurityContext" -}} +allowPrivilegeEscalation: false +capabilities: + drop: + - ALL +runAsNonRoot: true +runAsUser: {{ .securityContext.runAsUser }} {{- end }} {{- define "globalResourceName" -}} @@ -92,5 +101,10 @@ app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }} app.kubernetes.io/managed-by: {{ .Release.Service }} app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }} app.kubernetes.io/version: {{ .Chart.Version }} +helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} +{{- define "podSecurityContext" -}} +seccompProfile: + type: RuntimeDefault +{{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml index e8ba687..27fdbba 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml @@ -55,7 +55,7 @@ spec: "--webhook-server-port", {{ .Values.admissionController.webhook.port | quote }} ] - {{- include "environmentVariables" . | nindent 10 }} + {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "admissionController.containerImage" . }} imagePullPolicy: Always livenessProbe: @@ -88,13 +88,8 @@ spec: resources: {{- toYaml . | nindent 12 }} {{- end }} - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - runAsNonRoot: true - runAsUser: {{ .Values.admissionController.pod.containers.securityContext.runAsUser }} + securityContext: + {{- include "containerSecurityContext" (dict "securityContext" .Values.admissionController.pod.containers.securityContext) | nindent 12 }} volumeMounts: {{- if .Values.admissionController.certificateSecret.enabled }} - mountPath: {{ include "admissionController.certificateVolumeMountPath" .}} @@ -109,8 +104,7 @@ spec: - name: {{ .Values.resourceNamePrefix }}-image-pull-secret {{- end }} securityContext: - seccompProfile: - type: RuntimeDefault + {{- include "podSecurityContext" . }} serviceAccountName: {{ include "admissionController.resourceNamePrefix" . }}-service-account terminationGracePeriodSeconds: 60 {{- with .Values.admissionController.pod.tolerations }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml index 96c71cc..002f292 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml @@ -52,7 +52,7 @@ spec: {{ .Values.proxyUrl | quote }}, {{- end}} ] - {{- include "environmentVariables" . | nindent 10 }} + {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ include "connector.resourceNamePrefix" . }}-container @@ -61,12 +61,7 @@ spec: {{- toYaml . | nindent 12 }} {{- end }} securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - runAsNonRoot: true - runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} + {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 12 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 12 }} imagePullSecrets: @@ -76,8 +71,7 @@ spec: - name: {{ .Values.resourceNamePrefix }}-image-pull-secret {{- end }} securityContext: - seccompProfile: - type: RuntimeDefault + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "connector.resourceNamePrefix" . }}-service-account {{- with .Values.pod.tolerations }} tolerations: diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml index fd8f4de..2bdd098 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml @@ -39,7 +39,7 @@ spec: {{ .Values.proxyUrl | quote }}, {{- end }} ] - {{- include "environmentVariables" . | nindent 10 }} + {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ .Values.resourceNamePrefix }}-post-delete-container @@ -48,10 +48,7 @@ spec: {{- toYaml . | nindent 12 }} {{- end }} securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 12 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: @@ -62,10 +59,7 @@ spec: {{- end }} restartPolicy: Never securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} - seccompProfile: - type: RuntimeDefault + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ .Values.resourceNamePrefix }}-post-delete-service-account {{- with .Values.pod.tolerations }} tolerations: diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml index a5495d1..31d3b98 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml @@ -51,7 +51,7 @@ spec: {{ .Values.accountId | quote }} {{- end }} ] - {{- include "environmentVariables" . | nindent 10 }} + {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ .Values.resourceNamePrefix }}-pre-install-container @@ -60,10 +60,7 @@ spec: {{- toYaml . | nindent 12 }} {{- end }} securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL + {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 12 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: @@ -74,10 +71,7 @@ spec: {{- end }} restartPolicy: Never securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} - seccompProfile: - type: RuntimeDefault + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ .Values.resourceNamePrefix }}-pre-install-service-account {{- with .Values.pod.tolerations }} tolerations: diff --git a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml index d220797..dda56c3 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml @@ -45,7 +45,7 @@ spec: {{ .Values.proxyUrl | quote }}, {{- end}} ] - {{- include "environmentVariables" . | nindent 10 }} + {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "sensor.containerImage" . }} imagePullPolicy: Always name: {{ include "sensor.resourceNamePrefix" . }}-container @@ -67,9 +67,7 @@ spec: {{- else }} - name: {{ .Values.resourceNamePrefix }}-image-pull-secret {{- end }} - securityContext: - seccompProfile: - type: RuntimeDefault + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "sensor.resourceNamePrefix" . }}-service-account {{- with .Values.sensor.pod.tolerations }} tolerations: diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml index ffd5b61..9d0fb99 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml @@ -57,7 +57,7 @@ spec: {{ .Values.accountId | quote }} {{- end}} ] - {{- include "environmentVariables" . | nindent 14 }} + {{- include "containerEnvironmentVariables" . | nindent 14 }} image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ include "updater.resourceNamePrefix" . }}-container @@ -66,12 +66,7 @@ spec: {{- toYaml . | nindent 16 }} {{- end }} securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - runAsNonRoot: true - runAsUser: {{ .Values.pod.containers.securityContext.runAsUser }} + {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 16 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 16 }} imagePullSecrets: @@ -81,8 +76,7 @@ spec: - name: {{ .Values.resourceNamePrefix }}-image-pull-secret {{- end }} securityContext: - seccompProfile: - type: RuntimeDefault + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "updater.resourceNamePrefix" . }}-service-account {{- with .Values.pod.tolerations }} tolerations: From ed3a42c736995134b807a84c8ef4e10dea6d1964 Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Sun, 4 May 2025 17:14:50 +0300 Subject: [PATCH 05/13] small refactor --- .../kubernetes-cluster/templates/_helpers.tpl | 11 +++++++++++ .../templates/admission-controller/deployment.yaml | 8 ++------ .../templates/connector/deployment.yaml | 6 +----- .../templates/hook-post-delete-job.yaml | 8 ++------ .../templates/hook-pre-install-job.yaml | 6 +----- .../templates/sensor/daemonset.yaml | 9 +++------ .../kubernetes-cluster/templates/updater/cronjob.yaml | 10 +++------- 7 files changed, 23 insertions(+), 35 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index 76078c6..1263cf8 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -64,6 +64,17 @@ type: kubernetes.io/dockerconfigjson {{- end }} {{- end }} +{{- define "containerImagePullSecretNames" -}} +{{- if .root.Values.containerImage.pullSecrets }} + {{- toYaml .root.Values.containerImage.pullSecrets | nindent 0 }} +{{- else -}} + {{- if and .root.Values.containerImage.registryUsername .root.Values.containerImage.registryPassword -}} +- name: {{ .name | default (print .root.Values.resourceNamePrefix "-image-pull-secret") }} + {{- end }} +{{- end }} +{{- end }} + + {{- define "containerSecretsVolume" -}} {{- if .Values.containerSecrets.enabled -}} - name: {{ print .Values.resourceNamePrefix "-secret" }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml index 27fdbba..73893c2 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml @@ -98,13 +98,9 @@ spec: {{- end }} {{- include "containerSecretsVolumeMount" . | nindent 12 }} imagePullSecrets: - {{- with .Values.containerImage.pullSecrets }} - {{- toYaml . | nindent 8 }} - {{- else }} - - name: {{ .Values.resourceNamePrefix }}-image-pull-secret - {{- end }} + {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }} securityContext: - {{- include "podSecurityContext" . }} + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "admissionController.resourceNamePrefix" . }}-service-account terminationGracePeriodSeconds: 60 {{- with .Values.admissionController.pod.tolerations }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml index 002f292..7452622 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml @@ -65,11 +65,7 @@ spec: volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 12 }} imagePullSecrets: - {{- with .Values.containerImage.pullSecrets }} - {{- toYaml . | nindent 8 }} - {{- else }} - - name: {{ .Values.resourceNamePrefix }}-image-pull-secret - {{- end }} + {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }} securityContext: {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "connector.resourceNamePrefix" . }}-service-account diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml index 2bdd098..9902972 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml @@ -52,11 +52,7 @@ spec: volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: - {{- with .Values.containerImage.pullSecrets }} - {{- toYaml . | nindent 8 }} - {{- else }} - - name: {{ .Values.resourceNamePrefix }}-post-delete-image-pull-secret - {{- end }} + {{- include "containerImagePullSecretNames" (dict "name" (print .Values.resourceNamePrefix "-post-delete-image-pull-secret") "root" .) | nindent 8 }} restartPolicy: Never securityContext: {{- include "podSecurityContext" . | nindent 8 }} @@ -81,4 +77,4 @@ spec: "helm.sh/hook: post-delete" "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" "helm.sh/hook-weight: \"-10\"" }} -{{ include "containerImagePullSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" . "annotations" $containerImagePullSecretAnnotations) }} \ No newline at end of file +{{ include "containerImagePullSecret" (dict "name" (print .Values.resourceNamePrefix "-post-delete-image-pull-secret") "root" . "annotations" $containerImagePullSecretAnnotations) }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml index 31d3b98..04d1fb5 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml @@ -64,11 +64,7 @@ spec: volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: - {{- with .Values.containerImage.pullSecrets }} - {{- toYaml . | nindent 8 }} - {{- else }} - - name: {{ .Values.resourceNamePrefix }}-pre-install-image-pull-secret - {{- end }} + {{- include "containerImagePullSecretNames" (dict "name" (print .Values.resourceNamePrefix "-pre-install-image-pull-secret") "root" .) | nindent 8 }} restartPolicy: Never securityContext: {{- include "podSecurityContext" . | nindent 8 }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml index dda56c3..339557d 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml @@ -62,12 +62,9 @@ spec: {{- include "containerSecretsVolumeMount" . | nindent 12 }} hostPID: true imagePullSecrets: - {{- with .Values.containerImage.pullSecrets }} - {{- toYaml . | nindent 8 }} - {{- else }} - - name: {{ .Values.resourceNamePrefix }}-image-pull-secret - {{- end }} - {{- include "podSecurityContext" . | nindent 8 }} + {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }} + securityContext: + {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "sensor.resourceNamePrefix" . }}-service-account {{- with .Values.sensor.pod.tolerations }} tolerations: diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml index 9d0fb99..93d3ecf 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml @@ -29,7 +29,7 @@ spec: spec: {{- with .Values.pod.affinity }} affinity: - {{- toYaml . | nindent 14 }} + {{- toYaml . | nindent 12 }} {{- end }} automountServiceAccountToken: true restartPolicy: Never @@ -70,13 +70,9 @@ spec: volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 16 }} imagePullSecrets: - {{- with .Values.containerImage.pullSecrets }} - {{- toYaml . | nindent 12 }} - {{- else }} - - name: {{ .Values.resourceNamePrefix }}-image-pull-secret - {{- end }} + {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 12 }} securityContext: - {{- include "podSecurityContext" . | nindent 8 }} + {{- include "podSecurityContext" . | nindent 12 }} serviceAccountName: {{ include "updater.resourceNamePrefix" . }}-service-account {{- with .Values.pod.tolerations }} tolerations: From 1c1328a165e4b0b621dd21bb82c0c1554ad882eb Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Mon, 5 May 2025 02:21:05 +0300 Subject: [PATCH 06/13] AC certs options --- .../admission-controller/_helpers.tpl | 22 +- .../admission-controller/deployment.yaml | 18 +- .../validating-webhook-configuration.yaml | 23 +- .../kubernetes-cluster/values.schema.json | 218 +++++++++++++++--- .../kubernetes-cluster/values.yaml | 12 +- 5 files changed, 239 insertions(+), 54 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl index d0ae045..f1a3d2c 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl @@ -1,3 +1,7 @@ +{{- define "admissionController.caCertificateSecretName" -}} +{{ .Values.admissionController.caCertificate.secretName | default (printf "%s-ca-secret" (include "admissionController.resourceNamePrefix" .)) }} +{{- end }} + {{- define "admissionController.containerImage" -}} {{- print .Values.containerImage.registry "/" .Values.admissionController.containerImage.repository ":" (coalesce .Values.admissionController.containerImage.tag .Values.containerImage.tag | default .Chart.AppVersion)}} {{- end }} @@ -14,19 +18,17 @@ app.kubernetes.io/component: admission-controller {{- print .Values.resourceNamePrefix "-admission-controller" }} {{- end }} -{{- define "admissionController.certificateVolumeMountPath" -}} -{{ .Values.admissionController.certificateSecret.volumeMountPath -}} -{{- end }} - {{- define "admissionController.tls" -}} -{{- if .Values.admissionController.tls }} -{{- .Values.admissionController.tls | toYaml }} +{{- if .Values.admissionController.caCertificate.embeddedTls }} +{{- .Values.admissionController.caCertificate.embeddedTls | toYaml }} {{ else }} -{{- $serverCertificateAuthorityCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}} -{{- $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }} -{{- $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCertificateAuthorityCertificate -}} +{{ $serverCertificateAuthorityCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}} +{{ $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }} +{{ $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCertificateAuthorityCertificate -}} serverCertificateBase64: {{ $serverCertificate.Cert | b64enc }} serverCertificateAuthorityCertificateBase64: {{ $serverCertificateAuthorityCertificate.Cert | b64enc }} serverCertificateKeyBase64: {{ $serverCertificate.Key | b64enc }} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} + + diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml index 73893c2..4f043ba 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml @@ -51,7 +51,7 @@ spec: "--validating-admission-configuration-name", {{ include "admissionController.resourceNamePrefix" . }}-vwc, "--webhook-server-certificates-directory-path", - {{ include "admissionController.certificateVolumeMountPath" . | quote }}, + {{ .Values.admissionController.caCertificate.volumeMountPath | quote }}, "--webhook-server-port", {{ .Values.admissionController.webhook.port | quote }} ] @@ -91,9 +91,9 @@ spec: securityContext: {{- include "containerSecurityContext" (dict "securityContext" .Values.admissionController.pod.containers.securityContext) | nindent 12 }} volumeMounts: - {{- if .Values.admissionController.certificateSecret.enabled }} - - mountPath: {{ include "admissionController.certificateVolumeMountPath" .}} - name: {{ include "admissionController.resourceNamePrefix" . }}-secret + {{- if not .Values.admissionController.caCertificate.injectExternally }} + - mountPath: {{ .Values.admissionController.caCertificate.volumeMountPath }} + name: {{ include "admissionController.resourceNamePrefix" . }}-certificate-volume readOnly: true {{- end }} {{- include "containerSecretsVolumeMount" . | nindent 12 }} @@ -108,15 +108,11 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - {{- if .Values.admissionController.certificateSecret.enabled }} - - name: {{ include "admissionController.resourceNamePrefix" . }}-secret + {{- if not .Values.admissionController.caCertificate.injectExternally }} + - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate-volume secret: defaultMode: 0444 - {{- if .Values.admissionController.certificateSecret.name }} - secretName: {{ .Values.admissionController.certificateSecret.name }} - {{- else }} - secretName: {{ include "admissionController.resourceNamePrefix" . }}-secret - {{- end }} + secretName: {{ include "admissionController.caCertificateSecretName" . }} {{- end }} {{- include "containerSecretsVolume" . | nindent 8 }} {{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml index bb22f51..c27cb9e 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml @@ -1,24 +1,39 @@ {{- if .Values.admissionController.enabled }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ include "admissionController.resourceNamePrefix" . }}-vwc + annotations: + helm.sh/hook: pre-install,pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-5" +--- {{ $tls := include "admissionController.tls" . | fromYaml }} +{{- if or .Values.admissionController.caCertificate.createSelfSigned .Values.admissionController.caCertificate.embeddedTls }} apiVersion: v1 -kind: Secret +kind: Secret +type: kubernetes.io/tls metadata: annotations: {{- include "annotations" . | nindent 4 }} labels: {{- include "labels" . | nindent 4 }} {{- include "admissionController.labels" . | nindent 4 }} - name: {{ include "admissionController.resourceNamePrefix" . }}-secret + name: {{ include "admissionController.caCertificateSecretName" . }} namespace: {{ .Release.Namespace }} data: - tls.key: {{ $tls.serverCertificateKeyBase64 }} tls.crt: {{ $tls.serverCertificateBase64 }} + tls.key: {{ $tls.serverCertificateKeyBase64 }} +{{- end }} --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: annotations: {{- include "annotations" . | nindent 4 }} + {{- with .Values.admissionController.webhook.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }}}} labels: {{- include "labels" . | nindent 4 }} {{- include "admissionController.labels" . | nindent 4 }} @@ -28,7 +43,9 @@ webhooks: - v1 - v1beta1 clientConfig: + {{- if not .Values.admissionController.caCertificate.injectExternally }} caBundle: {{ $tls.serverCertificateAuthorityCertificateBase64 }} + {{- end }} service: name: {{ include "admissionController.resourceNamePrefix" . }}-service namespace: {{ .Release.Namespace }} diff --git a/charts/cloud-security/kubernetes-cluster/values.schema.json b/charts/cloud-security/kubernetes-cluster/values.schema.json index 412399d..2e9b255 100644 --- a/charts/cloud-security/kubernetes-cluster/values.schema.json +++ b/charts/cloud-security/kubernetes-cluster/values.schema.json @@ -10,6 +10,55 @@ }, "admissionController": { "properties": { + "caCertificate": { + "properties": { + "createSelfSigned": { + "type": "boolean" + }, + "embeddedTls": { + "properties": { + "serverCertificateAuthorityCertificateBase64": { + "type": [ + "null", + "string" + ] + }, + "serverCertificateBase64": { + "type": [ + "null", + "string" + ] + }, + "serverCertificateKeyBase64": { + "type": [ + "null", + "string" + ] + } + }, + "type": "object" + }, + "injectExternally": { + "type": "boolean" + }, + "secretName": { + "type": [ + "null", + "string" + ] + }, + "volumeMountPath": { + "type": "string" + } + }, + "required": [ + "createSelfSigned", + "embeddedTls", + "injectExternally", + "volumeMountPath" + ], + "type": "object" + }, "containerImage": { "properties": { "repository": { @@ -37,12 +86,18 @@ "type": "string" }, "networkPolicy": { - "enabled": { - "type": "boolean" - }, - "ingress": { - "type": "object" + "properties": { + "enabled": { + "type": "boolean" + }, + "ingress": { + "type": "object" + } }, + "required": [ + "enabled", + "ingress" + ], "type": "object" }, "pod": { @@ -80,6 +135,14 @@ "type": "array" } }, + "required": [ + "affinity", + "annotations", + "containers", + "labels", + "resources", + "tolerations" + ], "type": "object" }, "replicas": { @@ -108,20 +171,12 @@ ], "type": "object" }, - "tls": { - "serverCertificateAuthorityCertificateBase64": { - "type": "string" - }, - "serverCertificateBase64": { - "type": "string" - }, - "serverCertificateKeyBase64": { - "type": "string" - }, - "type": "object" - }, "webhook": { "properties": { + "annotations": { + "properties": {}, + "type": "object" + }, "failurePolicy": { "type": "string" }, @@ -133,17 +188,22 @@ } }, "required": [ + "annotations", "failurePolicy", - "port" + "port", + "timeoutSeconds" ], "type": "object" } }, "required": [ + "caCertificate", "containerImage", "enabled", "healthPort", "logLevel", + "networkPolicy", + "pod", "replicas", "strategy", "webhook" @@ -210,11 +270,33 @@ } }, "required": [ + "pullSecrets", "registry", "repository" ], "type": "object" }, + "containerSecrets": { + "properties": { + "apiKeyTokenName": { + "type": [ + "null", + "string" + ] + }, + "enabled": { + "type": "boolean" + }, + "volumeMountPath": { + "type": "string" + } + }, + "required": [ + "enabled", + "volumeMountPath" + ], + "type": "object" + }, "name": { "type": [ "null", @@ -249,21 +331,58 @@ "type": "object" }, "resources": { - "properties": {}, + "properties": { + "limits": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "required": [ + "cpu", + "memory" + ], + "type": "object" + }, + "requests": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "required": [ + "cpu", + "memory" + ], + "type": "object" + } + }, + "required": [ + "limits", + "requests" + ], "type": "object" }, "tolerations": { "type": "array" } }, + "required": [ + "affinity", + "annotations", + "containers", + "labels", + "resources", + "tolerations" + ], "type": "object" }, - "proxyUrl": { - "type": [ - "null", - "string" - ] - }, "resourceNamePrefix": { "type": "string" }, @@ -307,20 +426,63 @@ "type": "object" }, "resources": { - "properties": {}, + "properties": { + "limits": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "required": [ + "cpu", + "memory" + ], + "type": "object" + }, + "requests": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "required": [ + "cpu", + "memory" + ], + "type": "object" + } + }, + "required": [ + "limits", + "requests" + ], "type": "object" }, "tolerations": { "type": "array" } }, + "required": [ + "affinity", + "annotations", + "labels", + "resources", + "tolerations" + ], "type": "object" } }, "required": [ "containerImage", "dataPath", - "enabled" + "enabled", + "pod" ], "type": "object" } @@ -331,6 +493,8 @@ "apiUrl", "connector", "containerImage", + "containerSecrets", + "pod", "resourceNamePrefix", "sensor" ] diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index dc07587..eb49231 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -1,8 +1,13 @@ accountId: null admissionController: - certificateSecret: - enabled: true - name: null + caCertificate: + createSelfSigned: true + embeddedTls: + serverCertificateAuthorityCertificateBase64: null + serverCertificateBase64: null + serverCertificateKeyBase64: null + injectExternally: false + secretName: null volumeMountPath: "/var/run/secrets/certificates" containerImage: repository: cloud-security/kubernetes-cluster-admission-controller @@ -29,6 +34,7 @@ admissionController: maxUnavailable: 0 tls: {} webhook: + annotations: {} failurePolicy: Ignore port: 8443 timeoutSeconds: 3 From 6ec9591ed8c9f1bf0ea38ae75939cf050441a68e Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Mon, 5 May 2025 16:02:16 +0300 Subject: [PATCH 07/13] fixups --- .../kubernetes-cluster/templates/_helpers.tpl | 4 ++-- .../templates/admission-controller/_helpers.tpl | 6 +++--- .../templates/admission-controller/deployment.yaml | 8 ++++---- .../validating-webhook-configuration.yaml | 4 ++-- .../cloud-security/kubernetes-cluster/values.schema.json | 8 ++++---- charts/cloud-security/kubernetes-cluster/values.yaml | 4 ++-- 6 files changed, 17 insertions(+), 17 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index 1263cf8..2cc2025 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -76,7 +76,7 @@ type: kubernetes.io/dockerconfigjson {{- define "containerSecretsVolume" -}} -{{- if .Values.containerSecrets.enabled -}} +{{- if .Values.containerSecrets.createWithMount -}} - name: {{ print .Values.resourceNamePrefix "-secret" }} secret: items: @@ -87,7 +87,7 @@ type: kubernetes.io/dockerconfigjson {{- end }} {{- define "containerSecretsVolumeMount" -}} -{{- if .Values.containerSecrets.enabled -}} +{{- if .Values.containerSecrets.createWithMount -}} - mountPath: {{ .Values.containerSecrets.volumeMountPath | quote }} name: {{ print .Values.resourceNamePrefix "-secret" }} readOnly: true diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl index f1a3d2c..3fcc3c4 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl @@ -1,5 +1,5 @@ {{- define "admissionController.caCertificateSecretName" -}} -{{ .Values.admissionController.caCertificate.secretName | default (printf "%s-ca-secret" (include "admissionController.resourceNamePrefix" .)) }} +{{ .Values.admissionController.certificates.secretName | default (printf "%s-cert-secret" (include "admissionController.resourceNamePrefix" .)) }} {{- end }} {{- define "admissionController.containerImage" -}} @@ -19,8 +19,8 @@ app.kubernetes.io/component: admission-controller {{- end }} {{- define "admissionController.tls" -}} -{{- if .Values.admissionController.caCertificate.embeddedTls }} -{{- .Values.admissionController.caCertificate.embeddedTls | toYaml }} +{{- if .Values.admissionController.certificates.embeddedTls }} +{{- .Values.admissionController.certificates.embeddedTls | toYaml }} {{ else }} {{ $serverCertificateAuthorityCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}} {{ $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml index 4f043ba..e092aac 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml @@ -51,7 +51,7 @@ spec: "--validating-admission-configuration-name", {{ include "admissionController.resourceNamePrefix" . }}-vwc, "--webhook-server-certificates-directory-path", - {{ .Values.admissionController.caCertificate.volumeMountPath | quote }}, + {{ .Values.admissionController.certificates.volumeMountPath | quote }}, "--webhook-server-port", {{ .Values.admissionController.webhook.port | quote }} ] @@ -91,8 +91,8 @@ spec: securityContext: {{- include "containerSecurityContext" (dict "securityContext" .Values.admissionController.pod.containers.securityContext) | nindent 12 }} volumeMounts: - {{- if not .Values.admissionController.caCertificate.injectExternally }} - - mountPath: {{ .Values.admissionController.caCertificate.volumeMountPath }} + {{- if not .Values.admissionController.certificates.injectExternally }} + - mountPath: {{ .Values.admissionController.certificates.volumeMountPath }} name: {{ include "admissionController.resourceNamePrefix" . }}-certificate-volume readOnly: true {{- end }} @@ -108,7 +108,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - {{- if not .Values.admissionController.caCertificate.injectExternally }} + {{- if not .Values.admissionController.certificates.injectExternally }} - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate-volume secret: defaultMode: 0444 diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml index c27cb9e..37f9f06 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml @@ -9,7 +9,7 @@ metadata: helm.sh/hook-weight: "-5" --- {{ $tls := include "admissionController.tls" . | fromYaml }} -{{- if or .Values.admissionController.caCertificate.createSelfSigned .Values.admissionController.caCertificate.embeddedTls }} +{{- if not .Values.admissionController.certificates.injectExternally }} apiVersion: v1 kind: Secret type: kubernetes.io/tls @@ -43,7 +43,7 @@ webhooks: - v1 - v1beta1 clientConfig: - {{- if not .Values.admissionController.caCertificate.injectExternally }} + {{- if not .Values.admissionController.certificates.injectExternally }} caBundle: {{ $tls.serverCertificateAuthorityCertificateBase64 }} {{- end }} service: diff --git a/charts/cloud-security/kubernetes-cluster/values.schema.json b/charts/cloud-security/kubernetes-cluster/values.schema.json index 2e9b255..6c824c2 100644 --- a/charts/cloud-security/kubernetes-cluster/values.schema.json +++ b/charts/cloud-security/kubernetes-cluster/values.schema.json @@ -10,7 +10,7 @@ }, "admissionController": { "properties": { - "caCertificate": { + "certificates": { "properties": { "createSelfSigned": { "type": "boolean" @@ -197,7 +197,7 @@ } }, "required": [ - "caCertificate", + "certificates", "containerImage", "enabled", "healthPort", @@ -284,7 +284,7 @@ "string" ] }, - "enabled": { + "createWithMount": { "type": "boolean" }, "volumeMountPath": { @@ -292,7 +292,7 @@ } }, "required": [ - "enabled", + "createWithMount", "volumeMountPath" ], "type": "object" diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index eb49231..249170a 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -1,6 +1,6 @@ accountId: null admissionController: - caCertificate: + certificates: createSelfSigned: true embeddedTls: serverCertificateAuthorityCertificateBase64: null @@ -54,7 +54,7 @@ containerImage: tag: null containerSecrets: apiKeyTokenName: null - enabled: true + createWithMount: true volumeMountPath: "/var/run/secrets/application" name: null pod: From 456c28f8dafb22142a6f044348418b3cff1780af Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Mon, 5 May 2025 16:20:31 +0300 Subject: [PATCH 08/13] typo --- .../cloud-security/kubernetes-cluster/templates/_helpers.tpl | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index 2cc2025..5f3c335 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -8,8 +8,7 @@ meta.helm.sh/release-namespace: {{ .Release.Namespace }} {{- end }} {{- define "apiKeyTokenSecret" -}} -{{- if .root.Values.containerSecrets.enabled }} -{{- if not .root.Values.containerSecrets.apiKeyTokenName }} +{{- if and .root.Values.containerSecrets.createWithMount (not .root.Values.containerSecrets.apiKeyTokenName) }} apiVersion: v1 kind: Secret metadata: @@ -27,7 +26,6 @@ stringData: type: Opaque {{- end }} {{- end }} -{{- end }} {{- define "containerEnvironmentVariables" -}} env: From 954dd62729b7cd6c37d6fc6f08a09fe2221838a5 Mon Sep 17 00:00:00 2001 From: Or Nisan Date: Wed, 7 May 2025 13:46:23 +0300 Subject: [PATCH 09/13] CR fixes --- .../kubernetes-cluster/templates/_helpers.tpl | 14 ++-- .../admission-controller/_helpers.tpl | 18 ++--- .../admission-controller/deployment.yaml | 16 ++-- .../validating-webhook-configuration.yaml | 25 ++---- .../templates/connector/deployment.yaml | 26 +++---- .../templates/hook-post-delete-job.yaml | 15 ++-- .../templates/hook-pre-install-job.yaml | 46 ++++++----- .../kubernetes-cluster/templates/secret.yaml | 2 +- .../security-context-constraints.yaml | 4 +- .../templates/sensor/daemonset.yaml | 26 +++---- .../templates/updater/cronjob.yaml | 12 +-- .../kubernetes-cluster/values.schema.json | 77 +++++-------------- .../kubernetes-cluster/values.yaml | 14 +--- 13 files changed, 111 insertions(+), 184 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index 5f3c335..c4efb4a 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -8,7 +8,7 @@ meta.helm.sh/release-namespace: {{ .Release.Namespace }} {{- end }} {{- define "apiKeyTokenSecret" -}} -{{- if and .root.Values.containerSecrets.createWithMount (not .root.Values.containerSecrets.apiKeyTokenName) }} +{{- if and (not .root.Values.containerSecrets.injectExternally) (not .root.Values.containerSecrets.apiKeyTokenName) }} apiVersion: v1 kind: Secret metadata: @@ -27,16 +27,16 @@ type: Opaque {{- end }} {{- end }} +{{- define "apiKeyTokenSecretName" -}} +{{- .Values.containerSecrets.apiKeyTokenName | default (print .Values.resourceNamePrefix "-secret" ) }} +{{- end }} + {{- define "containerEnvironmentVariables" -}} env: - name: SIL_LogFormat value: Text {{- end }} -{{- define "apiKeyTokenSecretName" -}} -{{- .Values.containerSecrets.apiKeyTokenName | default (print .Values.resourceNamePrefix "-secret" ) }} -{{- end }} - {{- define "containerImage" -}} {{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}} {{- end }} @@ -74,7 +74,7 @@ type: kubernetes.io/dockerconfigjson {{- define "containerSecretsVolume" -}} -{{- if .Values.containerSecrets.createWithMount -}} +{{- if not .Values.containerSecrets.injectExternally -}} - name: {{ print .Values.resourceNamePrefix "-secret" }} secret: items: @@ -85,7 +85,7 @@ type: kubernetes.io/dockerconfigjson {{- end }} {{- define "containerSecretsVolumeMount" -}} -{{- if .Values.containerSecrets.createWithMount -}} +{{- if not .Values.containerSecrets.injectExternally -}} - mountPath: {{ .Values.containerSecrets.volumeMountPath | quote }} name: {{ print .Values.resourceNamePrefix "-secret" }} readOnly: true diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl index 3fcc3c4..5f4b240 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl @@ -1,5 +1,5 @@ -{{- define "admissionController.caCertificateSecretName" -}} -{{ .Values.admissionController.certificates.secretName | default (printf "%s-cert-secret" (include "admissionController.resourceNamePrefix" .)) }} +{{- define "admissionController.certificateSecretName" -}} +{{ include "admissionController.resourceNamePrefix" . }}-certificate-secret {{- end }} {{- define "admissionController.containerImage" -}} @@ -19,16 +19,10 @@ app.kubernetes.io/component: admission-controller {{- end }} {{- define "admissionController.tls" -}} -{{- if .Values.admissionController.certificates.embeddedTls }} -{{- .Values.admissionController.certificates.embeddedTls | toYaml }} -{{ else }} -{{ $serverCertificateAuthorityCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}} +{{ $serverCaCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}} {{ $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }} -{{ $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCertificateAuthorityCertificate -}} +{{ $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCaCertificate -}} +serverCaCertificateBase64: {{ $serverCaCertificate.Cert | b64enc }} serverCertificateBase64: {{ $serverCertificate.Cert | b64enc }} -serverCertificateAuthorityCertificateBase64: {{ $serverCertificateAuthorityCertificate.Cert | b64enc }} serverCertificateKeyBase64: {{ $serverCertificate.Key | b64enc }} -{{- end }} -{{- end }} - - +{{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml index e092aac..864f6db 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml @@ -47,11 +47,11 @@ spec: "--health-server-port", {{ .Values.admissionController.healthPort | quote }}, "--log-level", - "{{ .Values.admissionController.logLevel }}", + {{ .Values.admissionController.logLevel | quote }}, "--validating-admission-configuration-name", {{ include "admissionController.resourceNamePrefix" . }}-vwc, "--webhook-server-certificates-directory-path", - {{ .Values.admissionController.certificates.volumeMountPath | quote }}, + "/var/run/secrets/certificates", "--webhook-server-port", {{ .Values.admissionController.webhook.port | quote }} ] @@ -91,11 +91,9 @@ spec: securityContext: {{- include "containerSecurityContext" (dict "securityContext" .Values.admissionController.pod.containers.securityContext) | nindent 12 }} volumeMounts: - {{- if not .Values.admissionController.certificates.injectExternally }} - - mountPath: {{ .Values.admissionController.certificates.volumeMountPath }} - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate-volume + - mountPath: "/var/run/secrets/certificates" + name: {{ include "admissionController.resourceNamePrefix" . }}-certificate readOnly: true - {{- end }} {{- include "containerSecretsVolumeMount" . | nindent 12 }} imagePullSecrets: {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }} @@ -108,11 +106,9 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - {{- if not .Values.admissionController.certificates.injectExternally }} - - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate-volume + - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate secret: defaultMode: 0444 - secretName: {{ include "admissionController.caCertificateSecretName" . }} - {{- end }} + secretName: {{ include "admissionController.certificateSecretName" . }} {{- include "containerSecretsVolume" . | nindent 8 }} {{- end }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml index 37f9f06..e265ae2 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml @@ -1,17 +1,7 @@ {{- if .Values.admissionController.enabled }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: {{ include "admissionController.resourceNamePrefix" . }}-vwc - annotations: - helm.sh/hook: pre-install,pre-upgrade - helm.sh/hook-delete-policy: before-hook-creation - helm.sh/hook-weight: "-5" ---- {{ $tls := include "admissionController.tls" . | fromYaml }} -{{- if not .Values.admissionController.certificates.injectExternally }} apiVersion: v1 -kind: Secret +kind: Secret type: kubernetes.io/tls metadata: annotations: @@ -19,21 +9,20 @@ metadata: labels: {{- include "labels" . | nindent 4 }} {{- include "admissionController.labels" . | nindent 4 }} - name: {{ include "admissionController.caCertificateSecretName" . }} + name: {{ include "admissionController.certificateSecretName" . }} namespace: {{ .Release.Namespace }} data: tls.crt: {{ $tls.serverCertificateBase64 }} tls.key: {{ $tls.serverCertificateKeyBase64 }} -{{- end }} --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: annotations: + helm.sh/hook: pre-install,pre-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-5" {{- include "annotations" . | nindent 4 }} - {{- with .Values.admissionController.webhook.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }}}} labels: {{- include "labels" . | nindent 4 }} {{- include "admissionController.labels" . | nindent 4 }} @@ -43,9 +32,7 @@ webhooks: - v1 - v1beta1 clientConfig: - {{- if not .Values.admissionController.certificates.injectExternally }} - caBundle: {{ $tls.serverCertificateAuthorityCertificateBase64 }} - {{- end }} + caBundle: {{ $tls.serverCaCertificateBase64 }} service: name: {{ include "admissionController.resourceNamePrefix" . }}-service namespace: {{ .Release.Namespace }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml index 7452622..c923ed2 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml @@ -36,22 +36,22 @@ spec: automountServiceAccountToken: true containers: - args: [ - "connector", - "--api-key-token-file-path", + "connector", + "--api-key-token-file-path", {{ include "apiKeyTokenFilePath" . | quote }}, - "--api-url", + "--api-url", {{ .Values.apiUrl | quote }}, - {{- if .Values.connector.identity }} - "--identity", - {{- end}} - {{- if .Values.connector.network }} - "--network", - {{- end}} - {{- if .Values.proxyUrl }} - "--proxy-url", + {{- if .Values.connector.identity }} + "--identity", + {{- end }} + {{- if .Values.connector.network }} + "--network", + {{- end }} + {{- if .Values.proxyUrl }} + "--proxy-url", {{ .Values.proxyUrl | quote }}, - {{- end}} - ] + {{- end }} + ] {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} imagePullPolicy: Always diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml index 9902972..42543c8 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml @@ -29,16 +29,16 @@ spec: automountServiceAccountToken: true containers: - args: [ - "release-post-delete", - "--api-key-token-file-path", + "release-post-delete", + "--api-key-token-file-path", {{ include "apiKeyTokenFilePath" . | quote }}, - "--api-url", + "--api-url", {{ .Values.apiUrl | quote }}, - {{- if .Values.proxyUrl }} - "--proxy-url", + {{- if .Values.proxyUrl }} + "--proxy-url", {{ .Values.proxyUrl | quote }}, - {{- end }} - ] + {{- end }} + ] {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} imagePullPolicy: Always @@ -70,7 +70,6 @@ spec: "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" "helm.sh/hook-weight: \"-1\"" }} {{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" . "annotations" $apiKeyTokenSecretAnnotations) }} - --- {{ $containerImagePullSecretAnnotations := list diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml index 04d1fb5..4eb4eb1 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml @@ -29,28 +29,28 @@ spec: {{- end }} containers: - args: [ - "release-pre-install", - "--api-key-token-file-path", - {{ include "apiKeyTokenFilePath" . | quote }}, - "--api-url", - {{ .Values.apiUrl | quote }}, - "--application-version", - {{ .Chart.AppVersion | quote }}, - "--helm-release-name", - {{ print .Release.Namespace ":" .Release.Name | quote }}, - {{- if .Values.name }} - "--name", - {{ .Values.name | quote }}, - {{- end }} - {{- if .Values.proxyUrl }} - "--proxy-url", - {{ .Values.proxyUrl | quote }}, - {{- end }} - {{- if .Values.accountId }} - "--tenant-raw-id", - {{ .Values.accountId | quote }} - {{- end }} - ] + "release-pre-install", + "--api-key-token-file-path", + {{ include "apiKeyTokenFilePath" . | quote }}, + "--api-url", + {{ .Values.apiUrl | quote }}, + "--application-version", + {{ .Chart.AppVersion | quote }}, + "--helm-release-name", + {{ print .Release.Namespace ":" .Release.Name | quote }}, + {{- if .Values.name }} + "--name", + {{ .Values.name | quote }}, + {{- end }} + {{- if .Values.proxyUrl }} + "--proxy-url", + {{ .Values.proxyUrl | quote }}, + {{- end }} + {{- if .Values.accountId }} + "--tenant-raw-id", + {{ .Values.accountId | quote }} + {{- end }} + ] {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "containerImage" . }} imagePullPolicy: Always @@ -75,7 +75,6 @@ spec: {{- end }} volumes: {{- include "containerSecretsVolume" . | nindent 8 }} - --- {{ $apiKeyTokenSecretAnnotations := list @@ -83,7 +82,6 @@ spec: "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" "helm.sh/hook-weight: \"-2\"" }} {{ include "apiKeyTokenSecret" (dict "name" ( include "apiKeyTokenSecretName" .) "root" . "annotations" $apiKeyTokenSecretAnnotations) }} - --- {{ $containerImagePullSecretAnnotations := list diff --git a/charts/cloud-security/kubernetes-cluster/templates/secret.yaml b/charts/cloud-security/kubernetes-cluster/templates/secret.yaml index f4d6a65..a6a20c5 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/secret.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/secret.yaml @@ -1 +1 @@ -{{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" .) }} +{{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" .) }} \ No newline at end of file diff --git a/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml b/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml index 5199d1c..aa0df9a 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml @@ -16,10 +16,10 @@ seLinuxContext: users: {{- if .Values.admissionController.enabled }} - system:serviceaccount:{{ .Release.Namespace }}:{{ include "admissionController.resourceNamePrefix" . }}-service-account - {{- end}} + {{- end }} {{- if .Values.connector.enabled }} - system:serviceaccount:{{ .Release.Namespace }}:{{ include "connector.resourceNamePrefix" . }}-service-account - {{- end}} + {{- end }} - system:serviceaccount:{{ .Release.Namespace }}:{{ include "updater.resourceNamePrefix" . }}-service-account volumes: - csi diff --git a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml index 339557d..28afd0f 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml @@ -33,18 +33,18 @@ spec: automountServiceAccountToken: true containers: - args: [ - "--api-key-token-file-path", + "--api-key-token-file-path", {{ include "apiKeyTokenFilePath" . | quote }}, - "--api-url", + "--api-url", {{ .Values.apiUrl | quote }}, - "--data-path", + "--data-path", {{ .Values.sensor.dataPath | quote }}, - "--logs", - {{- if .Values.proxyUrl }} - "--proxy-url", + "--logs", + {{- if .Values.proxyUrl }} + "--proxy-url", {{ .Values.proxyUrl | quote }}, - {{- end}} - ] + {{- end }} + ] {{- include "containerEnvironmentVariables" . | nindent 10 }} image: {{ include "sensor.containerImage" . }} imagePullPolicy: Always @@ -63,7 +63,7 @@ spec: hostPID: true imagePullSecrets: {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }} - securityContext: + securityContext: {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ include "sensor.resourceNamePrefix" . }}-service-account {{- with .Values.sensor.pod.tolerations }} @@ -71,10 +71,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - - name: {{ include "sensor.resourceNamePrefix" . }}-data - hostPath: - path: {{ .Values.sensor.dataPath }} - type: DirectoryOrCreate + - name: {{ include "sensor.resourceNamePrefix" . }}-data + hostPath: + path: {{ .Values.sensor.dataPath }} + type: DirectoryOrCreate {{- include "containerSecretsVolume" . | nindent 6 }} updateStrategy: rollingUpdate: diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml index 93d3ecf..9c9ecea 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml @@ -44,18 +44,18 @@ spec: {{ .Chart.AppVersion | quote }}, "--helm-release-name", {{ print .Release.Namespace ":" .Release.Name | quote }}, - {{- if .Values.name }} + {{- if .Values.name }} "--name", {{ .Values.name | quote }}, - {{- end}} - {{- if .Values.proxyUrl }} + {{- end }} + {{- if .Values.proxyUrl }} "--proxy-url", {{ .Values.proxyUrl | quote }}, - {{- end}} - {{- if .Values.accountId }} + {{- end }} + {{- if .Values.accountId }} "--tenant-raw-id", {{ .Values.accountId | quote }} - {{- end}} + {{- end }} ] {{- include "containerEnvironmentVariables" . | nindent 14 }} image: {{ include "containerImage" . }} diff --git a/charts/cloud-security/kubernetes-cluster/values.schema.json b/charts/cloud-security/kubernetes-cluster/values.schema.json index 6c824c2..c5fe5cb 100644 --- a/charts/cloud-security/kubernetes-cluster/values.schema.json +++ b/charts/cloud-security/kubernetes-cluster/values.schema.json @@ -10,55 +10,6 @@ }, "admissionController": { "properties": { - "certificates": { - "properties": { - "createSelfSigned": { - "type": "boolean" - }, - "embeddedTls": { - "properties": { - "serverCertificateAuthorityCertificateBase64": { - "type": [ - "null", - "string" - ] - }, - "serverCertificateBase64": { - "type": [ - "null", - "string" - ] - }, - "serverCertificateKeyBase64": { - "type": [ - "null", - "string" - ] - } - }, - "type": "object" - }, - "injectExternally": { - "type": "boolean" - }, - "secretName": { - "type": [ - "null", - "string" - ] - }, - "volumeMountPath": { - "type": "string" - } - }, - "required": [ - "createSelfSigned", - "embeddedTls", - "injectExternally", - "volumeMountPath" - ], - "type": "object" - }, "containerImage": { "properties": { "repository": { @@ -118,9 +69,15 @@ "type": "integer" } }, + "required": [ + "runAsUser" + ], "type": "object" } }, + "required": [ + "securityContext" + ], "type": "object" }, "labels": { @@ -173,10 +130,6 @@ }, "webhook": { "properties": { - "annotations": { - "properties": {}, - "type": "object" - }, "failurePolicy": { "type": "string" }, @@ -188,7 +141,6 @@ } }, "required": [ - "annotations", "failurePolicy", "port", "timeoutSeconds" @@ -197,7 +149,6 @@ } }, "required": [ - "certificates", "containerImage", "enabled", "healthPort", @@ -284,7 +235,7 @@ "string" ] }, - "createWithMount": { + "injectExternally": { "type": "boolean" }, "volumeMountPath": { @@ -292,7 +243,7 @@ } }, "required": [ - "createWithMount", + "injectExternally", "volumeMountPath" ], "type": "object" @@ -321,9 +272,15 @@ "type": "integer" } }, + "required": [ + "runAsUser" + ], "type": "object" } }, + "required": [ + "securityContext" + ], "type": "object" }, "labels": { @@ -383,6 +340,12 @@ ], "type": "object" }, + "proxyUrl": { + "type": [ + "null", + "string" + ] + }, "resourceNamePrefix": { "type": "string" }, diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index 249170a..d0f2f0e 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -1,14 +1,5 @@ accountId: null admissionController: - certificates: - createSelfSigned: true - embeddedTls: - serverCertificateAuthorityCertificateBase64: null - serverCertificateBase64: null - serverCertificateKeyBase64: null - injectExternally: false - secretName: null - volumeMountPath: "/var/run/secrets/certificates" containerImage: repository: cloud-security/kubernetes-cluster-admission-controller tag: null @@ -32,9 +23,7 @@ admissionController: rollingUpdate: maxSurge: 1 maxUnavailable: 0 - tls: {} webhook: - annotations: {} failurePolicy: Ignore port: 8443 timeoutSeconds: 3 @@ -54,7 +43,7 @@ containerImage: tag: null containerSecrets: apiKeyTokenName: null - createWithMount: true + injectExternally: false volumeMountPath: "/var/run/secrets/application" name: null pod: @@ -72,6 +61,7 @@ pod: cpu: "100m" memory: "256Mi" tolerations: [] +proxyUrl: null resourceNamePrefix: kubernetes-cluster sensor: containerImage: From ec7b6102849d05a4514d1ef8434918d314b15cec Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Thu, 15 May 2025 12:04:13 +0300 Subject: [PATCH 10/13] pod properties per component --- .../templates/hook-post-delete-job.yaml | 12 +++---- .../templates/hook-pre-install-job.yaml | 12 +++---- .../templates/updater/cronjob.yaml | 12 +++---- .../kubernetes-cluster/values.yaml | 35 +++++++++++++++++++ 4 files changed, 53 insertions(+), 18 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml index 42543c8..eb3d1ae 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml @@ -14,15 +14,15 @@ spec: template: metadata: annotations: - {{- with .Values.pod.annotations }} + {{- with .Values.hooks.pod.annotations }} {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- with .Values.pod.labels }} + {{- with .Values.hooks.pod.labels }} {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.pod.affinity }} + {{- with .Values.hooks.pod.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} @@ -43,12 +43,12 @@ spec: image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ .Values.resourceNamePrefix }}-post-delete-container - {{- with .Values.pod.resources }} + {{- with .Values.hooks.pod.resources }} resources: {{- toYaml . | nindent 12 }} {{- end }} securityContext: - {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 12 }} + {{- include "containerSecurityContext" (dict "securityContext" .Values.hooks.pod.containers.securityContext) | nindent 12 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: @@ -57,7 +57,7 @@ spec: securityContext: {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ .Values.resourceNamePrefix }}-post-delete-service-account - {{- with .Values.pod.tolerations }} + {{- with .Values.hooks.pod.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml index 4eb4eb1..dad1e3c 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml @@ -15,15 +15,15 @@ spec: template: metadata: annotations: - {{- with .Values.pod.annotations }} + {{- with .Values.hooks.pod.annotations }} {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- with .Values.pod.labels }} + {{- with .Values.hooks.pod.labels }} {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.pod.affinity }} + {{- with .Values.hooks.pod.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} @@ -55,12 +55,12 @@ spec: image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ .Values.resourceNamePrefix }}-pre-install-container - {{- with .Values.pod.resources }} + {{- with .Values.hooks.pod.resources }} resources: {{- toYaml . | nindent 12 }} {{- end }} securityContext: - {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 12 }} + {{- include "containerSecurityContext" (dict "securityContext" .Values.hooks.pod.containers.securityContext) | nindent 12 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 10 }} imagePullSecrets: @@ -69,7 +69,7 @@ spec: securityContext: {{- include "podSecurityContext" . | nindent 8 }} serviceAccountName: {{ .Values.resourceNamePrefix }}-pre-install-service-account - {{- with .Values.pod.tolerations }} + {{- with .Values.hooks.pod.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml index 9c9ecea..655e107 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml @@ -17,17 +17,17 @@ spec: template: metadata: annotations: - {{- with .Values.pod.annotations }} + {{- with .Values.updater.pod.annotations }} {{- toYaml . | nindent 12 }} {{- end }} labels: {{- include "labels" . | nindent 12 }} {{- include "updater.labels" . | nindent 12 }} - {{- with .Values.pod.labels }} + {{- with .Values.updater.pod.labels }} {{- toYaml . | nindent 12 }} {{- end }} spec: - {{- with .Values.pod.affinity }} + {{- with .Values.updater.pod.affinity }} affinity: {{- toYaml . | nindent 12 }} {{- end }} @@ -61,12 +61,12 @@ spec: image: {{ include "containerImage" . }} imagePullPolicy: Always name: {{ include "updater.resourceNamePrefix" . }}-container - {{- with .Values.pod.resources }} + {{- with .Values.updater.pod.resources }} resources: {{- toYaml . | nindent 16 }} {{- end }} securityContext: - {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 16 }} + {{- include "containerSecurityContext" (dict "securityContext" .Values.updater.pod.containers.securityContext) | nindent 16 }} volumeMounts: {{- include "containerSecretsVolumeMount" . | nindent 16 }} imagePullSecrets: @@ -74,7 +74,7 @@ spec: securityContext: {{- include "podSecurityContext" . | nindent 12 }} serviceAccountName: {{ include "updater.resourceNamePrefix" . }}-service-account - {{- with .Values.pod.tolerations }} + {{- with .Values.updater.pod.tolerations }} tolerations: {{- toYaml . | nindent 12 }} {{- end }} diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index d0f2f0e..a19a3e6 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -34,6 +34,15 @@ connector: enabled: true identity: true network: true + pod: + affinity: {} + annotations: {} + containers: + securityContext: + runAsUser: 1000 + labels: {} + resources: {} + tolerations: [] containerImage: pullSecrets: [] registry: containers.tenable.com @@ -45,6 +54,16 @@ containerSecrets: apiKeyTokenName: null injectExternally: false volumeMountPath: "/var/run/secrets/application" +hooks: + pod: + affinity: {} + annotations: {} + containers: + securityContext: + runAsUser: 1000 + labels: {} + resources: {} + tolerations: [] name: null pod: affinity: {} @@ -81,3 +100,19 @@ sensor: cpu: "300m" memory: "256Mi" tolerations: [] +updater: + pod: + affinity: {} + annotations: {} + containers: + securityContext: + runAsUser: 1000 + labels: {} + resources: + limits: + cpu: "100m" + memory: "256Mi" + requests: + cpu: "100m" + memory: "256Mi" + tolerations: [] \ No newline at end of file From c38f1577a480b1abf36e2a90baf7d14c20b4ab60 Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Mon, 19 May 2025 02:30:18 +0300 Subject: [PATCH 11/13] connector permission addition --- .../kubernetes-cluster/templates/connector/cluster-role.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml index f05719c..09d145a 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml +++ b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml @@ -58,6 +58,7 @@ rules: - network.openshift.io - networking.k8s.io - oauth.openshift.io + - observability.openshift.io - operator.openshift.io - operators.coreos.com - policy From 14aae6c6c37884b153e2c73dc359da0deda94046 Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Tue, 20 May 2025 10:54:22 +0300 Subject: [PATCH 12/13] environment vars input --- .../kubernetes-cluster/templates/_helpers.tpl | 1 + .../kubernetes-cluster/values.schema.json | 19 +++++++++++++++++++ .../kubernetes-cluster/values.yaml | 1 + 3 files changed, 21 insertions(+) diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl index c4efb4a..972fc21 100644 --- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl +++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl @@ -33,6 +33,7 @@ type: Opaque {{- define "containerEnvironmentVariables" -}} env: +{{- include .Values.containerEnvironmentVariables | nindent 2 }} - name: SIL_LogFormat value: Text {{- end }} diff --git a/charts/cloud-security/kubernetes-cluster/values.schema.json b/charts/cloud-security/kubernetes-cluster/values.schema.json index c5fe5cb..059c309 100644 --- a/charts/cloud-security/kubernetes-cluster/values.schema.json +++ b/charts/cloud-security/kubernetes-cluster/values.schema.json @@ -227,6 +227,24 @@ ], "type": "object" }, + "containerEnvironmentVariables": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "name", + "value" + ] + } + }, "containerSecrets": { "properties": { "apiKeyTokenName": { @@ -456,6 +474,7 @@ "apiUrl", "connector", "containerImage", + "containerEnvironmentVariables", "containerSecrets", "pod", "resourceNamePrefix", diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index a19a3e6..67ab4ac 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -43,6 +43,7 @@ connector: labels: {} resources: {} tolerations: [] +containerEnvironmentVariables: [] containerImage: pullSecrets: [] registry: containers.tenable.com From 931f2af8f18eab0e7dadc03f72959d77847e228c Mon Sep 17 00:00:00 2001 From: Alex Plits Date: Wed, 4 Jun 2025 12:21:23 +0300 Subject: [PATCH 13/13] OOM fixup on some cluster configurations --- charts/cloud-security/kubernetes-cluster/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml index 67ab4ac..1990d73 100644 --- a/charts/cloud-security/kubernetes-cluster/values.yaml +++ b/charts/cloud-security/kubernetes-cluster/values.yaml @@ -76,10 +76,10 @@ pod: resources: limits: cpu: "100m" - memory: "256Mi" + memory: "512Mi" requests: cpu: "100m" - memory: "256Mi" + memory: "512Mi" tolerations: [] proxyUrl: null resourceNamePrefix: kubernetes-cluster @@ -112,8 +112,8 @@ updater: resources: limits: cpu: "100m" - memory: "256Mi" + memory: "512Mi" requests: cpu: "100m" - memory: "256Mi" + memory: "512Mi" tolerations: [] \ No newline at end of file