feat: jobs consolidation

accuknox-jobs/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

accuknox-jobs/Chart.yaml

@@ -0,0 +1,43 @@
+apiVersion: v2
+name: accuknox-jobs
+description: A Helm chart for managing Kubernetes jobs including CIS compliance checks, risk assessment jobs, TLS management jobs, and more.
+
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
+
+dependencies:
+  - name: cis-k8s-job
+    version: "0.1.0"
+    repository: "file:/./charts/cis-k8s-job"
+    condition: accuknox-jobs.cis.enabled  
+  - name: k8s-risk-assessment-job
+    version: "0.1.0"
+    repository: "file:/./charts/k8s-risk-assessment-job"
+    condition: accuknox-jobs.riskassessment.enabled  
+  # - name: k8tls-job
+  #   version: "0.1.0"
+  #   repository: "file:/./charts/k8tls-job"
+  #   condition: accuknox-jobs.k8tls.enabled  # Updated if needed (currently commented)
+  - name: kiem-job
+    version: "0.1.0"
+    repository: "file:/./charts/kiem-job"
+    condition: accuknox-jobs.kiem.enabled  

accuknox-jobs/charts/cis-k8s-job/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

accuknox-jobs/charts/cis-k8s-job/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: cis-k8s-job
+description: A Helm chart for Kubernetes CIS Benchmarks
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "v0.1.0"

accuknox-jobs/charts/cis-k8s-job/README.md

@@ -0,0 +1,78 @@
+# AccuKnox CIS K8s Job
+Instruction to perform CIS Benchmark on Cluster via AccuKnox CIS K8s Job
+
+### Prerequisites:
+- [Docker](https://docs.docker.com/engine/install/)
+- [Helm (v3.13.1 or later)](https://v3.helm.sh/docs/intro/install/)
+
+### Parameters:
+| Variable             | Sample Value                     | Description                          |
+| -------------------- | -------------------------------- | ------------------------------------ |
+| accuknox.url         | cspm.demo.accuknox.com           | AccuKnox CSPM Endpoint URL           |
+| accuknox.tenantId    | 2                                | AccuKnox Tenant ID                   |
+| accuknox.label       | CIS                              | AccuKnox Label                       |
+| accuknox.authToken   | $token                           | AccuKnox Token                       |
+| accuknox.clusterName | $clusterName                     | Cluster Name                         |
+| accuknox.cronTab     | 30 9 * * *                       | CronJob (UTC)                        |
+| toolConfig.platform  | "GKE" OR "AKS" | Name of the platform. Default: empty |
+| toolConfig.nodeType  | master OR controlplane           | For node selection                   |
+| toolConfig.targets   | "master,controlplane,node"       | [Ref](https://github.com/aquasecurity/kube-bench/blob/main/docs/flags-and-commands.md#specifying-benchmark-sections) |
+| toolConfig.benchmark  | "gke-1.6.0" | [Ref](https://github.com/aquasecurity/kube-bench/blob/main/docs/platforms.md) |
+| toolConfig.check | "1.1.1,1.2.3"     | Control IDs to check |
+| toolConfig.skip | "1.1.1,1.3.1" | Control IDs to skip |
+
+
+## Schedule CIS Job on cluster
+#### Clone GitHub and switch to CIS K8s Job folder
+```sh
+git clone https://github.com/accuknox/accuknox-jobs.git && cd accuknox-jobs/cis-k8s-job
+```
+
+#### Helm Command to deploy AccuKnox CIS K8s Job locally:
+```sh
+helm upgrade --install accuknox-cis-k8s . \
+    --set accuknox.url="cspm.demo.accuknox.com" \
+    --set accuknox.tenantId="$tenantId" \
+    --set accuknox.label="$label" \
+    --set accuknox.authToken="$token" \
+    --set accuknox.clusterName="$clusterName" \
+    --set accuknox.cronTab="30 9 * * *"
+```
+
+### Note:
+- You can get AccuKnox Token & Tenant ID from AccuKnox SaaS under navigation `Settings > Tokens`
+- You can get AccuKnox Label from AccuKNox SaaS under navigation `Settings > Labels`
+
+---
+## Manual Procedure
+Instruction to perform CIS Benchmark manually using [kube-bench](https://github.com/aquasecurity/kube-bench) binary
+
+### Prerequisites:
+- [Kube-Bench](https://github.com/aquasecurity/kube-bench)
+- [jq](https://jqlang.github.io/jq/download/)
+- [Cluster Context](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_config/kubectl_config_use-context/)
+
+### Steps to follow:
+ - Getting output file as `results.json` on current-context of selected cluster
+```sh
+kube-bench run --config-dir ~/test/KubeBench/cfg/ --json --outputfile results.json
+```
+> Make sure you provide correct `--config-dir`.
+
+ - Adding **Metadata** to above output file
+```sh
+cat <<<$(jq '. += {
+    "Metadata": {
+        "cluster_name":"$cluster",
+        "label_name":"$label"}}
+    ' results.json) >results.json
+```
+> Replace value of `$cluster` with cluster name & `$label` with AccuKnox Label
+
+ - Sending output file to AccuKnox SaaS
+```sh
+curl --location --request POST 'https://cspm.demo.accuknox.com/api/v1/artifact/?tenant_id=$tenantId&data_type=KB&save_to_s3=true' --header 'Tenant-Id: $tenantId' --header "Authorization: Bearer $token" --form 'file=@"./results.json"'
+```
+> Replace value of `$tenantId` from AccuKnox Tenant ID & `$token` from AccuKnox Token
+
+ - You should be able to see a successful message as **{"detail":"File received successfully"}**

accuknox-jobs/charts/cis-k8s-job/templates/_helpers.tpl

@@ -0,0 +1,203 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cis-k8s-job.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cis-k8s-job.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cis-k8s-job.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "cis-k8s-job.labels" -}}
+helm.sh/chart: {{ include "cis-k8s-job.chart" . }}
+{{ include "cis-k8s-job.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "cis-k8s-job.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cis-k8s-job.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cis-k8s-job.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cis-k8s-job.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "volumes" }}
+- name: datapath
+  emptyDir: {}
+- name: var-lib-kubelet
+  hostPath:
+    path: "/var/lib/kubelet"
+- name: etc-systemd
+  hostPath:
+    path: "/etc/systemd"
+- name: etc-kubernetes
+  hostPath:
+    path: "/etc/kubernetes"
+{{- if .platform | empty }}
+- name: var-lib-cni
+  hostPath:
+    path: /var/lib/cni
+- hostPath:
+    path: /var/lib/etcd
+  name: var-lib-etcd
+- hostPath:
+    path: /var/lib/kube-scheduler
+  name: var-lib-kube-scheduler
+- hostPath:
+    path: /var/lib/kube-controller-manager
+  name: var-lib-kube-controller-manager
+- hostPath:
+    path: /lib/systemd
+  name: lib-systemd
+- hostPath:
+    path: /srv/kubernetes
+  name: srv-kubernetes
+- hostPath:
+    path: /usr/bin
+  name: usr-bin
+- hostPath:
+    path: /etc/cni/net.d/
+  name: etc-cni-netd
+- hostPath:
+    path: /opt/cni/bin/
+  name: opt-cni-bin
+{{- else if eq .platform "GKE" }}
+- name: home-kubernetes
+  hostPath:
+    path: "/home/kubernetes"
+{{- else if eq .platform "AKS" }}
+- name: etc-default
+  hostPath:
+    path: "/etc/default"
+{{- end }}
+{{- end }}
+
+{{- define "volumeMounts" }}
+- mountPath: /data
+  name: datapath
+- name: var-lib-kubelet
+  mountPath: /var/lib/kubelet
+  readOnly: true
+- name: etc-systemd
+  mountPath: /etc/systemd
+  readOnly: true
+- name: etc-kubernetes
+  mountPath: /etc/kubernetes
+  readOnly: true
+{{- if .platform | empty }}
+- name: var-lib-cni
+  mountPath: /var/lib/cni
+  readOnly: true
+- mountPath: /var/lib/etcd
+  name: var-lib-etcd
+  readOnly: true
+- mountPath: /var/lib/kube-scheduler
+  name: var-lib-kube-scheduler
+  readOnly: true
+- mountPath: /var/lib/kube-controller-manager
+  name: var-lib-kube-controller-manager
+  readOnly: true
+- mountPath: /lib/systemd/
+  name: lib-systemd
+  readOnly: true
+- mountPath: /srv/kubernetes/
+  name: srv-kubernetes
+  readOnly: true
+- mountPath: /usr/local/mount-from-host/bin
+  name: usr-bin
+  readOnly: true
+- mountPath: /etc/cni/net.d/
+  name: etc-cni-netd
+  readOnly: true
+- mountPath: /opt/cni/bin/
+  name: opt-cni-bin
+  readOnly: true
+{{- else if eq .platform "GKE" }}
+- name: home-kubernetes
+  mountPath: /home/kubernetes
+  readOnly: true
+{{- else if eq .platform "AKS" }}
+- name: etc-default
+  mountPath: /etc/default
+  readOnly: true
+{{- end }}
+{{- end }}
+
+{{- define "cmd" }}
+- kube-bench
+- run
+- --json
+- --outputfile=/data/report.json
+{{- if not (.targets | empty) }}
+- --targets="{{ .targets }}"
+{{- end }}
+{{- if not (.benchmark | empty) }}
+- --benchmark="{{ .benchmark }}"
+{{- end }}
+{{- if not (.check | empty) }}
+- --check="{{ .check }}"
+{{- end }}
+{{- if not (.skip | empty) }}
+- --skip="{{ .skip }}"
+{{- end }}
+{{- end }}
+
+{{- define "masterConfig" }}
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+        - matchExpressions:
+            - key: node-role.kubernetes.io/master
+              operator: Exists
+tolerations:
+  - key: node-role.kubernetes.io/master
+    operator: Exists
+    effect: NoSchedule
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+{{- end }}