Skip to content

Commit 676321d

Browse files
nitzanzulernitzanzuler
committed
cronjob
1 parent 8236b82 commit 676321d

File tree

7 files changed

+238
-243
lines changed

7 files changed

+238
-243
lines changed

‎wiz-admission-controller/templates/_helpers.tpl‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,6 @@ Use for debug purpose only.
215215
{{- . | mustToPrettyJson | printf "\nThe JSON output of the dumped var is: \n%s" | fail }}
216216
{{- end -}}
217217

218-
219218
{{- define "autoUpdate.deployments" -}}
220219
{{- $list := list -}}
221220
{{- if or .Values.opaWebhook.enabled .Values.imageIntegrityWebhook.enabled .Values.debugWebhook.enabled -}}
@@ -224,5 +223,13 @@ Use for debug purpose only.
224223
{{- if .Values.kubernetesAuditLogsWebhook.enabled -}}
225224
{{- $list = append $list (include "wiz-kubernetes-audit-log-collector.name" . ) -}}
226225
{{- end -}}
227-
--auto-update-deployments={{ $list | toJson }}
226+
{{- $list | toJson -}}
227+
{{- end -}}
228+
229+
{{- define "autoUpdate.deployments.arg" -}}
230+
{{- $x := include "autoUpdate.deployments" . -}}
231+
{{- $x = replace "[" "" $x -}}
232+
{{- $x = replace "]" "" $x -}}
233+
{{- $x = replace "\"" "" $x -}}
234+
- "--update-deployments={{ $x }}"
228235
{{- end -}}

‎wiz-admission-controller/templates/cronjobmanager.yaml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
{{ if and .Values.wizManager.enabled -}}
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: {{ include "wiz-admission-controller-manager.name" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels:
8+
{{- include "wiz-admission-controller-manager.labels" . | nindent 4 }}
9+
spec:
10+
schedule: "{{ .Values.wizManager.schedule }}"
11+
concurrencyPolicy: Forbid # Ensures only one job instance runs at a time
12+
jobTemplate:
13+
spec:
14+
activeDeadlineSeconds: {{ .Values.wizManager.timeoutSeconds }}
15+
ttlSecondsAfterFinished: {{ .Values.wizManager.cleanupJobSeconds }}
16+
template:
17+
metadata:
18+
annotations:
19+
rollme.proxyHash: {{ include "wiz-admission-controller.proxyHash" . }}
20+
rollme.wizApiTokenHash: {{ include "wiz-admission-controller.wizApiTokenHash" . }}
21+
rollme.webhookCert: {{ include (print $.Template.BasePath "/opawebhook.yaml") . | sha256sum }}
22+
{{- with (coalesce .Values.global.podAnnotations .Values.podAnnotations) }}
23+
{{- toYaml . | nindent 12 }}
24+
{{- end }}
25+
labels:
26+
{{- include "wiz-admission-controller-manager.labels" . | nindent 12 }}
27+
{{- with (coalesce .Values.global.podLabels .Values.podLabels) }}
28+
{{- toYaml . | nindent 12 }}
29+
{{- end }}
30+
spec:
31+
restartPolicy: Never
32+
{{- if .Values.priorityClassName }}
33+
priorityClassName: {{ .Values.priorityClassName }}
34+
{{- end }}
35+
{{- with (coalesce .Values.global.imagePullSecrets .Values.imagePullSecrets) }}
36+
imagePullSecrets:
37+
{{- toYaml . | nindent 12 }}
38+
{{- end }}
39+
serviceAccountName: {{ include "wiz-admission-controller.serviceAccountName" . }}
40+
securityContext:
41+
{{- if hasKey .Values.global "lowPrivilegePodSecurityPolicy" }}
42+
{{- toYaml .Values.global.lowPrivilegePodSecurityPolicy | nindent 12 }}
43+
{{- else }}
44+
{{- toYaml .Values.podSecurityContext | nindent 12 }}
45+
{{- end }}
46+
{{- if .Values.hostNetwork }}
47+
hostNetwork: true
48+
{{- end }}
49+
terminationGracePeriodSeconds: {{ .Values.global.podTerminationGracePeriodSeconds }}
50+
containers:
51+
- name: {{ .Chart.Name }}
52+
securityContext:
53+
{{- if hasKey .Values.global "lowPrivilegeSecurityPolicy" }}
54+
{{- toYaml .Values.global.lowPrivilegeSecurityPolicy | nindent 16 }}
55+
{{- else }}
56+
{{- toYaml .Values.securityContext | nindent 16 }}
57+
{{- end }}
58+
image: "{{ coalesce .Values.global.image.registry .Values.image.registry }}/{{ coalesce .Values.global.image.repository .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
59+
imagePullPolicy: {{ .Values.image.pullPolicy }}
60+
readinessProbe:
61+
httpGet:
62+
path: /ready
63+
port: {{ .Values.healthPort }}
64+
scheme: HTTPS
65+
{{- toYaml .Values.probes.readinessProbe | nindent 16 }}
66+
livenessProbe:
67+
httpGet:
68+
path: /live
69+
port: {{ .Values.healthPort }}
70+
scheme: HTTPS
71+
{{- toYaml .Values.probes.livenessProbe | nindent 16 }}
72+
startupProbe:
73+
httpGet:
74+
path: /ready
75+
port: {{ .Values.healthPort }}
76+
scheme: HTTPS
77+
{{- toYaml .Values.probes.startupProbe | nindent 16 }}
78+
command:
79+
- "/usr/bin/wiz-admission-controller"
80+
- "manager"
81+
# Auto update flags
82+
- "--wiz-force-update-enabled={{ .Values.wizManager.rolloutRestart.wizForceEnabled }}"
83+
- "--periodic-restart-interval={{ .Values.wizManager.rolloutRestart.interval }}"
84+
- "--release-namespace={{ .Release.Namespace }}"
85+
{{- include "autoUpdate.deployments.arg" . | trim | nindent 16 -}}
86+
# Server flags
87+
- "--tls-private-key-file=/var/server-certs/tls.key"
88+
- "--tls-cert-file=/var/server-certs/tls.crt"
89+
# Cluster identification flags
90+
- "--cluster-external-id={{ coalesce .Values.global.clusterExternalId .Values.webhook.clusterExternalId }}"
91+
{{- with (coalesce .Values.global.subscriptionExternalId .Values.webhook.subscriptionExternalId) }}
92+
- --subscription-external-id
93+
- {{ . | quote }}
94+
{{- end }}
95+
{{- with (coalesce .Values.global.clusterTags .Values.webhook.clusterTags) }}
96+
- --cluster-tags
97+
- {{ . | toJson | quote }}
98+
{{- end }}
99+
{{- with (coalesce .Values.global.subscriptionTags .Values.webhook.subscriptionTags) }}
100+
- --subscription-tags
101+
- {{ . | toJson | quote }}
102+
{{- end }}
103+
env:
104+
{{- if not .Values.wizApiToken.usePodCustomEnvironmentVariablesFile }}
105+
- name: WIZ_CLIENT_ID
106+
valueFrom:
107+
secretKeyRef:
108+
name: {{ include "wiz-admission-controller.secretApiTokenName" . | trim }}
109+
key: clientId
110+
optional: false
111+
- name: WIZ_CLIENT_TOKEN
112+
valueFrom:
113+
secretKeyRef:
114+
name: {{ include "wiz-admission-controller.secretApiTokenName" . | trim }}
115+
key: clientToken
116+
optional: false
117+
{{- end }}
118+
- name: WIZ_ENV
119+
value: {{ coalesce .Values.global.wizApiToken.clientEndpoint .Values.wizApiToken.clientEndpoint | quote }}
120+
{{- if or .Values.global.httpProxyConfiguration.enabled .Values.httpProxyConfiguration.enabled }}
121+
- name: HTTP_PROXY
122+
valueFrom:
123+
secretKeyRef:
124+
name: {{ include "wiz-admission-controller.proxySecretName" . | trim }}
125+
key: httpProxy
126+
optional: false
127+
- name: HTTPS_PROXY
128+
valueFrom:
129+
secretKeyRef:
130+
name: {{ include "wiz-admission-controller.proxySecretName" . | trim }}
131+
key: httpsProxy
132+
optional: false
133+
- name: NO_PROXY
134+
valueFrom:
135+
secretKeyRef:
136+
name: {{ include "wiz-admission-controller.proxySecretName" . | trim }}
137+
key: noProxyAddress
138+
optional: false
139+
{{- end }}
140+
{{- if .Values.logLevel }}
141+
- name: LOG_LEVEL
142+
value: {{ .Values.logLevel }}
143+
{{- end }}
144+
{{- with .Values.podCustomEnvironmentVariables }}
145+
{{- toYaml . | nindent 14 }}
146+
{{- end }}
147+
{{- with .Values.global.podCustomEnvironmentVariables }}
148+
{{- toYaml . | nindent 14 }}
149+
{{- end }}
150+
{{- if .Values.podCustomEnvironmentVariablesFile }}
151+
- name: CLI_ENV_FILE
152+
value: {{ .Values.podCustomEnvironmentVariablesFile }}
153+
- name: USE_CLI_ENV_FILE
154+
value: "true"
155+
{{- end }}
156+
- name: WIZ_RUNTIME_METADATA_POD_NAME
157+
valueFrom:
158+
fieldRef:
159+
fieldPath: metadata.name
160+
- name: WIZ_RUNTIME_METADATA_NODE_NAME
161+
valueFrom:
162+
fieldRef:
163+
fieldPath: spec.nodeName
164+
- name: K8S_NAMESPACE
165+
valueFrom:
166+
fieldRef:
167+
fieldPath: metadata.namespace
168+
- name: WIZ_TERMINATION_GRACE_PERIOD
169+
value: "{{ .Values.global.podTerminationGracePeriodSeconds }}s"
170+
resources:
171+
{{- toYaml .Values.resources | nindent 16 }}
172+
volumeMounts:
173+
- mountPath: /var/server-certs
174+
name: server-certs
175+
readOnly: true
176+
{{- with .Values.customVolumeMounts }}
177+
{{- toYaml . | nindent 14 }}
178+
{{- end }}
179+
{{- with .Values.global.customVolumeMounts }}
180+
{{- toYaml . | nindent 14 }}
181+
{{- end }}
182+
volumes:
183+
- name: server-certs
184+
secret:
185+
defaultMode: 444
186+
secretName: {{ include "wiz-admission-controller.secretServerCert" . | trim }}
187+
{{- with .Values.customVolumes }}
188+
{{- toYaml . | nindent 12 }}
189+
{{- end }}
190+
{{- with .Values.global.customVolumes }}
191+
{{- toYaml . | nindent 12 }}
192+
{{- end }}
193+
{{- with (coalesce .Values.global.nodeSelector .Values.nodeSelector) }}
194+
nodeSelector:
195+
{{- toYaml . | nindent 12 }}
196+
{{- end }}
197+
{{- with (coalesce .Values.global.affinity .Values.affinity) }}
198+
affinity:
199+
{{- toYaml . | nindent 12 }}
200+
{{- end }}
201+
{{- with (coalesce .Values.global.tolerations .Values.tolerations) }}
202+
tolerations:
203+
{{- toYaml . | nindent 12 }}
204+
{{- end }}
205+
{{- end }}

‎wiz-admission-controller/templates/deploymentauditlogs.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ spec:
8282
command:
8383
- "/usr/bin/wiz-admission-controller"
8484
- "--readiness-port={{ .Values.healthPort }}"
85-
- "--status-port={{ .Values.statusPort }}"
8685
# Server flags
8786
- "--port={{ .Values.service.targetPort }}"
8887
- "--tls-private-key-file=/var/server-certs/tls.key"
@@ -111,8 +110,6 @@ spec:
111110
- "--misconfiguration-enabled=false"
112111
- "--image-integrity-enabled=false"
113112
env:
114-
- name: WIZ_UPLOAD_BACKEND_STORAGE # TODO: remove once this is removed from the code
115-
value: "true"
116113
{{- if not .Values.wizApiToken.usePodCustomEnvironmentVariablesFile }}
117114
- name: WIZ_CLIENT_ID
118115
valueFrom:
@@ -199,7 +196,7 @@ spec:
199196
volumes:
200197
- name: server-certs
201198
secret:
202-
defaultMode: 444
199+
defaultMode: 4
203200
secretName: {{ include "wiz-admission-controller.secretServerCert" . | trim }}
204201
{{- with .Values.customVolumes }}
205202
{{- toYaml . | nindent 8 }}

‎wiz-admission-controller/templates/deploymentenforcement.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ spec:
8282
command:
8383
- "/usr/bin/wiz-admission-controller"
8484
- "--readiness-port={{ .Values.healthPort }}"
85-
- "--status-port={{ .Values.statusPort }}"
8685
# Server flags
8786
- "--port={{ .Values.service.targetPort }}"
8887
- "--tls-private-key-file=/var/server-certs/tls.key"

0 commit comments

Comments
 (0)