Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/insights handler trivy server #621

Merged
merged 9 commits into from
Oct 30, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions charts/lagoon-core/Chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ type: application
# time you make changes to the chart and its templates, including the app
# version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 1.38.0
version: 1.39.0

# This is the version number of the application being deployed. This version
# number should be incremented each time you make changes to the application.
Expand All @@ -40,7 +40,5 @@ dependencies:
# Valid supported kinds are added, changed, deprecated, removed, fixed and security
annotations:
artifacthub.io/changes: |
- kind: changed
description: require minimum Kubernetes 1.23
- kind: changed
description: removed autoscaling api version helper
- kind: added
description: Insights trivy service
29 changes: 29 additions & 0 deletions charts/lagoon-core/templates/_helpers.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,35 @@ app.kubernetes.io/component: {{ include "lagoon-core.insightsHandler.fullname" .
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

{{/*
Create a default fully qualified app name for insights-trivy.
*/}}
{{- define "lagoon-core.insightsTrivy.fullname" -}}
{{- include "lagoon-core.fullname" . }}-insights-trivy
{{- end }}

{{/*
Common labels insights-trivy.
*/}}
{{- define "lagoon-core.insightsTrivy.labels" -}}
helm.sh/chart: {{ include "lagoon-core.chart" . }}
{{ include "lagoon-core.insightsTrivy.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

{{/*
Selector labels insights-trivy.
*/}}
{{- define "lagoon-core.insightsTrivy.selectorLabels" -}}
app.kubernetes.io/name: {{ include "lagoon-core.name" . }}
app.kubernetes.io/component: {{ include "lagoon-core.insightsTrivy.fullname" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}


{{/*
Create a default fully qualified app name for logs2notifications.
*/}}
Expand Down
6 changes: 6 additions & 0 deletions charts/lagoon-core/templates/insights-handler.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,12 @@ spec:
value: http://{{ include "lagoon-core.api.fullname" . }}:{{ .Values.api.service.port }}/graphql
- name: HTTP_LISTEN_PORT
value: "3000"
{{- if .Values.insightsHandler.trivy.enabled }}
- name: PROBLEMS_FROM_SBOM
value: "true"
- name: TRIVY_SERVER_ENDPOINT
value: http://{{ include "lagoon-core.insightsTrivy.fullname" . }}:{{ .Values.insightsHandler.trivy.service.port }}
{{- end }}
{{- range $key, $val := .Values.insightsHandler.additionalEnvs }}
- name: {{ $key }}
value: {{ $val | quote }}
Expand Down
75 changes: 75 additions & 0 deletions charts/lagoon-core/templates/insights-trivy.deployment.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
{{- if .Values.insightsHandler.trivy.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "lagoon-core.insightsTrivy.fullname" . }}
labels:
{{- include "lagoon-core.insightsTrivy.labels" . | nindent 4 }}
spec:
selector:
matchLabels:
{{- include "lagoon-core.insightsTrivy.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.insightsHandler.trivy.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "lagoon-core.insightsTrivy.selectorLabels" . | nindent 8 }}
spec:
securityContext:
{{- toYaml (coalesce .Values.insightsHandler.trivy.podSecurityContext .Values.podSecurityContext) | nindent 8 }}
containers:
- name: insights-trivy
securityContext:
{{- toYaml .Values.insightsHandler.trivy.securityContext | nindent 10 }}
image: "{{ .Values.insightsHandler.trivy.image.repository }}:{{ coalesce .Values.insightsHandler.trivy.image.tag .Values.imageTag .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.insightsHandler.trivy.image.pullPolicy }}
resources:
{{- toYaml .Values.insightsHandler.trivy.resources | nindent 10 }}
command: ["trivy", "server", "--cache-dir=/tmp", "--listen=0.0.0.0:4954", "-d"]
ports:
- containerPort: 4954
protocol: TCP
name: tcp-4954
livenessProbe:
httpGet:
path: /healthz
port: 4954
readinessProbe:
httpGet:
path: /healthz
port: 4954
{{- with .Values.insightsHandler.trivy.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 50
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- {{ include "lagoon-core.name" . }}
- key: app.kubernetes.io/component
operator: In
values:
- {{ include "lagoon-core.insightsTrivy.fullname" . }}
- key: app.kubernetes.io/instance
operator: In
values:
- {{ .Release.Name }}
topologyKey: kubernetes.io/hostname
{{- with .Values.insightsHandler.trivy.affinity }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.insightsHandler.trivy.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
16 changes: 16 additions & 0 deletions charts/lagoon-core/templates/insights-trivy.service.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{{- if .Values.insightsHandler.trivy.enabled -}}
apiVersion: v1
kind: Service
metadata:
name: {{ include "lagoon-core.insightsTrivy.fullname" . }}
labels:
{{- include "lagoon-core.insightsTrivy.labels" . | nindent 4 }}
spec:
type: {{ .Values.insightsHandler.trivy.service.type }}
ports:
- port: {{ .Values.insightsHandler.trivy.service.port }}
targetPort: 4954
name: tcp-4954
selector:
{{- include "lagoon-core.insightsTrivy.selectorLabels" . | nindent 4 }}
{{- end }}
8 changes: 8 additions & 0 deletions charts/lagoon-core/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,14 @@ insightsHandler:
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
trivy:
enabled: false
image:
repository: aquasec/trivy
tag: latest
service:
type: ClusterIP
port: 4954

logs2notifications:
enabled: true
Expand Down
Loading