Skip to content

Commit 535d930

Browse files
author
Nissim Bitan
committed
Add pks deployment
1 parent 71af718 commit 535d930

File tree

12 files changed

+336
-0
lines changed

12 files changed

+336
-0
lines changed

‎automation/aquactl/aquasec.cfg‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ common:
5555
initEnforcer: {{ .Values.Common.InitEnforcer }}
5656
enforcerSecretName: {{ .Values.Common.EnforcerSecretName }}
5757
enforcerSecretKey: {{ .Values.Common.EnforcerSecretKey }}
58+
cybercenterAddress: {{ .Values.Common.CybercenterAddress }}
5859
{{- else }}
5960
# Aqua Common variables for all installation process
6061
# common:

‎orchestrators/pivotal-pks/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Kubernetes
2+
3+
## Deployments
4+
* [**Helm Charts**](https://github.com/aquasecurity/aqua-helm) - Helm charts for installing Aqua server components and Aqua enforcers.
5+
* [**Kubernetes Templates**](templates/) - Deploy the Aqua Server and Enforcer components on a Kubernetes cluster.
6+
7+
## Open Source Tools
8+
* [**kube-bench**](https://github.com/aquasecurity/kube-bench) - The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed according to security best practices.
9+
* [**kube-hunter**](https://github.com/aquasecurity/kube-hunter) - Hunt for security weaknesses in Kubernetes clusters.

‎orchestrators/pivotal-pks/templates/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# PKS CSP Deployment
2+
3+
For full guide enter this [**link**](https://docs.aquasec.com/docs/)

‎orchestrators/pivotal-pks/templates/enforcer/enforcer-daemonset.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
apiVersion: extensions/v1beta1
3+
kind: DaemonSet
4+
metadata:
5+
name: aqua-agent
6+
namespace:
7+
spec:
8+
template:
9+
metadata:
10+
labels:
11+
app: aqua-agent
12+
name: aqua-agent
13+
annotations:
14+
container.apparmor.security.beta.kubernetes.io/aqua-agent: unconfined
15+
spec:
16+
serviceAccount: aqua-sa
17+
hostPID: true
18+
containers:
19+
- name: aqua-agent
20+
image: registry.aquasec.com/enforcer:4.0
21+
securityContext:
22+
privileged: false
23+
capabilities:
24+
add:
25+
- SYS_ADMIN
26+
- NET_ADMIN
27+
- NET_RAW
28+
- SYS_PTRACE
29+
- KILL
30+
- MKNOD
31+
- SETGID
32+
- SETUID
33+
- SYS_MODULE
34+
- AUDIT_CONTROL
35+
- SYSLOG
36+
- SYS_CHROOT
37+
env:
38+
- name: AQUA_TOKEN
39+
value: "token"
40+
- name: AQUA_SERVER
41+
value: aqua-gateway:3622
42+
- name: RESTART_CONTAINERS
43+
value: "no"
44+
- name: AQUA_HOST_RUN_PATH
45+
value: /var/vcap/sys/run/docker
46+
volumeMounts:
47+
- mountPath: /var/run
48+
name: var-run
49+
- mountPath: /dev
50+
name: dev
51+
- mountPath: /host/sys
52+
name: sys
53+
readOnly: true
54+
- mountPath: /host/proc
55+
name: proc
56+
readOnly: true
57+
- mountPath: /host/etc
58+
name: etc
59+
readOnly: true
60+
- mountPath: /host/opt/aquasec
61+
name: aquasec
62+
readOnly: true
63+
- mountPath: /opt/aquasec/tmp
64+
name: aquasec-tmp
65+
- mountPath: /opt/aquasec/audit
66+
name: aquasec-audit
67+
volumes:
68+
- name: var-run
69+
hostPath:
70+
path: /var/vcap/sys/run/docker
71+
- name: dev
72+
hostPath:
73+
path: /dev
74+
- name: sys
75+
hostPath:
76+
path: /sys
77+
- name: proc
78+
hostPath:
79+
path: /proc
80+
- name: etc
81+
hostPath:
82+
path: /etc
83+
- name: aquasec
84+
hostPath:
85+
path: /opt/aquasec
86+
- name: aquasec-tmp
87+
hostPath:
88+
path: /opt/aquasec/tmp
89+
- name: aquasec-audit
90+
hostPath:
91+
path: /opt/aquasec/audit

‎orchestrators/pivotal-pks/templates/scanner/scanner-deployment.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: extensions/v1beta1
3+
kind: Deployment
4+
metadata:
5+
name: aqua-scanner
6+
spec:
7+
template:
8+
metadata:
9+
labels:
10+
app: aqua-scanner
11+
name: aqua-scanner
12+
spec:
13+
serviceAccount: aqua-sa
14+
containers:
15+
- name: aqua-scanner
16+
image: registry.aquasec.com/scanner:4.0
17+
imagePullPolicy: Always
18+
args: ["daemon", "--direct-cc", "--user", "administrator", "--password", "Password1", "--host", "http://aqua-web:8080"]
19+
volumeMounts:
20+
- mountPath: /var/run/docker.sock
21+
name: docker-socket-mount
22+
ports:
23+
- containerPort: 8080
24+
volumes:
25+
- name: docker-socket-mount
26+
hostPath:
27+
path: /var/run/docker.sock

‎orchestrators/pivotal-pks/templates/server/db-deployment.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
apiVersion: extensions/v1beta1
3+
kind: Deployment
4+
metadata:
5+
name: aqua-db
6+
labels:
7+
app: aqua-db
8+
spec:
9+
template:
10+
metadata:
11+
labels:
12+
app: aqua-db
13+
name: aqua-db
14+
spec:
15+
serviceAccount: aqua-sa
16+
containers:
17+
- name: aqua-db
18+
image: registry.aquasec.com/database:4.0
19+
imagePullPolicy: IfNotPresent
20+
securityContext:
21+
privileged: false
22+
env:
23+
- name: POSTGRES_PASSWORD
24+
valueFrom:
25+
secretKeyRef:
26+
name: aqua-db
27+
key: password
28+
volumeMounts:
29+
- mountPath: /var/lib/postgresql/data
30+
name: postgres-db
31+
ports:
32+
- containerPort: 5432
33+
protocol: TCP
34+
volumes:
35+
- name: postgres-db
36+
hostPath:
37+
path: /var/lib/aqua/db

‎orchestrators/pivotal-pks/templates/server/db-service.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: aqua-db
6+
labels:
7+
app: aqua-db
8+
spec:
9+
type: ClusterIP
10+
selector:
11+
app: aqua-db
12+
ports:
13+
- port: 5432

‎orchestrators/pivotal-pks/templates/server/gateway-deployment.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
apiVersion: extensions/v1beta1
3+
kind: Deployment
4+
metadata:
5+
name: aqua-gateway
6+
spec:
7+
template:
8+
metadata:
9+
labels:
10+
app: aqua-gateway
11+
name: aqua-gateway
12+
spec:
13+
serviceAccount: aqua-sa
14+
containers:
15+
- name: aqua-gateway
16+
image: registry.aquasec.com/gateway:4.0
17+
imagePullPolicy: IfNotPresent
18+
securityContext:
19+
privileged: false
20+
env:
21+
- name: SCALOCK_GATEWAY_PUBLIC_IP
22+
value: aqua-gateway
23+
- name: SCALOCK_DBUSER
24+
value: "postgres"
25+
- name: SCALOCK_DBPASSWORD
26+
valueFrom:
27+
secretKeyRef:
28+
name: aqua-db
29+
key: password
30+
- name: SCALOCK_DBNAME
31+
value: "scalock"
32+
- name: SCALOCK_DBHOST
33+
value: aqua-db
34+
- name: SCALOCK_DBPORT
35+
value: "5432"
36+
- name: SCALOCK_AUDIT_DBUSER
37+
value: "postgres"
38+
- name: SCALOCK_AUDIT_DBPASSWORD
39+
valueFrom:
40+
secretKeyRef:
41+
name: aqua-db
42+
key: password
43+
- name: SCALOCK_AUDIT_DBNAME
44+
value: "slk_audit"
45+
- name: SCALOCK_AUDIT_DBHOST
46+
value: aqua-db
47+
- name: SCALOCK_AUDIT_DBPORT
48+
value: "5432"
49+
ports:
50+
- containerPort: 3622

‎orchestrators/pivotal-pks/templates/server/gateway-service.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: aqua-gateway
6+
labels:
7+
app: aqua-gateway
8+
spec:
9+
type: ClusterIP
10+
ports:
11+
- port: 3622
12+
selector:
13+
app: aqua-gateway

‎orchestrators/pivotal-pks/templates/server/server-deployment.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
apiVersion: extensions/v1beta1
3+
kind: Deployment
4+
metadata:
5+
name: aqua-web
6+
spec:
7+
template:
8+
metadata:
9+
labels:
10+
app: aqua-web
11+
name: aqua-web
12+
spec:
13+
serviceAccount: aqua-sa
14+
containers:
15+
- name: aqua-web
16+
image: registry.aquasec.com/console:4.0
17+
imagePullPolicy: IfNotPresent
18+
securityContext:
19+
privileged: false
20+
env:
21+
- name: SCALOCK_DBUSER
22+
value: "postgres"
23+
- name: SCALOCK_DBPASSWORD
24+
valueFrom:
25+
secretKeyRef:
26+
name: aqua-db
27+
key: password
28+
- name: SCALOCK_DBNAME
29+
value: "scalock"
30+
- name: SCALOCK_DBHOST
31+
value: aqua-db
32+
- name: SCALOCK_DBPORT
33+
value: "5432"
34+
- name: SCALOCK_AUDIT_DBUSER
35+
value: "postgres"
36+
- name: SCALOCK_AUDIT_DBPASSWORD
37+
valueFrom:
38+
secretKeyRef:
39+
name: aqua-db
40+
key: password
41+
- name: SCALOCK_AUDIT_DBNAME
42+
value: "slk_audit"
43+
- name: SCALOCK_AUDIT_DBHOST
44+
value: aqua-db
45+
- name: SCALOCK_AUDIT_DBPORT
46+
value: "5432"
47+
- name: "AUTHORIZATION_HEADER"
48+
value: "aqua-auth"
49+
- name: "BATCH_INSTALL_GATEWAY"
50+
value: "aqua-gateway"
51+
- name: "BATCH_INSTALL_NAME"
52+
value: "pks"
53+
- name: "BATCH_INSTALL_ENFORCE_MODE"
54+
value: "true"
55+
- name: "BATCH_INSTALL_TOKEN"
56+
value: "tests"
57+
volumeMounts:
58+
- mountPath: /var/run/docker.sock
59+
name: docker-socket-mount
60+
ports:
61+
- containerPort: 8080
62+
volumes:
63+
- name: docker-socket-mount
64+
hostPath:
65+
path: /var/vcap/data/sys/run/docker/docker.sock

0 commit comments

Comments
 (0)