Merge pull request #41 from Priyaccuknox/consol-charts

charts updated
accuknox · Sep 23, 2024 · d94f0da · d94f0da
2 parents b5eb695 + 28c882f
commit d94f0da
Show file tree

Hide file tree

Showing 41 changed files with 200 additions and 484 deletions.
diff --git a/cis-k8s-job/.helmignore → accuknox-k8s-job/cis-k8s-job/.helmignore b/cis-k8s-job/.helmignore → accuknox-k8s-job/cis-k8s-job/.helmignore
diff --git a/cis-k8s-job/Chart.yaml → accuknox-k8s-job/cis-k8s-job/Chart.yaml b/cis-k8s-job/Chart.yaml → accuknox-k8s-job/cis-k8s-job/Chart.yaml
diff --git a/cis-k8s-job/README.md → accuknox-k8s-job/cis-k8s-job/README.md b/cis-k8s-job/README.md → accuknox-k8s-job/cis-k8s-job/README.md
diff --git a/cis-k8s-job/templates/_helpers.tpl → ...8s-job/cis-k8s-job/templates/_helpers.tpl b/cis-k8s-job/templates/_helpers.tpl → ...8s-job/cis-k8s-job/templates/_helpers.tpl
diff --git a/cis-k8s-job/templates/cis-corn-job.yaml → ...8s-job/cis-k8s-job/templates/cis-job.yaml b/cis-k8s-job/templates/cis-corn-job.yaml → ...8s-job/cis-k8s-job/templates/cis-job.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.cis.enabled }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -18,17 +19,17 @@ spec:
             resources: {}
             env:
               - name: AUTH_TOKEN
-                value: {{ .Values.accuknox.authToken }}
+                value: {{ .Values.global.authToken }}
               - name: CLUSTER_NAME
-                value: {{ .Values.accuknox.clusterName }}
+                value: {{ .Values.global.clusterName }}
               - name: LABEL_NAME
-                value: {{ .Values.accuknox.label }}
+                value: {{ .Values.global.label }}
               - name: CLUSTER_ID
-                value: {{ .Values.accuknox.clusterId }}
+                value: {{ .Values.global.clusterId }}
               - name: TENANT_ID
-                value: {{ .Values.accuknox.tenantId | quote}}
+                value: {{ .Values.global.tenantId | quote}}
               - name: URL
-                value: {{ .Values.accuknox.url }}
+                value: {{ .Values.global.url }}
             volumeMounts:
             - mountPath: /data
               name: datapath
@@ -112,8 +113,10 @@ spec:
                 path: /opt/cni/bin/
               name: opt-cni-bin
 
-  schedule: "{{ .Values.accuknox.cronTab }}"
+  schedule: "{{ .Values.global.cronTab }}"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
 
 status: {}
+
+{{- end }}  
diff --git a/accuknox-k8s-job/cis-k8s-job/values.yaml b/accuknox-k8s-job/cis-k8s-job/values.yaml
@@ -0,0 +1,7 @@
+# Default values for cis-k8s-job.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+accuknox:
+  cis:
+    enabled: "false"
diff --git a/k8s-risk-assessment-job/.helmignore → ...s-job/k8s-risk-assessment-job/.helmignore b/k8s-risk-assessment-job/.helmignore → ...s-job/k8s-risk-assessment-job/.helmignore
diff --git a/k8s-risk-assessment-job/Chart.yaml → ...8s-job/k8s-risk-assessment-job/Chart.yaml b/k8s-risk-assessment-job/Chart.yaml → ...8s-job/k8s-risk-assessment-job/Chart.yaml
diff --git a/k8s-risk-assessment-job/README.md → ...k8s-job/k8s-risk-assessment-job/README.md b/k8s-risk-assessment-job/README.md → ...k8s-job/k8s-risk-assessment-job/README.md
diff --git a/accuknox-k8s-job/k8s-risk-assessment-job/templates/clusterrole.yaml b/accuknox-k8s-job/k8s-risk-assessment-job/templates/clusterrole.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.accuknox.riskassessment.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: k8s-risk-assessment-job-clusterrole
+rules:
+  - apiGroups:
+    - ""
+    - extensions
+    - apps
+    - batch
+    - rbac.authorization.k8s.io
+    - roles.rbac.authorization.k8s.io
+    - authorization.k8s.io
+    - certificates.k8s.io
+    - apiextensions.k8s.io
+    - admissionregistration.k8s.io
+    - networking.k8s.io
+    resources: ["*"]
+    verbs:  ["*"]
+
+{{- end }}  
diff --git a/...ent-job/templates/clusterrolebinding.yaml → ...ent-job/templates/clusterrolebinding.yaml b/...ent-job/templates/clusterrolebinding.yaml → ...ent-job/templates/clusterrolebinding.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.riskassessment.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -10,3 +11,5 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: k8s-risk-assessment-job-clusterrole
+
+{{- end }}  
diff --git a/...k-assessment-job/templates/configmap.yaml → ...k-assessment-job/templates/configmap.yaml b/...k-assessment-job/templates/configmap.yaml → ...k-assessment-job/templates/configmap.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.riskassessment.enabled }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -38,3 +39,5 @@ data:
     --header "Tenant-Id: ${TENANT_ID}" \
     --form "file=@\"/data/report.json\"" \
     "https://${URL}/api/v1/artifact/?tenant_id=${TENANT_ID}&data_type=KS&save_to_s3=false&label_id=${LABEL_NAME}"
+
+{{- end }}  
diff --git a/...isk-assessment-job/templates/cronjob.yaml → ...isk-assessment-job/templates/cronjob.yaml b/...isk-assessment-job/templates/cronjob.yaml → ...isk-assessment-job/templates/cronjob.yaml
@@ -1,10 +1,11 @@
+{{- if .Values.accuknox.riskassessment.enabled }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: k8s-risk-assessment-job
   namespace: {{ .Release.Namespace }}
 spec:
-  schedule: "{{ .Values.accuknox.cronTab }}"
+  schedule: "{{ .Values.global.cronTab }}"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
 
@@ -21,7 +22,7 @@ spec:
               args: ["scan", "framework", "allcontrols,clusterscan,mitre,nsa", "--format", "json", "--cache-dir", "/data/kubescape-cache", "--output", "/data/report.json", "--cluster-name=$(CLUSTER_NAME)"]
               env:
                 - name: CLUSTER_NAME
-                  value: {{ .Values.accuknox.clusterName }}
+                  value: {{ .Values.global.clusterName }}
               volumeMounts:
                 - name: datapath
                   mountPath: /data
@@ -32,25 +33,18 @@ spec:
                 - '/bin/sh'
                 - '/script/augment-and-push-results.sh'
               env:
-                - name: AUTH_TOKEN
-                  valueFrom:
-                    secretKeyRef:
-                      key: AUTH_TOKEN
-                      {{- if (.Values.accuknox.secretName | empty) }}
-                      name: k8s-risk-assessment-job-auth-token
-                      {{- else }}
-                      name: {{ .Values.accuknox.secretName }}
-                      {{- end }}
                 - name: URL
-                  value: {{ .Values.accuknox.URL }}
+                  value: {{ .Values.global.url }}
                 - name: TENANT_ID
-                  value: {{ .Values.accuknox.tenantID | quote }}
+                  value: {{ .Values.global.tenantId | quote }}
+                - name: AUTH_TOKEN
+                  value: {{ .Values.global.authToken }}
                 - name: CLUSTER_NAME
-                  value: {{ .Values.accuknox.clusterName }}
+                  value: {{ .Values.global.clusterName }}
                 - name: CLUSTER_ID
-                  value: {{ .Values.accuknox.clusterID | quote }}
+                  value: {{ .Values.global.clusterId | quote }}
                 - name: LABEL_NAME
-                  value: {{ .Values.accuknox.label }}
+                  value: {{ .Values.global.label }}
               volumeMounts:
                 - mountPath: /data
                   name: datapath
@@ -64,3 +58,4 @@ spec:
                 name: k8s-risk-assessment-job-script-configmap
           restartPolicy: OnFailure
           serviceAccount: k8s-risk-assessment-job-service-account
+{{- end }}  
diff --git a/...essment-job/templates/serviceaccount.yaml → ...essment-job/templates/serviceaccount.yaml b/...essment-job/templates/serviceaccount.yaml → ...essment-job/templates/serviceaccount.yaml
@@ -1,5 +1,7 @@
+{{- if .Values.accuknox.riskassessment.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: k8s-risk-assessment-job-service-account
   namespace: {{ .Release.Namespace }}
+{{- end }}  
diff --git a/k8s-risk-assessment-job/values.yaml → ...s-job/k8s-risk-assessment-job/values.yaml b/k8s-risk-assessment-job/values.yaml → ...s-job/k8s-risk-assessment-job/values.yaml
@@ -10,11 +10,5 @@ kubescape:
 replicaCount: 1
 
 accuknox:
-  authToken: "NO-TOKEN-SET"
-  URL: "cspm.demo.accuknox.com"
-  tenantID: ""
-  cronTab: "30 9 * * *"
-  clusterName: ""
-  clusterID: 0
-  label: ""
-  secretName: ""
+  riskassessment:
+    enabled: "false"
diff --git a/k8tls-job/.helmignore → accuknox-k8s-job/k8tls-job/.helmignore b/k8tls-job/.helmignore → accuknox-k8s-job/k8tls-job/.helmignore
diff --git a/k8tls-job/Chart.yaml → accuknox-k8s-job/k8tls-job/Chart.yaml b/k8tls-job/Chart.yaml → accuknox-k8s-job/k8tls-job/Chart.yaml
diff --git a/k8tls-job/README.md → accuknox-k8s-job/k8tls-job/README.md b/k8tls-job/README.md → accuknox-k8s-job/k8tls-job/README.md
diff --git a/k8tls-job/templates/_helpers.tpl → ...-k8s-job/k8tls-job/templates/_helpers.tpl b/k8tls-job/templates/_helpers.tpl → ...-k8s-job/k8tls-job/templates/_helpers.tpl
diff --git a/k8tls-job/templates/k8tls-cronjob.yaml → ...8s-job/k8tls-job/templates/k8tls-job.yaml b/k8tls-job/templates/k8tls-cronjob.yaml → ...8s-job/k8tls-job/templates/k8tls-job.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.k8tls.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -47,15 +48,17 @@ spec:
             resources: {}
             env:
               - name: URL
-                value: {{ .Values.accuknox.URL }}
+                value: {{ .Values.global.url }}
               - name: TENANT_ID
-                value: {{ .Values.accuknox.tenantID | quote }}
+                value: {{ .Values.global.tenantId | quote }}
               - name: AUTH_TOKEN
-                value: {{ .Values.accuknox.authToken }}
+                value: {{ .Values.global.authToken }}
               - name: CLUSTER_NAME
-                value: {{ if ne .Values.accuknox.clusterName "" }}{{ .Values.accuknox.clusterName }}{{ else }}{{ "default" }}{{ end }}
+                value: {{ if ne .Values.global.clusterName "" }}{{ .Values.global.clusterName }}{{ else }}{{ "default" }}{{ end }}
+              - name: CLUSTER_ID
+                value: {{ if ne .Values.global.clusterId "" }}{{ .Values.global.clusterId }}{{ else }}{{ "default" }}{{ end }}
               - name: LABEL_NAME
-                value: {{ if ne .Values.accuknox.label "" }}{{ .Values.accuknox.label }}{{ else }}{{ "default" }}{{ end }}
+                value: {{ if ne .Values.global.label "" }}{{ .Values.global.label }}{{ else }}{{ "default" }}{{ end }}
             volumeMounts:
               - mountPath: /data
                 name: datapath
@@ -75,6 +78,8 @@ spec:
             - name: datapath
               emptyDir: {}
 
-  schedule: "{{ .Values.accuknox.cronTab }}"
+  schedule: "{{ .Values.global.cronTab }}"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
+
+{{- end }}  
diff --git a/k8tls-job/values.yaml → accuknox-k8s-job/k8tls-job/values.yaml b/k8tls-job/values.yaml → accuknox-k8s-job/k8tls-job/values.yaml
@@ -3,9 +3,5 @@
 # Declare variables to be passed into your templates.
 
 accuknox:
-  authToken: "NO-TOKEN-SET"
-  cronTab: "30 9 * * *"
-  tenantID: ""
-  clusterName: ""
-  label: ""
-  URL: "cspm.demo.accuknox.com"
+  k8tls:
+    enabled: "false"
diff --git a/kiem-job/.helmignore → accuknox-k8s-job/kiem-job/.helmignore b/kiem-job/.helmignore → accuknox-k8s-job/kiem-job/.helmignore
diff --git a/kiem-job/Chart.yaml → accuknox-k8s-job/kiem-job/Chart.yaml b/kiem-job/Chart.yaml → accuknox-k8s-job/kiem-job/Chart.yaml
diff --git a/kiem-job/templates/_helpers.tpl → ...x-k8s-job/kiem-job/templates/_helpers.tpl b/kiem-job/templates/_helpers.tpl → ...x-k8s-job/kiem-job/templates/_helpers.tpl
diff --git a/kiem-job/templates/deployment.yaml → ...8s-job/kiem-job/templates/deployment.yaml b/kiem-job/templates/deployment.yaml → ...8s-job/kiem-job/templates/deployment.yaml
@@ -1,10 +1,11 @@
+{{- if .Values.accuknox.kiem.enabled }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: kiem-job
   namespace: {{ .Release.Namespace }}
 spec:
-  schedule: "{{ .Values.accuknox.cronTab }}"  
+  schedule: "{{ .Values.global.cronTab }}"  
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
   jobTemplate:
@@ -20,7 +21,7 @@ spec:
               args: ["./kiem", "run", "--mode", "k8s", "--output", "/data/report.json"]
               env:
                 - name: CLUSTER_NAME
-                  value: {{ .Values.accuknox.clusterName }}
+                  value: {{ .Values.global.clusterName }}
               volumeMounts:
                 - name: datapath
                   mountPath: /data
@@ -31,15 +32,15 @@ spec:
               resources: {}
               env:
                 - name: URL
-                  value: {{ .Values.accuknox.URL }}
+                  value: {{ .Values.global.url }}
                 - name: TENANT_ID
-                  value: {{ .Values.accuknox.tenantID | quote }}
+                  value: {{ .Values.global.tenantId | quote }}
                 - name: AUTH_TOKEN
-                  value: {{ .Values.accuknox.authToken }}
+                  value: {{ .Values.global.authToken }}
                 - name: CLUSTER_NAME
-                  value: {{ .Values.accuknox.clusterName }}
+                  value: {{ .Values.global.clusterName }}
                 - name: LABEL_NAME
-                  value: {{ .Values.accuknox.label | quote}}
+                  value: {{ .Values.global.label | quote}}
               volumeMounts:
                 - mountPath: /data
                   name: datapath      
@@ -49,4 +50,4 @@ spec:
           restartPolicy: OnFailure
           serviceAccount: kiem-service-account
 
-
+{{- end }}  
diff --git a/kiem-job/templates/job.yaml → accuknox-k8s-job/kiem-job/templates/job.yaml b/kiem-job/templates/job.yaml → accuknox-k8s-job/kiem-job/templates/job.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.kiem.enabled }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -15,7 +16,7 @@ spec:
           args: ["./kiem", "run", "--mode", "k8s", "--output", "/data/report.json"]
           env:
             - name: CLUSTER_NAME
-              value: {{ .Values.accuknox.clusterName }}
+              value: {{ .Values.global.clusterName }}
           volumeMounts:
             - name: datapath
               mountPath: /data
@@ -26,20 +27,22 @@ spec:
           resources: {}
           env:
             - name: URL
-              value: {{ .Values.accuknox.URL }}
+              value: {{ .Values.global.url }}
             - name: TENANT_ID
-              value: {{ .Values.accuknox.tenantID | quote }}
+              value: {{ .Values.global.tenantId | quote }}
             - name: AUTH_TOKEN
-              value: {{ .Values.accuknox.authToken }}
+              value: {{ .Values.global.authToken }}
             - name: CLUSTER_NAME
-              value: {{ .Values.accuknox.clusterName }}
+              value: {{ .Values.global.clusterName }}
             - name: LABEL_NAME
-              value: {{ .Values.accuknox.label | quote}}
+              value: {{ .Values.global.label | quote}}
           volumeMounts:
             - mountPath: /data
               name: datapath      
       volumes:
         - name: datapath
           emptyDir: {}
       restartPolicy: OnFailure
-      serviceAccount: kiem-service-account
+      serviceAccount: kiem-service-account
+
+{{- end }}  
diff --git a/kiem-job/templates/role.yaml → ...knox-k8s-job/kiem-job/templates/role.yaml b/kiem-job/templates/role.yaml → ...knox-k8s-job/kiem-job/templates/role.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.kiem.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -31,3 +32,5 @@ rules:
         - get
         - list
         - watch
+
+{{- end }}  
diff --git a/kiem-job/templates/rolebinding.yaml → ...s-job/kiem-job/templates/rolebinding.yaml b/kiem-job/templates/rolebinding.yaml → ...s-job/kiem-job/templates/rolebinding.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.accuknox.kiem.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -9,4 +10,6 @@ subjects:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kiem-cluster-role
+  name: kiem-cluster-role
+
+{{- end }}  
diff --git a/accuknox-k8s-job/kiem-job/templates/serviceaccount.yaml b/accuknox-k8s-job/kiem-job/templates/serviceaccount.yaml
@@ -0,0 +1,8 @@
+{{- if .Values.accuknox.kiem.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kiem-service-account
+  namespace: {{ .Release.Namespace }}
+
+{{- end }}  
diff --git a/kiem-job/values.yaml → accuknox-k8s-job/kiem-job/values.yaml b/kiem-job/values.yaml → accuknox-k8s-job/kiem-job/values.yaml
@@ -5,9 +5,5 @@
 replicaCount: 1
 
 accuknox:
-  authToken: "NO-TOKEN-SET"
-  URL: "cspm.demo.accuknox.com"
-  tenantID: ""
-  cronTab: "30 9 * * *"
-  clusterName: ""
-  label: ""
+  kiem:
+    enabled: "false"