Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit f6d1ae4

Browse files
J12934J12934
committed
Add ScheduledScan CRD to automate and centrally handle regular scan execution in one place
1 parent c97d726 commit f6d1ae4

13 files changed

+479
-0
lines changed

‎operator/PROJECT‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,7 @@ resources:
1414
- group: execution
1515
kind: ParseDefinition
1616
version: v1
17+
- group: execution
18+
kind: ScheduledScan
19+
version: v1
1720
version: "2"

‎operator/apis/execution/v1/scheduledscan_types.go‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
Copyright 2020 iteratec GmbH.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
)
22+
23+
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
24+
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
25+
26+
// ScheduledScanSpec defines the desired state of ScheduledScan
27+
type ScheduledScanSpec struct {
28+
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
29+
// Important: Run "make" to regenerate code after modifying this file
30+
31+
// Interval describes how often the scan should be repeated
32+
// Examples: '12h', '7d', '30m' (only days, hours and minutes supported, specified as integers)
33+
Interval metav1.Duration `json:"interval"`
34+
35+
// HistoryLimit determines how many past Scans will be kept until the oldest one will be delted, defaults to 3. When set to 0 Scans will be deleted directly after completion
36+
HistoryLimit int64 `json:"historyLimit,omitempty"`
37+
38+
// Foo is an example field of ScheduledScan. Edit ScheduledScan_types.go to remove/update
39+
ScanSpec *ScanSpec `json:"scanSpec"`
40+
}
41+
42+
// ScheduledScanStatus defines the observed state of ScheduledScan
43+
type ScheduledScanStatus struct {
44+
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
45+
// Important: Run "make" to regenerate code after modifying this file
46+
47+
LastScheduleTime *metav1.Time `json:"lastScheduleTime,omitempty"`
48+
}
49+
50+
// +kubebuilder:object:root=true
51+
// +kubebuilder:subresource:status
52+
53+
// ScheduledScan is the Schema for the scheduledscans API
54+
type ScheduledScan struct {
55+
metav1.TypeMeta `json:",inline"`
56+
metav1.ObjectMeta `json:"metadata,omitempty"`
57+
58+
Spec ScheduledScanSpec `json:"spec,omitempty"`
59+
Status ScheduledScanStatus `json:"status,omitempty"`
60+
}
61+
62+
// +kubebuilder:object:root=true
63+
64+
// ScheduledScanList contains a list of ScheduledScan
65+
type ScheduledScanList struct {
66+
metav1.TypeMeta `json:",inline"`
67+
metav1.ListMeta `json:"metadata,omitempty"`
68+
Items []ScheduledScan `json:"items"`
69+
}
70+
71+
func init() {
72+
SchemeBuilder.Register(&ScheduledScan{}, &ScheduledScanList{})
73+
}

‎operator/apis/execution/v1/zz_generated.deepcopy.go‎

Lines changed: 99 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/config/crd/bases/execution.experimental.securecodebox.io_scheduledscans.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
2+
---
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
creationTimestamp: null
7+
name: scheduledscans.execution.experimental.securecodebox.io
8+
spec:
9+
group: execution.experimental.securecodebox.io
10+
names:
11+
kind: ScheduledScan
12+
plural: scheduledscans
13+
scope: ""
14+
subresources:
15+
status: {}
16+
validation:
17+
openAPIV3Schema:
18+
description: ScheduledScan is the Schema for the scheduledscans API
19+
properties:
20+
apiVersion:
21+
description: 'APIVersion defines the versioned schema of this representation
22+
of an object. Servers should convert recognized schemas to the latest
23+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
24+
type: string
25+
kind:
26+
description: 'Kind is a string value representing the REST resource this
27+
object represents. Servers may infer this from the endpoint the client
28+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
29+
type: string
30+
metadata:
31+
type: object
32+
spec:
33+
description: ScheduledScanSpec defines the desired state of ScheduledScan
34+
properties:
35+
historyLimit:
36+
description: HistoryLimit determines how many past Scans will be kept
37+
until the oldest one will be delted, defaults to 3. When set to 0
38+
Scans will be deleted directly after completion
39+
format: int64
40+
type: integer
41+
interval:
42+
description: 'Interval describes how often the scan should be repeated
43+
Examples: ''12h'', ''7d'', ''30m'' (only days, hours and minutes supported,
44+
specified as integers)'
45+
type: string
46+
scanSpec:
47+
description: Foo is an example field of ScheduledScan. Edit ScheduledScan_types.go
48+
to remove/update
49+
properties:
50+
parameters:
51+
items:
52+
type: string
53+
type: array
54+
scanType:
55+
type: string
56+
type: object
57+
required:
58+
- interval
59+
- scanSpec
60+
type: object
61+
status:
62+
description: ScheduledScanStatus defines the observed state of ScheduledScan
63+
properties:
64+
lastScheduleTime:
65+
format: date-time
66+
type: string
67+
type: object
68+
type: object
69+
version: v1
70+
versions:
71+
- name: v1
72+
served: true
73+
storage: true
74+
status:
75+
acceptedNames:
76+
kind: ""
77+
plural: ""
78+
conditions: []
79+
storedVersions: []

‎operator/config/crd/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ resources:
66
- bases/execution.experimental.securecodebox.io_scantypes.yaml
77
- bases/execution.experimental.securecodebox.io_persistenceproviders.yaml
88
- bases/execution.experimental.securecodebox.io_parsedefinitions.yaml
9+
- bases/execution.experimental.securecodebox.io_scheduledscans.yaml
910
# +kubebuilder:scaffold:crdkustomizeresource
1011

1112
patchesStrategicMerge:
@@ -15,6 +16,7 @@ patchesStrategicMerge:
1516
#- patches/webhook_in_scantypes.yaml
1617
#- patches/webhook_in_persistenceproviders.yaml
1718
#- patches/webhook_in_parsedefinitions.yaml
19+
#- patches/webhook_in_scheduledscans.yaml
1820
# +kubebuilder:scaffold:crdkustomizewebhookpatch
1921

2022
# [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
@@ -23,6 +25,7 @@ patchesStrategicMerge:
2325
#- patches/cainjection_in_scantypes.yaml
2426
#- patches/cainjection_in_persistenceproviders.yaml
2527
#- patches/cainjection_in_parsedefinitions.yaml
28+
#- patches/cainjection_in_scheduledscans.yaml
2629
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
2730

2831
# the following config is for teaching kustomize how to do kustomization for CRDs.

‎operator/config/crd/patches/cainjection_in_scheduledscans.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# The following patch adds a directive for certmanager to inject CA into the CRD
2+
# CRD conversion requires k8s 1.13 or later.
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
annotations:
7+
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
8+
name: scheduledscans.execution.experimental.securecodebox.io

‎operator/config/crd/patches/webhook_in_scheduledscans.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# The following patch enables conversion webhook for CRD
2+
# CRD conversion requires k8s 1.13 or later.
3+
apiVersion: apiextensions.k8s.io/v1beta1
4+
kind: CustomResourceDefinition
5+
metadata:
6+
name: scheduledscans.execution.experimental.securecodebox.io
7+
spec:
8+
conversion:
9+
strategy: Webhook
10+
webhookClientConfig:
11+
# this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
12+
# but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
13+
caBundle: Cg==
14+
service:
15+
namespace: system
16+
name: webhook-service
17+
path: /convert

‎operator/config/rbac/role.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,26 @@ rules:
7171
- get
7272
- list
7373
- watch
74+
- apiGroups:
75+
- execution.experimental.securecodebox.io
76+
resources:
77+
- scheduledscans
78+
verbs:
79+
- create
80+
- delete
81+
- get
82+
- list
83+
- patch
84+
- update
85+
- watch
86+
- apiGroups:
87+
- execution.experimental.securecodebox.io
88+
resources:
89+
- scheduledscans/status
90+
verbs:
91+
- get
92+
- patch
93+
- update
7494
- apiGroups:
7595
- rbac.authorization.k8s.io
7696
resources:

‎operator/config/rbac/scheduledscan_editor_role.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# permissions for end users to edit scheduledscans.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: scheduledscan-editor-role
6+
rules:
7+
- apiGroups:
8+
- execution.experimental.securecodebox.io
9+
resources:
10+
- scheduledscans
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
19+
- apiGroups:
20+
- execution.experimental.securecodebox.io
21+
resources:
22+
- scheduledscans/status
23+
verbs:
24+
- get

‎operator/config/rbac/scheduledscan_viewer_role.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# permissions for end users to view scheduledscans.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: scheduledscan-viewer-role
6+
rules:
7+
- apiGroups:
8+
- execution.experimental.securecodebox.io
9+
resources:
10+
- scheduledscans
11+
verbs:
12+
- get
13+
- list
14+
- watch
15+
- apiGroups:
16+
- execution.experimental.securecodebox.io
17+
resources:
18+
- scheduledscans/status
19+
verbs:
20+
- get

0 commit comments

Comments
 (0)