Skip to content

Commit af10088

Browse files
orrshamli2orrshamli2
authored
WZ-61859-remediation sa (#570)
* WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa * WZ-61859-remediation sa
1 parent 95e9253 commit af10088

File tree

5 files changed

+224
-0
lines changed

5 files changed

+224
-0
lines changed

‎.circleci/tests/golden/wiz-outpost-lite/remediation.golden.yaml‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
# Source: wiz-outpost-lite/templates/serviceaccount.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: sa-remediation-aws-rds-003
7+
labels:
8+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
9+
app.kubernetes.io/name: wiz-outpost-lite
10+
app.kubernetes.io/instance: release-test
11+
wiz.io/runner: "remediation-aws-rds-003"
12+
app.kubernetes.io/version: "0.1.0"
13+
app.kubernetes.io/managed-by: Helm
14+
---
15+
# Source: wiz-outpost-lite/templates/credentials.secret.yaml
16+
apiVersion: v1
17+
kind: Secret
18+
metadata:
19+
name: outpost-lite-agent-creds
20+
labels:
21+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
22+
app.kubernetes.io/name: wiz-outpost-lite
23+
app.kubernetes.io/instance: release-test
24+
app.kubernetes.io/version: "0.1.0"
25+
app.kubernetes.io/managed-by: Helm
26+
stringData:
27+
clientId: "client-1"
28+
clientSecret: "secret-2"
29+
---
30+
# Source: wiz-outpost-lite/templates/service.yaml
31+
apiVersion: v1
32+
kind: Service
33+
metadata:
34+
name: release-test-wiz-outpost-lite-remediation-aws-rds-003
35+
labels:
36+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
37+
app.kubernetes.io/name: wiz-outpost-lite
38+
app.kubernetes.io/instance: release-test
39+
wiz.io/runner: "remediation-aws-rds-003"
40+
app.kubernetes.io/version: "0.1.0"
41+
app.kubernetes.io/managed-by: Helm
42+
spec:
43+
type: ClusterIP
44+
ports:
45+
- port: 9090
46+
targetPort: metrics
47+
protocol: TCP
48+
name: metrics
49+
selector:
50+
app.kubernetes.io/name: wiz-outpost-lite
51+
app.kubernetes.io/instance: release-test
52+
wiz.io/runner: "remediation-aws-rds-003"
53+
---
54+
# Source: wiz-outpost-lite/templates/deployment.yaml
55+
apiVersion: apps/v1
56+
kind: Deployment
57+
metadata:
58+
name: release-test-wiz-outpost-lite-remediation-aws-rds-003
59+
labels:
60+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
61+
app.kubernetes.io/name: wiz-outpost-lite
62+
app.kubernetes.io/instance: release-test
63+
wiz.io/runner: "remediation-aws-rds-003"
64+
app.kubernetes.io/version: "0.1.0"
65+
app.kubernetes.io/managed-by: Helm
66+
spec:
67+
replicas: 1
68+
selector:
69+
matchLabels:
70+
app.kubernetes.io/name: wiz-outpost-lite
71+
app.kubernetes.io/instance: release-test
72+
wiz.io/runner: "remediation-aws-rds-003"
73+
template:
74+
metadata:
75+
annotations:
76+
container.apparmor.security.beta.kubernetes.io/wiz-outpost-lite-remediation-aws-rds-003: unconfined
77+
labels:
78+
app.kubernetes.io/name: wiz-outpost-lite
79+
app.kubernetes.io/instance: release-test
80+
wiz.io/runner: "remediation-aws-rds-003"
81+
spec:
82+
serviceAccountName: sa-remediation-aws-rds-003
83+
restartPolicy: Always
84+
containers:
85+
- name: wiz-outpost-lite-remediation-aws-rds-003
86+
image: "wizio.azurecr.io/outpost-lite-runner-remediation:0.1-latest"
87+
command: [ "/entrypoint"]
88+
imagePullPolicy: Always
89+
env:
90+
- name: NODE_NAME
91+
valueFrom:
92+
fieldRef:
93+
fieldPath: spec.nodeName
94+
- name: K8S_NAMESPACE
95+
valueFrom:
96+
fieldRef:
97+
fieldPath: metadata.namespace
98+
- name: K8S_POD_NAME
99+
valueFrom:
100+
fieldRef:
101+
fieldPath: metadata.name
102+
- name: OUTPOST
103+
value: "1"
104+
- name: WIZ_OUTPOST_ID
105+
value: "my-outpost-id"
106+
- name: WIZ_OUTPOST_RUNNER_ID
107+
value: "remediation-aws-rds-003"
108+
- name: WIZ_CLIENT_ID
109+
valueFrom:
110+
secretKeyRef:
111+
name: outpost-lite-agent-creds
112+
key: clientId
113+
- name: WIZ_CLIENT_SECRET
114+
valueFrom:
115+
secretKeyRef:
116+
name: outpost-lite-agent-creds
117+
key: clientSecret
118+
- name: OUTPOST_LITE_RUNNER_REGION
119+
value: "partition-1"
120+
- name: OUTPOST_LITE_RUNNER_METRICS_PORT
121+
value: "9090"
122+
- name: OUTPOST_LITE_RUNNER_AUTO_UPDATE
123+
value: "1"
124+
- name: http_proxy
125+
valueFrom:
126+
secretKeyRef:
127+
name: "wiz-http-proxy-configuration"
128+
key: "httpProxy"
129+
optional: true
130+
- name: HTTP_PROXY
131+
valueFrom:
132+
secretKeyRef:
133+
name: "wiz-http-proxy-configuration"
134+
key: "httpProxy"
135+
optional: true
136+
- name: https_proxy
137+
valueFrom:
138+
secretKeyRef:
139+
name: "wiz-http-proxy-configuration"
140+
key: "httpsProxy"
141+
optional: true
142+
- name: HTTPS_PROXY
143+
valueFrom:
144+
secretKeyRef:
145+
name: "wiz-http-proxy-configuration"
146+
key: "httpsProxy"
147+
optional: true
148+
- name: no_proxy
149+
valueFrom:
150+
secretKeyRef:
151+
name: "wiz-http-proxy-configuration"
152+
key: "noProxyAddress"
153+
optional: true
154+
- name: NO_PROXY
155+
valueFrom:
156+
secretKeyRef:
157+
name: "wiz-http-proxy-configuration"
158+
key: "noProxyAddress"
159+
optional: true
160+
- name: SSL_CERT_DIR
161+
value: "/usr/local/share/ca-certificates/:/certificates/"
162+
ports:
163+
- name: metrics
164+
containerPort: 9090
165+
protocol: TCP
166+
resources:
167+
limits:
168+
memory: 4396M
169+
requests:
170+
memory: 1024M
171+
securityContext:
172+
capabilities:
173+
add:
174+
- SYS_ADMIN
175+
seLinuxOptions:
176+
type: spc_t
177+
volumeMounts:
178+
- mountPath: /var/wiz
179+
name: working-dir
180+
- mountPath: /usr/local/share/ca-certificates/
181+
name: ca-certificate
182+
readOnly: true
183+
terminationGracePeriodSeconds: 30
184+
volumes:
185+
- name: working-dir
186+
emptyDir: {}
187+
- name: ca-certificate
188+
secret:
189+
defaultMode: 420
190+
secretName: "wiz-http-proxy-configuration"
191+
items:
192+
- key: caCertificate
193+
path: root.crt
194+
optional: true

‎.circleci/tests/testfiles/wiz-outpost-lite/remediation.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
agent:
2+
secretName: outpost-lite-agent-creds
3+
clientId: "client-1"
4+
clientSecret: "secret-2"
5+
outpostId: "my-outpost-id"
6+
7+
runners:
8+
remediation-aws-rds-003:
9+
enabled: true
10+
serviceAccount:
11+
create: true

‎wiz-outpost-lite/templates/deployment.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ spec:
2525
{{- toYaml . | nindent 8 }}
2626
{{- end }}
2727
spec:
28+
{{- if .Values.serviceAccount.create }}
29+
serviceAccountName: sa-{{ .runner }}
30+
{{- end }}
2831
restartPolicy: Always
2932
{{- if .Values.affinity }}
3033
affinity:

‎wiz-outpost-lite/templates/serviceaccount.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- range $values := (include "wiz-outpost-lite.runners" . | fromJson) }}
2+
{{- with merge $values (omit $ "Values") }}
3+
{{- if and .Values.enabled .Values.serviceAccount.create }}
4+
apiVersion: v1
5+
kind: ServiceAccount
6+
metadata:
7+
name: sa-{{ .runner }}
8+
labels:
9+
{{- include "wiz-outpost-lite.labels" . | nindent 4 }}
10+
---
11+
{{- end }}
12+
{{- end }}
13+
{{- end }}

‎wiz-outpost-lite/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ httpProxyConfiguration:
7171

7272
terminationGracePeriodSeconds: 30
7373

74+
serviceAccount:
75+
create: false
76+
7477
runners:
7578
container-registry:
7679
enabled: false

0 commit comments

Comments
 (0)