diff --git a/accuknox-cis-job/values.yaml b/accuknox-cis-job/values.yaml index 9c1f4cf..4bc7243 100644 --- a/accuknox-cis-job/values.yaml +++ b/accuknox-cis-job/values.yaml @@ -5,3 +5,5 @@ accuknox: authToken: "NO-TOKEN-SET" cronTab: "0 */4 * * *" + clusterName: "" + label: "" \ No newline at end of file diff --git a/accuknox-k8tls-job/values.yaml b/accuknox-k8tls-job/values.yaml index f938ef1..1c41ede 100644 --- a/accuknox-k8tls-job/values.yaml +++ b/accuknox-k8tls-job/values.yaml @@ -5,3 +5,5 @@ accuknox: authToken: "NO-TOKEN-SET" cronTab: "0 */4 * * *" + clusterName: "" + label: "" \ No newline at end of file diff --git a/accuknox-kiem-job/.helmignore b/accuknox-kiem-job/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/accuknox-kiem-job/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/accuknox-kiem-job/Chart.yaml b/accuknox-kiem-job/Chart.yaml new file mode 100644 index 0000000..432242b --- /dev/null +++ b/accuknox-kiem-job/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: accuknox-kiem-job +description: A Helm chart for Accukinx Kiem + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/accuknox-kiem-job/templates/_helpers.tpl b/accuknox-kiem-job/templates/_helpers.tpl new file mode 100644 index 0000000..624610b --- /dev/null +++ b/accuknox-kiem-job/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "accuknox-kiem-job.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "accuknox-kiem-job.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "accuknox-kiem-job.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "accuknox-kiem-job.labels" -}} +helm.sh/chart: {{ include "accuknox-kiem-job.chart" . }} +{{ include "accuknox-kiem-job.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "accuknox-kiem-job.selectorLabels" -}} +app.kubernetes.io/name: {{ include "accuknox-kiem-job.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "accuknox-kiem-job.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "accuknox-kiem-job.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/accuknox-kiem-job/templates/deployment.yaml b/accuknox-kiem-job/templates/deployment.yaml new file mode 100644 index 0000000..6aa6d12 --- /dev/null +++ b/accuknox-kiem-job/templates/deployment.yaml @@ -0,0 +1,50 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: accuknox-kiem-job + namespace: {{ .Release.Namespace }} +spec: + schedule: "{{ .Values.accuknox.cronTab }}" + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 1 + + jobTemplate: + metadata: + labels: + app: accuknox-kiem-job + spec: + template: + spec: + initContainers: + - name: kiem-init + image: accuknox/kiem:latest + args: ["./kiem", "run", "--mode", "k8s", "--output", "/data/report.json"] + env: + - name: CLUSTER_NAME + value: {{ .Values.accuknox.clusterName }} + volumeMounts: + - name: datapath + mountPath: /data + containers: + - image: accuknox/accuknox-job:latest + command: ["/bin/sh", "-c"] + args: ["curl www.google.com && echo $AUTH_TOKEN"] + name: accuknox-kiem-cronjob + resources: {} + env: + - name: AUTH_TOKEN + value: {{ .Values.accuknox.authToken }} + - name: CLUSTER_NAME + value: {{ .Values.accuknox.clusterName }} + - name: LABEL_NAME + value: {{ .Values.accuknox.label }} + volumeMounts: + - mountPath: /data + name: datapath + volumes: + - name: datapath + emptyDir: {} + restartPolicy: OnFailure + serviceAccount: kiem-service-account + + diff --git a/accuknox-kiem-job/templates/role.yaml b/accuknox-kiem-job/templates/role.yaml new file mode 100644 index 0000000..810266a --- /dev/null +++ b/accuknox-kiem-job/templates/role.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kiem-cluster-role +rules: + - apiGroups: + - "" + - extensions + - apps + - rbac.authorization.k8s.io + - roles.rbac.authorization.k8s.io + - authorization.k8s.io + - certificates.k8s.io + - apiextensions.k8s.io + resources: ["*"] + verbs: ["*"] diff --git a/accuknox-kiem-job/templates/rolebinding.yaml b/accuknox-kiem-job/templates/rolebinding.yaml new file mode 100644 index 0000000..a0ea35b --- /dev/null +++ b/accuknox-kiem-job/templates/rolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: api-cluster-role-binding +subjects: +- namespace: {{ .Release.Namespace }} + kind: ServiceAccount + name: kiem-service-account +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kiem-cluster-role \ No newline at end of file diff --git a/accuknox-kiem-job/templates/serviceaccount.yaml b/accuknox-kiem-job/templates/serviceaccount.yaml new file mode 100644 index 0000000..53ad66e --- /dev/null +++ b/accuknox-kiem-job/templates/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kiem-service-account + namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/accuknox-kiem-job/values.yaml b/accuknox-kiem-job/values.yaml new file mode 100644 index 0000000..ee2dde6 --- /dev/null +++ b/accuknox-kiem-job/values.yaml @@ -0,0 +1,13 @@ +# Default values for accuknox-kiem-job. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +accuknox: + authToken: "NO-TOKEN-SET" + cronTab: "0 */6 * * *" + clusterName: "" + label: "" + +