Skip to content
This repository was archived by the owner on Sep 15, 2022. It is now read-only.

Commit ffa10af

Browse files
author
David Wertenteil
authored
Merge pull request #70 from armosec/dev
update helm from dev after testing
2 parents 8e155a3 + 4471f76 commit ffa10af

16 files changed

+290
-13
lines changed

‎README.md‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# ARMO cluster components
22
ARMO Vulnerability Scanning
33

4-
![Version: 1.7.8](https://img.shields.io/badge/Version-1.7.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.7.8](https://img.shields.io/badge/AppVersion-v1.7.8-informational?style=flat-square)
4+
![Version: 1.7.9](https://img.shields.io/badge/Version-1.7.9-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.7.9](https://img.shields.io/badge/AppVersion-v1.7.9-informational?style=flat-square)
55

66
## [Docs](https://hub.armo.cloud/docs/installation-of-armo-in-cluster)
77

@@ -43,25 +43,41 @@ helm upgrade --install armo armo/armo-cluster-components -n armo-system --creat
4343
| armoCollector.enabled | bool | `true` | enable/disable the armoCollector |
4444
| armoCollector.env[0] | object | `{"name":"PRINT_REPORT","value":"false"}` | print in verbose mode (print all reported data) |
4545
| armoCollector.image.repository | string | `"quay.io/armosec/cluster-collector"` | [source code](https://github.com/armosec/k8s-armo-collector) (private repo) |
46+
| armoCollector.volumes | object | `[]` | Additional volumes for the collector |
47+
| armoCollector.volumeMounts | object | `[]` | Additional volumeMounts for the collector |
4648
| armoKubescape.downloadArtifacts | bool | `true` | download policies every scan, we recommend it should remain true, you should change to 'false' when running in an air-gapped environment or when scanning with high frequency (when running with Prometheus) |
4749
| armoKubescape.enableHostScan | bool | `true` | enable [host scanner feature](https://hub.armo.cloud/docs/host-sensor) |
4850
| armoKubescape.enabled | bool | `true` | enable/disable kubescape scanning |
4951
| armoKubescape.image.repository | string | `"quay.io/armosec/kubescape"` | [source code](https://github.com/armosec/kubescape/tree/master/httphandler) (public repo) |
5052
| armoKubescape.serviceMonitor.enabled | bool | `false` | enable/disable service monitor for prometheus (operator) integration |
5153
| armoKubescape.skipUpdateCheck | bool | `false` | skip check for a newer version |
5254
| armoKubescape.submit | bool | `true` | submit results to ARMO SaaS: https://portal.armo.cloud/ |
55+
| armoKubescape.volumes | object | `[]` | Additional volumes for Kubescape |
56+
| armoKubescape.volumeMounts | object | `[]` | Additional volumeMounts for Kubescape |
5357
| armoKubescapeScanScheduler.enabled | bool | `true` | enable/disable a kubescape scheduled scan using a CronJob |
5458
| armoKubescapeScanScheduler.image.repository | string | `"quay.io/armosec/http_request"` | [source code](https://github.com/armosec/http-request) (public repo) |
5559
| armoKubescapeScanScheduler.scanSchedule | string | `"0 0 * * *"` | scan schedule frequency |
60+
| armoKubescapeScanScheduler.volumes | object | `[]` | Additional volumes for scan scheduler |
61+
| armoKubescapeScanScheduler.volumeMounts | object | `[]` | Additional volumeMounts for scan scheduler |
5662
| armoNotificationService.enabled | bool | `true` | enable/disable passing notifications from ARMO SaaS to the armo-web-socket microservice. The notifications are the onDemand scanning and the scanning schedule settings |
5763
| armoNotificationService.image.repository | string | `"quay.io/armosec/notification-server"` | [source code](https://github.com/armosec/capostman) (private repo) |
64+
| armoNotificationService.volumes | object | `[]` | Additional volumes for the notification service |
65+
| armoNotificationService.volumeMounts | object | `[]` | Additional volumeMounts for the notification service |
5866
| armoScanScheduler.enabled | bool | `true` | enable/disable image vulnerability a schedule scan using a CronJob |
5967
| armoScanScheduler.image.repository | string | `"curlimages/curl"` | image: curlimages/curl |
6068
| armoScanScheduler.scanSchedule | string | `"0 0 * * *"` | scan schedule frequency |
69+
| armoKubescapeScanScheduler.volumes | object | `[]` | Additional volumes for scan scheduler |
70+
| armoKubescapeScanScheduler.volumeMounts | object | `[]` | Additional volumeMounts for scan scheduler |
6171
| armoVulnScanner.enabled | bool | `true` | enable/disable image vulnerability scanning |
6272
| armoVulnScanner.image.repository | string | `"quay.io/armosec/images-vulnerabilities-scan"` | [source code](https://github.com/armosec/ca-vuln-scan) (private repo) |
73+
| armoVulnScanner.volumes | object | `[]` | Additional volumes for the image vulnerability scanning |
74+
| armoVulnScanner.volumeMounts | object | `[]` | Additional volumeMounts for the image vulnerability scanning |
6375
| armoWebsocket.enabled | bool | `true` | enable/disable kubescape and image vulnerability scanning |
6476
| armoWebsocket.image.repository | string | `"quay.io/armosec/action-trigger"` | [source code](https://github.com/armosec/k8s-ca-websocket) (private repo) |
77+
| armoWebsocket.volumes | object | `[]` | Additional volumes for the web socket |
78+
| armoWebsocket.volumeMounts | object | `[]` | Additional volumeMounts for the web socket |
79+
| armoKubescapeHostScanner.volumes | object | `[]` | Additional volumes for the host scanner |
80+
| armoKubescapeHostScanner.volumeMounts | object | `[]` | Additional volumeMounts for the host scanner |
6581
| aws_iam_role_arn | string | `nil` | AWS IAM arn role |
6682
| clientID | string | `""` | client ID, [read more](https://hub.armo.cloud/docs/authentication) |
6783
| cloudRegion | string | `nil` | cloud region |
@@ -70,5 +86,7 @@ helm upgrade --install armo armo/armo-cluster-components -n armo-system --creat
7086
| gke_service_account | string | `nil` | GKE service account |
7187
| secretKey | string | `""` | secret key, [read more](https://hub.armo.cloud/docs/authentication) |
7288
| triggerNewImageScan | string | `"disable"` | enable/disable trigger image scan for new images |
89+
| volumes | object | `[]` | Additional volumes for all containers |
90+
| volumeMounts | object | `[]` | Additional volumeMounts for all containers |
7391

7492

‎charts/armo-components/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@ type: application
88
# This is the chart version. This version number should be incremented each time you make changes
99
# to the chart and its templates, including the app version.
1010
# Versions are expected to follow Semantic Versioning (https://semver.org/)
11-
version: 1.7.8
11+
version: 1.7.9
1212

1313
# This is the version number of the application being deployed. This version number should be
1414
# incremented each time you make changes to the application. Versions are not expected to
1515
# follow Semantic Versioning. They should reflect the version the application is using.
1616
# It is recommended to use it with quotes.
17-
appVersion: "v1.7.8"
17+
appVersion: "v1.7.9"
1818

1919
maintainers:
2020
- name: Ben Hirschberg

‎charts/armo-components/assets/armo-kubescape-cronjob-full.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,22 @@ apiVersion: batch/v1
3232
mountPath: /home/armo/request-body.json
3333
subPath: request-body.json
3434
readOnly: true
35+
{{- if .Values.volumeMounts }}
36+
{{ toYaml .Values.volumeMounts | indent 18 }}
37+
{{- end }}
38+
{{- if .Values.armoKubescapeScanScheduler.volumeMounts }}
39+
{{ toYaml .Values.armoKubescapeScanScheduler.volumeMounts | indent 18 }}
40+
{{- end }}
3541
restartPolicy: Never
3642
automountServiceAccountToken: false
3743
volumes:
3844
- name: "request-body-volume" # placeholder
3945
configMap:
4046
name: {{ .Values.armoKubescapeScanScheduler.name }}
41-
42-
47+
{{- if .Values.volumes }}
48+
{{ toYaml .Values.volumes | indent 16 }}
49+
{{- end }}
50+
{{- if .Values.armoKubescapeScanScheduler.volumes }}
51+
{{ toYaml .Values.armoKubescapeScanScheduler.volumes | indent 16 }}
52+
{{- end }}
4353

‎charts/armo-components/assets/armo-registry-scan-cronjob-ful.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
apiVersion: batch/v1
2+
kind: CronJob
3+
metadata:
4+
name: {{ .Values.armoRegistryScanScheduler.name }}
5+
namespace: {{ .Values.armoNameSpace }}
6+
labels:
7+
app: {{ .Values.armoRegistryScanScheduler.name }}
8+
tier: {{ .Values.global.namespaceTier}}
9+
armo.tier: "registry-scan"
10+
spec:
11+
schedule: "{{ .Values.armoRegistryScanScheduler.scanSchedule }}"
12+
jobTemplate:
13+
spec:
14+
template:
15+
metadata:
16+
labels:
17+
armo.tier: "registry-scan"
18+
spec:
19+
containers:
20+
- name: {{ .Values.armoRegistryScanScheduler.name }}
21+
image: "{{ .Values.armoRegistryScanScheduler.image.repository }}:{{ .Values.armoRegistryScanScheduler.image.tag }}"
22+
imagePullPolicy: {{ .Values.armoRegistryScanScheduler.image.pullPolicy }}
23+
args:
24+
- -method=post
25+
- -scheme=http
26+
- -host={{ .Values.armoWebsocket.name }}:{{ .Values.armoWebsocket.service.port }}
27+
- -path=v1/triggerAction
28+
- -headers="Content-Type:application/json"
29+
- -path-body=/home/armo/request-body.json
30+
volumeMounts:
31+
- name: "request-body-volume"
32+
mountPath: /home/armo/request-body.json
33+
subPath: request-body.json
34+
readOnly: true
35+
{{- if .Values.volumeMounts }}
36+
{{ toYaml .Values.volumeMounts | indent 18 }}
37+
{{- end }}
38+
{{- if .Values.armoRegistryScanScheduler.volumeMounts }}
39+
{{ toYaml .Values.armoRegistryScanScheduler.volumeMounts | indent 18 }}
40+
{{- end }}
41+
restartPolicy: Never
42+
automountServiceAccountToken: false
43+
volumes:
44+
- name: "request-body-volume" # placeholder
45+
configMap:
46+
name: {{ .Values.armoRegistryScanScheduler.name }}
47+
{{- if .Values.volumes }}
48+
{{ toYaml .Values.volumes | indent 16 }}
49+
{{- end }}
50+
{{- if .Values.armoRegistryScanScheduler.volumes }}
51+
{{ toYaml .Values.armoRegistryScanScheduler.volumes | indent 16 }}
52+
{{- end }}
53+

‎charts/armo-components/assets/host-scanner-definition.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ spec:
5353
volumeMounts:
5454
- mountPath: /host_fs
5555
name: host-filesystem
56+
{{- if .Values.volumeMounts }}
57+
{{ toYaml .Values.volumeMounts | indent 8 }}
58+
{{- end }}
59+
{{- if .Values.armoKubescapeHostScanner.volumeMounts }}
60+
{{ toYaml .Values.armoKubescapeHostScanner.volumeMounts | indent 8 }}
61+
{{- end }}
5662
readinessProbe:
5763
httpGet:
5864
path: /kernelVersion
@@ -67,6 +73,12 @@ spec:
6773
path: /
6874
type: Directory
6975
name: host-filesystem
76+
{{- if .Values.volumeMounts }}
77+
{{ toYaml .Values.volumes | indent 6 }}
78+
{{- end }}
79+
{{- if .Values.armoKubescapeHostScanner.volumes }}
80+
{{ toYaml .Values.armoKubescapeHostScanner.volumes | indent 6 }}
81+
{{- end }}
7082
hostNetwork: true
7183
hostPID: true
7284
hostIPC: true

‎charts/armo-components/templates/armo-collector-deployment.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,25 @@ spec:
6060
- name: {{ .Values.global.beConfig }}
6161
mountPath: /etc/config
6262
readOnly: true
63+
{{- if .Values.volumeMounts }}
64+
{{ toYaml .Values.volumeMounts | indent 12 }}
65+
{{- end }}
66+
{{- if .Values.armoCollector.volumeMounts }}
67+
{{ toYaml .Values.armoCollector.volumeMounts | indent 12 }}
68+
{{- end }}
6369
volumes:
6470
- name: {{ .Values.global.beConfig }}
6571
configMap:
6672
name: {{ .Values.global.beConfig }}
6773
items:
6874
- key: "clusterData"
6975
path: "clusterData.json"
76+
{{- if .Values.volumes }}
77+
{{ toYaml .Values.volumes | indent 8 }}
78+
{{- end }}
79+
{{- if .Values.armoCollector.volumes }}
80+
{{ toYaml .Values.armoCollector.volumes | indent 8 }}
81+
{{- end }}
7082
serviceAccountName: {{ .Values.global.armoServiceAccountName }}
7183
automountServiceAccountToken: true
7284
{{- with .Values.nodeSelector }}

‎charts/armo-components/templates/armo-kubescape-deployment.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,12 @@ spec:
8989
- name: host-scanner-definition
9090
mountPath: /home/armo/.kubescape/host-scanner.yaml
9191
subPath: host-scanner-yaml
92+
{{- if .Values.volumeMounts }}
93+
{{ toYaml .Values.volumeMounts | indent 8 }}
94+
{{- end }}
95+
{{- if .Values.armoKubescape.volumeMounts }}
96+
{{ toYaml .Values.armoKubescape.volumeMounts | indent 8 }}
97+
{{- end }}
9298
serviceAccountName: {{ .Values.global.armoKubescapeServiceAccountName }}
9399
automountServiceAccountToken: true
94100
volumes:
@@ -98,4 +104,10 @@ spec:
98104
- name: host-scanner-definition
99105
configMap:
100106
name: host-scanner-definition
107+
{{- if .Values.volumes }}
108+
{{ toYaml .Values.volumes | indent 6 }}
109+
{{- end }}
110+
{{- if .Values.armoKubescape.volumes }}
111+
{{ toYaml .Values.armoKubescape.volumes | indent 6 }}
112+
{{- end }}
101113
{{- end }}

‎charts/armo-components/templates/armo-kubescape-host-scanner-definition-config-map.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ metadata:
88
tier: {{ .Values.global.namespaceTier }}
99
data:
1010
host-scanner-yaml: |-
11-
{{ .Files.Get "assets/host-scanner-definition.yaml" | indent 6 }}
11+
{{ tpl (.Files.Get "assets/host-scanner-definition.yaml") . | indent 4}}

‎charts/armo-components/templates/armo-kubescape-servicemonitor.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@ apiVersion: monitoring.coreos.com/v1
33
kind: ServiceMonitor
44
metadata:
55
name: {{ .Values.armoKubescape.name }}-monitor
6-
{{- if .Values.armoKubescape.serviceMonitor.namespace }}
7-
namespace: {{ .Values.armoKubescape.serviceMonitor.namespace }}
8-
{{- end }}
6+
namespace: {{ .Values.armoKubescape.serviceMonitor.namespace | default .Values.armoNameSpace }}
97
labels:
108
app: {{ .Values.armoKubescape.name }}
119
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

‎charts/armo-components/templates/armo-kubescapeScanScheduler-cronjob.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,22 @@ spec:
3737
mountPath: /home/armo/request-body.json
3838
subPath: request-body.json
3939
readOnly: true
40+
{{- if .Values.volumeMounts }}
41+
{{ toYaml .Values.volumeMounts | indent 14 }}
42+
{{- end }}
43+
{{- if .Values.armoKubescapeScanScheduler.volumeMounts }}
44+
{{ toYaml .Values.armoKubescapeScanScheduler.volumeMounts | indent 14 }}
45+
{{- end }}
4046
restartPolicy: Never
4147
automountServiceAccountToken: false
4248
volumes:
4349
- name: {{ .Values.armoKubescapeScanScheduler.name }}
4450
configMap:
4551
name: {{ .Values.armoKubescapeScanScheduler.name }}
52+
{{- if .Values.volumes }}
53+
{{ toYaml .Values.volumes | indent 10 }}
54+
{{- end }}
55+
{{- if .Values.armoKubescapeScanScheduler.volumes }}
56+
{{ toYaml .Values.armoKubescapeScanScheduler.volumes | indent 10 }}
57+
{{- end }}
4658
{{- end }}

0 commit comments

Comments
 (0)