twistlock-updater.yaml

apiVersion: v1
kind: Namespaces
metadata:
  name: twistlock
---
apiVersion: v1
kind: ServiceAccount # Service Account is used for managing security context constraints policies in Openshift (SCC)
metadata:
  name: twistlock-updater-service
  namespace: twistlock
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: twistlock-updater-clusterrole
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles", "clusterrolebindings"] 
  verbs: ["create", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"] # Allow Defenders to list RBAC resources
  verbs: ["list"]
- apiGroups: ["security.istio.io"]
  resources: ["authorizationpolicies", "peerauthentications"] # Allow Defenders to list Istio security resources
  verbs: ["list"]
- apiGroups: ["networking.istio.io"]
  resources: ["virtualservices", "destinationrules", "gateways"] # Allow Defenders to list Istio networking resources
  verbs: ["list"]
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods", "endpoints", "services"] # Allow Defenders to list pods, services and endpoints
  verbs: ["list"]
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods/proxy"] # Allow Defenders to get pod proxy
  verbs: ["get"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"] # Allow Defenders to get Deployments and ReplicaSets
  verbs: ["get"]
- apiGroups: [""] # Core API
  resources: ["namespaces", "pods"] # Allow Defenders to get Namespaces and Pods
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: twistlock-updater-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: twistlock-updater-clusterrole
subjects:
- apiGroup:
  kind: ServiceAccount
  name: twistlock-updater-service
  namespace: twistlock
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: twistlock-updater-role
  namespace: twistlock
rules: 
- apiGroups:
  - "apps"
  resources:
  - "daemonsets"
  verbs: 
  - "list"
  - "create"
  - "delete"
- apiGroups: 
  - ""
  - "apps"
  - "rbac.authorization.k8s.io"
  resources: 
  - "secrets"
  - "serviceaccounts"
  - "services"
  verbs: 
  - "create"
  - "delete"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: twistlock-updater-rolebinding
  namespace: twistlock
subjects:
- kind: ServiceAccount
  name: twistlock-updater-service
  namespace: twistlock
roleRef:
  kind: Role
  name: twistlock-updater-role
  apiGroup: rbac.authorization.k8s.io
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: twistlock-updater-data
  namespace: twistlock
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: default
---
apiVersion: v1
data:
  .dockerconfigjson: ${DOCKER_CONFIG}
kind: Secret
metadata:
  name: twistlock-updater-pull-secret
  namespace: twistlock
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
kind: Secret
metadata:
  name: compute-secret
  namespace: twistlock
type: Opaque
data:
  username: ${PRISMA_USERNAME}
  password: ${PRISMA_PASSWORD}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: daemonset-extra-config
  namespace: twistlock
data:
  daemonset.extraconfig.yaml: |
    annotations:
      sample: value
#    proxy:
#      ca: "-----BEGIN CERTIFICATE-----"
#      httpProxy: "https://proxy.example.com:8443"
#      user: "myuser"
#      password: "mypasswd"
#    tolerations:
#      - effect: NoSchedule 
#        key: key1
#        operator: Exists
#        toleration_seconds: 0
#      - effect: NoExecute 
#        key: key1
#        operator: Equals
#        toleration_seconds: 0
#        value: value1
---
apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app: twistlock-updater
  name: twistlock-updater
  namespace: twistlock
spec:
  schedule: "0 0 * * Sun"
  timeZone: "Etc/UTC"
  jobTemplate:
    spec:
      template:
        metadata:
          name: twistlock-updater
          creationTimestamp: null
          labels:
            app: twistlock-updater
        spec:
          serviceAccountName: twistlock-updater-service
          securityContext:
            fsGroup: 10001
            seccompProfile:
              type: RuntimeDefault
          imagePullSecrets:
          - name: twistlock-updater-pull-secret
          containers:
          - image: {IMAGE_NAME}
            name: twistlock-updater
            env:
            - name: COMPUTE_API_ENDPOINT
              value: ${COMPUTE_API_ENDPOINT}
            - name: PRISMA_USERNAME
              valueFrom:
                secretKeyRef:
                  name: compute-secret
                  key: username
            - name: PRISMA_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: compute-secret
                  key: password
            - name: SKIP_VERIFY
              value: "false"
            - name: NAMESPACE
              value: twistlock
            - name: CONSOLE_NAME
              value: ""
            - name: COMMUNICATION_PORT
              value: ""
            - name: ORCHESTRATOR
              value: "kubernetes"
            - name: CONTAINER_RUNTIME
              value: "containerd"
            - name: COLLECT_POD_LABELS
              value: "true"
            - name: MONITOR_SERVICEACCOUNTS
              value: "true"
            - name: CLUSTER_NAME
              value: ""
            - name: RUNTIME_SOCKET_PATH
              value: ""
            - name: NODE_SELECTOR
              value: ''
            - name: ROLE_ARN
              value: ""
            - name: UNIQUE_HOSTNAME
              value: "false"
            - name: MONITOR_ISTIO
              value: "true"
            - name: BOTTLEROCKET
              value: "false"
            - name: GKE_AUTOPILOT
              value: "false"
            - name: TALOS
              value: "false"
            - name: IMAGE_NAME
              value: ""
            - name: IMAGE_PULL_SECRET
              value: ""
            - name: SELINUX
              value: "false"
            - name: PRIVILEGED
              value: "false"
            - name: CPU_LIMIT
              value: "0"
            - name: MEMORY_LIMIT
              value: "0"
            - name: PRIORITY_CLASS_NAME
              value: ""
            - name: PROJECT_ID
              value: ""
            - name: REGION
              value: "eastus"
            - name: DEBUG
              value: "false"
            securityContext:
              allowPrivilegeEscalation: false
              runAsNonRoot: true
              runAsUser: 10001
              capabilities:
                drop:
                - ALL
            imagePullPolicy: IfNotPresent
            volumeMounts:
            - mountPath: /app/twistlock
              name: twistlock-updater-data 
            - mountPath: /app/config
              name: daemonset-extra-config
            resources:
              limits:
                cpu: 500m
                memory: 2Gi
              requests:
                cpu: 100m
                memory: 128Mi
            terminationMessagePath: /dev/termination-log
            terminationMessagePolicy: File
          volumes:
          - name: twistlock-updater-data
            persistentVolumeClaim:
              claimName: "twistlock-updater-data"
          - name: daemonset-extra-config
            configMap:
              name: daemonset-extra-config
              items:
              - key: daemonset.extraconfig.yaml
                path: daemonset.extraconfig.yaml
          dnsPolicy: ClusterFirst
          restartPolicy: OnFailure