Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 7fef6a6

Browse files
J12934J12934
committed
Add helm chart
1 parent 2cec8b4 commit 7fef6a6

24 files changed

+7221
-5
lines changed

‎operator/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎operator/Chart.lock‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: minio
3+
repository: https://kubernetes-charts.storage.googleapis.com/
4+
version: 5.0.17
5+
digest: sha256:b35baf336cc13709979f3f0824963bfe658da479092085fafa61dd86f0ce6b89
6+
generated: "2020-03-19T17:36:50.79157+01:00"

‎operator/Chart.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v2
2+
name: operator
3+
description: secureCodeBox Operator to automate the execution of security scans on kubernetes
4+
5+
type: application
6+
7+
# This is the chart version. This version number should be incremented each time you make changes
8+
# to the chart and its templates, including the app version.
9+
version: 0.1.0
10+
11+
# This is the version number of the application being deployed. This version number should be
12+
# incremented each time you make changes to the application.
13+
appVersion: 1.16.0
14+
15+
dependencies:
16+
- name: minio
17+
version: 5.0.17
18+
repository: https://kubernetes-charts.storage.googleapis.com/
19+
condition: minio.enabled

‎operator/charts/minio-5.0.17.tgz‎

16.3 KB
Binary file not shown.

‎operator/config/rbac/role.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,40 @@ rules:
1818
- patch
1919
- update
2020
- watch
21+
- apiGroups:
22+
- ""
23+
resources:
24+
- pods
25+
verbs:
26+
- get
27+
- list
28+
- watch
2129
- apiGroups:
2230
- ""
2331
resources:
2432
- serviceaccounts
2533
verbs:
2634
- create
2735
- get
36+
- list
2837
- watch
2938
- apiGroups:
30-
- rbac
39+
- rbac.authorization.k8s.io
3140
resources:
3241
- rolebindings
3342
verbs:
3443
- create
3544
- get
45+
- list
3646
- watch
3747
- apiGroups:
38-
- rbac
48+
- rbac.authorization.k8s.io
3949
resources:
4050
- roles
4151
verbs:
4252
- create
4353
- get
54+
- list
4455
- watch
4556
- apiGroups:
4657
- scans.experimental.securecodebox.io

‎operator/controllers/scan_controller.go‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,13 @@ type ScanReconciler struct {
6060
// +kubebuilder:rbac:groups=scans.experimental.securecodebox.io,resources=parsedefinitions,verbs=get;list;watch
6161
// +kubebuilder:rbac:groups=scans.experimental.securecodebox.io,resources=persistenceproviders,verbs=get;list;watch
6262
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
63-
// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;watch;create
64-
// +kubebuilder:rbac:groups=rbac,resources=roles,verbs=get;watch;create
65-
// +kubebuilder:rbac:groups=rbac,resources=rolebindings,verbs=get;watch;create
63+
// Permissions needed to create service accounts for lurcher, parser and persistence providers
64+
65+
// Pod permission are required to grant these permission to service accounts
66+
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch
67+
// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;watch;list;create
68+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=get;watch;list;create
69+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=get;watch;list;create
6670

6771
// Reconcile compares the scan object against the state of the cluster and updates both if needed
6872
func (r *ScanReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {

‎operator/crds/scans.experimental.securecodebox.io_parsedefinitions.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
2+
---
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
creationTimestamp: null
7+
name: parsedefinitions.scans.experimental.securecodebox.io
8+
spec:
9+
group: scans.experimental.securecodebox.io
10+
names:
11+
kind: ParseDefinition
12+
plural: parsedefinitions
13+
scope: ""
14+
validation:
15+
openAPIV3Schema:
16+
description: ParseDefinition is the Schema for the parsedefinitions API
17+
properties:
18+
apiVersion:
19+
description: 'APIVersion defines the versioned schema of this representation
20+
of an object. Servers should convert recognized schemas to the latest
21+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
22+
type: string
23+
kind:
24+
description: 'Kind is a string value representing the REST resource this
25+
object represents. Servers may infer this from the endpoint the client
26+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
27+
type: string
28+
metadata:
29+
type: object
30+
spec:
31+
description: ParseDefinitionSpec defines the desired state of ParseDefinition
32+
properties:
33+
handlesResultsType:
34+
description: Foo is an example field of ParseDefinition. Edit ParseDefinition_types.go
35+
to remove/update
36+
type: string
37+
image:
38+
type: string
39+
type: object
40+
status:
41+
description: ParseDefinitionStatus defines the observed state of ParseDefinition
42+
type: object
43+
type: object
44+
version: v1
45+
versions:
46+
- name: v1
47+
served: true
48+
storage: true
49+
status:
50+
acceptedNames:
51+
kind: ""
52+
plural: ""
53+
conditions: []
54+
storedVersions: []

‎operator/crds/scans.experimental.securecodebox.io_persistenceproviders.yaml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
2+
---
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
creationTimestamp: null
7+
name: persistenceproviders.scans.experimental.securecodebox.io
8+
spec:
9+
group: scans.experimental.securecodebox.io
10+
names:
11+
kind: PersistenceProvider
12+
plural: persistenceproviders
13+
scope: ""
14+
validation:
15+
openAPIV3Schema:
16+
description: PersistenceProvider is the Schema for the persistenceproviders
17+
API
18+
properties:
19+
apiVersion:
20+
description: 'APIVersion defines the versioned schema of this representation
21+
of an object. Servers should convert recognized schemas to the latest
22+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
23+
type: string
24+
kind:
25+
description: 'Kind is a string value representing the REST resource this
26+
object represents. Servers may infer this from the endpoint the client
27+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
28+
type: string
29+
metadata:
30+
type: object
31+
spec:
32+
description: PersistenceProviderSpec defines the desired state of PersistenceProvider
33+
properties:
34+
env:
35+
items:
36+
description: EnvVar represents an environment variable present in
37+
a Container.
38+
properties:
39+
name:
40+
description: Name of the environment variable. Must be a C_IDENTIFIER.
41+
type: string
42+
value:
43+
description: 'Variable references $(VAR_NAME) are expanded using
44+
the previous defined environment variables in the container
45+
and any service environment variables. If a variable cannot
46+
be resolved, the reference in the input string will be unchanged.
47+
The $(VAR_NAME) syntax can be escaped with a double $$, ie:
48+
$$(VAR_NAME). Escaped references will never be expanded, regardless
49+
of whether the variable exists or not. Defaults to "".'
50+
type: string
51+
valueFrom:
52+
description: Source for the environment variable's value. Cannot
53+
be used if value is not empty.
54+
properties:
55+
configMapKeyRef:
56+
description: Selects a key of a ConfigMap.
57+
properties:
58+
key:
59+
description: The key to select.
60+
type: string
61+
name:
62+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
63+
TODO: Add other useful fields. apiVersion, kind, uid?'
64+
type: string
65+
optional:
66+
description: Specify whether the ConfigMap or its key
67+
must be defined
68+
type: boolean
69+
required:
70+
- key
71+
type: object
72+
fieldRef:
73+
description: 'Selects a field of the pod: supports metadata.name,
74+
metadata.namespace, metadata.labels, metadata.annotations,
75+
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP,
76+
status.podIPs.'
77+
properties:
78+
apiVersion:
79+
description: Version of the schema the FieldPath is written
80+
in terms of, defaults to "v1".
81+
type: string
82+
fieldPath:
83+
description: Path of the field to select in the specified
84+
API version.
85+
type: string
86+
required:
87+
- fieldPath
88+
type: object
89+
resourceFieldRef:
90+
description: 'Selects a resource of the container: only resources
91+
limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage,
92+
requests.cpu, requests.memory and requests.ephemeral-storage)
93+
are currently supported.'
94+
properties:
95+
containerName:
96+
description: 'Container name: required for volumes, optional
97+
for env vars'
98+
type: string
99+
divisor:
100+
description: Specifies the output format of the exposed
101+
resources, defaults to "1"
102+
type: string
103+
resource:
104+
description: 'Required: resource to select'
105+
type: string
106+
required:
107+
- resource
108+
type: object
109+
secretKeyRef:
110+
description: Selects a key of a secret in the pod's namespace
111+
properties:
112+
key:
113+
description: The key of the secret to select from. Must
114+
be a valid secret key.
115+
type: string
116+
name:
117+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
118+
TODO: Add other useful fields. apiVersion, kind, uid?'
119+
type: string
120+
optional:
121+
description: Specify whether the Secret or its key must
122+
be defined
123+
type: boolean
124+
required:
125+
- key
126+
type: object
127+
type: object
128+
required:
129+
- name
130+
type: object
131+
type: array
132+
image:
133+
description: Foo is an example field of PersistenceProvider. Edit PersistenceProvider_types.go
134+
to remove/update
135+
type: string
136+
type: object
137+
status:
138+
description: PersistenceProviderStatus defines the observed state of PersistenceProvider
139+
type: object
140+
type: object
141+
version: v1
142+
versions:
143+
- name: v1
144+
served: true
145+
storage: true
146+
status:
147+
acceptedNames:
148+
kind: ""
149+
plural: ""
150+
conditions: []
151+
storedVersions: []

‎operator/crds/scans.experimental.securecodebox.io_scans.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
2+
---
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
creationTimestamp: null
7+
name: scans.scans.experimental.securecodebox.io
8+
spec:
9+
additionalPrinterColumns:
10+
- JSONPath: .status.state
11+
description: Scan State
12+
name: State
13+
type: string
14+
group: scans.experimental.securecodebox.io
15+
names:
16+
kind: Scan
17+
plural: scans
18+
scope: ""
19+
subresources:
20+
status: {}
21+
validation:
22+
openAPIV3Schema:
23+
description: Scan is the Schema for the scans API
24+
properties:
25+
apiVersion:
26+
description: 'APIVersion defines the versioned schema of this representation
27+
of an object. Servers should convert recognized schemas to the latest
28+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
29+
type: string
30+
kind:
31+
description: 'Kind is a string value representing the REST resource this
32+
object represents. Servers may infer this from the endpoint the client
33+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
34+
type: string
35+
metadata:
36+
type: object
37+
spec:
38+
description: ScanSpec defines the desired state of Scan
39+
properties:
40+
parameters:
41+
items:
42+
type: string
43+
type: array
44+
scanType:
45+
type: string
46+
type: object
47+
status:
48+
description: ScanStatus defines the observed state of Scan
49+
properties:
50+
rawResultFile:
51+
description: RawResultFile Filename of the result file of the scanner.
52+
e.g. `nmap-result.xml`
53+
type: string
54+
rawResultType:
55+
description: RawResultType determines which kind of ParseDefinition
56+
will be used to turn the raw results of the scanner into findings
57+
type: string
58+
state:
59+
type: string
60+
type: object
61+
type: object
62+
version: v1
63+
versions:
64+
- name: v1
65+
served: true
66+
storage: true
67+
status:
68+
acceptedNames:
69+
kind: ""
70+
plural: ""
71+
conditions: []
72+
storedVersions: []

0 commit comments

Comments
 (0)