Skip to content

Commit 66ad3ca

Browse files
nitzanzulernitzanzuler
authored
AC auto-update (#397)
* version port * rename version port to status port * undo replica set * manager deployment * bump minor * remove watch * autp update args * create manager only in auto upadte enabled * bump app version * cronjob * comment * undo defaultMode: 444 * fix rolebinding * fix values.yaml * remove probes * cr fix * cr fix * manager service account * fix error * remove from values * event creator role * fix * cr fix * fix error * istio sidecar * fix merge * use controller.isEnforcerEnabled and inline it * fix * use common args and env * cr fix * update comment
1 parent 10ce306 commit 66ad3ca

File tree

10 files changed

+384
-198
lines changed

10 files changed

+384
-198
lines changed

‎wiz-admission-controller/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ type: application
77
# This is the chart version. This version number should be incremented each time you make changes
88
# to the chart and its templates, including the app version.
99
# Versions are expected to follow Semantic Versioning (https://semver.org/)
10-
version: 3.6.1
10+
version: 3.7.0-preview
1111

1212
# This is the version number of the application being deployed. This version number should be
1313
# incremented each time you make changes to the application. Versions are not expected to
1414
# follow Semantic Versioning. They should reflect the version the application is using.
1515
# It is recommended to use it with quotes.
16-
appVersion: "2.6"
16+
appVersion: "2.7"

‎wiz-admission-controller/templates/_helpers.tpl‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,19 @@ If release name contains chart name it will be used as a full name.
4040
{{- end }}
4141
{{- end }}
4242

43+
{{- define "wiz-admission-controller-manager.name" -}}
44+
{{- if .Values.wizManager.nameOverride }}
45+
{{- .Values.wizManager.nameOverride | trunc 63 | trimSuffix "-" }}
46+
{{- else }}
47+
{{- $name := "wiz-admission-controller-manager" }}
48+
{{- if contains $name .Release.Name }}
49+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
50+
{{- else }}
51+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
52+
{{- end }}
53+
{{- end }}
54+
{{- end }}
55+
4356
{{- define "wiz-hpa-enforcer.name" -}}
4457
{{- printf "%s-hpa" (include "wiz-admission-controller.fullname" .) | trunc 63 | trimSuffix "-" }}
4558
{{- end }}
@@ -99,6 +112,13 @@ Wiz kubernetes audit logs webhook server selector labels
99112
app.kubernetes.io/name: {{ include "wiz-kubernetes-audit-log-collector.name" . }}
100113
{{- end }}
101114

115+
{{/*
116+
Wiz manager selector labels
117+
*/}}
118+
{{- define "wiz-admission-controller-manager.selectorLabels" -}}
119+
app.kubernetes.io/name: {{ include "wiz-admission-controller-manager.name" . }}
120+
{{- end }}
121+
102122
{{- define "wiz-admission-controller-enforcement.labels" -}}
103123
{{ include "wiz-admission-controller.labels" . }}
104124
{{ include "wiz-admission-controller-enforcement.selectorLabels" . }}
@@ -109,6 +129,11 @@ app.kubernetes.io/name: {{ include "wiz-kubernetes-audit-log-collector.name" . }
109129
{{ include "wiz-kubernetes-audit-log-collector.selectorLabels" . }}
110130
{{- end }}
111131

132+
{{- define "wiz-admission-controller-manager.labels" -}}
133+
{{ include "wiz-admission-controller.labels" . }}
134+
{{ include "wiz-admission-controller-manager.selectorLabels" . }}
135+
{{- end }}
136+
112137
{{/*
113138
Wiz Horizontal Pod Autoscaler labels
114139
*/}}
@@ -133,6 +158,11 @@ Create the name of the service account to use
133158
{{ coalesce (.Values.serviceAccount.name) (include "wiz-admission-controller.fullname" .) }}
134159
{{- end }}
135160

161+
{{- define "wiz-admission-controller.manager.serviceAccountName" -}}
162+
{{ coalesce (.Values.wizManager.serviceAccount.name) (include "wiz-admission-controller-manager.name" .) }}
163+
{{- end }}
164+
165+
136166
{{- define "wiz-admission-controller.secretApiTokenName" -}}
137167
{{ coalesce (.Values.global.wizApiToken.secret.name) (.Values.wizApiToken.secret.name) (printf "%s-%s" .Release.Name "api-token") }}
138168
{{- end }}
@@ -249,3 +279,124 @@ scaleDown:
249279
periodSeconds: 300
250280
{{- end -}}
251281
{{- end -}}
282+
283+
{{- define "autoUpdate.deployments" -}}
284+
{{- $list := list -}}
285+
{{- if eq (include "wiz-admission-controller.isEnforcerEnabled" . | trim | lower) "true" }}
286+
{{- $list = append $list (include "wiz-admission-controller.fullname" . ) -}}
287+
{{- end -}}
288+
{{- if .Values.kubernetesAuditLogsWebhook.enabled -}}
289+
{{- $list = append $list (include "wiz-kubernetes-audit-log-collector.name" . ) -}}
290+
{{- end -}}
291+
{{- $list | toJson -}}
292+
{{- end -}}
293+
294+
{{/*
295+
Clean the list of deployments for the auto-update flag, removing quotes and brackets
296+
*/}}
297+
{{- define "autoUpdate.deployments.arg" -}}
298+
{{- $deployments := include "autoUpdate.deployments" . -}}
299+
{{- $deployments = replace "[" "" $deployments -}}
300+
{{- $deployments = replace "]" "" $deployments -}}
301+
{{- $deployments = replace "\"" "" $deployments -}}
302+
- "--update-deployments={{ $deployments }}"
303+
{{- end -}}
304+
305+
{{- define "spec.common.commandArgs" -}}
306+
# Cluster identification flags
307+
- "--cluster-external-id={{ coalesce .Values.global.clusterExternalId .Values.webhook.clusterExternalId .Values.opaWebhook.clusterExternalId }}"
308+
- "--subscription-external-id={{ coalesce .Values.global.subscriptionExternalId .Values.webhook.subscriptionExternalId }}"
309+
{{- with (coalesce .Values.global.clusterTags .Values.webhook.clusterTags) }}
310+
- --cluster-tags
311+
- {{ . | toJson | quote }}
312+
{{- end }}
313+
{{- with (coalesce .Values.global.subscriptionTags .Values.webhook.subscriptionTags) }}
314+
- --subscription-tags
315+
- {{ . | toJson | quote }}
316+
{{- end }}
317+
{{- end -}}
318+
319+
{{- define "spec.admissionControllerRunner.commandArgs" -}}
320+
# Server flags
321+
- "--port={{ .Values.service.targetPort }}"
322+
- "--tls-private-key-file=/var/server-certs/tls.key"
323+
- "--tls-cert-file=/var/server-certs/tls.crt"
324+
- "--readiness-port={{ .Values.healthPort }}"
325+
# Kubernetes API server flags
326+
- "--namespace-cache-ttl={{ .Values.kubernetesApiServer.cacheNamespaceLabelsTTL }}"
327+
{{- end -}}
328+
329+
{{- define "spec.common.envVars" -}}
330+
{{- if not .Values.wizApiToken.usePodCustomEnvironmentVariablesFile }}
331+
- name: WIZ_CLIENT_ID
332+
valueFrom:
333+
secretKeyRef:
334+
name: {{ include "wiz-admission-controller.secretApiTokenName" . | trim }}
335+
key: clientId
336+
optional: false
337+
- name: WIZ_CLIENT_TOKEN
338+
valueFrom:
339+
secretKeyRef:
340+
name: {{ include "wiz-admission-controller.secretApiTokenName" . | trim }}
341+
key: clientToken
342+
optional: false
343+
{{- end }}
344+
- name: WIZ_ENV
345+
value: {{ coalesce .Values.global.wizApiToken.clientEndpoint .Values.wizApiToken.clientEndpoint | quote }}
346+
{{- if or .Values.global.httpProxyConfiguration.enabled .Values.httpProxyConfiguration.enabled }}
347+
- name: HTTP_PROXY
348+
valueFrom:
349+
secretKeyRef:
350+
name: {{ include "wiz-admission-controller.proxySecretName" . | trim }}
351+
key: httpProxy
352+
optional: false
353+
- name: HTTPS_PROXY
354+
valueFrom:
355+
secretKeyRef:
356+
name: {{ include "wiz-admission-controller.proxySecretName" . | trim }}
357+
key: httpsProxy
358+
optional: false
359+
- name: NO_PROXY
360+
valueFrom:
361+
secretKeyRef:
362+
name: {{ include "wiz-admission-controller.proxySecretName" . | trim }}
363+
key: noProxyAddress
364+
optional: false
365+
{{- end }}
366+
{{- if .Values.logLevel }}
367+
- name: LOG_LEVEL
368+
value: {{ .Values.logLevel }}
369+
{{- end }}
370+
{{- with .Values.podCustomEnvironmentVariables }}
371+
{{- toYaml . | nindent 14 }}
372+
{{- end }}
373+
{{- with .Values.global.podCustomEnvironmentVariables }}
374+
{{- toYaml . | nindent 14 }}
375+
{{- end }}
376+
{{- if .Values.podCustomEnvironmentVariablesFile }}
377+
- name: CLI_ENV_FILE
378+
value: {{ .Values.podCustomEnvironmentVariablesFile }}
379+
- name: USE_CLI_ENV_FILE
380+
value: "true"
381+
{{- end }}
382+
- name: WIZ_RUNTIME_METADATA_POD_NAME
383+
valueFrom:
384+
fieldRef:
385+
fieldPath: metadata.name
386+
- name: WIZ_RUNTIME_METADATA_NODE_NAME
387+
valueFrom:
388+
fieldRef:
389+
fieldPath: spec.nodeName
390+
- name: K8S_NAMESPACE
391+
valueFrom:
392+
fieldRef:
393+
fieldPath: metadata.namespace
394+
- name: WIZ_TERMINATION_GRACE_PERIOD
395+
value: "{{ .Values.global.podTerminationGracePeriodSeconds }}s"
396+
{{- if .Values.global.istio.enabled }}
397+
- name: WIZ_ISTIO_PROXY_ENABLED
398+
value: "true"
399+
- name: WIZ_ISTIO_PROXY_PORT
400+
value: "{{ .Values.global.istio.proxySidecarPort }}"
401+
{{- end }}
402+
{{- end -}}

‎wiz-admission-controller/templates/cronjobmanager.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{{ if and .Values.wizManager.enabled -}}
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: {{ include "wiz-admission-controller-manager.name" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels:
8+
{{- include "wiz-admission-controller-manager.labels" . | nindent 4 }}
9+
spec:
10+
schedule: "{{ .Values.wizManager.schedule }}"
11+
concurrencyPolicy: Forbid # Ensures only one job instance runs at a time
12+
jobTemplate:
13+
spec:
14+
activeDeadlineSeconds: {{ .Values.wizManager.timeoutSeconds }}
15+
ttlSecondsAfterFinished: {{ .Values.wizManager.cleanupJobSeconds }}
16+
template:
17+
metadata:
18+
annotations:
19+
rollme.proxyHash: {{ include "wiz-admission-controller.proxyHash" . }}
20+
rollme.wizApiTokenHash: {{ include "wiz-admission-controller.wizApiTokenHash" . }}
21+
{{- with (coalesce .Values.global.podAnnotations .Values.podAnnotations) }}
22+
{{- toYaml . | nindent 12 }}
23+
{{- end }}
24+
labels:
25+
{{- include "wiz-admission-controller-manager.labels" . | nindent 12 }}
26+
{{- with (coalesce .Values.global.podLabels .Values.podLabels) }}
27+
{{- toYaml . | nindent 12 }}
28+
{{- end }}
29+
spec:
30+
restartPolicy: Never
31+
{{- if .Values.priorityClassName }}
32+
priorityClassName: {{ .Values.priorityClassName }}
33+
{{- end }}
34+
{{- with (coalesce .Values.global.imagePullSecrets .Values.imagePullSecrets) }}
35+
imagePullSecrets:
36+
{{- toYaml . | nindent 12 }}
37+
{{- end }}
38+
serviceAccountName: {{ include "wiz-admission-controller.manager.serviceAccountName" . }}
39+
securityContext:
40+
{{- if hasKey .Values.global "lowPrivilegePodSecurityPolicy" }}
41+
{{- toYaml .Values.global.lowPrivilegePodSecurityPolicy | nindent 12 }}
42+
{{- else }}
43+
{{- toYaml .Values.podSecurityContext | nindent 12 }}
44+
{{- end }}
45+
{{- if .Values.hostNetwork }}
46+
hostNetwork: true
47+
{{- end }}
48+
terminationGracePeriodSeconds: {{ .Values.global.podTerminationGracePeriodSeconds }}
49+
containers:
50+
- name: {{ .Chart.Name }}
51+
securityContext:
52+
{{- if hasKey .Values.global "lowPrivilegeSecurityPolicy" }}
53+
{{- toYaml .Values.global.lowPrivilegeSecurityPolicy | nindent 16 }}
54+
{{- else }}
55+
{{- toYaml .Values.securityContext | nindent 16 }}
56+
{{- end }}
57+
image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
58+
imagePullPolicy: {{ .Values.image.pullPolicy }}
59+
command:
60+
- "/usr/bin/wiz-admission-controller"
61+
- "manager"
62+
{{- include "spec.common.commandArgs" . | trim | nindent 14 }}
63+
{{- include "autoUpdate.deployments.arg" . | trim | nindent 14 }}
64+
# Auto update flags
65+
- "--auto-update-enabled={{ .Values.wizManager.autoRolloutRestart.enabled }}"
66+
- "--release-namespace={{ .Release.Namespace }}"
67+
env:
68+
{{- include "spec.common.envVars" . | trim | nindent 14 }}
69+
resources:
70+
{{- include "wiz-admission-controller.resources" . | trim | nindent 16 }}
71+
{{- with .Values.customVolumeMounts }}
72+
{{- toYaml . | nindent 14 }}
73+
{{- end }}
74+
{{- with .Values.global.customVolumeMounts }}
75+
{{- toYaml . | nindent 14 }}
76+
{{- end }}
77+
volumes:
78+
{{- with .Values.customVolumes }}
79+
{{- toYaml . | nindent 12 }}
80+
{{- end }}
81+
{{- with .Values.global.customVolumes }}
82+
{{- toYaml . | nindent 12 }}
83+
{{- end }}
84+
{{- with (coalesce .Values.global.nodeSelector .Values.nodeSelector) }}
85+
nodeSelector:
86+
{{- toYaml . | nindent 12 }}
87+
{{- end }}
88+
{{- with (coalesce .Values.global.affinity .Values.affinity) }}
89+
affinity:
90+
{{- toYaml . | nindent 12 }}
91+
{{- end }}
92+
{{- with (coalesce .Values.global.tolerations .Values.tolerations) }}
93+
tolerations:
94+
{{- toYaml . | nindent 12 }}
95+
{{- end }}
96+
{{- end }}

0 commit comments

Comments
 (0)