-
Notifications
You must be signed in to change notification settings - Fork 2
/
_manifest_.yaml
121 lines (121 loc) · 2.69 KB
/
_manifest_.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
---
apiVersion: v1
kind: Service
metadata:
name: grypy
namespace: default
labels:
name: grypy
spec:
ports:
- name: webhook
port: 443
targetPort: 8080
selector:
name: grypy
---
# https://github.com/anchore/grype#configuration
# Fill out .grype/config.yaml with some nice-to-haves
# Ignore rules for whitelisting: https://github.com/anchore/grype#specifying-matches-to-ignore
apiVersion: v1
kind: ConfigMap
metadata:
name: grypeconfig
data:
config.yaml: |
check-for-app-update: true
output: "table"
quiet: false
db:
auto-update: true
cache-dir: "/tmp"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: grypy
namespace: default
labels:
name: grypy
spec:
replicas: 1
selector:
matchLabels:
name: grypy
template:
metadata:
name: grypy
labels:
name: grypy
spec:
${CONSTRUCTED_SECRET}
containers:
- name: webhook
image: ghcr.io/boxboat/grypeadmissioncontroller:${GRYPE_VERSION}
imagePullPolicy: Always
args:
- -alsologtostderr
- --log_dir=/
- -v=10
- 2>&1
env:
- name: SEVERITY
value: "medium"
- name: XDG_CONFIG_HOME
value: "/"
resources:
limits:
memory: 50Mi
cpu: 300m
requests:
memory: 00Mi
cpu: 300m
volumeMounts:
- name: webhook-certs
mountPath: /etc/certs
readOnly: true
- name: logs
mountPath: /tmp
- name: config
mountPath: "/grype"
readOnly: true
securityContext:
readOnlyRootFilesystem: true
volumes:
- name: webhook-certs
secret:
secretName: grypy
- name: logs
emptyDir: {}
- name: config
configMap:
name: grypeconfig
items:
- key: "config.yaml"
path: "config.yaml"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: grypy
webhooks:
- name: grypy.kubernetes.io
clientConfig:
service:
name: grypy
namespace: default
path: "/validate"
caBundle: "${CA_BUNDLE}"
rules:
- operations: ["CREATE","UPDATE"]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
failurePolicy: Ignore
sideEffects: None
admissionReviewVersions: ["v1", "v1beta1"]
namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: NotIn
values: ["kube-system"]