Skip to content

Commit c48db75

Browse files
mikkeloscarmikkeloscar
authored
Merge pull request #8679 from zalando-incubator/vthupili
feat: add wiz manifests
2 parents b41767c + 1775813 commit c48db75

14 files changed

+759
-0
lines changed

‎cluster/config-defaults.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1221,3 +1221,18 @@ role_sync_controller_enabled: "true"
12211221
{{ else }}
12221222
role_sync_controller_enabled: "false"
12231223
{{ end }}
1224+
1225+
#Wiz Configs
1226+
# When wiz_enable_runtime_sensor and wiz_enable_runtime_connector are set to true,
1227+
# this enables WIZ runtime monitoring. A DaemonSet called Sensor and a Deployment
1228+
# called Connector will be deployed into the cluster.
1229+
wiz_enable_runtime_sensor: "false"
1230+
wiz_enable_runtime_connector: "false"
1231+
wiz_sensor_cpu: "300m"
1232+
wiz_sensor_memory: "300Mi"
1233+
wiz_connector_cpu: "300m"
1234+
wiz_connector_memory: "300Mi"
1235+
# Please note when this is set to true it allows the use of the node selector feature
1236+
# to deploy the sensor and connector on specific nodes, by manually setting the node selector label on the nodes.
1237+
# This is useful when you want to deploy the sensor and connector on specific nodes.
1238+
wiz_node_feature_rollout : "false"

‎cluster/manifests/01-admission-control/config.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,9 @@ data:
115115
{{- range $sa := split .Cluster.ConfigItems.teapot_admission_controller_pod_security_policy_privileged_service_accounts "," }}
116116
pod.pod-security-policy.privileged-service-accounts.{{ $sa }}: ""
117117
{{- end}}
118+
{{- if eq .Cluster.ConfigItems.wiz_enable_runtime_sensor "true" }}
119+
pod.pod-security-policy.privileged-service-accounts.wiz_wiz_sensor: ""
120+
{{- end }}
118121

119122
pod.pod-security-policy.allowed-restricted-capabilities.AUDIT_WRITE: ""
120123
pod.pod-security-policy.allowed-restricted-capabilities.CHOWN: ""
@@ -139,6 +142,17 @@ data:
139142
pod.pod-security-policy.allowed-privileged-capabilities.{{ $cap }}: ""
140143
{{- end}}
141144

145+
{{- if eq .Cluster.ConfigItems.wiz_enable_runtime_sensor "true" }}
146+
pod.pod-security-policy.allowed-privileged-capabilities.DAC_READ_SEARCH: ""
147+
pod.pod-security-policy.allowed-privileged-capabilities.IPC_LOCK: ""
148+
pod.pod-security-policy.allowed-privileged-capabilities.NET_ADMIN: ""
149+
pod.pod-security-policy.allowed-privileged-capabilities.SYS_ADMIN: ""
150+
pod.pod-security-policy.allowed-privileged-capabilities.SYS_MODULE: ""
151+
pod.pod-security-policy.allowed-privileged-capabilities.SYS_PTRACE: ""
152+
pod.pod-security-policy.allowed-privileged-capabilities.SYS_RESOURCE: ""
153+
pod.pod-security-policy.allowed-privileged-capabilities.SYS_RAWIO: ""
154+
pod.pod-security-policy.allowed-privileged-capabilities.SYSLOG: ""
155+
{{- end }}
142156

143157
{{- range $sysctl := split .Cluster.ConfigItems.allowed_unsafe_sysctls "," }}
144158
pod.pod-security-policy.allowed-unsafe-sysctls.{{ $sysctl }}: ""

‎cluster/manifests/deletions.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,65 @@ post_apply:
339339
- name: kube-janitor
340340
kind: ClusterRoleBinding
341341
{{- end }}
342+
{{- if ne .Cluster.ConfigItems.wiz_enable_runtime_connector "true" }}
343+
- name: wiz-kubernetes-connector-create-connector
344+
kind : Job
345+
namespace: wiz
346+
- name: wiz-kubernetes-connector-delete-connector
347+
kind : Job
348+
namespace: wiz
349+
- name: wiz-connector-agent
350+
kind : Deployment
351+
namespace: wiz
352+
- name: wiz-broker
353+
kind : ServiceAccount
354+
namespace: wiz
355+
- name: wiz-cluster-reader
356+
kind : ServiceAccount
357+
namespace: wiz
358+
- name: wiz-auto-modify-connector
359+
kind : ServiceAccount
360+
namespace: wiz
361+
- name: wiz-connector-connector
362+
kind : Secret
363+
namespace: wiz
364+
- name: wiz-cluster-reader-token
365+
kind : Secret
366+
namespace: wiz
367+
- name: wiz-api-token
368+
kind : Secret
369+
namespace: wiz
370+
- name: wiz-auto-modify-connector
371+
kind : Role
372+
namespace: wiz
373+
- name: wiz-auto-modify-connector
374+
kind : RoleBinding
375+
namespace: wiz
376+
- name: wiz-cluster-reader
377+
kind : ClusterRoleBinding
378+
namespace: wiz
379+
{{- end }}
380+
{{- if ne .Cluster.ConfigItems.wiz_enable_runtime_sensor "true" }}
381+
- name: wiz-sensor
382+
kind : DaemonSet
383+
namespace: wiz
384+
- name: wiz-sensor
385+
kind: ServiceAccount
386+
namespace: wiz
387+
- name: wiz-sensor-apikey
388+
kind: Secret
389+
namespace: wiz
390+
- name: wiz-sensor
391+
kind : ClusterRole
392+
namespace: wiz
393+
- name: wiz-sensor
394+
kind : ClusterRoleBinding
395+
namespace: wiz
396+
{{- end }}
397+
{{- if and (ne .Cluster.ConfigItems.wiz_enable_runtime_connector "true") (ne .Cluster.ConfigItems.wiz_enable_runtime_sensor "true") }}
398+
- name: wiz
399+
kind: Namespace
400+
{{- end }}
342401
{{- if ne .Cluster.ConfigItems.aws_efa_device_plugin_enabled "true"}}
343402
- name: aws-efa-k8s-device-plugin
344403
kind: DaemonSet

‎cluster/manifests/wiz/001-namespace.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: wiz

‎cluster/manifests/wiz/002-connector-serviceaccount.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{{ if eq .Cluster.ConfigItems.wiz_enable_runtime_connector "true"}}
2+
---
3+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/charts/wiz-broker/templates/serviceaccount.yaml
4+
apiVersion: v1
5+
kind: ServiceAccount
6+
metadata:
7+
name: wiz-broker
8+
namespace: "wiz"
9+
labels:
10+
helm.sh/chart: wiz-broker-2.1.0
11+
application: "wiz"
12+
component: "connector"
13+
---
14+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/service-account-cluster-reader.yaml
15+
apiVersion: v1
16+
kind: ServiceAccount
17+
metadata:
18+
name: wiz-cluster-reader
19+
namespace: "wiz"
20+
labels:
21+
helm.sh/chart: wiz-broker-2.1.0
22+
application: "wiz"
23+
component: "connector"
24+
---
25+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/service-account-modify-connector.yaml
26+
apiVersion: v1
27+
kind: ServiceAccount
28+
metadata:
29+
name: wiz-auto-modify-connector
30+
namespace: "wiz"
31+
labels:
32+
helm.sh/chart: wiz-broker-2.1.0
33+
application: "wiz"
34+
component: "connector"
35+
{{end}}

‎cluster/manifests/wiz/002-sensor-serviceaccount.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{ if eq .Cluster.ConfigItems.wiz_enable_runtime_sensor "true"}}
2+
---
3+
# Source: wiz-sensor/templates/serviceaccount.yaml
4+
apiVersion: v1
5+
kind: ServiceAccount
6+
metadata:
7+
name: wiz-sensor
8+
namespace: wiz
9+
labels:
10+
helm.sh/chart: wiz-sensor-1.0.4760
11+
application: "wiz"
12+
component: "connector"
13+
{{end}}

‎cluster/manifests/wiz/003-connector-clusterrole.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{{ if eq .Cluster.ConfigItems.wiz_enable_runtime_connector "true"}}
2+
---
3+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/service-account-cluster-reader.yaml
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: ClusterRoleBinding
6+
metadata:
7+
name: wiz-cluster-reader
8+
labels:
9+
helm.sh/chart: wiz-broker-2.1.0
10+
application: "wiz"
11+
component: "connector"
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: readonly # readonly role created by default in out kubernetes environment
16+
subjects:
17+
- kind: ServiceAccount
18+
name: wiz-cluster-reader
19+
namespace: "wiz"
20+
{{end}}

‎cluster/manifests/wiz/003-connector-role.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{{ if eq .Cluster.ConfigItems.wiz_enable_runtime_connector "true"}}
2+
---
3+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/service-account-modify-connector.yaml
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: Role
6+
metadata:
7+
name: wiz-auto-modify-connector
8+
namespace: "wiz"
9+
labels:
10+
helm.sh/chart: wiz-broker-2.1.0
11+
application: "wiz"
12+
component: "connector"
13+
rules:
14+
- apiGroups: [""]
15+
resources: ["secrets"]
16+
resourceNames: ["wiz-connector-connector"]
17+
verbs: ["update", "get"]
18+
- apiGroups: [""]
19+
resources: ["secrets"]
20+
resourceNames:
21+
- "wiz-api-token"
22+
- "wiz-cluster-reader-token"
23+
verbs: ["get"]
24+
---
25+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/service-account-modify-connector.yaml
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: RoleBinding
28+
metadata:
29+
name: wiz-auto-modify-connector
30+
namespace: "wiz"
31+
labels:
32+
helm.sh/chart: wiz-broker-2.1.0
33+
application: "wiz"
34+
component: "connector"
35+
roleRef:
36+
apiGroup: rbac.authorization.k8s.io
37+
kind: Role
38+
name: wiz-auto-modify-connector
39+
subjects:
40+
- kind: ServiceAccount
41+
name: wiz-auto-modify-connector
42+
namespace: "wiz"
43+
{{end}}

‎cluster/manifests/wiz/003-sensor-clusterrole.yaml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{{ if eq .Cluster.ConfigItems.wiz_enable_runtime_sensor "true"}}
2+
---
3+
# Source: wiz-sensor/templates/clusterrole.yaml
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: ClusterRole
6+
metadata:
7+
name: wiz-sensor
8+
labels:
9+
helm.sh/chart: wiz-sensor-1.0.4760
10+
application: "wiz"
11+
component: "sensor"
12+
rules:
13+
- apiGroups: [""]
14+
resources: ["pods", "namespaces", "nodes", "replicationcontrollers", "serviceaccounts"]
15+
verbs: ["get", "list", "watch"]
16+
17+
- apiGroups: ["apps"]
18+
resources: ["daemonsets", "replicasets", "deployments", "statefulsets"]
19+
verbs: ["get", "list", "watch"]
20+
21+
- apiGroups: ["batch"]
22+
resources: ["cronjobs"]
23+
verbs: ["get", "list", "watch"]
24+
---
25+
# Source: wiz-sensor/templates/clusterrolebinding.yaml
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: ClusterRoleBinding
28+
metadata:
29+
name: wiz-sensor
30+
labels:
31+
helm.sh/chart: wiz-sensor-1.0.4760
32+
application: "wiz"
33+
component: "sensor"
34+
subjects:
35+
- kind: ServiceAccount
36+
name: wiz-sensor
37+
namespace: wiz
38+
roleRef:
39+
kind: ClusterRole
40+
name: wiz-sensor
41+
apiGroup: rbac.authorization.k8s.io
42+
{{end}}

‎cluster/manifests/wiz/004-connector-secrets.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{{ if eq .Cluster.ConfigItems.wiz_enable_runtime_connector "true"}}
2+
---
3+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/secret-connector.yaml
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: wiz-connector-connector
8+
namespace: "wiz"
9+
labels:
10+
helm.sh/chart: wiz-broker-2.1.0
11+
application: "wiz"
12+
component: "connector"
13+
type: Opaque
14+
data:
15+
connectorData: "e30="
16+
---
17+
# Source: wiz-kubernetes-integration/charts/wiz-kubernetes-connector/templates/service-account-cluster-reader.yaml
18+
apiVersion: v1
19+
kind: Secret
20+
metadata:
21+
name: wiz-cluster-reader-token
22+
namespace: "wiz"
23+
labels:
24+
helm.sh/chart: wiz-broker-2.1.0
25+
application: "wiz"
26+
component: "connector"
27+
annotations:
28+
kubernetes.io/service-account.name: wiz-cluster-reader
29+
type: kubernetes.io/service-account-token
30+
---
31+
# Source: wiz-sensor/templates/apikeysecret.yaml
32+
apiVersion: v1
33+
kind: Secret
34+
metadata:
35+
name: wiz-api-token
36+
namespace: wiz
37+
labels:
38+
helm.sh/chart: wiz-broker-2.1.0
39+
application: "wiz"
40+
component: "connector"
41+
type: Opaque
42+
stringData:
43+
clientId: "{{ .Cluster.ConfigItems.wiz_api_client_id }}"
44+
clientToken: "{{ .Cluster.ConfigItems.wiz_api_client_token }}"
45+
{{end}}

0 commit comments

Comments
 (0)