Skip to content

Commit cd41220

Browse files
venkateshjayagopalselvamt94
venkateshjayagopal
authored and
selvamt94
committed
NVSHAS-10047 Add RBAC & CRD schema to helm chart for supporting response rules
1 parent 0a19a45 commit cd41220

File tree

5 files changed

+488
-5
lines changed

5 files changed

+488
-5
lines changed

‎charts/core/templates/crd-role-least.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,63 @@ userNames:
345345

346346
---
347347

348+
# ClusterRole for NeuVector to manage response rules
349+
{{- if $oc3 }}
350+
apiVersion: authorization.openshift.io/v1
351+
{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
352+
apiVersion: rbac.authorization.k8s.io/v1
353+
{{- else }}
354+
apiVersion: v1
355+
{{- end }}
356+
kind: ClusterRole
357+
metadata:
358+
name: neuvector-binding-nvresponserulesecurityrules
359+
labels:
360+
chart: {{ template "neuvector.chart" . }}
361+
release: {{ .Release.Name }}
362+
rules:
363+
- apiGroups:
364+
- neuvector.com
365+
resources:
366+
- nvresponserulesecurityrules
367+
verbs:
368+
- get
369+
- list
370+
- delete
371+
372+
---
373+
374+
# ClusterRoleBinding for NeuVector to manage response rules
375+
{{- if $oc3 }}
376+
apiVersion: authorization.openshift.io/v1
377+
{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
378+
apiVersion: rbac.authorization.k8s.io/v1
379+
{{- else }}
380+
apiVersion: v1
381+
{{- end }}
382+
kind: ClusterRoleBinding
383+
metadata:
384+
name: neuvector-binding-nvresponserulesecurityrules
385+
labels:
386+
chart: {{ template "neuvector.chart" . }}
387+
release: {{ .Release.Name }}
388+
roleRef:
389+
{{- if not $oc3 }}
390+
apiGroup: rbac.authorization.k8s.io
391+
kind: ClusterRole
392+
{{- end }}
393+
name: neuvector-binding-nvresponserulesecurityrules
394+
subjects:
395+
- kind: ServiceAccount
396+
name: controller
397+
namespace: {{ .Release.Namespace }}
398+
{{- if $oc3 }}
399+
userNames:
400+
- system:serviceaccount:{{ .Release.Namespace }}:controller
401+
{{- end }}
402+
403+
---
404+
348405
# ClusterRole for NeuVector to manage vulnerability CRD profiles
349406
{{- if $oc3 }}
350407
apiVersion: authorization.openshift.io/v1

‎charts/core/templates/crd-role.yaml‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,63 @@ userNames:
402402

403403
---
404404

405+
# ClusterRole for NeuVector to manage response rules
406+
{{- if $oc3 }}
407+
apiVersion: authorization.openshift.io/v1
408+
{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
409+
apiVersion: rbac.authorization.k8s.io/v1
410+
{{- else }}
411+
apiVersion: v1
412+
{{- end }}
413+
kind: ClusterRole
414+
metadata:
415+
name: neuvector-binding-nvresponserulesecurityrules
416+
labels:
417+
chart: {{ template "neuvector.chart" . }}
418+
release: {{ .Release.Name }}
419+
rules:
420+
- apiGroups:
421+
- neuvector.com
422+
resources:
423+
- nvresponserulesecurityrules
424+
verbs:
425+
- get
426+
- list
427+
- delete
428+
429+
---
430+
431+
# ClusterRoleBinding for NeuVector to manage response rules
432+
{{- if $oc3 }}
433+
apiVersion: authorization.openshift.io/v1
434+
{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
435+
apiVersion: rbac.authorization.k8s.io/v1
436+
{{- else }}
437+
apiVersion: v1
438+
{{- end }}
439+
kind: ClusterRoleBinding
440+
metadata:
441+
name: neuvector-binding-nvresponserulesecurityrules
442+
labels:
443+
chart: {{ template "neuvector.chart" . }}
444+
release: {{ .Release.Name }}
445+
roleRef:
446+
{{- if not $oc3 }}
447+
apiGroup: rbac.authorization.k8s.io
448+
kind: ClusterRole
449+
{{- end }}
450+
name: neuvector-binding-nvresponserulesecurityrules
451+
subjects:
452+
- kind: ServiceAccount
453+
name: {{ .Values.serviceAccount }}
454+
namespace: {{ .Release.Namespace }}
455+
{{- if $oc3 }}
456+
userNames:
457+
- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }}
458+
{{- end }}
459+
460+
---
461+
405462
# Clusterrolebinding for Neuvector to manage name referral for common groups
406463
{{- if $oc3 }}
407464
apiVersion: authorization.openshift.io/v1
@@ -430,5 +487,4 @@ subjects:
430487
userNames:
431488
- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }}
432489
{{- end }}
433-
434490
{{- end }}

‎charts/core/templates/crd.yaml‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,55 @@ spec:
192192
- Protect
193193
type: string
194194
type: object
195+
response:
196+
items:
197+
properties:
198+
policy_name:
199+
enum:
200+
- default
201+
type: string
202+
event:
203+
enum:
204+
- event
205+
- security-event
206+
- cve-report
207+
- compliance
208+
type: string
209+
comment:
210+
type: string
211+
conditions:
212+
items:
213+
properties:
214+
type:
215+
type: string
216+
value:
217+
type: string
218+
required:
219+
- type
220+
- value
221+
type: object
222+
type: array
223+
actions:
224+
items:
225+
enum:
226+
- quarantine
227+
- suppress-log
228+
- webhook
229+
type: string
230+
minItems: 1
231+
type: array
232+
webhooks:
233+
items:
234+
type: string
235+
type: array
236+
disable:
237+
type: boolean
238+
required:
239+
- policy_name
240+
- event
241+
- actions
242+
type: object
243+
type: array
195244
target:
196245
properties:
197246
policymode:
@@ -477,6 +526,55 @@ spec:
477526
- Protect
478527
type: string
479528
type: object
529+
response:
530+
items:
531+
properties:
532+
policy_name:
533+
enum:
534+
- default
535+
type: string
536+
event:
537+
enum:
538+
- event
539+
- security-event
540+
- cve-report
541+
- compliance
542+
type: string
543+
comment:
544+
type: string
545+
conditions:
546+
items:
547+
properties:
548+
type:
549+
type: string
550+
value:
551+
type: string
552+
required:
553+
- type
554+
- value
555+
type: object
556+
type: array
557+
actions:
558+
items:
559+
enum:
560+
- quarantine
561+
- suppress-log
562+
- webhook
563+
type: string
564+
minItems: 1
565+
type: array
566+
webhooks:
567+
items:
568+
type: string
569+
type: array
570+
disable:
571+
type: boolean
572+
required:
573+
- policy_name
574+
- event
575+
- actions
576+
type: object
577+
type: array
480578
target:
481579
properties:
482580
policymode:
@@ -1045,4 +1143,87 @@ spec:
10451143
type: object
10461144
type: object
10471145
{{- end }}
1146+
---
1147+
{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
1148+
apiVersion: apiextensions.k8s.io/v1
1149+
{{- else }}
1150+
apiVersion: apiextensions.k8s.io/v1beta1
1151+
{{- end }}
1152+
kind: CustomResourceDefinition
1153+
metadata:
1154+
name: nvresponserulesecurityrules.neuvector.com
1155+
spec:
1156+
group: neuvector.com
1157+
names:
1158+
kind: NvResponseRuleSecurityRule
1159+
listKind: NvResponseRuleSecurityRuleList
1160+
plural: nvresponserulesecurityrules
1161+
singular: nvresponserulesecurityrule
1162+
scope: Cluster
1163+
{{- if (semverCompare "<1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
1164+
version: v1
1165+
{{- end }}
1166+
versions:
1167+
- name: v1
1168+
served: true
1169+
storage: true
1170+
{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
1171+
schema:
1172+
openAPIV3Schema:
1173+
properties:
1174+
spec:
1175+
properties:
1176+
rule:
1177+
properties:
1178+
policy_name:
1179+
enum:
1180+
- default
1181+
type: string
1182+
event:
1183+
enum:
1184+
- event
1185+
- security-event
1186+
- cve-report
1187+
- compliance
1188+
- admission-control
1189+
type: string
1190+
comment:
1191+
type: string
1192+
conditions:
1193+
items:
1194+
properties:
1195+
type:
1196+
type: string
1197+
value:
1198+
type: string
1199+
required:
1200+
- type
1201+
- value
1202+
type: object
1203+
type: array
1204+
actions:
1205+
items:
1206+
enum:
1207+
- quarantine
1208+
- suppress-log
1209+
- webhook
1210+
type: string
1211+
minItems: 1
1212+
type: array
1213+
webhooks:
1214+
items:
1215+
type: string
1216+
type: array
1217+
disable:
1218+
type: boolean
1219+
required:
1220+
- policy_name
1221+
- event
1222+
- actions
1223+
type: object
1224+
required:
1225+
- rule
1226+
type: object
1227+
type: object
1228+
{{- end }}
10481229
{{- end }}

0 commit comments

Comments
 (0)