Skip to content

Commit 0b2655e

Browse files
yairsappiryairsappir
committed
Merge branch 'other-approach-test' into outpostlite-remediation-security-changes
# Conflicts: # wiz-outpost-lite/templates/_helpers.tpl # wiz-outpost-lite/templates/deployment.yaml
2 parents 1b03203 + 9adb701 commit 0b2655e

File tree

34 files changed

+502
-182
lines changed

34 files changed

+502
-182
lines changed

‎.DS_Store‎

-10 KB
Binary file not shown.

‎.circleci/tests/testfiles/wiz-kubernetes-integration/api-tokens-volume-mount.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
global:
2+
wizApiToken:
3+
wizApiTokensVolumeMount: /path/to/global
4+
5+
wiz-kubernetes-connector:
6+
enabled: true
7+
autoCreateConnector:
8+
enabled: true
9+
autoDeleteConnectorEnabled: true
10+
broker:
11+
enabled: true
12+
13+
wiz-sensor:
14+
enabled: true
15+
imagePullSecret:
16+
create: true
17+
name: sensor-image-pull
18+
username: pulluser
19+
password: pullpassword
20+
image:
21+
registry: wizio.azurecr.io
22+
23+
wiz-admission-controller:
24+
enabled: true
25+
opaWebhook:
26+
enabled: true
27+
kubernetesAuditLogsWebhook:
28+
enabled: true

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,5 @@
99
/.github/ @wiz-sec/wiz-devops
1010
/.circleci/ @wiz-sec/wiz-devops
1111
/.circleci/tests/ @wiz-sec/Wiz-Charts-Approvers
12-
/wiz-outpost-lite/**/* @yarinm
12+
/wiz-outpost-lite/**/* @yarinm
13+
/wiz-sensor/**/* @ariknem

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
.idea/*
22
!/.idea/runConfigurations
33

4+
.DS_Store

‎wiz-admission-controller/Chart.yaml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
apiVersion: v2
22
name: wiz-admission-controller
33
description: Wiz admission controller
4-
54
type: application
6-
75
# This is the chart version. This version number should be incremented each time you make changes
86
# to the chart and its templates, including the app version.
97
# Versions are expected to follow Semantic Versioning (https://semver.org/)
10-
version: 3.9.1
11-
8+
version: 3.10.0-preview.3
129
# This is the version number of the application being deployed. This version number should be
1310
# incremented each time you make changes to the application. Versions are not expected to
1411
# follow Semantic Versioning. They should reflect the version the application is using.
1512
# It is recommended to use it with quotes.
16-
appVersion: "2.8"
17-
13+
appVersion: "2.9"
1814
dependencies:
1915
- name: wiz-common
20-
version: "0.1.6"
16+
version: "0.1.8"
2117
repository: https://wiz-sec.github.io/charts
2218
# repository: "file://../wiz-common" # Use this line to test the chart locally

‎wiz-admission-controller/templates/_helpers.tpl‎

Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,16 @@ If release name contains chart name it will be used as a full name.
5050
{{- end }}
5151
{{- end }}
5252

53+
{{- define "wiz-admission-controller-uninstall.name" -}}
54+
{{- if .Values.wizUninstallJob.nameOverride }}
55+
{{- .Values.wizUninstallJob.nameOverride | trunc 63 | trimSuffix "-" }}
56+
{{- else }}
57+
{{- $suffix := "-uninstall" -}}
58+
{{- $maxLength := int (sub 63 (len $suffix)) -}}
59+
{{- printf "%s%s" (include "wiz-admission-controller.fullname" . | trunc $maxLength | trimSuffix "-") $suffix -}}
60+
{{- end }}
61+
{{- end }}
62+
5363
{{- define "wiz-admission-controller.wiz-hpa-enforcer.name" -}}
5464
{{- $suffix := "-hpa" -}}
5565
{{- $maxLength := int (sub 63 (len $suffix)) -}}
@@ -120,6 +130,14 @@ Wiz manager selector labels
120130
app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
121131
{{- end }}
122132

133+
{{/*
134+
Wiz uninstall selector labels
135+
*/}}
136+
{{- define "wiz-admission-controller-uninstall.selectorLabels" -}}
137+
app.kubernetes.io/name: {{ include "wiz-admission-controller-uninstall.name" . }}
138+
{{- end }}
139+
140+
123141
{{- define "wiz-admission-controller-enforcement.labels" -}}
124142
{{ include "wiz-admission-controller.labels" . }}
125143
{{ include "wiz-admission-controller-enforcement.selectorLabels" . }}
@@ -135,6 +153,11 @@ app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
135153
{{ include "wiz-admission-controller-manager.selectorLabels" . }}
136154
{{- end }}
137155

156+
{{- define "wiz-admission-controller-uninstall.labels" -}}
157+
{{ include "wiz-admission-controller.labels" . }}
158+
{{ include "wiz-admission-controller-uninstall.selectorLabels" . }}
159+
{{- end }}
160+
138161
{{/*
139162
Wiz Horizontal Pod Autoscaler labels
140163
*/}}
@@ -319,15 +342,24 @@ Clean the list of deployments for the auto-update flag, removing quotes and brac
319342
{{- end -}}
320343

321344
{{- define "wiz-admission-controller.isWizApiTokenSecretEnabled" -}}
322-
{{- if and (.Values.wizApiToken.secret.create) (eq (include "wiz-common.isWizApiClientVolumeMountEnabled" (list .Values.wizApiToken.usePodCustomEnvironmentVariablesFile .Values.wizApiToken.wizApiTokensVolumeMount) | trim | lower) "true") }}
345+
{{- if and (.Values.wizApiToken.secret.create) (eq (include "wiz-common.isWizApiClientVolumeMountEnabled" (list .Values.wizApiToken.usePodCustomEnvironmentVariablesFile .Values.wizApiToken.wizApiTokensVolumeMount .Values.global.wizApiToken.wizApiTokensVolumeMount) | trim | lower) "true") }}
323346
true
324347
{{- else }}
325348
false
326349
{{- end }}
327350
{{- end }}
328351

352+
{{- define "wiz-admission-controller.isWizApiClientVolumeMountEnabled" -}}
353+
{{- if eq (include "wiz-common.isWizApiClientVolumeMountEnabled" (list .Values.wizApiToken.usePodCustomEnvironmentVariablesFile .Values.wizApiToken.wizApiTokensVolumeMount .Values.global.wizApiToken.wizApiTokensVolumeMount) | trim | lower) "true" -}}
354+
true
355+
{{- else -}}
356+
false
357+
{{- end }}
358+
{{- end }}
359+
360+
329361
{{- define "wiz-admission-controller.spec.common.volumeMounts" -}}
330-
{{- if eq (include "wiz-common.isWizApiClientVolumeMountEnabled" (list .Values.wizApiToken.usePodCustomEnvironmentVariablesFile .Values.wizApiToken.wizApiTokensVolumeMount) | trim | lower) "true" -}}
362+
{{- if eq (include "wiz-admission-controller.isWizApiClientVolumeMountEnabled" . | trim | lower) "true" }}
331363
- name: {{ include "wiz-common.volumes.apiClientName" . }}
332364
mountPath: /var/{{ include "wiz-common.volumes.apiClientName" . }}
333365
readOnly: true
@@ -338,7 +370,7 @@ Clean the list of deployments for the auto-update flag, removing quotes and brac
338370
{{- end -}}
339371

340372
{{- define "wiz-admission-controller.spec.common.volumes" -}}
341-
{{- if eq (include "wiz-common.isWizApiClientVolumeMountEnabled" (list .Values.wizApiToken.usePodCustomEnvironmentVariablesFile .Values.wizApiToken.wizApiTokensVolumeMount) | trim | lower) "true" -}}
373+
{{- if eq (include "wiz-admission-controller.isWizApiClientVolumeMountEnabled" . | trim | lower) "true" }}
342374
- name: {{ include "wiz-common.volumes.apiClientName" . | trim }}
343375
secret:
344376
secretName: {{ include "wiz-admission-controller.secretApiTokenName" . | trim }}
@@ -353,15 +385,19 @@ Clean the list of deployments for the auto-update flag, removing quotes and brac
353385
{{- if not .Values.wizApiToken.usePodCustomEnvironmentVariablesFile }}
354386
- name: CLI_FILES_AS_ARGS
355387
{{- $wizApiTokensPath := "" -}}
356-
{{- if .Values.wizApiToken.wizApiTokensVolumeMount }}
357-
{{- $wizApiTokensPath = .Values.wizApiToken.wizApiTokensVolumeMount -}}
388+
{{- if coalesce .Values.wizApiToken.wizApiTokensVolumeMount .Values.global.wizApiToken.wizApiTokensVolumeMount }}
389+
{{- $wizApiTokensPath = coalesce .Values.wizApiToken.wizApiTokensVolumeMount .Values.global.wizApiToken.wizApiTokensVolumeMount -}}
358390
{{- else }}
359391
{{- $wizApiTokensPath = printf "/var/%s" (include "wiz-common.volumes.apiClientName" .) -}}
360392
{{- end }}
361393
value: "{{ $wizApiTokensPath }}/clientToken,{{ $wizApiTokensPath }}/clientId"
362394
{{- end }}
363395
{{- if or .Values.global.httpProxyConfiguration.enabled .Values.httpProxyConfiguration.enabled }}
364396
{{ include "wiz-common.proxy.env" . | trim }}
397+
{{- if or .Values.global.httpProxyConfiguration.clientCertificate .Values.httpProxyConfiguration.clientCertificate }}
398+
- name: WIZ_HTTP_PROXY_CLIENT_CERT_PATH
399+
value: "{{ include "wiz-common.proxy.dir" . }}/clientCertificate"
400+
{{- end }}
365401
{{- end }}
366402
- name: WIZ_ENV
367403
value: {{ coalesce .Values.global.wizApiToken.clientEndpoint .Values.wizApiToken.clientEndpoint | quote }}
@@ -411,21 +447,6 @@ Clean the list of deployments for the auto-update flag, removing quotes and brac
411447
- name: WIZ_MISCONFIGURATION_CUSTOM_ERROR_MESSAGE
412448
value: "{{ coalesce .Values.opaWebhook.customErrorMessage .Values.customErrorMessage }}"
413449
{{- end -}}
414-
{{- if .Values.opaWebhook.enabled }}
415-
- name: WIZ_MISCONFIGURATION_WEBHOOK_CONFIG
416-
value: |
417-
{{ .Values.opaWebhook | toJson | nindent 4 }}
418-
{{- end -}}
419-
{{- if .Values.imageIntegrityWebhook.enabled }}
420-
- name: WIZ_IMAGE_INTEGRITY_WEBHOOK_CONFIG
421-
value: |
422-
{{ .Values.imageIntegrityWebhook | toJson | nindent 4 }}
423-
{{- end -}}
424-
{{- if .Values.kubernetesAuditLogsWebhook.enabled }}
425-
- name: WIZ_KUBERNETES_AUDIT_LOG_WEBHOOK_CONFIG
426-
value: |
427-
{{ .Values.kubernetesAuditLogsWebhook | toJson | nindent 4 }}
428-
{{- end -}}
429450
{{- if coalesce .Values.global.clusterDisplayName .Values.clusterDisplayName }}
430451
- name: WIZ_CLUSTER_NAME
431452
value: {{ coalesce .Values.global.clusterDisplayName .Values.clusterDisplayName | quote }}

‎wiz-admission-controller/templates/cronjobmanager.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ spec:
6161
{{- else }}
6262
{{- toYaml .Values.securityContext | nindent 16 }}
6363
{{- end }}
64-
image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
64+
image: {{ include "wiz-admission-controller.image" . }}
6565
imagePullPolicy: {{ .Values.image.pullPolicy }}
6666
command:
6767
- "/usr/bin/wiz-admission-controller"

‎wiz-admission-controller/templates/deploymentauditlogs.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ spec:
101101
- "--image-integrity-enabled=false"
102102
env:
103103
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
104+
- name: WIZ_KUBERNETES_AUDIT_LOG_WEBHOOK_CONFIG
105+
value: |
106+
{{- .Values.kubernetesAuditLogsWebhook | toJson | nindent 14 }}
104107
## Enable debug webhook that only logs the request
105108
{{- if .Values.debugWebhook.enabled }}
106109
- name: WIZ_DEBUG_WEBHOOK_ENABLED

‎wiz-admission-controller/templates/deploymentenforcement.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,16 @@ spec:
117117
- "--kubernetes-audit-logs-enabled=false"
118118
env:
119119
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
120+
{{- if .Values.opaWebhook.enabled }}
121+
- name: WIZ_MISCONFIGURATION_WEBHOOK_CONFIG
122+
value: |
123+
{{- .Values.opaWebhook | toJson | nindent 14 }}
124+
{{- end -}}
125+
{{- if .Values.imageIntegrityWebhook.enabled }}
126+
- name: WIZ_IMAGE_INTEGRITY_WEBHOOK_CONFIG
127+
value: |
128+
{{- .Values.imageIntegrityWebhook | toJson | nindent 14 }}
129+
{{- end }}
120130
- name: WIZ_IMAGE_INTEGRITY_PATCH_IMAGE_DIGEST_ANNOTATION
121131
value: {{ .Values.imageIntegrityWebhook.patchImageDigestAnnotation | quote }}
122132
# For running pod with read only file system we write all the cache files to /var/cache volume mount, used by image integrity hook

‎wiz-admission-controller/templates/jobuninstall.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{{ if .Values.wizUninstallJob.enabled -}}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "wiz-admission-controller-uninstall.name" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels:
8+
wiz.io/component: "admission-controller-uninstall"
9+
{{- include "wiz-admission-controller-uninstall.labels" . | nindent 4 }}
10+
annotations:
11+
"helm.sh/hook": post-delete
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
rollme.proxyHash: {{ include "wiz-admission-controller.proxyHash" . }}
14+
rollme.wizApiTokenHash: {{ include "wiz-admission-controller.wizApiTokenHash" . }}
15+
{{- with (.Values.wizUninstallJob.jobAnnotations) }}
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
spec:
19+
{{- if .Values.wizUninstallJob.useJobTTL }}
20+
ttlSecondsAfterFinished: 60
21+
{{- end }}
22+
manualSelector: true
23+
selector:
24+
matchLabels:
25+
{{- include "wiz-admission-controller-uninstall.selectorLabels" . | nindent 6 }}
26+
activeDeadlineSeconds: {{ .Values.wizUninstallJob.timeoutSeconds }}
27+
backoffLimit: 1
28+
template:
29+
metadata:
30+
{{- if (or .Values.global.podAnnotations .Values.podAnnotations .Values.wizUninstallJob.podAnnotations)}}
31+
annotations:
32+
{{- with .Values.global.podAnnotations }}
33+
{{- toYaml . | nindent 8 }}
34+
{{- end }}
35+
{{- with .Values.podAnnotations }}
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
{{- with .Values.wizUninstallJob.podAnnotations }}
39+
{{- toYaml . | nindent 8 }}
40+
{{- end }}
41+
{{- end }}
42+
labels:
43+
wiz.io/component: "admission-controller-uninstall"
44+
{{- include "wiz-admission-controller-uninstall.labels" . | nindent 8 }}
45+
{{- with .Values.global.podLabels }}
46+
{{- toYaml . | nindent 8 }}
47+
{{- end }}
48+
{{- with .Values.podLabels }}
49+
{{- toYaml . | nindent 8 }}
50+
{{- end }}
51+
spec:
52+
{{- with .Values.wizUninstallJob.podAdditionalSpec }}
53+
{{- toYaml . | nindent 8 }}
54+
{{- end }}
55+
{{- with .Values.global.imagePullSecrets }}
56+
imagePullSecrets:
57+
{{- toYaml . | nindent 8 }}
58+
{{- end }}
59+
restartPolicy: "Never"
60+
securityContext:
61+
{{- if hasKey .Values.global "lowPrivilegePodSecurityPolicy" }}
62+
{{- toYaml .Values.global.lowPrivilegePodSecurityPolicy | nindent 8 }}
63+
{{- else }}
64+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
65+
{{- end }}
66+
{{- if .Values.hostNetwork }}
67+
hostNetwork: true
68+
{{- end }}
69+
volumes:
70+
{{- include "wiz-admission-controller.spec.common.volumes" . | trim | nindent 8 }}
71+
{{- with .Values.customVolumes }}
72+
{{- toYaml . | nindent 8 }}
73+
{{- end }}
74+
{{- with .Values.global.customVolumes }}
75+
{{- toYaml . | nindent 8 }}
76+
{{- end }}
77+
containers:
78+
- name: {{ .Chart.Name }}-uninstall
79+
securityContext:
80+
{{- if hasKey .Values.global "lowPrivilegeSecurityPolicy" }}
81+
{{- toYaml .Values.global.lowPrivilegeSecurityPolicy | nindent 14 }}
82+
{{- else }}
83+
{{- toYaml .Values.securityContext | nindent 14 }}
84+
{{- end }}
85+
image: {{ include "wiz-admission-controller.image" . }}
86+
imagePullPolicy: {{ .Values.image.pullPolicy }}
87+
command:
88+
- "/usr/bin/wiz-admission-controller"
89+
- "uninstall"
90+
{{- include "wiz-admission-controller.spec.common.commandArgs" . | trim | nindent 10 }}
91+
env:
92+
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
93+
resources:
94+
{{- include "wiz-admission-controller.resources" . | trim | nindent 12 }}
95+
volumeMounts:
96+
{{- include "wiz-admission-controller.spec.common.volumeMounts" . | trim | nindent 14 }}
97+
{{- if or .Values.customVolumeMounts .Values.global.customVolumeMounts }}
98+
{{- with .Values.customVolumeMounts }}
99+
{{- toYaml . | nindent 14 }}
100+
{{- end }}
101+
{{- with .Values.global.customVolumeMounts }}
102+
{{- toYaml . | nindent 14 }}
103+
{{- end }}
104+
{{- end }}
105+
{{- with (coalesce .Values.global.nodeSelector .Values.nodeSelector) }}
106+
nodeSelector:
107+
{{- toYaml . | nindent 8 }}
108+
{{- end }}
109+
{{- with (coalesce .Values.global.affinity .Values.affinity) }}
110+
affinity:
111+
{{- toYaml . | nindent 8 }}
112+
{{- end }}
113+
{{- if (or .Values.global.tolerations .Values.tolerations) }}
114+
tolerations:
115+
{{- with .Values.global.tolerations }}
116+
{{- toYaml . | nindent 8 }}
117+
{{- end }}
118+
{{- with .Values.tolerations }}
119+
{{- toYaml . | nindent 8 }}
120+
{{- end }}
121+
{{- end }}
122+
{{- end }}
123+

0 commit comments

Comments
 (0)