Add Validator Kubescape Charts

charts/validator-plugin-kubescape/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/validator-plugin-kubescape/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: validator-plugin-kubescape
+description: Perform Kubescape
+type: application
+version: 0.0.1
+appVersion: 0.0.2

charts/validator-plugin-kubescape/README.md

@@ -0,0 +1,41 @@
+
+validator-plugin-kubescape
+===========
+
+validator-plugin-kubescape performs a variety of validations against your Azure account.
+
+
+## Configuration
+
+The following table lists the configurable parameters of the validator-plugin-kubescape chart and their default values.
+
+| Parameter                | Description             | Default        |
+| ------------------------ | ----------------------- | -------------- |
+| `controllerManager.kubeRbacProxy.args` |  | `["--secure-listen-address=0.0.0.0:8443", "--upstream=http://127.0.0.1:8080/", "--logtostderr=true", "--v=0"]` |
+| `controllerManager.kubeRbacProxy.containerSecurityContext.allowPrivilegeEscalation` |  | `false` |
+| `controllerManager.kubeRbacProxy.containerSecurityContext.capabilities.drop` |  | `["ALL"]` |
+| `controllerManager.kubeRbacProxy.image.repository` |  | `"gcr.io/kubebuilder/kube-rbac-proxy"` |
+| `controllerManager.kubeRbacProxy.image.tag` |  | `"v0.14.1"` |
+| `controllerManager.kubeRbacProxy.resources.limits.cpu` |  | `"500m"` |
+| `controllerManager.kubeRbacProxy.resources.limits.memory` |  | `"128Mi"` |
+| `controllerManager.kubeRbacProxy.resources.requests.cpu` |  | `"5m"` |
+| `controllerManager.kubeRbacProxy.resources.requests.memory` |  | `"64Mi"` |
+| `controllerManager.manager.args` |  | `["--health-probe-bind-address=:8081", "--metrics-bind-address=127.0.0.1:8080", "--leader-elect"]` |
+| `controllerManager.manager.containerSecurityContext.allowPrivilegeEscalation` |  | `false` |
+| `controllerManager.manager.containerSecurityContext.capabilities.drop` |  | `["ALL"]` |
+| `controllerManager.manager.image.repository` |  | `"quay.io/spectrocloud-labs/validator-plugin-kubescape"` |
+| `controllerManager.manager.image.tag` | x-release-please-version | `"v0.0.10"` |
+| `controllerManager.manager.resources.limits.cpu` |  | `"500m"` |
+| `controllerManager.manager.resources.limits.memory` |  | `"128Mi"` |
+| `controllerManager.manager.resources.requests.cpu` |  | `"10m"` |
+| `controllerManager.manager.resources.requests.memory` |  | `"64Mi"` |
+| `controllerManager.manager.volumeMounts` |  | `[]` |
+| `controllerManager.replicas` |  | `1` |
+| `controllerManager.serviceAccount.annotations` |  | `{}` |
+| `controllerManager.volumes` |  | `[]` |
+| `kubernetesClusterDomain` |  | `"cluster.local"` |
+| `metricsService.ports` |  | `[{"name": "https", "port": 8443, "protocol": "TCP", "targetPort": "https"}]` |
+| `metricsService.type` |  | `"ClusterIP"` |
+---
+_Documentation generated by [Frigate](https://frigate.readthedocs.io)._
+

charts/validator-plugin-kubescape/crds/validation.spectrocloud.labs_kubescapevalidators.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.12.0
+  name: kubescapevalidators.validation.spectrocloud.labs
+spec:
+  group: validation.spectrocloud.labs
+  names:
+    kind: KubescapeValidator
+    listKind: KubescapeValidatorList
+    plural: kubescapevalidators
+    singular: kubescapevalidator
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: KubescapeValidator is the Schema for the kubescapevalidators
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: KubescapeValidatorSpec defines the desired state of KubescapeValidator
+            properties:
+              flaggedCVERule:
+                description: Rule for Flagged CVEs
+                items:
+                  type: string
+                type: array
+              ignoredCVERule:
+                description: Global Ignore CVEs
+                items:
+                  type: string
+                type: array
+              severityLimitRule:
+                properties:
+                  critical:
+                    type: integer
+                  high:
+                    type: integer
+                  low:
+                    type: integer
+                  medium:
+                    type: integer
+                  negligible:
+                    type: integer
+                  unknown:
+                    type: integer
+                type: object
+            type: object
+          status:
+            description: KubescapeValidatorStatus defines the observed state of KubescapeValidator
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

charts/validator-plugin-kubescape/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "chart.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 28 chars because some Kubernetes name fields are limited to 63 chars by the DNS naming spec.
+And the longest suffix appended to the chart's full name is 35 chars.
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "chart.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 28 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 28 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 28 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "chart.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "chart.labels" -}}
+helm.sh/chart: {{ include "chart.chart" . }}
+{{ include "chart.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "chart.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "chart.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "chart.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "chart.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/validator-plugin-kubescape/templates/deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "chart.fullname" . }}-controller-manager
+  labels:
+    app.kubernetes.io/component: manager
+    app.kubernetes.io/created-by: validator-plugin-kubescape
+    app.kubernetes.io/part-of: validator-plugin-kubescape
+    control-plane: controller-manager
+  {{- include "chart.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.controllerManager.replicas }}
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+    {{- include "chart.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+        {{- include "chart.selectorLabels" . | nindent 8 }}
+        {{- range $key, $value := .Values.controllerManager.podLabels }}
+        {{ $key }}: {{ $value }}
+        {{- end }}
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
+    spec:
+      containers:
+      - args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
+        env:
+        - name: KUBERNETES_CLUSTER_DOMAIN
+          value: {{ quote .Values.kubernetesClusterDomain }}
+        image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag | default .Chart.AppVersion }}
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https
+          protocol: TCP
+        resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent 10 }}
+        securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext | nindent 10 }}
+      - args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
+        command:
+        - /manager
+        env:
+        - name: KUBERNETES_CLUSTER_DOMAIN
+          value: {{ quote .Values.kubernetesClusterDomain }}
+        volumeMounts: {{- toYaml .Values.controllerManager.manager.volumeMounts | nindent 10 }}
+        image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag | default .Chart.AppVersion }}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        name: manager
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10 }}
+        securityContext: {{- toYaml .Values.controllerManager.manager.containerSecurityContext | nindent 10 }}
+      securityContext:
+        runAsNonRoot: true
+      {{- if .Values.auth.serviceAccountName }}
+      serviceAccountName: {{ .Values.auth.serviceAccountName }}
+      {{- else }}
+      serviceAccountName: {{ include "chart.fullname" . }}-controller-manager
+      {{- end }}
+      terminationGracePeriodSeconds: 10
+      volumes: {{- toYaml .Values.controllerManager.volumes | nindent 8 }}

charts/validator-plugin-kubescape/templates/leader-election-rbac.yaml

@@ -0,0 +1,59 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "chart.fullname" . }}-leader-election-role
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: validator-plugin-kubescape
+    app.kubernetes.io/part-of: validator-plugin-kubescape
+  {{- include "chart.labels" . | nindent 4 }}
+rules:
+- piGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "chart.fullname" . }}-leader-election-rolebinding
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: validator-plugin-kubescape
+    app.kubernetes.io/part-of: validator-plugin-kubescape
+  {{- include "chart.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: '{{ include "chart.fullname" . }}-leader-election-role'
+subjects:
+- kind: ServiceAccount
+  name: '{{ include "chart.fullname" . }}-controller-manager'
+  namespace: '{{ .Release.Namespace }}'