Skip to content

Commit b7b7f3f

Browse files
soerenschneidersoerenschneider
committed
Accept risk of cicd/ansible/rbac.yaml for AVD-KSV-0113
1 parent 2dca790 commit b7b7f3f

17 files changed

+491
-0
lines changed

‎.trivyignore.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ misconfigurations:
5050
- id: "AVD-KSV-0113"
5151
paths:
5252
- "apps/monitoring/prometheus-vault-token-syncer/rbac.yaml"
53+
- "cicd/ansible/rbac.yaml"
5354
- id: "AVD-KSV-0114"
5455
paths:
5556
- "infra/external-secrets/components/resources/rbac-bindings.yaml"

‎apps/gollum/crd/gollum.soeren.cloud_repositories.yaml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.16.4
7+
name: repositories.gollum.soeren.cloud
8+
spec:
9+
group: gollum.soeren.cloud
10+
names:
11+
kind: Repository
12+
listKind: RepositoryList
13+
plural: repositories
14+
singular: repository
15+
scope: Namespaced
16+
versions:
17+
- additionalPrinterColumns:
18+
- jsonPath: .spec.owner
19+
name: Owner
20+
type: string
21+
- jsonPath: .spec.repo
22+
name: Repo
23+
type: string
24+
- jsonPath: .status.conditions[?(@.status)].status
25+
name: Ready
26+
type: string
27+
name: v1alpha1
28+
schema:
29+
openAPIV3Schema:
30+
properties:
31+
apiVersion:
32+
description: |-
33+
APIVersion defines the versioned schema of this representation of an object.
34+
Servers should convert recognized schemas to the latest internal value, and
35+
may reject unrecognized values.
36+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
37+
type: string
38+
kind:
39+
description: |-
40+
Kind is a string value representing the REST resource this object represents.
41+
Servers may infer this from the endpoint the client submits requests to.
42+
Cannot be updated.
43+
In CamelCase.
44+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
45+
type: string
46+
metadata:
47+
type: object
48+
spec:
49+
description: RepositorySpec defines the desired state of Repository.
50+
properties:
51+
memorizeReleases:
52+
default: true
53+
type: boolean
54+
owner:
55+
type: string
56+
pipelineName:
57+
type: string
58+
pipelineRunName:
59+
type: string
60+
repo:
61+
type: string
62+
url:
63+
type: string
64+
versionFilter:
65+
properties:
66+
arg:
67+
type: string
68+
impl:
69+
enum:
70+
- semver
71+
type: string
72+
required:
73+
- arg
74+
- impl
75+
type: object
76+
workspaces:
77+
additionalProperties:
78+
additionalProperties:
79+
type: string
80+
type: object
81+
type: object
82+
required:
83+
- memorizeReleases
84+
- owner
85+
- pipelineRunName
86+
- repo
87+
- url
88+
- workspaces
89+
type: object
90+
status:
91+
description: RepositoryStatus defines the observed state of Repository.
92+
properties:
93+
conditions:
94+
items:
95+
description: Condition contains details for one aspect of the current
96+
state of this API Resource.
97+
properties:
98+
lastTransitionTime:
99+
description: |-
100+
lastTransitionTime is the last time the condition transitioned from one status to another.
101+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
102+
format: date-time
103+
type: string
104+
message:
105+
description: |-
106+
message is a human readable message indicating details about the transition.
107+
This may be an empty string.
108+
maxLength: 32768
109+
type: string
110+
observedGeneration:
111+
description: |-
112+
observedGeneration represents the .metadata.generation that the condition was set based upon.
113+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
114+
with respect to the current state of the instance.
115+
format: int64
116+
minimum: 0
117+
type: integer
118+
reason:
119+
description: |-
120+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
121+
Producers of specific condition types may define expected values and meanings for this field,
122+
and whether the values are considered a guaranteed API.
123+
The value should be a CamelCase string.
124+
This field may not be empty.
125+
maxLength: 1024
126+
minLength: 1
127+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
128+
type: string
129+
status:
130+
description: status of the condition, one of True, False, Unknown.
131+
enum:
132+
- "True"
133+
- "False"
134+
- Unknown
135+
type: string
136+
type:
137+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
138+
maxLength: 316
139+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
140+
type: string
141+
required:
142+
- lastTransitionTime
143+
- message
144+
- reason
145+
- status
146+
- type
147+
type: object
148+
type: array
149+
lastCheck:
150+
format: date-time
151+
type: string
152+
ready:
153+
type: boolean
154+
releases:
155+
additionalProperties:
156+
properties:
157+
hasAssets:
158+
type: boolean
159+
pipelineRuns:
160+
properties:
161+
name:
162+
type: string
163+
timestamp:
164+
format: date-time
165+
type: string
166+
required:
167+
- name
168+
type: object
169+
runsCreated:
170+
type: integer
171+
required:
172+
- hasAssets
173+
- runsCreated
174+
type: object
175+
type: object
176+
required:
177+
- lastCheck
178+
- ready
179+
- releases
180+
type: object
181+
type: object
182+
served: true
183+
storage: true
184+
subresources:
185+
status: {}

‎apps/gollum/crd/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
resources:
3+
- gollum.soeren.cloud_repositories.yaml

‎apps/gollum/crd/kustomizeconfig.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# This file is for teaching kustomize how to substitute name and namespace reference in CRD
2+
nameReference:
3+
- kind: Service
4+
version: v1
5+
fieldSpecs:
6+
- kind: CustomResourceDefinition
7+
version: v1
8+
group: apiextensions.k8s.io
9+
path: spec/conversion/webhook/clientConfig/service/name
10+
11+
namespace:
12+
- kind: CustomResourceDefinition
13+
version: v1
14+
group: apiextensions.k8s.io
15+
path: spec/conversion/webhook/clientConfig/service/namespace
16+
create: false
17+
18+
varReference:
19+
- path: metadata/annotations

‎apps/gollum/deployment.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: gollum
6+
labels:
7+
app.kubernetes.io/name: gollum
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app.kubernetes.io/name: gollum
13+
template:
14+
metadata:
15+
labels:
16+
app: gollum
17+
app.kubernetes.io/name: gollum
18+
app.kubernetes.io/instance: gollum-prod
19+
app.kubernetes.io/component: gollum
20+
app.kubernetes.io/part-of: gollum
21+
spec:
22+
securityContext:
23+
runAsUser: 34322
24+
runAsGroup: 34322
25+
fsGroup: 34322
26+
runAsNonRoot: true
27+
seccompProfile:
28+
type: RuntimeDefault
29+
containers:
30+
- name: gollum
31+
image: cr.svc.dd.soeren.cloud/gollum
32+
imagePullPolicy: Always
33+
command:
34+
- /manager
35+
args:
36+
- --leader-elect
37+
- --health-probe-bind-address=:8081
38+
env:
39+
- name: GH_TOKEN
40+
valueFrom:
41+
secretKeyRef:
42+
name: gollum-gh-token
43+
key: GH_TOKEN
44+
optional: true
45+
securityContext:
46+
runAsNonRoot: true
47+
runAsUser: 34322
48+
runAsGroup: 34322
49+
privileged: false
50+
allowPrivilegeEscalation: false
51+
readOnlyRootFilesystem: true
52+
seccompProfile:
53+
type: RuntimeDefault
54+
capabilities:
55+
drop:
56+
- ALL
57+
resources:
58+
limits:
59+
memory: "512Mi"
60+
requests:
61+
cpu: "10m"
62+
memory: "256Mi"
63+
livenessProbe:
64+
httpGet:
65+
path: /healthz
66+
port: 8081
67+
initialDelaySeconds: 15
68+
periodSeconds: 20
69+
readinessProbe:
70+
httpGet:
71+
path: /readyz
72+
port: 8081
73+
initialDelaySeconds: 5
74+
periodSeconds: 10
75+
serviceAccountName: controller-manager
76+
terminationGracePeriodSeconds: 10

‎apps/gollum/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
namespace: gollum-system
5+
resources:
6+
- namespace.yaml
7+
- deployment.yaml
8+
- crd
9+
- rbac

‎apps/gollum/namespace.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: gollum-system

‎apps/gollum/rbac/kustomization.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
resources:
3+
- service_account.yaml
4+
- role.yaml
5+
- role_binding.yaml
6+
- leader_election_role.yaml
7+
- leader_election_role_binding.yaml
8+
- metrics_auth_role.yaml
9+
- metrics_auth_role_binding.yaml
10+
- metrics_reader_role.yaml
11+

‎apps/gollum/rbac/leader_election_role.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# permissions to do leader election.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
labels:
6+
app.kubernetes.io/name: gollum
7+
app.kubernetes.io/managed-by: kustomize
8+
name: leader-election-role
9+
rules:
10+
- apiGroups:
11+
- ""
12+
resources:
13+
- configmaps
14+
verbs:
15+
- get
16+
- list
17+
- watch
18+
- create
19+
- update
20+
- patch
21+
- delete
22+
- apiGroups:
23+
- coordination.k8s.io
24+
resources:
25+
- leases
26+
verbs:
27+
- get
28+
- list
29+
- watch
30+
- create
31+
- update
32+
- patch
33+
- delete
34+
- apiGroups:
35+
- ""
36+
resources:
37+
- events
38+
verbs:
39+
- create
40+
- patch

‎apps/gollum/rbac/leader_election_role_binding.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: gollum
6+
app.kubernetes.io/managed-by: kustomize
7+
name: leader-election-rolebinding
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: Role
11+
name: leader-election-role
12+
subjects:
13+
- kind: ServiceAccount
14+
name: controller-manager
15+
namespace: gollum-system

0 commit comments

Comments
 (0)