Feature - Enable post-build scanning in insights-remote

charts/lagoon-remote/Chart.yaml

@@ -40,6 +40,8 @@ dependencies:
 # Valid supported kinds are added, changed, deprecated, removed, fixed and security
 annotations:
   artifacthub.io/changes: |
+    - kind: changed
+      description: add buildScannerImage config to insights-remote
     - kind: changed
       description: update ssh-portal to v0.41.3
       links:

charts/lagoon-remote/templates/docker-host.networkpolicy.yaml

@@ -16,6 +16,14 @@ spec:
         matchExpressions:
         - key: lagoon.sh/buildName
           operator: Exists
+    - namespaceSelector:
+        matchExpressions:
+        - key: lagoon.sh/environment
+          operator: Exists
+      podSelector:
+        matchExpressions:
+        - key: insights.lagoon.sh/imagescanner
+          operator: Exists
   podSelector:
     matchLabels:
       {{- include "lagoon-remote.dockerHost.selectorLabels" . | nindent 6 }}

charts/lagoon-remote/templates/insights-remote.clusterrole.yaml

@@ -6,19 +6,64 @@ metadata:
   labels:
     {{- include "lagoon-remote.insightsRemote.labels" . | nindent 4 }}
 rules:
-  - verbs:
-      - '*'
-    apiGroups:
-      - ''
-    resources:
-      - configmaps
-      - secrets
-  - verbs:
-      - get
-      - watch
-      - list
-    apiGroups:
-      - ''
-    resources:
-      - namespaces
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
   {{- end }}

charts/lagoon-remote/templates/insights-remote.deployment.yaml

@@ -42,6 +42,12 @@ spec:
             - name: BURN_AFTER_READING
               value: "TRUE"
             {{- end }}
+            {{- if .Values.insightsRemote.enableBuildScanning }}
+            - name: ENABLE_BUILD_SCANNING
+              value: "TRUE"
+            - name: BUILD_SCANNER_IMAGE
+              value: "{{ coalesce .Values.insightsRemote.buildScannerImage "docker.io/uselagoon/insights-scanner:latest" }}"
+            {{- end }}
             - name: RABBITMQ_ADDRESS
               value: {{ required "A valid rabbitMQHostname required!" $rabbitMQHostname | quote }}
             - name: RABBITMQ_PASSWORD

charts/lagoon-remote/values.yaml

@@ -206,6 +206,12 @@ dbaasHTTPEndpoint: ""
 
 insightsRemote:
   enabled: false
+
+  # The following values control whether post-build insights scanning is enabled
+  enableBuildScanning: false
+  # If enabled, we deploy a particular image into the namespace, this can be overriden by the following
+  # buildScannerImage: docker.io/uselagoon/insights-scanner:latest
+
   # sets insights configMaps to be removed after being processed
   burnAfterReading: true