Skip to content

Commit 43fdfb1

Browse files
yairsappiryairsappir
committed
Merge remote-tracking branch 'origin/master' into outpostlite-remediation-security-changes
2 parents 1b919ee + 9c4ffc8 commit 43fdfb1

File tree

8 files changed

+202
-6
lines changed

8 files changed

+202
-6
lines changed

‎wiz-admission-controller/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ type: application
55
# This is the chart version. This version number should be incremented each time you make changes
66
# to the chart and its templates, including the app version.
77
# Versions are expected to follow Semantic Versioning (https://semver.org/)
8-
version: 3.9.5
8+
version: 3.10.0
99
# This is the version number of the application being deployed. This version number should be
1010
# incremented each time you make changes to the application. Versions are not expected to
1111
# follow Semantic Versioning. They should reflect the version the application is using.
1212
# It is recommended to use it with quotes.
13-
appVersion: "2.8"
13+
appVersion: "2.9"
1414
dependencies:
1515
- name: wiz-common
1616
version: "0.1.8"

‎wiz-admission-controller/templates/_helpers.tpl‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,16 @@ If release name contains chart name it will be used as a full name.
5050
{{- end }}
5151
{{- end }}
5252

53+
{{- define "wiz-admission-controller-uninstall.name" -}}
54+
{{- if .Values.wizUninstallJob.nameOverride }}
55+
{{- .Values.wizUninstallJob.nameOverride | trunc 63 | trimSuffix "-" }}
56+
{{- else }}
57+
{{- $suffix := "-uninstall" -}}
58+
{{- $maxLength := int (sub 63 (len $suffix)) -}}
59+
{{- printf "%s%s" (include "wiz-admission-controller.fullname" . | trunc $maxLength | trimSuffix "-") $suffix -}}
60+
{{- end }}
61+
{{- end }}
62+
5363
{{- define "wiz-admission-controller.wiz-hpa-enforcer.name" -}}
5464
{{- $suffix := "-hpa" -}}
5565
{{- $maxLength := int (sub 63 (len $suffix)) -}}
@@ -120,6 +130,14 @@ Wiz manager selector labels
120130
app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
121131
{{- end }}
122132

133+
{{/*
134+
Wiz uninstall selector labels
135+
*/}}
136+
{{- define "wiz-admission-controller-uninstall.selectorLabels" -}}
137+
app.kubernetes.io/name: {{ include "wiz-admission-controller-uninstall.name" . }}
138+
{{- end }}
139+
140+
123141
{{- define "wiz-admission-controller-enforcement.labels" -}}
124142
{{ include "wiz-admission-controller.labels" . }}
125143
{{ include "wiz-admission-controller-enforcement.selectorLabels" . }}
@@ -135,6 +153,11 @@ app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
135153
{{ include "wiz-admission-controller-manager.selectorLabels" . }}
136154
{{- end }}
137155

156+
{{- define "wiz-admission-controller-uninstall.labels" -}}
157+
{{ include "wiz-admission-controller.labels" . }}
158+
{{ include "wiz-admission-controller-uninstall.selectorLabels" . }}
159+
{{- end }}
160+
138161
{{/*
139162
Wiz Horizontal Pod Autoscaler labels
140163
*/}}

‎wiz-admission-controller/templates/jobuninstall.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{{ if .Values.wizUninstallJob.enabled -}}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "wiz-admission-controller-uninstall.name" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels:
8+
wiz.io/component: "admission-controller-uninstall"
9+
{{- include "wiz-admission-controller-uninstall.labels" . | nindent 4 }}
10+
annotations:
11+
"helm.sh/hook": pre-delete
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
rollme.proxyHash: {{ include "wiz-admission-controller.proxyHash" . }}
14+
rollme.wizApiTokenHash: {{ include "wiz-admission-controller.wizApiTokenHash" . }}
15+
{{- with (.Values.wizUninstallJob.jobAnnotations) }}
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
spec:
19+
{{- if .Values.wizUninstallJob.useJobTTL }}
20+
ttlSecondsAfterFinished: 60
21+
{{- end }}
22+
manualSelector: true
23+
selector:
24+
matchLabels:
25+
{{- include "wiz-admission-controller-uninstall.selectorLabels" . | nindent 6 }}
26+
activeDeadlineSeconds: {{ .Values.wizUninstallJob.timeoutSeconds }}
27+
backoffLimit: 1
28+
template:
29+
metadata:
30+
{{- if (or .Values.global.podAnnotations .Values.podAnnotations .Values.wizUninstallJob.podAnnotations)}}
31+
annotations:
32+
{{- with .Values.global.podAnnotations }}
33+
{{- toYaml . | nindent 8 }}
34+
{{- end }}
35+
{{- with .Values.podAnnotations }}
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
{{- with .Values.wizUninstallJob.podAnnotations }}
39+
{{- toYaml . | nindent 8 }}
40+
{{- end }}
41+
{{- end }}
42+
labels:
43+
wiz.io/component: "admission-controller-uninstall"
44+
{{- include "wiz-admission-controller-uninstall.labels" . | nindent 8 }}
45+
{{- with .Values.global.podLabels }}
46+
{{- toYaml . | nindent 8 }}
47+
{{- end }}
48+
{{- with .Values.podLabels }}
49+
{{- toYaml . | nindent 8 }}
50+
{{- end }}
51+
spec:
52+
{{- with .Values.wizUninstallJob.podAdditionalSpec }}
53+
{{- toYaml . | nindent 8 }}
54+
{{- end }}
55+
{{- with .Values.global.imagePullSecrets }}
56+
imagePullSecrets:
57+
{{- toYaml . | nindent 8 }}
58+
{{- end }}
59+
restartPolicy: "Never"
60+
securityContext:
61+
{{- if hasKey .Values.global "lowPrivilegePodSecurityPolicy" }}
62+
{{- toYaml .Values.global.lowPrivilegePodSecurityPolicy | nindent 8 }}
63+
{{- else }}
64+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
65+
{{- end }}
66+
{{- if .Values.hostNetwork }}
67+
hostNetwork: true
68+
{{- end }}
69+
volumes:
70+
{{- include "wiz-admission-controller.spec.common.volumes" . | trim | nindent 8 }}
71+
{{- with .Values.customVolumes }}
72+
{{- toYaml . | nindent 8 }}
73+
{{- end }}
74+
{{- with .Values.global.customVolumes }}
75+
{{- toYaml . | nindent 8 }}
76+
{{- end }}
77+
containers:
78+
- name: {{ .Chart.Name }}-uninstall
79+
securityContext:
80+
{{- if hasKey .Values.global "lowPrivilegeSecurityPolicy" }}
81+
{{- toYaml .Values.global.lowPrivilegeSecurityPolicy | nindent 14 }}
82+
{{- else }}
83+
{{- toYaml .Values.securityContext | nindent 14 }}
84+
{{- end }}
85+
image: {{ include "wiz-admission-controller.image" . }}
86+
imagePullPolicy: {{ .Values.image.pullPolicy }}
87+
command:
88+
- "/usr/bin/wiz-admission-controller"
89+
- "uninstall"
90+
{{- include "wiz-admission-controller.spec.common.commandArgs" . | trim | nindent 10 }}
91+
env:
92+
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
93+
resources:
94+
{{- include "wiz-admission-controller.resources" . | trim | nindent 12 }}
95+
volumeMounts:
96+
{{- include "wiz-admission-controller.spec.common.volumeMounts" . | trim | nindent 14 }}
97+
{{- if or .Values.customVolumeMounts .Values.global.customVolumeMounts }}
98+
{{- with .Values.customVolumeMounts }}
99+
{{- toYaml . | nindent 14 }}
100+
{{- end }}
101+
{{- with .Values.global.customVolumeMounts }}
102+
{{- toYaml . | nindent 14 }}
103+
{{- end }}
104+
{{- end }}
105+
{{- with (coalesce .Values.global.nodeSelector .Values.nodeSelector) }}
106+
nodeSelector:
107+
{{- toYaml . | nindent 8 }}
108+
{{- end }}
109+
{{- with (coalesce .Values.global.affinity .Values.affinity) }}
110+
affinity:
111+
{{- toYaml . | nindent 8 }}
112+
{{- end }}
113+
{{- if (or .Values.global.tolerations .Values.tolerations) }}
114+
tolerations:
115+
{{- with .Values.global.tolerations }}
116+
{{- toYaml . | nindent 8 }}
117+
{{- end }}
118+
{{- with .Values.tolerations }}
119+
{{- toYaml . | nindent 8 }}
120+
{{- end }}
121+
{{- end }}
122+
{{- end }}
123+

‎wiz-admission-controller/values.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -498,6 +498,21 @@ wizManager:
498498
# If empty, a name is generated using the nameOverride
499499
name: ""
500500

501+
wizUninstallJob:
502+
enabled: true # Should the uninstall job be deployed.
503+
nameOverride: "" # Override the uninstall job name.
504+
timeoutSeconds: 300 # The timeout for the uninstall job in seconds.
505+
# Toggle the TTL (Time to Live) mechanism for automatic cleanup of finished Jobs.
506+
# Set to `true` to enable Kubernetes to automatically delete Jobs after they complete or fail, based on the `ttlSecondsAfterFinished` field.
507+
# Set to `false` if using Argo CD to manage Job lifecycle with deletion hooks, as TTL-based cleanup can cause Application to appear OutOfSync.
508+
# See: https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks/#sync-status-with-jobsworkflows-with-time-to-live-ttl
509+
useJobTTL: true
510+
jobAnnotations: {}
511+
podAnnotations: {}
512+
podAdditionalSpec: {}
513+
514+
515+
501516
# Global values to override chart values.
502517
global:
503518
nameOverride: "" # Override the release’s name.

‎wiz-kubernetes-integration/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: wiz-kubernetes-integration
33
description: A Helm chart for Kubernetes
44
type: application
5-
version: 0.2.88
5+
version: 0.2.92
66
appVersion: ""
77

88
# Dependencies for wiz-kubernetes connector and wiz-admission-controller and wiz-sensor
@@ -17,5 +17,5 @@ dependencies:
1717
condition: wiz-admission-controller.enabled
1818
- name: wiz-sensor
1919
repository: https://wiz-sec.github.io/charts
20-
version: ">=1.0.6187"
20+
version: ">=1.0.6440"
2121
condition: wiz-sensor.enabled

‎wiz-sensor/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@ description: Wiz Sensor helm chart
33
home: https://www.wiz.io/
44
name: wiz-sensor
55
type: application
6-
version: 1.0.6187
7-
appVersion: 1.0.6187
6+
version: 1.0.6440
7+
appVersion: 1.0.6349

‎wiz-sensor/templates/daemonset.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@ spec:
3737
{{- end }}
3838

3939
spec:
40+
{{- if .Values.setFsGroup }}
41+
securityContext:
42+
fsGroup: {{- if .Values.privileged }} 0 {{- else }} 2202 {{- end }}
43+
{{- end }}
44+
4045
{{- if .Values.serviceAccount.create }}
4146
serviceAccountName: {{ include "wiz-sensor.serviceAccountName" . }}
4247
{{- end }}
@@ -378,6 +383,31 @@ spec:
378383
{{- toYaml . | nindent 8 }}
379384
{{- end }}
380385

386+
{{- if and (not .Values.gkeAutopilot) .Values.livenessProbe.enabled }}
387+
livenessProbe:
388+
exec:
389+
command:
390+
- "/bin/onprem-agent"
391+
- "version"
392+
{{ toYaml .Values.livenessProbe.config | indent 10 }}
393+
{{- end }}
394+
{{- if and (not .Values.gkeAutopilot) .Values.startupProbe.enabled }}
395+
startupProbe:
396+
exec:
397+
command:
398+
- "/bin/onprem-agent"
399+
- "version"
400+
{{ toYaml .Values.startupProbe.config | indent 10 }}
401+
{{- end }}
402+
{{- if and (not .Values.gkeAutopilot) .Values.readinessProbe.enabled }}
403+
readinessProbe:
404+
exec:
405+
command:
406+
- "/bin/onprem-agent"
407+
- "version"
408+
{{ toYaml .Values.readinessProbe.config | indent 10 }}
409+
{{- end }}
410+
381411
securityContext:
382412
{{- if .Values.privileged }}
383413
privileged: true

‎wiz-sensor/values.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ oldAppArmorAnnotation: false
8383
# check by enabling this option.
8484
disableImageVersionCheck: false
8585

86+
# add appropriate fsGroup/supplementalGroups to the pod's securityContext
87+
useFsGroup: false
88+
8689
clusterExternalId: "" # Required for OKE clusters - specify the cluster's OCID
8790
subscriptionExternalId: "" # Optional. Used to associate the installation with a Subscription if none can be obtained from IMDS (e.g. on-prem)
8891
clusterTags: {} # Optional. List of key: value tags to be added to KubernetesCluster object associated with this installation
@@ -295,6 +298,8 @@ daemonset:
295298
#- key: node.ocs.openshift.io/storage
296299
# value: "true"
297300
# effect: NoSchedule
301+
#- key: CriticalAddonsOnly # allow running on EKS auto-mode system nodes
302+
# operator: Exists
298303

299304
# Default strategy to update the daemonset
300305
updateStrategy:

0 commit comments

Comments
 (0)