Skip to content

Commit 3decbe0

Browse files
vishwanathsvishwanaths
authored
Merge branch 'main' into sus-522-spegel0026
2 parents 69a665d + 80eb1a1 commit 3decbe0

33 files changed

+2985
-0
lines changed

‎packs/kubearmor-1.4.6/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# KubeArmor
2+
3+
KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior \(such as process execution, file access, and networking operations\) of pods, containers, and nodes (VMs) at the system level.
4+
5+
KubeArmor leverages [Linux security modules \(LSMs\)](https://en.wikipedia.org/wiki/Linux_Security_Modules) such as [AppArmor](https://en.wikipedia.org/wiki/AppArmor), [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux), or [BPF-LSM](https://docs.kernel.org/bpf/prog_lsm.html) to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.
6+
7+
## Usage
8+
9+
To use the KubeArmor pack, first create a new add-on cluster profile, and search for the kubearmor pack
10+
11+
A KubeArmor policy is written in yaml and specifies the file, process, network, capabilities and syscalls that need to be monitored or blocked. Policies can be applied on the host and on containers with cluster-wide policy support.
12+
13+
A community-owned library of Kubernetes System and Network policies can be found in this [github repo](https://github.com/kubearmor/policy-templates)
14+
15+
## Least Permissive Access
16+
17+
KubeArmor helps organizations enforce a zero trust posture within their Kubernetes clusters. It allows users to define an allow-based policy that allows specific operations, and denies or audits all other operations. This helps to ensure that only authorized activities are allowed within the cluster, and that any deviations from the expected behavior are denied and flagged for further investigation.
18+
19+
## Harden Infrastructure
20+
21+
One of the key features of KubeArmor is that it provides hardening policies out-of-the-box, meaning that you don't have to spend time researching and configuring them yourself. Instead, you can simply apply the policies to your workloads and immediately start benefiting from the added security that they provide.
22+
23+
For more information refer to the [detailed documentation](https://docs.kubearmor.io/kubearmor).

‎packs/kubearmor-1.4.6/charts/KubeArmorOperator/Chart.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: v2
2+
name: kubearmor-operator
3+
description: A Helm chart for kubearmor operator
4+
# A chart can be either an 'application' or a 'library' chart.
5+
#
6+
# Application charts are a collection of templates that can be packaged into versioned archives
7+
# to be deployed.
8+
#
9+
# Library charts provide useful utilities or functions for the chart developer. They're included as
10+
# a dependency of application charts to inject those utilities and functions into the rendering
11+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
12+
type: application
13+
# This is the chart version. This version number should be incremented each time you make changes
14+
# to the chart and its templates, including the app version.
15+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
16+
version: v1.4.6
17+
# This is the version number of the application being deployed. This version number should be
18+
# incremented each time you make changes to the application. Versions are not expected to
19+
# follow Semantic Versioning. They should reflect the version the application is using.
20+
# It is recommended to use it with quotes.
21+
appVersion: v1.4.6

‎packs/kubearmor-1.4.6/charts/KubeArmorOperator/templates/clusterrole-binding-rbac.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: {{ .Values.kubearmorOperator.name }}-clusterrole-binding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: {{ .Values.kubearmorOperator.name }}-clusterrole
9+
subjects:
10+
- kind: ServiceAccount
11+
name: {{ .Values.kubearmorOperator.name }}
12+
namespace: {{ .Release.Namespace }}
13+
---
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: ClusterRoleBinding
16+
metadata:
17+
name: {{ .Values.kubearmorOperator.name }}-manage-kubearmor-clusterrole-binding
18+
roleRef:
19+
apiGroup: rbac.authorization.k8s.io
20+
kind: ClusterRole
21+
name: {{ .Values.kubearmorOperator.name }}-manage-kubearmor-clusterrole
22+
subjects:
23+
- kind: ServiceAccount
24+
name: {{ .Values.kubearmorOperator.name }}
25+
namespace: {{ .Release.Namespace }}
26+
---
27+
apiVersion: rbac.authorization.k8s.io/v1
28+
kind: ClusterRoleBinding
29+
metadata:
30+
name: {{ .Values.kubearmorOperator.name }}-manage-controller-clusterrole-binding
31+
roleRef:
32+
apiGroup: rbac.authorization.k8s.io
33+
kind: ClusterRole
34+
name: {{ .Values.kubearmorOperator.name }}-manage-controller-clusterrole
35+
subjects:
36+
- kind: ServiceAccount
37+
name: {{ .Values.kubearmorOperator.name }}
38+
namespace: {{ .Release.Namespace }}
39+
---
40+
apiVersion: rbac.authorization.k8s.io/v1
41+
kind: ClusterRoleBinding
42+
metadata:
43+
name: {{ .Values.kubearmorOperator.name }}-manage-relay-clusterrole-binding
44+
roleRef:
45+
apiGroup: rbac.authorization.k8s.io
46+
kind: ClusterRole
47+
name: {{ .Values.kubearmorOperator.name }}-manage-relay-clusterrole
48+
subjects:
49+
- kind: ServiceAccount
50+
name: {{ .Values.kubearmorOperator.name }}
51+
namespace: {{ .Release.Namespace }}

‎packs/kubearmor-1.4.6/charts/KubeArmorOperator/templates/clusterrole-rbac.yaml‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ .Values.kubearmorOperator.name }}-clusterrole
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resources:
9+
- nodes
10+
verbs:
11+
- get
12+
- watch
13+
- list
14+
- patch
15+
- apiGroups:
16+
- admissionregistration.k8s.io
17+
resources:
18+
- mutatingwebhookconfigurations
19+
verbs:
20+
- get
21+
- create
22+
- delete
23+
- apiGroups:
24+
- rbac.authorization.k8s.io
25+
resources:
26+
- clusterroles
27+
- clusterrolebindings
28+
verbs:
29+
- create
30+
- get
31+
- apiGroups:
32+
- operator.kubearmor.com
33+
resources:
34+
- kubearmorconfigs
35+
verbs:
36+
- create
37+
- delete
38+
- get
39+
- list
40+
- patch
41+
- update
42+
- watch
43+
- apiGroups:
44+
- operator.kubearmor.com
45+
resources:
46+
- kubearmorconfigs/status
47+
verbs:
48+
- get
49+
- patch
50+
- update
51+
- apiGroups:
52+
- apiextensions.k8s.io
53+
resources:
54+
- customresourcedefinitions
55+
verbs:
56+
- create
57+
---
58+
apiVersion: rbac.authorization.k8s.io/v1
59+
kind: ClusterRole
60+
metadata:
61+
name: {{ .Values.kubearmorOperator.name }}-manage-kubearmor-clusterrole
62+
rules:
63+
- apiGroups:
64+
- ""
65+
resources:
66+
- namespaces
67+
verbs:
68+
- get
69+
- list
70+
- watch
71+
- update
72+
- apiGroups:
73+
- ""
74+
resources:
75+
- pods
76+
- nodes
77+
- configmaps
78+
verbs:
79+
- get
80+
- list
81+
- watch
82+
- apiGroups:
83+
- apps
84+
resources:
85+
- deployments
86+
- replicasets
87+
- daemonsets
88+
- statefulsets
89+
verbs:
90+
- get
91+
- list
92+
- watch
93+
{{- if .Values.kubearmorOperator.annotateResource }}
94+
- patch
95+
- update
96+
{{- end }}
97+
- apiGroups:
98+
- batch
99+
resources:
100+
- jobs
101+
- cronjobs
102+
verbs:
103+
- get
104+
- list
105+
- watch
106+
{{- if .Values.kubearmorOperator.annotateResource }}
107+
- patch
108+
- update
109+
{{- end }}
110+
- apiGroups:
111+
- security.kubearmor.com
112+
resources:
113+
- kubearmorpolicies
114+
- kubearmorclusterpolicies
115+
- kubearmorhostpolicies
116+
verbs:
117+
- get
118+
- list
119+
- watch
120+
- update
121+
- delete
122+
- nonResourceURLs:
123+
- /apis
124+
- /apis/*
125+
verbs:
126+
- get
127+
---
128+
apiVersion: rbac.authorization.k8s.io/v1
129+
kind: ClusterRole
130+
metadata:
131+
name: {{ .Values.kubearmorOperator.name }}-manage-relay-clusterrole
132+
rules:
133+
- apiGroups:
134+
- ""
135+
resources:
136+
- pods
137+
verbs:
138+
- list
139+
- watch
140+
---
141+
apiVersion: rbac.authorization.k8s.io/v1
142+
kind: ClusterRole
143+
metadata:
144+
name: {{ .Values.kubearmorOperator.name }}-manage-controller-clusterrole
145+
rules:
146+
- apiGroups:
147+
- ""
148+
resources:
149+
- pods
150+
verbs:
151+
- create
152+
- delete
153+
- get
154+
- patch
155+
- list
156+
- watch
157+
- update
158+
- apiGroups:
159+
- ""
160+
resources:
161+
- nodes
162+
verbs:
163+
- get
164+
- list
165+
- watch
166+
- apiGroups:
167+
- security.kubearmor.com
168+
resources:
169+
- kubearmorpolicies
170+
- kubearmorclusterpolicies
171+
- kubearmorhostpolicies
172+
verbs:
173+
- create
174+
- delete
175+
- get
176+
- list
177+
- patch
178+
- update
179+
- watch
180+
- apiGroups:
181+
- security.kubearmor.com
182+
resources:
183+
- kubearmorpolicies/status
184+
- kubearmorclusterpolicies/status
185+
- kubearmorhostpolicies/status
186+
verbs:
187+
- get
188+
- patch
189+
- update

‎packs/kubearmor-1.4.6/charts/KubeArmorOperator/templates/deployment.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ .Values.kubearmorOperator.name }}
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
kubearmor-app: {{ .Values.kubearmorOperator.name }}
8+
spec:
9+
selector:
10+
matchLabels:
11+
kubearmor-app: {{ .Values.kubearmorOperator.name }}
12+
template:
13+
metadata:
14+
labels:
15+
kubearmor-app: {{ .Values.kubearmorOperator.name }}
16+
{{- with .Values.kubearmorOperator.podLabels }}
17+
{{- . | toYaml | nindent 8 }}
18+
{{- end }}
19+
{{- with .Values.kubearmorOperator.podAnnotations }}
20+
annotations:
21+
{{- . | toYaml | nindent 8 }}
22+
{{- end }}
23+
spec:
24+
{{- with .Values.kubearmorOperator.podSecurityContext }}
25+
securityContext:
26+
{{- toYaml . | nindent 8 }}
27+
{{- end }}
28+
{{- if .Values.kubearmorOperator.image.imagePullSecrets }}
29+
imagePullSecrets:
30+
{{ toYaml .Values.kubearmorOperator.image.imagePullSecrets | indent 6 }}
31+
{{- end }}
32+
{{- if .Values.kubearmorOperator.image.tolerations }}
33+
tolerations:
34+
{{ toYaml .Values.kubearmorOperator.tolerations | indent 6 }}
35+
{{- end }}
36+
containers:
37+
- name: {{ .Values.kubearmorOperator.name }}
38+
env:
39+
- name: KUBEARMOR_OPERATOR_NS
40+
valueFrom:
41+
fieldRef:
42+
fieldPath: metadata.namespace
43+
{{- if .Values.imagePinning -}}
44+
{{ include "pinnedImages" .Values.oci_meta | trim | nindent 8 }}
45+
{{- end }}
46+
image: {{ include "operatorImage" . }}
47+
imagePullPolicy: {{ .Values.kubearmorOperator.imagePullPolicy }}
48+
args:
49+
{{- if .Values.kubearmorOperator.args -}}
50+
{{- toYaml .Values.kubearmorOperator.args | trim | nindent 8 }}
51+
{{- end }}
52+
{{- with .Values.kubearmorOperator.securityContext }}
53+
securityContext:
54+
{{- toYaml . | nindent 10 }}
55+
{{- end }}
56+
{{- with .Values.kubearmorOperator.resources }}
57+
resources:
58+
{{- toYaml . | nindent 10 }}
59+
{{- end }}
60+
serviceAccountName: {{ .Values.kubearmorOperator.name }}
61+

‎packs/kubearmor-1.4.6/charts/KubeArmorOperator/templates/helpers.tpl‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- define "pinnedImages" }}
2+
- name: RELATED_IMAGE_KUBEARMOR_SNITCH
3+
value: "{{ .repo }}/{{.images.kubearmorSnitch.image}}:{{.images.kubearmorSnitch.tag}}"
4+
- name: RELATED_IMAGE_KUBEARMOR
5+
value: "{{ .repo }}/{{.images.kubearmor.image}}:{{.images.kubearmor.tag}}"
6+
- name: RELATED_IMAGE_KUBEARMOR_INIT
7+
value: "{{ .repo }}/{{.images.kubearmorInit.image}}:{{.images.kubearmorInit.tag}}"
8+
- name: RELATED_IMAGE_KUBEARMOR_RELAY_SERVER
9+
value: "{{ .repo }}/{{.images.kubearmorRelay.image}}:{{.images.kubearmorRelay.tag}}"
10+
- name: RELATED_IMAGE_KUBEARMOR_CONTROLLER
11+
value: "{{ .repo }}/{{.images.kubearmorController.image}}:{{.images.kubearmorController.tag}}"
12+
{{- end }}
13+
14+
{{- define "operatorImage" }}
15+
{{- if .Values.imagePinning }}
16+
{{- printf "%s/%s:%s" .Values.oci_meta.repo .Values.oci_meta.images.kubearmorOperator.image .Values.oci_meta.images.kubearmorOperator.tag }}
17+
{{- else if eq .Values.kubearmorOperator.image.tag "" }}
18+
{{- printf "%s:%s" .Values.kubearmorOperator.image.repository .Chart.Version }}
19+
{{- else }}
20+
{{- printf "%s:%s" .Values.kubearmorOperator.image.repository .Values.kubearmorOperator.image.tag }}
21+
{{- end }}
22+
{{- end }}

‎packs/kubearmor-1.4.6/charts/KubeArmorOperator/templates/ka-config.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if .Values.autoDeploy }}
2+
apiVersion: operator.kubearmor.com/v1
3+
kind: KubeArmorConfig
4+
metadata:
5+
annotations:
6+
"helm.sh/hook": post-install,post-upgrade
7+
labels:
8+
app.kubernetes.io/name: kubearmorconfig
9+
app.kubernetes.io/instance: kubearmorconfig-sample
10+
app.kubernetes.io/part-of: kubearmoroperator
11+
app.kubernetes.io/managed-by: kustomize
12+
app.kubernetes.io/created-by: kubearmoroperator
13+
name: kubearmor-default
14+
namespace: {{ .Release.Namespace }}
15+
spec:
16+
{{- toYaml .Values.kubearmorConfig | nindent 4}}
17+
{{- end}}

0 commit comments

Comments
 (0)