Skip to content
This repository was archived by the owner on Sep 15, 2022. It is now read-only.

Commit c5cde62

Browse files
author
David Wertenteil
authored
Merge pull request #114 from armosec/dev
Release v1.7.18
2 parents 6e26e98 + 8cafbe4 commit c5cde62

18 files changed

+184
-212
lines changed

‎README.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ helm upgrade --install armo armo/armo-cluster-components -n armo-system --creat
4343
| armoCollector.affinity | object | `{}` | Assign custom [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) rules to the StatefulSet |
4444
| armoCollector.enabled | bool | `true` | enable/disable the armoCollector |
4545
| armoCollector.env[0] | object | `{"name":"PRINT_REPORT","value":"false"}` | print in verbose mode (print all reported data) |
46-
| armoCollector.image.repository | string | `"quay.io/armosec/cluster-collector"` | [source code](https://github.com/armosec/k8s-armo-collector) (private repo) |
46+
| armoCollector.image.repository | string | `"quay.io/kubescape/kollector"` | [source code](https://github.com/kubescape/kollector) |
4747
| armoCollector.nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) |
4848
| armoCollector.volumes | object | `[]` | Additional volumes for the collector |
4949
| armoCollector.volumeMounts | object | `[]` | Additional volumeMounts for the collector |
@@ -65,31 +65,32 @@ helm upgrade --install armo armo/armo-cluster-components -n armo-system --creat
6565
| armoKubescapeScanScheduler.volumeMounts | object | `[]` | Additional volumeMounts for scan scheduler |
6666
| armoNotificationService.affinity | object | `{}` | Assign custom [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) rules to the deployment |
6767
| armoNotificationService.enabled | bool | `true` | enable/disable passing notifications from ARMO SaaS to the armo-web-socket microservice. The notifications are the onDemand scanning and the scanning schedule settings |
68-
| armoNotificationService.image.repository | string | `"quay.io/armosec/notification-server"` | [source code](https://github.com/armosec/capostman) (private repo) |
68+
| armoNotificationService.image.repository | string | `"quay.io/kubescape/gateway"` | [source code](https://github.com/kubescape/gateway) |
6969
| armoNotificationService.nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) |
7070
| armoNotificationService.volumes | object | `[]` | Additional volumes for the notification service |
7171
| armoNotificationService.volumeMounts | object | `[]` | Additional volumeMounts for the notification service |
72-
| armoScanScheduler.enabled | bool | `true` | enable/disable image vulnerability a schedule scan using a CronJob |
73-
| armoScanScheduler.image.repository | string | `"curlimages/curl"` | image: curlimages/curl |
74-
| armoScanScheduler.scanSchedule | string | `"0 0 * * *"` | scan schedule frequency |
75-
| armoScanScheduler.volumes | object | `[]` | Additional volumes for scan scheduler |
76-
| armoScanScheduler.volumeMounts | object | `[]` | Additional volumeMounts for scan scheduler |
7772
| armoVulnScanner.affinity | object | `{}` | Assign custom [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) rules to the deployment |
7873
| armoVulnScanner.enabled | bool | `true` | enable/disable image vulnerability scanning |
79-
| armoVulnScanner.image.repository | string | `"quay.io/armosec/images-vulnerabilities-scan"` | [source code](https://github.com/armosec/ca-vuln-scan) (private repo) |
74+
| armoVulnScanner.image.repository | string | `"quay.io/kubescape/kubevuln"` | [source code](https://github.com/kubescape/kubevuln) |
8075
| armoVulnScanner.nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) |
8176
| armoVulnScanner.volumes | object | `[]` | Additional volumes for the image vulnerability scanning |
8277
| armoVulnScanner.volumeMounts | object | `[]` | Additional volumeMounts for the image vulnerability scanning |
78+
| armoVulnScanScheduler.enabled | bool | `true` | enable/disable a image vulnerability scheduled scan using a CronJob |
79+
| armoVulnScanScheduler.image.repository | string | `"quay.io/armosec/http_request"` | [source code](https://github.com/armosec/http-request) (public repo) |
80+
| armoVulnScanScheduler.scanSchedule | string | `"0 0 * * *"` | scan schedule frequency |
81+
| armoVulnScanScheduler.volumes | object | `[]` | Additional volumes for scan scheduler |
82+
| armoVulnScanScheduler.volumeMounts | object | `[]` | Additional volumeMounts for scan scheduler |
8383
| armoWebsocket.affinity | object | `{}` | Assign custom [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) rules to the deployment |
8484
| armoWebsocket.enabled | bool | `true` | enable/disable kubescape and image vulnerability scanning |
85-
| armoWebsocket.image.repository | string | `"quay.io/armosec/action-trigger"` | [source code](https://github.com/armosec/k8s-ca-websocket) (private repo) |
85+
| armoWebsocket.image.repository | string | `"quay.io/kubescape/kontroller"` | [source code](https://github.com/kubescape/kontroller) |
8686
| armoWebsocket.nodeSelector | object | `{}` | [Node selector](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) |
8787
| armoWebsocket.volumes | object | `[]` | Additional volumes for the web socket |
8888
| armoWebsocket.volumeMounts | object | `[]` | Additional volumeMounts for the web socket |
8989
| armoKubescapeHostScanner.volumes | object | `[]` | Additional volumes for the host scanner |
9090
| armoKubescapeHostScanner.volumeMounts | object | `[]` | Additional volumeMounts for the host scanner |
9191
| aws_iam_role_arn | string | `nil` | AWS IAM arn role |
9292
| clientID | string | `""` | client ID, [read more](https://hub.armosec.io/docs/authentication) |
93+
| addRevisionLabel | bool | `true` | Add revision label to the components. This will insure the components will restart when updating the helm |
9394
| cloudRegion | string | `nil` | cloud region |
9495
| cloud_provider_engine | string | `nil` | cloud provider engine |
9596
| gkeProject | string | `nil` | GKE project |

‎charts/armo-components/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@ type: application
88
# This is the chart version. This version number should be incremented each time you make changes
99
# to the chart and its templates, including the app version.
1010
# Versions are expected to follow Semantic Versioning (https://semver.org/)
11-
version: 1.7.17
11+
version: 1.7.18
1212

1313
# This is the version number of the application being deployed. This version number should be
1414
# incremented each time you make changes to the application. Versions are not expected to
1515
# follow Semantic Versioning. They should reflect the version the application is using.
1616
# It is recommended to use it with quotes.
17-
appVersion: "v1.7.17"
17+
appVersion: "v1.7.18"
1818

1919
maintainers:
2020
- name: Ben Hirschberg

‎charts/armo-components/assets/armo-kubescape-cronjob-full.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ apiVersion: batch/v1
88
tier: {{ .Values.global.namespaceTier}}
99
armo.tier: "kubescape-scan"
1010
spec:
11-
schedule: "{{ .Values.armoScanScheduler.scanSchedule }}"
11+
schedule: "{{ .Values.armoKubescapeScanScheduler.scanSchedule }}"
1212
jobTemplate:
1313
spec:
1414
template:
@@ -26,10 +26,10 @@ apiVersion: batch/v1
2626
- -host={{ .Values.armoWebsocket.name }}:{{ .Values.armoWebsocket.service.port }}
2727
- -path=v1/triggerAction
2828
- -headers="Content-Type:application/json"
29-
- -path-body=/home/armo/request-body.json
29+
- -path-body=/home/ks/request-body.json
3030
volumeMounts:
3131
- name: "request-body-volume"
32-
mountPath: /home/armo/request-body.json
32+
mountPath: /home/ks/request-body.json
3333
subPath: request-body.json
3434
readOnly: true
3535
{{- if .Values.volumeMounts }}

‎charts/armo-components/assets/armo-registry-scan-cronjob-ful.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ apiVersion: batch/v1
2626
- -host={{ .Values.armoWebsocket.name }}:{{ .Values.armoWebsocket.service.port }}
2727
- -path=v1/triggerAction
2828
- -headers="Content-Type:application/json"
29-
- -path-body=/home/armo/request-body.json
29+
- -path-body=/home/ks/request-body.json
3030
volumeMounts:
3131
- name: "request-body-volume"
32-
mountPath: /home/armo/request-body.json
32+
mountPath: /home/ks/request-body.json
3333
subPath: request-body.json
3434
readOnly: true
3535
{{- if .Values.volumeMounts }}

‎charts/armo-components/assets/armo-vulnscan-cronjob-full.yaml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ apiVersion: batch/v1
88
tier: {{ .Values.global.namespaceTier}}
99
armo.tier: "vuln-scan"
1010
spec:
11-
schedule: "{{ .Values.armoScanScheduler.scanSchedule }}"
11+
schedule: "{{ .Values.armoVulnScanScheduler.scanSchedule }}"
1212
jobTemplate:
1313
spec:
1414
template:
@@ -26,18 +26,28 @@ apiVersion: batch/v1
2626
- -host={{ .Values.armoWebsocket.name }}:{{ .Values.armoWebsocket.service.port }}
2727
- -path=v1/triggerAction
2828
- -headers="Content-Type:application/json"
29-
- -path-body=/home/armo/request-body.json
29+
- -path-body=/home/ks/request-body.json
3030
volumeMounts:
3131
- name: "request-body-volume"
32-
mountPath: /home/armo/request-body.json
32+
mountPath: /home/ks/request-body.json
3333
subPath: request-body.json
3434
readOnly: true
35+
{{- if .Values.volumeMounts }}
36+
{{ toYaml .Values.volumeMounts | indent 18 }}
37+
{{- end }}
38+
{{- if .Values.armoVulnScanScheduler.volumeMounts }}
39+
{{ toYaml .Values.armoVulnScanScheduler.volumeMounts | indent 18 }}
40+
{{- end }}
3541
restartPolicy: Never
3642
automountServiceAccountToken: false
3743
volumes:
3844
- name: "request-body-volume" # placeholder
3945
configMap:
4046
name: {{ .Values.armoVulnScanScheduler.name }}
41-
42-
47+
{{- if .Values.volumes }}
48+
{{ toYaml .Values.volumes | indent 16 }}
49+
{{- end }}
50+
{{- if .Values.armoVulnScanScheduler.volumes }}
51+
{{ toYaml .Values.armoVulnScanScheduler.volumes | indent 16 }}
52+
{{- end }}
4353

‎charts/armo-components/templates/armo-collector-statefulset.yaml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,26 @@ spec:
2727
tier: {{ .Values.global.namespaceTier}}
2828
app: {{ .Values.armoCollector.name }}
2929
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
30+
{{- if .Values.addRevisionLabel }}
31+
helm.sh/revision: "{{ .Release.Revision }}"
32+
{{- end }}
3033
spec:
3134
{{- if .Values.imagePullSecrets }}
3235
imagePullSecrets:
3336
- name: {{ toYaml .Values.imagePullSecrets }}
3437
{{- end }}
3538
initContainers:
36-
- image: bitnami/kubectl:1.24
37-
name: disconnect-handle
39+
- image: quay.io/armosec/kubectl:1.24 # https://github.com/armosec/bitnami-docker-kubectl
40+
name: remove-old-deployments
3841
command:
3942
- bash
4043
args:
4144
- -c
4245
- set -xv; kubectl delete deployment armo-collector -n armo-system; dep_exist=$?; echo $dep_exist; while [ $dep_exist -eq 0 ]; do kubectl get deployment armo-collector -n armo-system; dep_exist=$?; echo $dep_exist; done
4346
resources:
4447
limits:
45-
cpu: 10m
46-
memory: 40Mi
48+
cpu: 20m
49+
memory: 100Mi
4750
requests:
4851
cpu: 10m
4952
memory: 40Mi
@@ -66,13 +69,18 @@ spec:
6669
env:
6770
- name: ACTIVATE_CVE_SCAN_ON_NEW_IMAGE_FEATURE
6871
value: "{{ .Values.triggerNewImageScan }}"
72+
- name: NAMESPACE
73+
valueFrom:
74+
fieldRef:
75+
fieldPath: metadata.namespace
6976
{{- range .Values.armoCollector.env }}
7077
- name: {{ .name }}
7178
value: "{{ .value }}"
7279
{{- end }}
7380
args:
74-
- -include-namespaces={{ .Values.armoNameSpace }}
75-
- 2>&1
81+
- -alsologtostderr
82+
- -v=4
83+
- 2>&1
7684
volumeMounts:
7785
- name: {{ .Values.global.beConfig }}
7886
mountPath: /etc/config

‎charts/armo-components/templates/armo-configmap.yaml‎

Lines changed: 14 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -11,37 +11,28 @@ metadata:
1111
data:
1212
clusterData: |
1313
{
14-
"ociImageURL": "",
15-
"notificationWSURL": "{{ .Values.armoNotificationService.name }}:{{ .Values.armoNotificationService.websocketService.port }}",
16-
"notificationRestURL": "{{ .Values.armoNotificationService.name }}:{{ .Values.armoNotificationService.httpService.port }}",
14+
"gatewayWebsocketURL": "{{ .Values.armoNotificationService.name }}:{{ .Values.armoNotificationService.websocketService.port }}",
15+
"gatewayRestURL": "{{ .Values.armoNotificationService.name }}:{{ .Values.armoNotificationService.httpService.port }}",
1716
"vulnScanURL": "{{ .Values.armoVulnScanner.name }}:{{ .Values.armoVulnScanner.service.port }}",
17+
"kubevulnURL": "{{ .Values.armoVulnScanner.name }}:{{ .Values.armoVulnScanner.service.port }}",
1818
"kubescapeURL": "{{ .Values.armoKubescape.name }}:{{ .Values.armoKubescape.service.port }}",
19-
"oracleURL": "",
2019
"triggerNewImageScan": "{{ .Values.armoTriggerNewImageScan }}",
20+
"accountID": "{{ .Values.accountGuid }}",
21+
"clusterName": "{{ regexReplaceAll "\\W+" .Values.clusterName "-" | lower }}",
2122
{{- if eq .Values.environment "dev" }}
2223
"backendOpenAPI": "{{ .Values.devBackendOpenAPI }}",
23-
"dashboard": "{{ .Values.devBackendOpenAPI }}",
24-
"eventReceiverREST": "{{ .Values.devEventReceiverHttpUrl }}",
25-
"postman": "wss://{{ .Values.devPostmanUrl }}",
26-
"eventReceiverWS": "{{ .Values.devK8sReportUrl }}",
27-
"masterNotificationServer": "wss://{{ .Values.devMasterNotificationService }}/v1/waitfornotification",
24+
"eventReceiverRestURL": "{{ .Values.devEventReceiverHttpUrl }}",
25+
"eventReceiverWebsocketURL": "{{ .Values.devK8sReportUrl }}",
26+
"rootGatewayURL": "wss://{{ .Values.devGateway }}/v1/waitfornotification"
2827
{{- else if eq .Values.environment "staging" }}
29-
"dashboard": "{{ .Values.stagingBackendOpenAPI }}",
3028
"backendOpenAPI": "{{ .Values.stagingBackendOpenAPI }}",
31-
"eventReceiverREST": "{{ .Values.stagingEventReceiverHttpUrl }}",
32-
"postman": "wss://{{ .Values.stagingPostmanUrl }}",
33-
"eventReceiverWS": "{{ .Values.stagingK8sReportUrl }}",
34-
"masterNotificationServer": "wss://{{ .Values.stagingMasterNotificationService }}/v1/waitfornotification",
29+
"eventReceiverRestURL": "{{ .Values.stagingEventReceiverHttpUrl }}",
30+
"eventReceiverWebsocketURL": "{{ .Values.stagingK8sReportUrl }}",
31+
"rootGatewayURL": "wss://{{ .Values.stagingGateway }}/v1/waitfornotification"
3532
{{- else }}
36-
"dashboard": "{{ .Values.backendOpenAPI }}",
37-
"eventReceiverREST": "{{ .Values.eventReceiverHttpUrl }}",
3833
"backendOpenAPI": "{{ .Values.backendOpenAPI }}",
39-
"postman": "wss://{{ .Values.postmanUrl }}",
40-
"eventReceiverWS": "{{ .Values.k8sReportUrl }}",
41-
"masterNotificationServer": "wss://{{ .Values.masterNotificationService }}/v1/waitfornotification",
34+
"eventReceiverRestURL": "{{ .Values.eventReceiverHttpUrl }}",
35+
"eventReceiverWebsocketURL": "{{ .Values.k8sReportUrl }}",
36+
"rootGatewayURL": "wss://{{ .Values.gateway }}/v1/waitfornotification"
4237
{{- end }}
43-
"portal": "",
44-
"customerGUID": "{{ .Values.accountGuid }}",
45-
"clusterGUID": "",
46-
"clusterName": "{{ regexReplaceAll "\\W+" .Values.clusterName "-" | lower }}"
4738
}

‎charts/armo-components/templates/armo-kubescape-configmap.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ metadata:
1010
app: {{ .Values.armoKubescape.name }}-config
1111
tier: {{ .Values.global.namespaceTier }}
1212
data:
13-
clusterName: {{ regexReplaceAll "\\W+" .Values.clusterName "-" | lower }} # deprecate
1413
config.json: |
1514
{
1615
"accountID": "{{ .Values.accountGuid }}",

‎charts/armo-components/templates/armo-kubescape-deployment.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ spec:
3030
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
3131
tier: {{ .Values.global.namespaceTier}}
3232
app: {{ .Values.armoKubescape.name }}
33+
{{- if .Values.addRevisionLabel }}
34+
helm.sh/revision: "{{ .Release.Revision }}"
35+
{{- end }}
3336
spec:
3437
containers:
3538
- name: kubescape
@@ -57,7 +60,9 @@ spec:
5760
- name: KS_DEFAULT_CONFIGMAP_NAME
5861
value: "{{ .Values.armoKubescape.name }}-config"
5962
- name: KS_DEFAULT_CONFIGMAP_NAMESPACE
60-
value: "{{ .Values.armoNameSpace }}"
63+
valueFrom:
64+
fieldRef:
65+
fieldPath: metadata.namespace
6166
- name: KS_ENABLE_HOST_SCANNER
6267
value: "{{ .Values.armoKubescape.enableHostScan }}"
6368
- name: KS_SUBMIT
@@ -90,10 +95,10 @@ spec:
9095
{{ toYaml .Values.armoKubescape.resources | indent 14 }}
9196
volumeMounts:
9297
- name: kubescape-config-volume
93-
mountPath: /home/armo/.kubescape/config.json
98+
mountPath: /home/ks/.kubescape/config.json
9499
subPath: config.json
95100
- name: host-scanner-definition
96-
mountPath: /home/armo/.kubescape/host-scanner.yaml
101+
mountPath: /home/ks/.kubescape/host-scanner.yaml
97102
subPath: host-scanner-yaml
98103
{{- if .Values.volumeMounts }}
99104
{{ toYaml .Values.volumeMounts | indent 8 }}

‎charts/armo-components/templates/armo-kubescapeScanScheduler-cronjob.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ spec:
3131
- -host={{ .Values.armoWebsocket.name }}:{{ .Values.armoWebsocket.service.port }}
3232
- -path=v1/triggerAction
3333
- -headers="Content-Type:application/json"
34-
- -path-body=/home/armo/request-body.json
34+
- -path-body=/home/ks/request-body.json
3535
volumeMounts:
3636
- name: {{ .Values.armoKubescapeScanScheduler.name }}
37-
mountPath: /home/armo/request-body.json
37+
mountPath: /home/ks/request-body.json
3838
subPath: request-body.json
3939
readOnly: true
4040
{{- if .Values.volumeMounts }}

0 commit comments

Comments
 (0)