Skip to content
This repository was archived by the owner on Sep 15, 2022. It is now read-only.

Commit 56c1318

Browse files
author
David Wertenteil
authored
Merge pull request #111 from dwertent/dev
Dev
2 parents 5cfe977 + ac28bc2 commit 56c1318

10 files changed

+88
-130
lines changed

‎README.md‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,6 @@ helm upgrade --install armo armo/armo-cluster-components -n armo-system --creat
6969
| armoNotificationService.nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) |
7070
| armoNotificationService.volumes | object | `[]` | Additional volumes for the notification service |
7171
| armoNotificationService.volumeMounts | object | `[]` | Additional volumeMounts for the notification service |
72-
| armoScanScheduler.enabled | bool | `true` | enable/disable image vulnerability a schedule scan using a CronJob |
73-
| armoScanScheduler.image.repository | string | `"curlimages/curl"` | image: curlimages/curl |
74-
| armoScanScheduler.scanSchedule | string | `"0 0 * * *"` | scan schedule frequency |
75-
| armoScanScheduler.volumes | object | `[]` | Additional volumes for scan scheduler |
76-
| armoScanScheduler.volumeMounts | object | `[]` | Additional volumeMounts for scan scheduler |
7772
| armoVulnScanner.affinity | object | `{}` | Assign custom [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) rules to the deployment |
7873
| armoVulnScanner.enabled | bool | `true` | enable/disable image vulnerability scanning |
7974
| armoVulnScanner.image.repository | string | `"quay.io/kubescape/kubevuln"` | [source code](https://github.com/kubescape/kubevuln) |

‎charts/armo-components/assets/armo-kubescape-cronjob-full.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ apiVersion: batch/v1
88
tier: {{ .Values.global.namespaceTier}}
99
armo.tier: "kubescape-scan"
1010
spec:
11-
schedule: "{{ .Values.armoScanScheduler.scanSchedule }}"
11+
schedule: "{{ .Values.armoKubescapeScanScheduler.scanSchedule }}"
1212
jobTemplate:
1313
spec:
1414
template:

‎charts/armo-components/assets/armo-vulnscan-cronjob-full.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ apiVersion: batch/v1
88
tier: {{ .Values.global.namespaceTier}}
99
armo.tier: "vuln-scan"
1010
spec:
11-
schedule: "{{ .Values.armoScanScheduler.scanSchedule }}"
11+
schedule: "{{ .Values.armoVulnScanScheduler.scanSchedule }}"
1212
jobTemplate:
1313
spec:
1414
template:

‎charts/armo-components/templates/armo-collector-statefulset.yaml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -35,21 +35,21 @@ spec:
3535
imagePullSecrets:
3636
- name: {{ toYaml .Values.imagePullSecrets }}
3737
{{- end }}
38-
# initContainers:
39-
# - image: bitnami/kubectl:1.24
40-
# name: disconnect-handle
41-
# command:
42-
# - bash
43-
# args:
44-
# - -c
45-
# - set -xv; kubectl delete deployment armo-collector -n armo-system; dep_exist=$?; echo $dep_exist; while [ $dep_exist -eq 0 ]; do kubectl get deployment armo-collector -n armo-system; dep_exist=$?; echo $dep_exist; done
46-
# resources:
47-
# limits:
48-
# cpu: 10m
49-
# memory: 40Mi
50-
# requests:
51-
# cpu: 10m
52-
# memory: 40Mi
38+
initContainers:
39+
- image: quay.io/armosec/kubectl
40+
name: disconnect-handle
41+
command:
42+
- bash
43+
args:
44+
- -c
45+
- set -xv; kubectl delete deployment armo-collector -n armo-system; dep_exist=$?; echo $dep_exist; while [ $dep_exist -eq 0 ]; do kubectl get deployment armo-collector -n armo-system; dep_exist=$?; echo $dep_exist; done
46+
resources:
47+
limits:
48+
cpu: 10m
49+
memory: 40Mi
50+
requests:
51+
cpu: 10m
52+
memory: 40Mi
5353
containers:
5454
- name: {{ .Values.armoCollector.name }}
5555
image: "{{ .Values.armoCollector.image.repository }}:{{ .Values.armoCollector.image.tag }}"

‎charts/armo-components/templates/armo-kubescape-configmap.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ metadata:
1010
app: {{ .Values.armoKubescape.name }}-config
1111
tier: {{ .Values.global.namespaceTier }}
1212
data:
13-
clusterName: {{ regexReplaceAll "\\W+" .Values.clusterName "-" | lower }} # deprecate
1413
config.json: |
1514
{
1615
"accountID": "{{ .Values.accountGuid }}",

‎charts/armo-components/templates/armo-scanScheduler-configmap.yaml‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎charts/armo-components/templates/armo-scanScheduler-cronjob.yaml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎charts/armo-components/templates/armo-vulnScanScheduler-configmap.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if and .Values.armoVulnScanScheduler.enabled .Values.armoKubescape.submit }}
2+
kind: ConfigMap
3+
apiVersion: v1
4+
metadata:
5+
name: {{ .Values.armoVulnScanScheduler.name }}
6+
namespace: {{ .Values.armoNameSpace }}
7+
labels:
8+
app: {{ .Values.armoVulnScanScheduler.name }}
9+
tier: {{ .Values.global.namespaceTier }}
10+
data:
11+
request-body.json: |-
12+
{"commands":[{"commandName":"scan","designators":[{"designatorType":"Attributes","attributes":{}}]}]}
13+
{{- end }}

‎charts/armo-components/templates/armo-vulnScanScheduler-cronjob.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if and .Values.armoVulnScanScheduler.enabled .Values.armoKubescape.submit }}
2+
{{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }}
3+
apiVersion: batch/v1
4+
{{- else }}
5+
apiVersion: batch/v1beta1
6+
{{- end }}
7+
kind: CronJob
8+
metadata:
9+
name: {{ .Values.armoVulnScanScheduler.name }}
10+
namespace: {{ .Values.armoNameSpace }}
11+
labels:
12+
app: {{ .Values.armoVulnScanScheduler.name }}
13+
tier: {{ .Values.global.namespaceTier}}
14+
armo.tier: "kubescape-scan"
15+
spec:
16+
schedule: "{{ .Values.armoVulnScanScheduler.scanSchedule }}"
17+
jobTemplate:
18+
spec:
19+
template:
20+
metadata:
21+
labels:
22+
armo.tier: "kubescape-scan"
23+
spec:
24+
containers:
25+
- name: {{ .Values.armoVulnScanScheduler.name }}
26+
image: "{{ .Values.armoVulnScanScheduler.image.repository }}:{{ .Values.armoVulnScanScheduler.image.tag }}"
27+
imagePullPolicy: {{ .Values.armoVulnScanScheduler.image.pullPolicy }}
28+
args:
29+
- -method=post
30+
- -scheme=http
31+
- -host={{ .Values.armoWebsocket.name }}:{{ .Values.armoWebsocket.service.port }}
32+
- -path=v1/triggerAction
33+
- -headers="Content-Type:application/json"
34+
- -path-body=/home/ks/request-body.json
35+
volumeMounts:
36+
- name: {{ .Values.armoVulnScanScheduler.name }}
37+
mountPath: /home/ks/request-body.json
38+
subPath: request-body.json
39+
readOnly: true
40+
{{- if .Values.volumeMounts }}
41+
{{ toYaml .Values.volumeMounts | indent 14 }}
42+
{{- end }}
43+
{{- if .Values.armoVulnScanScheduler.volumeMounts }}
44+
{{ toYaml .Values.armoVulnScanScheduler.volumeMounts | indent 14 }}
45+
{{- end }}
46+
restartPolicy: Never
47+
automountServiceAccountToken: false
48+
volumes:
49+
- name: {{ .Values.armoVulnScanScheduler.name }}
50+
configMap:
51+
name: {{ .Values.armoVulnScanScheduler.name }}
52+
{{- if .Values.volumes }}
53+
{{ toYaml .Values.volumes | indent 10 }}
54+
{{- end }}
55+
{{- if .Values.armoVulnScanScheduler.volumes }}
56+
{{ toYaml .Values.armoVulnScanScheduler.volumes | indent 10 }}
57+
{{- end }}
58+
{{- end }}

‎charts/armo-components/values.yaml‎

Lines changed: 0 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -72,42 +72,6 @@ global:
7272
armoServiceAccountName: armo-scanner-service-account
7373
armoKubescapeServiceAccountName: armo-kubescape-service-account
7474

75-
# image vulnerability scheduled scan using a CronJob
76-
armoScanScheduler:
77-
78-
# -- enable/disable image vulnerability a schedule scan using a CronJob
79-
enabled: true
80-
81-
# scan scheduler container name
82-
name: armo-scan-scheduler
83-
84-
# Frequency of running the scan
85-
# ┌───────────── minute (0 - 59)
86-
# │ ┌───────────── hour (0 - 23)
87-
# │ │ ┌───────────── day of the month (1 - 31)
88-
# │ │ │ ┌───────────── month (1 - 12)
89-
# │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
90-
# │ │ │ │ │ 7 is also Sunday on some systems)
91-
# │ │ │ │ │
92-
# │ │ │ │ │
93-
# * * * * *
94-
# -- scan schedule frequency
95-
scanSchedule: "0 0 * * *"
96-
97-
image:
98-
# -- image: curlimages/curl
99-
repository: curlimages/curl
100-
tag: latest
101-
pullPolicy: IfNotPresent
102-
103-
replicaCount: 1
104-
105-
# Additional volumes to be mounted on the scan scheduler
106-
volumes: []
107-
108-
# Additional volumeMounts to be mounted on the scan scheduler
109-
volumeMounts: []
110-
11175
# kubescape scheduled scan using a CronJob
11276
armoKubescapeScanScheduler:
11377

0 commit comments

Comments
 (0)