Skip to content

Commit 78b585c

Browse files
circleci-wizcircleci-wiz
committed
Update charts with latest changes
1 parent 710d31a commit 78b585c

File tree

8 files changed

+240
-8
lines changed

8 files changed

+240
-8
lines changed

‎wiz-kubernetes-integration/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ dependencies:
1717
condition: wiz-admission-controller.enabled
1818
- name: wiz-sensor
1919
repository: https://wiz-sec.github.io/charts
20-
version: ">=1.0.6440"
20+
version: ">=1.0.6572"
2121
condition: wiz-sensor.enabled

‎wiz-outpost-configuration/templates/networkAnalyzer.job.yaml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
2+
{{- if .Values.networkAnalyzer.enabled }}
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
{{- if .Values.networkAnalyzer.rollingUpdate }}
7+
name: "{{ .Values.networkAnalyzer.name }}-{{ now | unixEpoch }}"
8+
{{else}}
9+
name: "{{ .Values.networkAnalyzer.name }}"
10+
{{- end }}
11+
namespace: {{ .Release.Namespace | quote }}
12+
labels:
13+
{{- include "wiz-outpost-configuration.labels" . | nindent 4 }}
14+
annotations:
15+
"meta.helm.sh/release-name": "{{ .Release.Name }}"
16+
"meta.helm.sh/release-namespace": "{{ .Release.Namespace }}"
17+
"helm.sh/hook": "pre-install,pre-upgrade"
18+
"helm.sh/hook-delete-policy": "before-hook-creation"
19+
spec:
20+
ttlSecondsAfterFinished: 0
21+
manualSelector: true
22+
selector:
23+
matchLabels:
24+
{{- include "wiz-outpost-configuration.selectorLabels" . | nindent 6 }}
25+
backoffLimit: 1
26+
template:
27+
metadata:
28+
{{- with (coalesce .Values.podAnnotations) }}
29+
annotations:
30+
{{- toYaml . | nindent 8 }}
31+
{{- end }}
32+
labels:
33+
{{- include "wiz-outpost-configuration.labels" . | nindent 8 }}
34+
spec:
35+
{{- with .Values.imagePullSecrets }}
36+
imagePullSecrets:
37+
{{- toYaml . | nindent 8 }}
38+
{{- end }}
39+
serviceAccountName: {{ include "wiz-outpost-configuration.serviceAccountName" . | trim }}
40+
restartPolicy: "Never"
41+
securityContext:
42+
fsGroup: 1000
43+
supplementalGroups:
44+
- 1000
45+
containers:
46+
- name: wiz-network-analyzer
47+
securityContext:
48+
readOnlyRootFilesystem: true
49+
runAsNonRoot: true
50+
runAsUser: 1000
51+
runAsGroup: 1000
52+
privileged: false
53+
allowPrivilegeEscalation: false
54+
image: "{{ .Values.networkAnalyzer.image.repository }}/{{ .Values.networkAnalyzer.image.namePrefix}}:{{ .Values.networkAnalyzer.image.tag | default .Chart.AppVersion }}"
55+
imagePullPolicy: {{ .Values.networkAnalyzer.image.pullPolicy }}
56+
command:
57+
- "wiz-network-analyzer"
58+
args:
59+
- analyze
60+
- --output
61+
- /tmp
62+
{{- with .Values.networkAnalyzer.outpostId }}
63+
- --outpost-id
64+
- {{ . | quote }}
65+
{{- end }}
66+
- --region
67+
- {{ .Values.networkAnalyzer.wizRegion }}
68+
{{- with .Values.networkAnalyzer.forceHttp1 }}
69+
- --http1
70+
{{- end }}
71+
env:
72+
- name: LOG_LEVEL
73+
value: "info"
74+
{{- with .Values.networkAnalyzer.env }}
75+
- name: ENV
76+
value: {{ . | quote }}
77+
{{- end}}
78+
{{- with .Values.networkAnalyzer.outpostId }}
79+
- name: WIZ_OUTPOST_ID
80+
value: {{ . | quote }}
81+
{{- end }}
82+
- name: WIZ_CLIENT_ID
83+
valueFrom:
84+
secretKeyRef:
85+
name: {{ .Values.agentCredsSecretName }}
86+
key: clientId
87+
- name: WIZ_CLIENT_SECRET
88+
valueFrom:
89+
secretKeyRef:
90+
name: {{ .Values.agentCredsSecretName }}
91+
key: clientSecret
92+
- name: WIZ_DATA_CENTER
93+
value: {{ .Values.networkAnalyzer.dataCenter | quote }}
94+
- name: http_proxy
95+
valueFrom:
96+
secretKeyRef:
97+
name: {{ .Values.httpProxyConfiguration.name | quote }}
98+
key: "httpProxy"
99+
optional: true
100+
- name: HTTP_PROXY
101+
valueFrom:
102+
secretKeyRef:
103+
name: {{ .Values.httpProxyConfiguration.name | quote }}
104+
key: "httpProxy"
105+
optional: true
106+
- name: https_proxy
107+
valueFrom:
108+
secretKeyRef:
109+
name: {{ .Values.httpProxyConfiguration.name | quote }}
110+
key: "httpsProxy"
111+
optional: true
112+
- name: HTTPS_PROXY
113+
valueFrom:
114+
secretKeyRef:
115+
name: {{ .Values.httpProxyConfiguration.name | quote }}
116+
key: "httpsProxy"
117+
optional: true
118+
- name: no_proxy
119+
valueFrom:
120+
secretKeyRef:
121+
name: {{ .Values.httpProxyConfiguration.name | quote }}
122+
key: "noProxyAddress"
123+
optional: true
124+
- name: NO_PROXY
125+
valueFrom:
126+
secretKeyRef:
127+
name: {{ .Values.httpProxyConfiguration.name | quote }}
128+
key: "noProxyAddress"
129+
optional: true
130+
- name: SSL_CERT_DIR
131+
value: "/usr/local/share/ca-certificates/:/certificates/"
132+
volumeMounts:
133+
- mountPath: /tmp
134+
name: tmp-dir
135+
{{- if not .Values.networkAnalyzer.outpostId }}
136+
- name: secrets
137+
mountPath: /mnt/secrets/
138+
readOnly: true
139+
{{- end }}
140+
resources:
141+
{{- toYaml .Values.networkAnalyzer.resources | nindent 12 }}
142+
volumes:
143+
- name: tmp-dir
144+
emptyDir: { }
145+
- name: ca-certificate
146+
secret:
147+
defaultMode: 420
148+
secretName: {{ .Values.httpProxyConfiguration.name | quote }}
149+
items:
150+
- key: caCertificate
151+
path: root.crt
152+
optional: true
153+
{{- if not .Values.networkAnalyzer.outpostId }}
154+
- name: secrets
155+
projected:
156+
sources:
157+
- secret:
158+
name: {{ .Values.agentCredsSecretName }}
159+
items:
160+
- key: privateKey
161+
path: WIZ_PRIVATE_KEY
162+
{{- end}}
163+
{{- end}}

‎wiz-outpost-configuration/templates/nodeHttpProxyConfiguration.gcp.ubuntu.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ metadata:
7272
name: node-initializer
7373
labels:
7474
app: default-init
75+
{{- include "wiz-outpost-configuration.labels" . | nindent 4 }}
7576
spec:
7677
selector:
7778
matchLabels:
@@ -81,8 +82,13 @@ spec:
8182
template:
8283
metadata:
8384
labels:
85+
{{- include "wiz-outpost-configuration.labels" . | nindent 8 }}
8486
name: node-initializer
8587
app: default-init
88+
{{- with .Values.podAnnotations }}
89+
annotations:
90+
{{- toYaml . | nindent 8 }}
91+
{{- end }}
8692
spec:
8793
hostPID: true
8894
volumes:

‎wiz-outpost-configuration/values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,23 @@ serviceAccount:
4848
# The name of the service account to use.
4949
# If empty, a name is generated using the fullname template
5050
name: ""
51+
52+
networkAnalyzer:
53+
enabled: false
54+
name: wiz-network-analyzer
55+
outpostId: ""
56+
wizRegion: ""
57+
env: ""
58+
dataCenter: ""
59+
forceHttp1: false
60+
image:
61+
registry: public-registry.wiz.io/wiz-app
62+
repository: wiz-network-analyzer
63+
pullPolicy: Always
64+
# Overrides the image tag whose default is the chart appVersion.
65+
tag: "0.1.3"
66+
67+
podAnnotations: {}
68+
imagePullSecrets: []
69+
resources: {}
70+
rollingUpdate: true

‎wiz-sensor/Chart.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
2-
description: Wiz Sensor helm chart
3-
home: https://www.wiz.io/
42
name: wiz-sensor
3+
description: Wiz Sensor helm chart
54
type: application
6-
version: 1.0.6440
7-
appVersion: 1.0.6349
5+
home: https://www.wiz.io/
6+
version: 1.0.6572
7+
appVersion: 1.0.6572

‎wiz-sensor/templates/_helpers.tpl‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,10 +149,36 @@ log levels
149149
{{- end }}
150150
{{- end }}
151151

152+
{{/*
153+
Registry Helpers
154+
*/}}
155+
{{- define "wiz-sensor.knownRegistries" -}}
156+
{{- list "wizio.azurecr.io" "wiziosensor.azurecr.io" "registry.wiz.io" | toJson -}}
157+
{{- end -}}
158+
159+
{{/*
160+
Rule Validation
161+
*/}}
152162
{{- define "validate.values" -}}
153163
{{- if .Values.exposeMetrics }}
154164
{{- if .Values.hostNetwork }}
155165
{{- fail "Cannot set hostNetwork to true when exposeMetrics is set to true" }}
156166
{{- end }}
157167
{{- end }}
168+
169+
{{- if .Values.fixedDefsVersion }}
170+
{{- if not (regexMatch "^[0-9]+\\.[0-9]+\\.[0-9]+$" .Values.fixedDefsVersion) }}
171+
{{- fail "fixedDefsVersion must be in major.minor.patch format (e.g. 1.2.3)" }}
172+
{{- end }}
173+
{{- end }}
174+
175+
176+
{{- if .Values.gkeAutopilotUseAllowlist }}
177+
{{- if empty .Values.image.sha256 }}
178+
{{- if not (has .Values.image.registry (include "wiz-sensor.knownRegistries" . | fromJsonArray)) }}
179+
{{- fail "If using gkeAutopilotUseAllowlist and a private repo, make sure to set the image.sha256 value to a specific version" }}
180+
{{- end }}
181+
{{- end }}
182+
{{- end }}
183+
158184
{{- end }}

‎wiz-sensor/templates/daemonset.yaml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ spec:
2525
prometheus.io/port: "{{ .Values.metricsPort }}"
2626
{{- end }}
2727

28-
{{- if or (semverCompare "<1.31" $kubeVersion) (.Values.oldAppArmorAnnotation) }}
28+
{{- if and (not .Values.newAppArmorAnnotation) (or (semverCompare "<1.31" $kubeVersion) (.Values.oldAppArmorAnnotation)) }}
2929
container.apparmor.security.beta.kubernetes.io/wiz-sensor: unconfined
3030
{{- if .Values.diskScan.enabled }}
3131
container.apparmor.security.beta.kubernetes.io/wiz-disk-scanner: unconfined
@@ -78,7 +78,11 @@ spec:
7878
containers:
7979
- name: wiz-sensor
8080
{{- if (coalesce .Values.global.image.registry .Values.image.registry) }}
81+
{{- if .Values.image.sha256 }}
82+
image: {{ printf "%s/%s@sha256:%s" (coalesce .Values.global.image.registry .Values.image.registry) .Values.image.repository .Values.image.sha256 }}
83+
{{- else }}
8184
image: {{ printf "%s/%s:%s" (coalesce .Values.global.image.registry .Values.image.registry) .Values.image.repository .Values.image.tag }}
85+
{{- end }}
8286
{{- else }}
8387
image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag }}
8488
{{- end }}
@@ -156,7 +160,7 @@ spec:
156160
{{- end }}
157161
readOnlyRootFilesystem: true
158162

159-
{{- if and (semverCompare ">=1.30" $kubeVersion) (not .Values.oldAppArmorAnnotation) }}
163+
{{- if or (.Values.newAppArmorAnnotation) (and (semverCompare ">=1.30" $kubeVersion) (not .Values.oldAppArmorAnnotation)) }}
160164
appArmorProfile:
161165
type: Unconfined
162166
{{- end }}
@@ -316,6 +320,10 @@ spec:
316320
{{- with .Values.global.podCustomEnvironmentVariables }}
317321
{{- toYaml . | nindent 8 }}
318322
{{- end }}
323+
{{- if .Values.fixedDefsVersion }}
324+
- name: FIXED_DEFS_VERSION
325+
value: {{ .Values.fixedDefsVersion }}
326+
{{- end }}
319327

320328
volumeMounts:
321329
{{- with .Values.customVolumeMounts }}
@@ -428,7 +436,7 @@ spec:
428436
runAsGroup: 2202
429437
{{- end }}
430438
readOnlyRootFilesystem: true
431-
{{- if and (semverCompare ">=1.30" $kubeVersion) (not .Values.oldAppArmorAnnotation) }}
439+
{{- if or (.Values.newAppArmorAnnotation) (and (semverCompare ">=1.30" $kubeVersion) (not .Values.oldAppArmorAnnotation)) }}
432440
appArmorProfile:
433441
type: Unconfined
434442
{{- end }}

‎wiz-sensor/values.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@ debug: false
7575

7676
# Force old-style annotation for AppArmor profile (compatibility with some gitops tools)
7777
oldAppArmorAnnotation: false
78+
# Force the use of an appArmorProfile element in the securityContext, and remove the old-style annotation, even for old Kubernetes versions
79+
newAppArmorAnnotation: false
7880

7981
# The Sensor will sometimes cause its container to restart in order to check if a new docker image
8082
# version is available. Such a restart puts some increased load on the API-server and the node.
@@ -91,6 +93,10 @@ subscriptionExternalId: "" # Optional. Used to associate the installation with a
9193
clusterTags: {} # Optional. List of key: value tags to be added to KubernetesCluster object associated with this installation
9294
subscriptionTags: {} # Optional. List of key: value tags to be added to Subscription object associated with this installation
9395

96+
# A fixed version of the definitions to use. Won't upgrade even when a new version is available.
97+
# Format: major.minor.patch
98+
fixedDefsVersion: ""
99+
94100
# enable liveness probe for the sensor container
95101
livenessProbe:
96102
enabled: false
@@ -234,6 +240,9 @@ image:
234240
repository: sensor
235241
args: {}
236242
tag: "v1"
243+
# The sha256 of the image to use. Should not be used normally. Exists for compatibility with GKE Autopilot
244+
# with private registries. This overrides the tag variable when set.
245+
sha256: ""
237246
pullPolicy: Always
238247
# the default is "wizio.azurecr.io/wiz-app/wiz-workload-scanner:v1"
239248
diskScanRepository: wiz-app/wiz-workload-scanner

0 commit comments

Comments
 (0)