Skip to content

Commit cad7ee5

Browse files
yairsappiryairsappir
committed
* added app armor config
* moved security context config to helpers * added tests
1 parent bb64b49 commit cad7ee5

File tree

9 files changed

+1163
-16
lines changed

9 files changed

+1163
-16
lines changed

‎.circleci/tests/golden/wiz-outpost-lite/multiple-runners-security-context.golden.yaml‎

Lines changed: 708 additions & 0 deletions
Large diffs are not rendered by default.

‎.circleci/tests/golden/wiz-outpost-lite/remediation-special-security-context.golden.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,6 @@ spec:
7474
template:
7575
metadata:
7676
annotations:
77-
container.apparmor.security.beta.kubernetes.io/wiz-outpost-lite-remediation-aws-rds-003: unconfined
7877
labels:
7978
app.kubernetes.io/name: wiz-outpost-lite
8079
app.kubernetes.io/instance: release-test

‎.circleci/tests/golden/wiz-outpost-lite/remediation.golden.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,6 @@ spec:
7474
template:
7575
metadata:
7676
annotations:
77-
container.apparmor.security.beta.kubernetes.io/wiz-outpost-lite-remediation-aws-rds-003: unconfined
7877
labels:
7978
app.kubernetes.io/name: wiz-outpost-lite
8079
app.kubernetes.io/instance: release-test

‎.circleci/tests/golden/wiz-outpost-lite/vcs-with-openshift.golden.yaml‎

Lines changed: 379 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,379 @@
1+
---
2+
# Source: wiz-outpost-lite/templates/serviceaccount.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: sa-vcs-event-triggered
7+
namespace: release-helm-namespace
8+
labels:
9+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
10+
app.kubernetes.io/name: wiz-outpost-lite
11+
app.kubernetes.io/instance: release-test
12+
wiz.io/runner: "vcs-event-triggered"
13+
app.kubernetes.io/version: "0.1.0"
14+
app.kubernetes.io/managed-by: Helm
15+
---
16+
# Source: wiz-outpost-lite/templates/serviceaccount.yaml
17+
apiVersion: v1
18+
kind: ServiceAccount
19+
metadata:
20+
name: sa-vcs-scheduled
21+
namespace: release-helm-namespace
22+
labels:
23+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
24+
app.kubernetes.io/name: wiz-outpost-lite
25+
app.kubernetes.io/instance: release-test
26+
wiz.io/runner: "vcs-scheduled"
27+
app.kubernetes.io/version: "0.1.0"
28+
app.kubernetes.io/managed-by: Helm
29+
---
30+
# Source: wiz-outpost-lite/templates/credentials.secret.yaml
31+
apiVersion: v1
32+
kind: Secret
33+
metadata:
34+
name: outpost-lite-agent-creds
35+
labels:
36+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
37+
app.kubernetes.io/name: wiz-outpost-lite
38+
app.kubernetes.io/instance: release-test
39+
app.kubernetes.io/version: "0.1.0"
40+
app.kubernetes.io/managed-by: Helm
41+
stringData:
42+
clientId: "client-1"
43+
clientSecret: "secret-2"
44+
---
45+
# Source: wiz-outpost-lite/templates/service.yaml
46+
apiVersion: v1
47+
kind: Service
48+
metadata:
49+
name: release-test-wiz-outpost-lite-vcs-event-triggered
50+
labels:
51+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
52+
app.kubernetes.io/name: wiz-outpost-lite
53+
app.kubernetes.io/instance: release-test
54+
wiz.io/runner: "vcs-event-triggered"
55+
app.kubernetes.io/version: "0.1.0"
56+
app.kubernetes.io/managed-by: Helm
57+
spec:
58+
type: ClusterIP
59+
ports:
60+
- port: 9090
61+
targetPort: metrics
62+
protocol: TCP
63+
name: metrics
64+
selector:
65+
app.kubernetes.io/name: wiz-outpost-lite
66+
app.kubernetes.io/instance: release-test
67+
wiz.io/runner: "vcs-event-triggered"
68+
---
69+
# Source: wiz-outpost-lite/templates/service.yaml
70+
apiVersion: v1
71+
kind: Service
72+
metadata:
73+
name: release-test-wiz-outpost-lite-vcs-scheduled
74+
labels:
75+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
76+
app.kubernetes.io/name: wiz-outpost-lite
77+
app.kubernetes.io/instance: release-test
78+
wiz.io/runner: "vcs-scheduled"
79+
app.kubernetes.io/version: "0.1.0"
80+
app.kubernetes.io/managed-by: Helm
81+
spec:
82+
type: ClusterIP
83+
ports:
84+
- port: 9090
85+
targetPort: metrics
86+
protocol: TCP
87+
name: metrics
88+
selector:
89+
app.kubernetes.io/name: wiz-outpost-lite
90+
app.kubernetes.io/instance: release-test
91+
wiz.io/runner: "vcs-scheduled"
92+
---
93+
# Source: wiz-outpost-lite/templates/deployment.yaml
94+
apiVersion: apps/v1
95+
kind: Deployment
96+
metadata:
97+
name: release-test-wiz-outpost-lite-vcs-event-triggered
98+
labels:
99+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
100+
app.kubernetes.io/name: wiz-outpost-lite
101+
app.kubernetes.io/instance: release-test
102+
wiz.io/runner: "vcs-event-triggered"
103+
app.kubernetes.io/version: "0.1.0"
104+
app.kubernetes.io/managed-by: Helm
105+
spec:
106+
replicas: 1
107+
selector:
108+
matchLabels:
109+
app.kubernetes.io/name: wiz-outpost-lite
110+
app.kubernetes.io/instance: release-test
111+
wiz.io/runner: "vcs-event-triggered"
112+
template:
113+
metadata:
114+
annotations:
115+
container.apparmor.security.beta.kubernetes.io/wiz-outpost-lite-vcs-event-triggered: unconfined
116+
labels:
117+
app.kubernetes.io/name: wiz-outpost-lite
118+
app.kubernetes.io/instance: release-test
119+
wiz.io/runner: "vcs-event-triggered"
120+
spec:
121+
serviceAccountName: sa-vcs-event-triggered
122+
restartPolicy: Always
123+
containers:
124+
- name: wiz-outpost-lite-vcs-event-triggered
125+
image: "wizio.azurecr.io/outpost-lite-runner-vcs:0.1-latest"
126+
command: [ "/entrypoint"]
127+
imagePullPolicy: Always
128+
env:
129+
- name: NODE_NAME
130+
valueFrom:
131+
fieldRef:
132+
fieldPath: spec.nodeName
133+
- name: K8S_NAMESPACE
134+
valueFrom:
135+
fieldRef:
136+
fieldPath: metadata.namespace
137+
- name: K8S_POD_NAME
138+
valueFrom:
139+
fieldRef:
140+
fieldPath: metadata.name
141+
- name: OUTPOST
142+
value: "1"
143+
- name: WIZ_OUTPOST_ID
144+
value: "my-outpost-id"
145+
- name: WIZ_OUTPOST_RUNNER_ID
146+
value: "vcs-event-triggered"
147+
- name: WIZ_CLIENT_ID
148+
valueFrom:
149+
secretKeyRef:
150+
name: outpost-lite-agent-creds
151+
key: clientId
152+
- name: WIZ_CLIENT_SECRET
153+
valueFrom:
154+
secretKeyRef:
155+
name: outpost-lite-agent-creds
156+
key: clientSecret
157+
- name: OUTPOST_LITE_RUNNER_REGION
158+
value: "partition-1"
159+
- name: OUTPOST_LITE_RUNNER_METRICS_PORT
160+
value: "9090"
161+
- name: OUTPOST_LITE_RUNNER_AUTO_UPDATE
162+
value: "1"
163+
- name: OUTPOST_LITE_RUNNER_CONCURRENCY
164+
value: "4"
165+
- name: http_proxy
166+
valueFrom:
167+
secretKeyRef:
168+
name: "wiz-http-proxy-configuration"
169+
key: "httpProxy"
170+
optional: true
171+
- name: HTTP_PROXY
172+
valueFrom:
173+
secretKeyRef:
174+
name: "wiz-http-proxy-configuration"
175+
key: "httpProxy"
176+
optional: true
177+
- name: https_proxy
178+
valueFrom:
179+
secretKeyRef:
180+
name: "wiz-http-proxy-configuration"
181+
key: "httpsProxy"
182+
optional: true
183+
- name: HTTPS_PROXY
184+
valueFrom:
185+
secretKeyRef:
186+
name: "wiz-http-proxy-configuration"
187+
key: "httpsProxy"
188+
optional: true
189+
- name: no_proxy
190+
valueFrom:
191+
secretKeyRef:
192+
name: "wiz-http-proxy-configuration"
193+
key: "noProxyAddress"
194+
optional: true
195+
- name: NO_PROXY
196+
valueFrom:
197+
secretKeyRef:
198+
name: "wiz-http-proxy-configuration"
199+
key: "noProxyAddress"
200+
optional: true
201+
- name: SSL_CERT_DIR
202+
value: "/usr/local/share/ca-certificates/:/certificates/"
203+
ports:
204+
- name: metrics
205+
containerPort: 9090
206+
protocol: TCP
207+
resources:
208+
limits:
209+
memory: 4396M
210+
requests:
211+
memory: 1024M
212+
securityContext:
213+
capabilities:
214+
add:
215+
- SYS_ADMIN
216+
privileged: true
217+
seLinuxOptions:
218+
type: spc_t
219+
volumeMounts:
220+
- mountPath: /var/wiz
221+
name: working-dir
222+
- mountPath: /usr/local/share/ca-certificates/
223+
name: ca-certificate
224+
readOnly: true
225+
terminationGracePeriodSeconds: 300
226+
volumes:
227+
- name: working-dir
228+
emptyDir: {}
229+
- name: ca-certificate
230+
secret:
231+
defaultMode: 420
232+
secretName: "wiz-http-proxy-configuration"
233+
items:
234+
- key: caCertificate
235+
path: root.crt
236+
optional: true
237+
---
238+
# Source: wiz-outpost-lite/templates/deployment.yaml
239+
apiVersion: apps/v1
240+
kind: Deployment
241+
metadata:
242+
name: release-test-wiz-outpost-lite-vcs-scheduled
243+
labels:
244+
helm.sh/chart: "GOLDEN_STATIC_VALUE"
245+
app.kubernetes.io/name: wiz-outpost-lite
246+
app.kubernetes.io/instance: release-test
247+
wiz.io/runner: "vcs-scheduled"
248+
app.kubernetes.io/version: "0.1.0"
249+
app.kubernetes.io/managed-by: Helm
250+
spec:
251+
replicas: 1
252+
selector:
253+
matchLabels:
254+
app.kubernetes.io/name: wiz-outpost-lite
255+
app.kubernetes.io/instance: release-test
256+
wiz.io/runner: "vcs-scheduled"
257+
template:
258+
metadata:
259+
annotations:
260+
container.apparmor.security.beta.kubernetes.io/wiz-outpost-lite-vcs-scheduled: unconfined
261+
labels:
262+
app.kubernetes.io/name: wiz-outpost-lite
263+
app.kubernetes.io/instance: release-test
264+
wiz.io/runner: "vcs-scheduled"
265+
spec:
266+
serviceAccountName: sa-vcs-scheduled
267+
restartPolicy: Always
268+
containers:
269+
- name: wiz-outpost-lite-vcs-scheduled
270+
image: "wizio.azurecr.io/outpost-lite-runner-vcs:0.1-latest"
271+
command: [ "/entrypoint"]
272+
imagePullPolicy: Always
273+
env:
274+
- name: NODE_NAME
275+
valueFrom:
276+
fieldRef:
277+
fieldPath: spec.nodeName
278+
- name: K8S_NAMESPACE
279+
valueFrom:
280+
fieldRef:
281+
fieldPath: metadata.namespace
282+
- name: K8S_POD_NAME
283+
valueFrom:
284+
fieldRef:
285+
fieldPath: metadata.name
286+
- name: OUTPOST
287+
value: "1"
288+
- name: WIZ_OUTPOST_ID
289+
value: "my-outpost-id"
290+
- name: WIZ_OUTPOST_RUNNER_ID
291+
value: "vcs-scheduled"
292+
- name: WIZ_CLIENT_ID
293+
valueFrom:
294+
secretKeyRef:
295+
name: outpost-lite-agent-creds
296+
key: clientId
297+
- name: WIZ_CLIENT_SECRET
298+
valueFrom:
299+
secretKeyRef:
300+
name: outpost-lite-agent-creds
301+
key: clientSecret
302+
- name: OUTPOST_LITE_RUNNER_REGION
303+
value: "partition-1"
304+
- name: OUTPOST_LITE_RUNNER_METRICS_PORT
305+
value: "9090"
306+
- name: OUTPOST_LITE_RUNNER_AUTO_UPDATE
307+
value: "1"
308+
- name: http_proxy
309+
valueFrom:
310+
secretKeyRef:
311+
name: "wiz-http-proxy-configuration"
312+
key: "httpProxy"
313+
optional: true
314+
- name: HTTP_PROXY
315+
valueFrom:
316+
secretKeyRef:
317+
name: "wiz-http-proxy-configuration"
318+
key: "httpProxy"
319+
optional: true
320+
- name: https_proxy
321+
valueFrom:
322+
secretKeyRef:
323+
name: "wiz-http-proxy-configuration"
324+
key: "httpsProxy"
325+
optional: true
326+
- name: HTTPS_PROXY
327+
valueFrom:
328+
secretKeyRef:
329+
name: "wiz-http-proxy-configuration"
330+
key: "httpsProxy"
331+
optional: true
332+
- name: no_proxy
333+
valueFrom:
334+
secretKeyRef:
335+
name: "wiz-http-proxy-configuration"
336+
key: "noProxyAddress"
337+
optional: true
338+
- name: NO_PROXY
339+
valueFrom:
340+
secretKeyRef:
341+
name: "wiz-http-proxy-configuration"
342+
key: "noProxyAddress"
343+
optional: true
344+
- name: SSL_CERT_DIR
345+
value: "/usr/local/share/ca-certificates/:/certificates/"
346+
ports:
347+
- name: metrics
348+
containerPort: 9090
349+
protocol: TCP
350+
resources:
351+
limits:
352+
memory: 4396M
353+
requests:
354+
memory: 1024M
355+
securityContext:
356+
capabilities:
357+
add:
358+
- SYS_ADMIN
359+
privileged: true
360+
seLinuxOptions:
361+
type: spc_t
362+
volumeMounts:
363+
- mountPath: /var/wiz
364+
name: working-dir
365+
- mountPath: /usr/local/share/ca-certificates/
366+
name: ca-certificate
367+
readOnly: true
368+
terminationGracePeriodSeconds: 30
369+
volumes:
370+
- name: working-dir
371+
emptyDir: {}
372+
- name: ca-certificate
373+
secret:
374+
defaultMode: 420
375+
secretName: "wiz-http-proxy-configuration"
376+
items:
377+
- key: caCertificate
378+
path: root.crt
379+
optional: true

0 commit comments

Comments
 (0)