Simplify FedRamp deployment (#429)

ofirc-wiz · nitzanzuler · web-flow · commit 57cc98a5997b · 2024-11-06T20:26:01.000+02:00
* Simplify FedRamp deployment

Set `global.isFedRamp` to true for FedRamp deployments (default is false).

Co-authored-by: nitzanzuler &lt;71496861+nitzanzuler@users.noreply.github.com&gt;
diff --git a/wiz-admission-controller/templates/_helpers.tpl b/wiz-admission-controller/templates/_helpers.tpl
@@ -406,3 +406,11 @@ Clean the list of deployments for the auto-update flag, removing quotes and brac
   value: "{{ .Values.global.istio.proxySidecarPort }}"
 {{- end }}
 {{- end -}}
+
+{{- define "wiz-admission-controller.image" -}}
+{{- if .Values.global.isFedRamp -}}
+publicregistryfedrampwizio.azurecr.us/wiz-app/wiz-admission-controller-fips:{{ .Values.image.tag | default .Chart.AppVersion }}
+{{- else -}}
+{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+{{- end -}}
+{{- end -}}
diff --git a/wiz-admission-controller/templates/deploymentauditlogs.yaml b/wiz-admission-controller/templates/deploymentauditlogs.yaml
@@ -58,7 +58,7 @@ spec:
             {{- else }}
             {{- toYaml .Values.securityContext | nindent 12 }}
             {{- end }}
-          image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: {{ include "wiz-admission-controller.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
           - containerPort: {{ .Values.service.targetPort }}
diff --git a/wiz-admission-controller/templates/deploymentenforcement.yaml b/wiz-admission-controller/templates/deploymentenforcement.yaml
@@ -58,7 +58,7 @@ spec:
             {{- else }}
             {{- toYaml .Values.securityContext | nindent 12 }}
             {{- end }}
-          image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: {{ include "wiz-admission-controller.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
           - containerPort: {{ .Values.service.targetPort }}
diff --git a/wiz-admission-controller/values.yaml b/wiz-admission-controller/values.yaml
@@ -10,7 +10,8 @@ commonLabels: {} # Labels applied on all the resources (not used for selection)
 wizApiToken:
   clientId: "" # Client ID of the Wiz Service Account.
   clientToken: "" # Client secret of the Wiz Service Account.
-  clientEndpoint: "" # Set to 'gov' or 'fedramp' for gov/fedramp tenants only, otherwise leave blank.
+  clientEndpoint: "" # Defaults to commercial.
+                     # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
 
   secret:
     # Should a Secret be created by the chart or not.
@@ -53,12 +54,11 @@ podDisruptionBudget:
 
 image:
   registry: wiziopublic.azurecr.io/wiz-app
-  # Use this if you are deploying on federal environments with FIPS endpoints.
-  # repository: wiz-admission-controller-fips
   repository: wiz-admission-controller
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
+
 imagePullSecrets: [] # Secrets for container image registry keys as described in https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod
 
 priorityClassName: ""
@@ -489,7 +489,8 @@ global:
   wizApiToken:
     clientId: "" 
     clientToken: ""
-    clientEndpoint: "" # Wiz endpoint to connect to (required for gov tenants).
+    clientEndpoint: "" # Defaults to commercial.
+                       # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
     
     secret:
       # The name of the Wiz Service Account Secret.
@@ -556,3 +557,6 @@ global:
   #
   # lowPrivilegePodSecurityPolicy: {}
   # lowPrivilegeSecurityPolicy: {}
+
+  # Set to true to use FedRamp endpoints and FIPS-compliant images.
+  isFedRamp: false
diff --git a/wiz-broker/Chart.yaml b/wiz-broker/Chart.yaml
@@ -4,5 +4,5 @@ description: Wiz Broker for tunneling http traffic to Wiz backend
 
 type: application
 
-version: 2.1.0
+version: 2.2.0
 appVersion: "2.5"
diff --git a/wiz-broker/templates/_helpers.tpl b/wiz-broker/templates/_helpers.tpl
@@ -103,3 +103,11 @@ Secrets names
 {{- define "wiz-broker.connectorSecretName" -}}
 {{ coalesce (.Values.wizConnector.secretName) (printf "%s-connector" .Release.Name) }}
 {{- end }}
+
+{{- define "wiz-broker.image" -}}
+{{- if .Values.global.isFedRamp -}}
+publicregistryfedrampwizio.azurecr.us/wiz-app/wiz-broker-fips:{{ .Values.image.tag | default .Chart.AppVersion }}
+{{- else -}}
+{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ coalesce .Values.global.image.tag .Values.image.tag | default .Chart.AppVersion }}
+{{- end -}}
+{{- end -}}
diff --git a/wiz-broker/templates/wiz-broker-deployment.yaml b/wiz-broker/templates/wiz-broker-deployment.yaml
@@ -77,7 +77,7 @@ spec:
             {{- else }}
             {{- toYaml .Values.global.securityContext | nindent 12 }}
             {{- end }}
-          image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ coalesce .Values.global.image.tag .Values.image.tag | default .Chart.AppVersion }}"
+          image: {{ include "wiz-broker.image" . }}
           imagePullPolicy: {{ coalesce .Values.global.image.pullPolicy .Values.image.pullPolicy }}
           volumeMounts:
           - name: connector-data
diff --git a/wiz-broker/values.yaml b/wiz-broker/values.yaml
@@ -9,8 +9,6 @@ commonLabels: {} # Labels applied on all the resources (not used for selection)
 
 image:
   registry: wiziopublic.azurecr.io/wiz-app
-  # Use this if you are deploying on federal environments with FIPS endpoints.
-  # repository: wiz-broker-fips
   repository: wiz-broker
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
@@ -71,7 +69,8 @@ wizConnector:
 wizApiToken:
   clientId: "" # Client ID of the Wiz Service Account.
   clientToken: "" # Client secret of the Wiz Service Account.
-  clientEndpoint: "" # Set to 'gov' or 'fedramp' for gov/fedramp tenants only, otherwise leave blank.
+  clientEndpoint: "" # Defaults to commercial.
+                     # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
 
   secret:
     # Should a Secret be created by the chart or not.
@@ -116,8 +115,6 @@ global:
 
   image:
     registry: wiziopublic.azurecr.io/wiz-app
-    # Use this if you are deploying on federal environments with FIPS endpoints.
-    # repository: wiz-broker-fips
     repository: wiz-broker
     pullPolicy: Always  # Always pull the image on every deployment
     # Overrides the image tag whose default is the chart appVersion.
@@ -151,11 +148,15 @@ global:
     runAsUser: 1000
 
   wizApiToken:
-    clientEndpoint: "" # Wiz endpoint to connect to (required for gov tenants).
+    clientEndpoint: "" # Defaults to commercial.
+                       # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
     secret:
       name: "" # Override with parent secret name
 
   httpProxyConfiguration:
     enabled: false # Should the components use a proxy.
     create: false # Secret created by wiz-broker.
     secretName: "" # The name of the proxy Secret.
+
+  # Set to true to use FedRamp endpoints and FIPS-compliant images.
+  isFedRamp: false
diff --git a/wiz-kubernetes-connector/Chart.yaml b/wiz-kubernetes-connector/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.1.1
+version: 3.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/wiz-kubernetes-connector/templates/_helpers.tpl b/wiz-kubernetes-connector/templates/_helpers.tpl
@@ -225,3 +225,11 @@ delete-kubernetes-connector
   - >
     {{- printf "%s" $output | nindent 2 }}
 {{- end }}
+
+{{- define "wiz-broker.image" -}}
+{{- if .Values.global.isFedRamp -}}
+publicregistryfedrampwizio.azurecr.us/wiz-app/wiz-broker-fips:{{ .Values.image.tag | default .Chart.AppVersion }}
+{{- else -}}
+{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+{{- end -}}
+{{- end -}}
diff --git a/wiz-kubernetes-connector/templates/job-create-connector.yaml b/wiz-kubernetes-connector/templates/job-create-connector.yaml
@@ -78,7 +78,7 @@ spec:
             {{- else }}
             {{- toYaml .Values.global.securityContext | nindent 12 }}
             {{- end }}
-          image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: {{ include "wiz-broker.image" . }}
           imagePullPolicy: {{ coalesce .Values.global.image.pullPolicy .Values.image.pullPolicy }}
           command:
             {{- include "wiz-kubernetes-connector.entrypoint" . | nindent 12 }}
diff --git a/wiz-kubernetes-connector/templates/job-delete-connector.yaml b/wiz-kubernetes-connector/templates/job-delete-connector.yaml
@@ -64,7 +64,7 @@ spec:
             {{- else }}
             {{- toYaml .Values.global.securityContext | nindent 12 }}
             {{- end }}
-          image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: {{ include "wiz-broker.image" . }}
           imagePullPolicy: {{ coalesce .Values.global.image.pullPolicy .Values.image.pullPolicy }}
           command: ["/bin/sh", "-c"]
           args: {{- include "wiz-kubernetes-connector.argsListDeleteConnector" . | nindent 12 }}
diff --git a/wiz-kubernetes-connector/values.yaml b/wiz-kubernetes-connector/values.yaml
@@ -7,8 +7,6 @@ commonLabels: {} # Labels applied on all the resources (not used for selection)
 
 image:
   registry: wiziopublic.azurecr.io/wiz-app
-  # Use this if you are deploying on federal environments with FIPS endpoints.
-  # repository: wiz-broker-fips
   repository: wiz-broker
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
@@ -78,7 +76,8 @@ autoCreateConnector:
 wizApiToken:
   clientId: "" # Client ID of the Wiz Service Account.
   clientToken: "" # Client secret of the Wiz Service Account.
-  clientEndpoint: "" # Set to 'gov' or 'fedramp' for gov/fedramp tenants only, otherwise leave blank.
+  clientEndpoint: "" # Defaults to commercial.
+                     # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
 
   secret:
     # Should a Secret be created by the chart or not.
@@ -131,7 +130,8 @@ wiz-broker:
   customVolumeMounts: [] # Additional volume mounts to add to the components Pods
 
   wizApiToken:
-    clientEndpoint: "" # Wiz endpoint to connect to (required for gov tenants).
+    clientEndpoint: "" # Defaults to commercial.
+                       # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
     secret:
       create: false # Secret created by wiz-kubernetes-connector.
     secretName: ""
@@ -181,8 +181,6 @@ httpProxyConfiguration:
 global:
   image:
     registry: wiziopublic.azurecr.io/wiz-app
-    # Use this if you are deploying on federal environments with FIPS endpoints.
-    # repository: wiz-broker-fips
     repository: wiz-broker
     pullPolicy: Always
     # Overrides the image tag whose default is the chart appVersion.
@@ -236,11 +234,15 @@ global:
     allowPrivilegeEscalation: false
 
   wizApiToken:
-    clientEndpoint: "" # Wiz endpoint to connect to (required for gov tenants).
+    clientEndpoint: "" # Defaults to commercial.
+                       # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
     secret:
       name: "" # Override with parent secret name
 
   httpProxyConfiguration:
     enabled: false # Should the components use a proxy.
     create: false # Secret created by wiz-kubernetes-connector.
     secretName: "" # The name of the proxy Secret.
+
+  # Set to true to use FedRamp endpoints and FIPS-compliant images.
+  isFedRamp: false
diff --git a/wiz-kubernetes-integration/values.yaml b/wiz-kubernetes-integration/values.yaml
@@ -10,7 +10,8 @@ global:
   wizApiToken:
     clientId: "" # Client ID of the Wiz Service Account.
     clientToken: "" # Client secret of the Wiz Service Account.
-    clientEndpoint: "" # Set to 'gov' or 'fedramp' for gov/fedramp tenants only, otherwise leave blank.
+    clientEndpoint: "" # Defaults to commercial.
+                       # If `global.isFedRamp` is `true`, this field gets automatically set to `fedramp`.
 
     secret:
       # Should a Secret be created by the chart or not.
@@ -76,6 +77,9 @@ global:
   # lowPrivilegePodSecurityPolicy: {}
   # lowPrivilegeSecurityPolicy: {}
 
+  # Set to true to use FedRamp endpoints and FIPS-compliant images.
+  isFedRamp: false
+
 # Wiz Kubernetes Connector
 # Configuration values for the wiz-kubernetes-connector dependency
 # ref: https://github.com/wiz-sec/charts/blob/master/wiz-kubernetes-connector/values.yaml
