Skip to content

Commit 181f228

Browse files
committed
Apply review findings #2
1 parent 78220a3 commit 181f228

5 files changed

Lines changed: 82 additions & 25 deletions

File tree

charts/templates/_helpers.tpl

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,21 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
4242
app.kubernetes.io/managed-by: {{ .Release.Service }}
4343
{{- end }}
4444

45+
{{/*
46+
Resolve the effective name of the transformation script ConfigMap.
47+
When scriptConfigMap.create is true the name is derived from the release.
48+
When false the caller-supplied ref is used.
49+
*/}}
50+
{{- define "charts.transformScriptConfigMapName" -}}
51+
{{- with .Values.operator.trivyDojoReportOperator.transformation.scriptConfigMap }}
52+
{{- if .create }}
53+
{{- include "charts.fullname" $ }}-transform-scripts
54+
{{- else }}
55+
{{- .ref }}
56+
{{- end }}
57+
{{- end }}
58+
{{- end }}
59+
4560
{{/*
4661
Selector labels
4762
*/}}

charts/templates/deployment.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,8 @@ spec:
130130
securityContext: {{- toYaml .Values.operator.trivyDojoReportOperator.containerSecurityContext
131131
| nindent 10 }}
132132
volumeMounts:
133-
{{- if .Values.operator.trivyDojoReportOperator.transformation.scriptConfigMap }}
133+
{{- $cm := .Values.operator.trivyDojoReportOperator.transformation.scriptConfigMap }}
134+
{{- if or $cm.create $cm.ref }}
134135
- mountPath: /scripts
135136
name: transformation-scripts
136137
{{- end }}
@@ -144,10 +145,11 @@ spec:
144145
securityContext: {{- toYaml .Values.operator.podSecurityContext | nindent 8 }}
145146
# Additional volumes on the output Deployment definition.
146147
volumes:
147-
{{- if .Values.operator.trivyDojoReportOperator.transformation.scriptConfigMap }}
148+
{{- $cm := .Values.operator.trivyDojoReportOperator.transformation.scriptConfigMap }}
149+
{{- if or $cm.create $cm.ref }}
148150
- name: transformation-scripts
149151
configMap:
150-
name: {{ .Values.operator.trivyDojoReportOperator.transformation.scriptConfigMap }}
152+
name: {{ include "charts.transformScriptConfigMapName" . }}
151153
{{- end }}
152154
{{- with .Values.operator.trivyDojoReportOperator.extraVolumes }}
153155
{{- toYaml . | nindent 8 }}

charts/templates/rbac.yaml

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -38,35 +38,18 @@ rules:
3838
- ""
3939
resources:
4040
- namespaces
41-
- pods
42-
- secrets
43-
- replicationcontrollers
4441
verbs:
4542
- list
4643
- watch
47-
- get
48-
- apiGroups:
49-
- apps
50-
resources:
51-
- deployments
52-
- statefulsets
53-
- daemonsets
54-
- replicasets
55-
verbs:
56-
- get
57-
- apiGroups:
58-
- batch
59-
resources:
60-
- jobs
61-
- cronjobs
62-
verbs:
63-
- get
6444
- apiGroups:
6545
- ""
6646
resources:
6747
- events
6848
verbs:
6949
- create
50+
{{- range .Values.rbac.additionalRules }}
51+
- {{ toYaml . | nindent 2 | trim }}
52+
{{- end }}
7053
---
7154
apiVersion: rbac.authorization.k8s.io/v1
7255
kind: ClusterRoleBinding
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- with .Values.operator.trivyDojoReportOperator.transformation }}
2+
{{- if and .enabled .scriptConfigMap.create }}
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: {{ include "charts.transformScriptConfigMapName" $ }}
7+
labels:
8+
{{- include "charts.labels" $ | nindent 4 }}
9+
data:
10+
{{- toYaml .scriptConfigMap.data | nindent 2 }}
11+
{{- end }}
12+
{{- end }}

charts/values.yaml

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,58 @@ operator:
6464
tag: 0.9.2
6565
imagePullSecrets: []
6666
transformation:
67-
enabled: true
68-
scriptConfigMap: "trivy-dojo-transform-script"
67+
enabled: false
6968
scriptFilename: "wrapper.sh"
7069
interpreter: "bash"
7170
scanType: "Generic Findings Import"
71+
# scriptConfigMap: defines the ConfigMap that holds the transformation scripts.
72+
# create: when true, Helm creates and manages the ConfigMap; the name is
73+
# derived automatically from the release. Only data is needed.
74+
# data: map of filename -> script content; only used when create: true.
75+
# ref: name of an existing externally-deployed ConfigMap to mount;
76+
# only used when create: false.
77+
#
78+
# Example — let Helm manage the ConfigMap:
79+
# scriptConfigMap:
80+
# create: true
81+
# data:
82+
# wrapper.sh: |
83+
# #!/bin/bash
84+
# echo "$REPORT_JSON" | python3 /scripts/transform.py
85+
# transform.py: |
86+
# import sys, json
87+
# print(sys.stdin.read())
88+
#
89+
# Example — reference an externally-deployed ConfigMap:
90+
# scriptConfigMap:
91+
# ref: my-transform-scripts
92+
scriptConfigMap:
93+
create: false
94+
ref: ""
95+
data: {}
7296
type: ClusterIP
7397
podSecurityContext:
7498
runAsNonRoot: true
7599
fsGroupChangePolicy: Always
76100
fsGroup: 1000
101+
# rbac.additionalRules: Additional RBAC rules appended to the base ClusterRole.
102+
# These rules are strictly additive — the built-in base rules are always present
103+
# and cannot be removed through this value.
104+
#
105+
# Each entry must be a valid RBAC rule object (apiGroups, resources, verbs).
106+
# The rules below are the ones needed when the transformation feature is used
107+
# to enrich reports with workload context (pods, deployments, jobs, …):
108+
#
109+
# rbac:
110+
# additionalRules:
111+
# - apiGroups: [""]
112+
# resources: [pods, secrets, replicationcontrollers]
113+
# verbs: [list, watch, get]
114+
# - apiGroups: [apps]
115+
# resources: [deployments, statefulsets, daemonsets, replicasets]
116+
# verbs: [get]
117+
# - apiGroups: [batch]
118+
# resources: [jobs, cronjobs]
119+
# verbs: [get]
120+
rbac:
121+
additionalRules: []

0 commit comments

Comments
 (0)