Skip to content

Commit 5284583

Browse files
circleci-wizcircleci-wiz
authored
Update charts with latest changes (#585)
1 parent 2087486 commit 5284583

File tree

7 files changed

+177
-18
lines changed

7 files changed

+177
-18
lines changed

‎wiz-admission-controller/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ type: application
55
# This is the chart version. This version number should be incremented each time you make changes
66
# to the chart and its templates, including the app version.
77
# Versions are expected to follow Semantic Versioning (https://semver.org/)
8-
version: 3.9.2
8+
version: 3.10.0-preview
99
# This is the version number of the application being deployed. This version number should be
1010
# incremented each time you make changes to the application. Versions are not expected to
1111
# follow Semantic Versioning. They should reflect the version the application is using.
1212
# It is recommended to use it with quotes.
13-
appVersion: "2.8"
13+
appVersion: "2.9"
1414
dependencies:
1515
- name: wiz-common
1616
version: "0.1.7"

‎wiz-admission-controller/templates/_helpers.tpl‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,16 @@ If release name contains chart name it will be used as a full name.
5050
{{- end }}
5151
{{- end }}
5252

53+
{{- define "wiz-admission-controller-uninstall.name" -}}
54+
{{- if .Values.wizUninstallJob.nameOverride }}
55+
{{- .Values.wizUninstallJob.nameOverride | trunc 63 | trimSuffix "-" }}
56+
{{- else }}
57+
{{- $suffix := "-uninstall" -}}
58+
{{- $maxLength := int (sub 63 (len $suffix)) -}}
59+
{{- printf "%s%s" (include "wiz-admission-controller.fullname" . | trunc $maxLength | trimSuffix "-") $suffix -}}
60+
{{- end }}
61+
{{- end }}
62+
5363
{{- define "wiz-admission-controller.wiz-hpa-enforcer.name" -}}
5464
{{- $suffix := "-hpa" -}}
5565
{{- $maxLength := int (sub 63 (len $suffix)) -}}
@@ -120,6 +130,14 @@ Wiz manager selector labels
120130
app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
121131
{{- end }}
122132

133+
{{/*
134+
Wiz uninstall selector labels
135+
*/}}
136+
{{- define "wiz-admission-controller-uninstall.selectorLabels" -}}
137+
app.kubernetes.io/name: {{ include "wiz-admission-controller-uninstall.name" . }}
138+
{{- end }}
139+
140+
123141
{{- define "wiz-admission-controller-enforcement.labels" -}}
124142
{{ include "wiz-admission-controller.labels" . }}
125143
{{ include "wiz-admission-controller-enforcement.selectorLabels" . }}
@@ -135,6 +153,11 @@ app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
135153
{{ include "wiz-admission-controller-manager.selectorLabels" . }}
136154
{{- end }}
137155

156+
{{- define "wiz-admission-controller-uninstall.labels" -}}
157+
{{ include "wiz-admission-controller.labels" . }}
158+
{{ include "wiz-admission-controller-uninstall.selectorLabels" . }}
159+
{{- end }}
160+
138161
{{/*
139162
Wiz Horizontal Pod Autoscaler labels
140163
*/}}
@@ -420,21 +443,6 @@ false
420443
- name: WIZ_MISCONFIGURATION_CUSTOM_ERROR_MESSAGE
421444
value: "{{ coalesce .Values.opaWebhook.customErrorMessage .Values.customErrorMessage }}"
422445
{{- end -}}
423-
{{- if .Values.opaWebhook.enabled }}
424-
- name: WIZ_MISCONFIGURATION_WEBHOOK_CONFIG
425-
value: |
426-
{{ .Values.opaWebhook | toJson | nindent 4 }}
427-
{{- end -}}
428-
{{- if .Values.imageIntegrityWebhook.enabled }}
429-
- name: WIZ_IMAGE_INTEGRITY_WEBHOOK_CONFIG
430-
value: |
431-
{{ .Values.imageIntegrityWebhook | toJson | nindent 4 }}
432-
{{- end -}}
433-
{{- if .Values.kubernetesAuditLogsWebhook.enabled }}
434-
- name: WIZ_KUBERNETES_AUDIT_LOG_WEBHOOK_CONFIG
435-
value: |
436-
{{ .Values.kubernetesAuditLogsWebhook | toJson | nindent 4 }}
437-
{{- end -}}
438446
{{- if coalesce .Values.global.clusterDisplayName .Values.clusterDisplayName }}
439447
- name: WIZ_CLUSTER_NAME
440448
value: {{ coalesce .Values.global.clusterDisplayName .Values.clusterDisplayName | quote }}

‎wiz-admission-controller/templates/cronjobmanager.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ spec:
6161
{{- else }}
6262
{{- toYaml .Values.securityContext | nindent 16 }}
6363
{{- end }}
64-
image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
64+
image: {{ include "wiz-admission-controller.image" . }}
6565
imagePullPolicy: {{ .Values.image.pullPolicy }}
6666
command:
6767
- "/usr/bin/wiz-admission-controller"

‎wiz-admission-controller/templates/deploymentauditlogs.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ spec:
101101
- "--image-integrity-enabled=false"
102102
env:
103103
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
104+
- name: WIZ_KUBERNETES_AUDIT_LOG_WEBHOOK_CONFIG
105+
value: |
106+
{{- .Values.kubernetesAuditLogsWebhook | toJson | nindent 14 }}
104107
## Enable debug webhook that only logs the request
105108
{{- if .Values.debugWebhook.enabled }}
106109
- name: WIZ_DEBUG_WEBHOOK_ENABLED

‎wiz-admission-controller/templates/deploymentenforcement.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,16 @@ spec:
117117
- "--kubernetes-audit-logs-enabled=false"
118118
env:
119119
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
120+
{{- if .Values.opaWebhook.enabled }}
121+
- name: WIZ_MISCONFIGURATION_WEBHOOK_CONFIG
122+
value: |
123+
{{- .Values.opaWebhook | toJson | nindent 14 }}
124+
{{- end -}}
125+
{{- if .Values.imageIntegrityWebhook.enabled }}
126+
- name: WIZ_IMAGE_INTEGRITY_WEBHOOK_CONFIG
127+
value: |
128+
{{- .Values.imageIntegrityWebhook | toJson | nindent 14 }}
129+
{{- end }}
120130
- name: WIZ_IMAGE_INTEGRITY_PATCH_IMAGE_DIGEST_ANNOTATION
121131
value: {{ .Values.imageIntegrityWebhook.patchImageDigestAnnotation | quote }}
122132
# For running pod with read only file system we write all the cache files to /var/cache volume mount, used by image integrity hook

‎wiz-admission-controller/templates/jobuninstall.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{{ if .Values.wizUninstallJob.enabled -}}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ include "wiz-admission-controller-uninstall.name" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels:
8+
wiz.io/component: "admission-controller-uninstall"
9+
{{- include "wiz-admission-controller-uninstall.labels" . | nindent 4 }}
10+
annotations:
11+
"helm.sh/hook": pre-delete
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
rollme.proxyHash: {{ include "wiz-admission-controller.proxyHash" . }}
14+
rollme.wizApiTokenHash: {{ include "wiz-admission-controller.wizApiTokenHash" . }}
15+
{{- with (.Values.wizUninstallJob.jobAnnotations) }}
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
spec:
19+
{{- if .Values.wizUninstallJob.useJobTTL }}
20+
ttlSecondsAfterFinished: 60
21+
{{- end }}
22+
manualSelector: true
23+
selector:
24+
matchLabels:
25+
{{- include "wiz-admission-controller-uninstall.selectorLabels" . | nindent 6 }}
26+
activeDeadlineSeconds: {{ .Values.wizUninstallJob.timeoutSeconds }}
27+
backoffLimit: 1
28+
template:
29+
metadata:
30+
{{- if (or .Values.global.podAnnotations .Values.podAnnotations .Values.wizUninstallJob.podAnnotations)}}
31+
annotations:
32+
{{- with .Values.global.podAnnotations }}
33+
{{- toYaml . | nindent 8 }}
34+
{{- end }}
35+
{{- with .Values.podAnnotations }}
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
{{- with .Values.wizUninstallJob.podAnnotations }}
39+
{{- toYaml . | nindent 8 }}
40+
{{- end }}
41+
{{- end }}
42+
labels:
43+
wiz.io/component: "admission-controller-uninstall"
44+
{{- include "wiz-admission-controller-uninstall.labels" . | nindent 8 }}
45+
{{- with .Values.global.podLabels }}
46+
{{- toYaml . | nindent 8 }}
47+
{{- end }}
48+
{{- with .Values.podLabels }}
49+
{{- toYaml . | nindent 8 }}
50+
{{- end }}
51+
spec:
52+
{{- with .Values.wizUninstallJob.podAdditionalSpec }}
53+
{{- toYaml . | nindent 8 }}
54+
{{- end }}
55+
{{- with .Values.global.imagePullSecrets }}
56+
imagePullSecrets:
57+
{{- toYaml . | nindent 8 }}
58+
{{- end }}
59+
restartPolicy: "Never"
60+
securityContext:
61+
{{- if hasKey .Values.global "lowPrivilegePodSecurityPolicy" }}
62+
{{- toYaml .Values.global.lowPrivilegePodSecurityPolicy | nindent 8 }}
63+
{{- else }}
64+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
65+
{{- end }}
66+
{{- if .Values.hostNetwork }}
67+
hostNetwork: true
68+
{{- end }}
69+
volumes:
70+
{{- include "wiz-admission-controller.spec.common.volumes" . | trim | nindent 8 }}
71+
{{- with .Values.customVolumes }}
72+
{{- toYaml . | nindent 8 }}
73+
{{- end }}
74+
{{- with .Values.global.customVolumes }}
75+
{{- toYaml . | nindent 8 }}
76+
{{- end }}
77+
containers:
78+
- name: {{ .Chart.Name }}-uninstall
79+
securityContext:
80+
{{- if hasKey .Values.global "lowPrivilegeSecurityPolicy" }}
81+
{{- toYaml .Values.global.lowPrivilegeSecurityPolicy | nindent 14 }}
82+
{{- else }}
83+
{{- toYaml .Values.securityContext | nindent 14 }}
84+
{{- end }}
85+
image: {{ include "wiz-admission-controller.image" . }}
86+
imagePullPolicy: {{ .Values.image.pullPolicy }}
87+
command:
88+
- "/usr/bin/wiz-admission-controller"
89+
- "uninstall"
90+
{{- include "wiz-admission-controller.spec.common.commandArgs" . | trim | nindent 10 }}
91+
env:
92+
{{- include "wiz-admission-controller.spec.common.envVars" . | trim | nindent 10 }}
93+
resources:
94+
{{- include "wiz-admission-controller.resources" . | trim | nindent 12 }}
95+
volumeMounts:
96+
{{- include "wiz-admission-controller.spec.common.volumeMounts" . | trim | nindent 14 }}
97+
{{- if or .Values.customVolumeMounts .Values.global.customVolumeMounts }}
98+
{{- with .Values.customVolumeMounts }}
99+
{{- toYaml . | nindent 14 }}
100+
{{- end }}
101+
{{- with .Values.global.customVolumeMounts }}
102+
{{- toYaml . | nindent 14 }}
103+
{{- end }}
104+
{{- end }}
105+
{{- with (coalesce .Values.global.nodeSelector .Values.nodeSelector) }}
106+
nodeSelector:
107+
{{- toYaml . | nindent 8 }}
108+
{{- end }}
109+
{{- with (coalesce .Values.global.affinity .Values.affinity) }}
110+
affinity:
111+
{{- toYaml . | nindent 8 }}
112+
{{- end }}
113+
{{- if (or .Values.global.tolerations .Values.tolerations) }}
114+
tolerations:
115+
{{- with .Values.global.tolerations }}
116+
{{- toYaml . | nindent 8 }}
117+
{{- end }}
118+
{{- with .Values.tolerations }}
119+
{{- toYaml . | nindent 8 }}
120+
{{- end }}
121+
{{- end }}
122+
{{- end }}
123+

‎wiz-admission-controller/values.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,21 @@ wizManager:
495495
# If empty, a name is generated using the nameOverride
496496
name: ""
497497

498+
wizUninstallJob:
499+
enabled: true # Should the uninstall job be deployed.
500+
nameOverride: "" # Override the uninstall job name.
501+
timeoutSeconds: 300 # The timeout for the uninstall job in seconds.
502+
# Toggle the TTL (Time to Live) mechanism for automatic cleanup of finished Jobs.
503+
# Set to `true` to enable Kubernetes to automatically delete Jobs after they complete or fail, based on the `ttlSecondsAfterFinished` field.
504+
# Set to `false` if using Argo CD to manage Job lifecycle with deletion hooks, as TTL-based cleanup can cause Application to appear OutOfSync.
505+
# See: https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks/#sync-status-with-jobsworkflows-with-time-to-live-ttl
506+
useJobTTL: true
507+
jobAnnotations: {}
508+
podAnnotations: {}
509+
podAdditionalSpec: {}
510+
511+
512+
498513
# Global values to override chart values.
499514
global:
500515
nameOverride: "" # Override the release’s name.

0 commit comments

Comments
 (0)