Skip to content
This repository was archived by the owner on Mar 19, 2025. It is now read-only.

Commit 9b8f529

Browse files
akocbekakocbek
authored
feat: add scc workload protection agent DA flavor (#91)
1 parent befaed2 commit 9b8f529

28 files changed

+530
-4
lines changed

‎.catalog-onboard-pipeline.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,8 @@ offerings:
1212
scc:
1313
instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
1414
region: us-south
15+
- name: agents
16+
mark_ready: true
17+
install_type: extension
18+
pre_validation: "tests/scripts/pre-validation-deploy-slz-roks-and-scc-wp-instances.sh"
19+
post_validation: "tests/scripts/post-validation-destroy-slz-roks-and-scc-wp-instances.sh"

‎ibm_catalog.json‎

Lines changed: 70 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@
284284
}
285285
],
286286
"architecture": {
287-
"descriptions": "This architecture supports creating and configuring an Key Protect instance.",
287+
"descriptions": "This architecture supports creating and configuring a Security and Compliance Center Workload Protection instance.",
288288
"features": [
289289
{
290290
"title": "Creates a Security and Compliance Center instance.",
@@ -310,7 +310,75 @@
310310
}
311311
]
312312
}
313-
}
313+
},
314+
{
315+
"label": "Agents",
316+
"name": "agents",
317+
"install_type": "fullstack",
318+
"working_directory": "solutions/agents",
319+
"compliance": {},
320+
"configuration": [
321+
{
322+
"key": "ibmcloud_api_key"
323+
},
324+
{
325+
"key": "scc_workload_protection_agent_agent_name"
326+
},
327+
{
328+
"key": "scc_workload_protection_agent_agent_namespace"
329+
},
330+
{
331+
"key": "scc_workload_protection_agent_cluster_name"
332+
},
333+
{
334+
"key": "scc_workload_protection_agent_access_key"
335+
},
336+
{
337+
"key": "scc_workload_protection_instance_region"
338+
},
339+
{
340+
"key": "scc_workload_protection_agent_endpoint_type",
341+
"options": [
342+
{
343+
"displayname": "Public",
344+
"value": "public"
345+
},
346+
{
347+
"displayname": "Private",
348+
"value": "private"
349+
}
350+
]
351+
}
352+
],
353+
"iam_permissions": [
354+
{
355+
"service_name": "compliance",
356+
"role_crns": [
357+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
358+
"crn:v1:bluemix:public:iam::::role:Editor"
359+
]
360+
}
361+
],
362+
"architecture": {
363+
"descriptions": "This architecture supports creating and configuring Security and Compliance Center Workload Protection agents.",
364+
"features": [
365+
{
366+
"title": "Creates a Security and Compliance Center Workload Protection agents.",
367+
"description": "Creates and configures a Security and Compliance Center Workload Protection agents."
368+
}
369+
],
370+
"diagrams": [
371+
{
372+
"diagram": {
373+
"caption": "Security and Compliance Center Workload Protection Agent",
374+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-scc-da/main/reference-architecture/scc-wp-agent.svg",
375+
"type": "image/svg+xml"
376+
},
377+
"description": "This architecture supports creating and configuring Security and Compliance Center Workload Protection agent resources."
378+
}
379+
]
380+
}
381+
}
314382
]
315383
}
316384
]

‎reference-architecture/scc-wp-agent.svg‎

Lines changed: 4 additions & 0 deletions
Loading

‎solutions/agents/README.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
11
# Security and Compliance Center Workload Protection Agent solution
22

3-
(Coming soon)
3+
This solution supports installing and configuring [IBM Cloud Security and Compliance Center Workload Protection agent](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started). It uses [sysdig-deploy charts](https://github.com/sysdiglabs/charts/tree/master/charts/sysdig-deploy) which deploys the following components into your cluster:
4+
- Agent
5+
- Node Analyzer
6+
- KSPM Collector
7+
8+
This solution will deploy and configure the Workload Protections components in an existing cluster to an existing IBM Cloud Security and Compliance Center Workload Protection instance.
9+
10+
![scc-wp-agent](../../reference-architecture/scc-wp-agent.svg)

‎solutions/agents/catalogValidationValues.json.template‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"ibmcloud_api_key": $VALIDATION_APIKEY
3+
}

‎solutions/agents/kubeconfig/.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Ignore everything
2+
*
3+
4+
# But not these files...
5+
!.gitignore
6+
!README.md

‎solutions/agents/kubeconfig/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
This directory must exist in source control so the `ibm_container_cluster_config` data lookup can use it to place the
2+
config.yml used to connect to a kubernetes cluster.

‎solutions/agents/main.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#######################################################################################################################
2+
# SCC WP Agent
3+
#######################################################################################################################
4+
5+
module "scc_wp_agent" {
6+
source = "terraform-ibm-modules/scc-workload-protection-agent/ibm"
7+
version = "1.2.3"
8+
access_key = var.access_key
9+
cluster_name = var.cluster_name
10+
region = var.region
11+
endpoint_type = var.endpoint_type
12+
name = var.name
13+
namespace = var.namespace
14+
deployment_tag = var.deployment_tag
15+
kspm_deploy = var.kspm_deploy
16+
node_analyzer_deploy = var.node_analyzer_deploy
17+
host_scanner_deploy = var.host_scanner_deploy
18+
cluster_scanner_deploy = var.cluster_scanner_deploy
19+
20+
}

‎solutions/agents/outputs.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
########################################################################################################################
2+
# Outputs
3+
########################################################################################################################
4+
5+
output "name" {
6+
description = "Helm chart release name."
7+
value = module.scc_wp_agent.name
8+
}

‎solutions/agents/provider.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
########################################################################################################################
2+
# Provider config
3+
########################################################################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
}
9+
10+
provider "kubernetes" {
11+
host = data.ibm_container_cluster_config.cluster_dconfig.host
12+
token = data.ibm_container_cluster_config.cluster_config.token
13+
}
14+
15+
provider "helm" {
16+
kubernetes {
17+
host = data.ibm_container_cluster_config.cluster_config.host
18+
token = data.ibm_container_cluster_config.cluster_config.token
19+
}
20+
}
21+
22+
data "ibm_container_cluster_config" "cluster_config" {
23+
cluster_name_id = var.cluster_name
24+
config_dir = "${path.module}/kubeconfig"
25+
endpoint_type = var.cluster_endpoint_type
26+
}

0 commit comments

Comments
 (0)