CS | KSPM | Restrictions option and Secrets manual mgmt

charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl

@@ -3,7 +3,12 @@ meta.helm.sh/release-name: {{ .Release.Name }}
 meta.helm.sh/release-namespace: {{ .Release.Namespace }}
 {{- end }}
 
+{{- define "apiKeyTokenFilePath" -}}
+{{ print (.Values.containerSecrets.volumeMountPath) "/apikeytoken" }}
+{{- end }}
+
 {{- define "apiKeyTokenSecret" -}}
+{{- if and (not .root.Values.containerSecrets.injectExternally) (not .root.Values.containerSecrets.apiKeyTokenName) }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -20,36 +25,21 @@ stringData:
   API_KEY_TOKEN: {{ .root.Values.apiKeyToken }}
 type: Opaque
 {{- end }}
-
-{{- define "apiKeyTokenVolume" -}}
-- name: {{ .name }}
-  secret:
-    secretName: {{ .name }}
-    items:
-    - key: API_KEY_TOKEN
-      path: apikeytoken
 {{- end }}
 
-{{- define "containerImage" -}}
-{{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}}
+{{- define "apiKeyTokenSecretName" -}}
+{{- .Values.containerSecrets.apiKeyTokenName | default (print .Values.resourceNamePrefix "-secret" ) }}
 {{- end }}
 
-{{- define "environmentVariables" -}}
+{{- define "containerEnvironmentVariables" -}}
 env:
+{{- include .Values.containerEnvironmentVariables | nindent 2 }}
   - name: SIL_LogFormat
     value: Text
 {{- end }}
 
-
-{{- define "globalResourceName" -}}
-{{- print "tenable" "-" .root.Values.resourceNamePrefix "-" .name "-" (trunc 8 (sha256sum (print .root.Release.Namespace ":" .root.Release.Name))) }}
-{{- end }}
-
-{{- define "labels" -}}
-app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }}
-app.kubernetes.io/version: {{ .Chart.Version }}
+{{- define "containerImage" -}}
+{{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}}
 {{- end }}
 
 {{- define "containerImagePullSecret" -}}
@@ -72,3 +62,59 @@ data:
 type: kubernetes.io/dockerconfigjson
 {{- end }}
 {{- end }}
+
+{{- define "containerImagePullSecretNames" -}}
+{{- if .root.Values.containerImage.pullSecrets }}
+  {{- toYaml .root.Values.containerImage.pullSecrets | nindent 0 }}
+{{- else -}}
+    {{- if and .root.Values.containerImage.registryUsername .root.Values.containerImage.registryPassword -}}
+- name: {{ .name | default (print .root.Values.resourceNamePrefix "-image-pull-secret") }}
+    {{- end }}
+{{- end }}
+{{- end }}
+
+
+{{- define "containerSecretsVolume" -}}
+{{- if not .Values.containerSecrets.injectExternally -}}
+- name: {{ print .Values.resourceNamePrefix "-secret" }}
+  secret:
+    items:
+    - key: API_KEY_TOKEN
+      path: apikeytoken
+    secretName: {{ include "apiKeyTokenSecretName" . }}
+{{- end }}
+{{- end }}
+
+{{- define "containerSecretsVolumeMount" -}}
+{{- if not .Values.containerSecrets.injectExternally -}}
+- mountPath: {{ .Values.containerSecrets.volumeMountPath | quote }}
+  name: {{ print .Values.resourceNamePrefix "-secret" }}
+  readOnly: true
+{{- end }}
+{{- end }}
+
+{{- define "containerSecurityContext" -}}
+allowPrivilegeEscalation: false
+capabilities:
+  drop:
+    - ALL
+runAsNonRoot: true
+runAsUser: {{ .securityContext.runAsUser }}
+{{- end }}
+
+{{- define "globalResourceName" -}}
+{{- print "tenable" "-" .root.Values.resourceNamePrefix "-" .name "-" (trunc 8 (sha256sum (print .root.Release.Namespace ":" .root.Release.Name))) }}
+{{- end }}
+
+{{- define "labels" -}}
+app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }}
+app.kubernetes.io/version: {{ .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "podSecurityContext" -}}
+seccompProfile:
+  type: RuntimeDefault
+{{- end }}

charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl

@@ -1,3 +1,7 @@
+{{- define "admissionController.certificateSecretName" -}}
+{{ include "admissionController.resourceNamePrefix" . }}-certificate-secret
+{{- end }}
+
 {{- define "admissionController.containerImage" -}}
 {{- print .Values.containerImage.registry "/" .Values.admissionController.containerImage.repository ":" (coalesce .Values.admissionController.containerImage.tag .Values.containerImage.tag | default .Chart.AppVersion)}}
 {{- end }}
@@ -15,14 +19,10 @@ app.kubernetes.io/component: admission-controller
 {{- end }}
 
 {{- define "admissionController.tls" -}}
-{{- if .Values.admissionController.tls }}
-{{- .Values.admissionController.tls | toYaml }}
-{{ else }}
-{{- $serverCertificateAuthorityCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}}
-{{- $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }}
-{{- $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCertificateAuthorityCertificate -}}
+{{ $serverCaCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}}
+{{ $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }}
+{{ $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCaCertificate -}}
+serverCaCertificateBase64: {{ $serverCaCertificate.Cert | b64enc }}
 serverCertificateBase64: {{ $serverCertificate.Cert | b64enc }}
-serverCertificateAuthorityCertificateBase64: {{ $serverCertificateAuthorityCertificate.Cert | b64enc }}
 serverCertificateKeyBase64: {{ $serverCertificate.Key | b64enc }}
-{{- end }}
 {{- end }}

charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml

@@ -41,21 +41,21 @@ spec:
       containers:
         - args: [
             "--api-key-token-file-path",
-            "/var/run/secrets/application/apikeytoken",
+            {{ include "apiKeyTokenFilePath" . | quote }},
             "--api-url",
             {{ .Values.apiUrl | quote }},
             "--health-server-port",
             {{ .Values.admissionController.healthPort | quote }},
             "--log-level",
-            "{{ .Values.admissionController.logLevel }}",
+            {{ .Values.admissionController.logLevel | quote }},
             "--validating-admission-configuration-name",
             {{ include "admissionController.resourceNamePrefix" . }}-vwc,
             "--webhook-server-certificates-directory-path",
             "/var/run/secrets/certificates",
             "--webhook-server-port",
             {{ .Values.admissionController.webhook.port | quote }}
           ]
-          {{- include "environmentVariables" . | nindent 10 }}
+          {{- include "containerEnvironmentVariables" . | nindent 10 }}
           image: {{ include "admissionController.containerImage" . }}
           imagePullPolicy: Always
           livenessProbe:
@@ -88,39 +88,27 @@ spec:
           resources:
         {{- toYaml . | nindent 12 }}
         {{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            runAsUser: {{ .Values.runAsUser }}
+          securityContext:  
+          {{- include "containerSecurityContext" (dict "securityContext" .Values.admissionController.pod.containers.securityContext) | nindent 12 }}
           volumeMounts:
             - mountPath: "/var/run/secrets/certificates"
-              name: {{ include "admissionController.resourceNamePrefix" . }}-secret
-              readOnly: true
-            - mountPath: "/var/run/secrets/application"
-              name: {{ .Values.resourceNamePrefix }}-secret
+              name: {{ include "admissionController.resourceNamePrefix" . }}-certificate
               readOnly: true
+            {{- include "containerSecretsVolumeMount" . | nindent 12 }}
       imagePullSecrets:
-        {{- with .Values.containerImage.pullSecrets }}
-          {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - name: {{ .Values.resourceNamePrefix }}-image-pull-secret
-        {{- end }}
+        {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }}
       securityContext:
-        seccompProfile:
-          type: RuntimeDefault
+        {{- include "podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "admissionController.resourceNamePrefix" . }}-service-account
       terminationGracePeriodSeconds: 60
       {{- with .Values.admissionController.pod.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-        - name: {{ include "admissionController.resourceNamePrefix" . }}-secret
+        - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate
           secret:
             defaultMode: 0444
-            secretName: {{ include "admissionController.resourceNamePrefix" . }}-secret
-      {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 8 }}
+            secretName: {{ include "admissionController.certificateSecretName" . }}
+        {{- include "containerSecretsVolume" . | nindent 8 }}
 {{- end }}

charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml

@@ -2,22 +2,26 @@
 {{ $tls := include "admissionController.tls" . | fromYaml }}
 apiVersion: v1
 kind: Secret
+type: kubernetes.io/tls
 metadata:
   annotations:
     {{- include "annotations" . | nindent 4 }}
   labels:
     {{- include "labels" . | nindent 4 }}
     {{- include "admissionController.labels" . | nindent 4 }}
-  name: {{ include "admissionController.resourceNamePrefix" . }}-secret
+  name: {{ include "admissionController.certificateSecretName" . }}
   namespace: {{ .Release.Namespace }}
 data:
-  tls.key: {{ $tls.serverCertificateKeyBase64 }}
   tls.crt: {{ $tls.serverCertificateBase64 }}
+  tls.key: {{ $tls.serverCertificateKeyBase64 }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-5"
     {{- include "annotations" . | nindent 4 }}
   labels:
     {{- include "labels" . | nindent 4 }}
@@ -28,7 +32,7 @@ webhooks:
   - v1
   - v1beta1
   clientConfig:
-    caBundle: {{ $tls.serverCertificateAuthorityCertificateBase64 }}
+    caBundle: {{ $tls.serverCaCertificateBase64 }}
     service:
       name: {{ include "admissionController.resourceNamePrefix" . }}-service
       namespace: {{ .Release.Namespace }}

charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml

@@ -9,7 +9,73 @@ metadata:
     {{- include "connector.labels" . | nindent 4 }}
   name: {{ include "connector.globalResourceName" (dict "name" "cr" "root" .) }}
 rules:
+  {{- if .Values.connector.clusterRoleExplicitPermissions }}
+  - apiGroups: [""]
+    resources:
+      - bindings
+      - componentstatuses
+      - configmaps
+      - endpoints
+      - events
+      - limitranges
+      - namespaces
+      - nodes
+      - nodes/status
+      - persistentvolumeclaims
+      - persistentvolumes
+      - pods
+      - podtemplates
+      - replicationcontrollers
+      - resourcequotas
+      - serviceaccounts
+      - services
+      - services/status
+    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - admissionregistration.k8s.io
+      - apiextensions.k8s.io
+      - apiregistration.k8s.io
+      - apiserver.openshift.io
+      - apps
+      - apps.openshift.io
+      - authorization.openshift.io
+      - autoscaling
+      - batch
+      - build.openshift.io
+      - cloudcredential.openshift.io
+      - compliance.openshift.io
+      - config.openshift.io
+      - console.openshift.io
+      - discovery.k8s.io
+      - events.k8s.io
+      - extensions
+      - image.openshift.io
+      - ingress.operator.openshift.io
+      - machine.openshift.io
+      - machineconfiguration.openshift.io
+      - metal3.io
+      - monitoring.coreos.com
+      - network.openshift.io
+      - networking.k8s.io
+      - oauth.openshift.io
+      - observability.openshift.io
+      - operator.openshift.io
+      - operators.coreos.com
+      - policy
+      - project.openshift.io
+      - quota.openshift.io
+      - rbac.authorization.k8s.io
+      - route.openshift.io
+      - security.openshift.io
+      - storage.k8s.io
+      - template.openshift.io
+      - tuned.openshift.io
+      - user.openshift.io
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  {{- else }}
   - apiGroups: ["*"]
     resources: ["*"]
     verbs: ["get", "list", "watch"]
+  {{- end }}
 {{- end }}