kubescape · dwertent · Dec 11, 2023 · Nov 14, 2023
diff --git a/charts/kubescape-operator/templates/_helpers.tpl b/charts/kubescape-operator/templates/_helpers.tpl
@@ -7,6 +7,7 @@ matchingRulesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.
 nodeAgentConfig: {{ include (printf "%s/node-agent/configmap.yaml" $.Template.BasePath) . | sha256sum }}
 operatorConfig: {{ include (printf "%s/operator/configmap.yaml" $.Template.BasePath) . | sha256sum }}
 proxySecret: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.proxySecretDirectory "proxy-secret.yaml") . | sha256sum }}
+synchronizerConfig: {{ include (printf "%s/synchronizer/configmap.yaml" $.Template.BasePath) . | sha256sum }}
 {{- end -}}
 
 
@@ -59,4 +60,6 @@ storage:
 cloudSecret:
   create: {{ $configurations.createCloudSecret }}
   name: {{ if $configurations.createCloudSecret }}"cloud-secret"{{ else }}{{ .Values.credentials.cloudSecret }}{{ end }}
+synchronizer:
+  enabled: {{ and $configurations.submit (eq .Values.capabilities.synchronizer "enable") }}
 {{- end -}}
diff --git a/charts/kubescape-operator/templates/synchronizer/clusterrole.yaml b/charts/kubescape-operator/templates/synchronizer/clusterrole.yaml
@@ -0,0 +1,20 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if $components.synchronizer.enabled }}
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.synchronizer.name }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["spdx.softwarecomposition.kubescape.io"]
+    resources: ["applicationactivities", "applicationprofiles", "applicationprofilesummaries", "configurationscansummaries", "networkneighborses", "openvulnerabilityexchangecontainers", "sbomspdxv2p3s", "sbomspdxv2p3filtereds", "sbomsummaries", "vulnerabilitymanifests", "vulnerabilitymanifestsummaries", "vulnerabilitysummaries", "workloadconfigurationscans", "workloadconfigurationscansummaries"]
+    verbs: ["get", "watch", "list"]
+#  - apiGroups: ["spdx.softwarecomposition.kubescape.io"]
+#    resources: ["knownservers"]
+#    verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
+{{- end }}
diff --git a/charts/kubescape-operator/templates/synchronizer/clusterrolebinding.yaml b/charts/kubescape-operator/templates/synchronizer/clusterrolebinding.yaml
@@ -0,0 +1,15 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if $components.synchronizer.enabled }}
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ .Values.synchronizer.name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.synchronizer.name }}
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{- end }}
diff --git a/charts/kubescape-operator/templates/synchronizer/configmap.yaml b/charts/kubescape-operator/templates/synchronizer/configmap.yaml
@@ -0,0 +1,77 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- $configurations := fromYaml (include "configurations" .) }}
+{{- if $components.synchronizer.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+data:
+  config.json: |
+    {
+      "inCluster": {
+        "resources": [
+          {
+            "group": "apps",
+            "version": "v1",
+            "resource": "deployments",
+            "strategy": "patch"
+          },
+          {
+            "group": "",
+            "version": "v1",
+            "resource": "pods",
+            "strategy": "patch"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "sbomspdxv2p3s",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "sbomspdxv2p3filtereds",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "vulnerabilitymanifests",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "workloadconfigurationscans",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "applicationprofiles",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "applicationactivities",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "networkneighborses",
+            "strategy": "copy"
+          },
+          {
+            "group": "spdx.softwarecomposition.kubescape.io",
+            "version": "v1beta1",
+            "resource": "openvulnerabilityexchangecontainers",
+            "strategy": "copy"
+          }
+        ]
+      }
+    }
+{{- end }}
diff --git a/charts/kubescape-operator/templates/synchronizer/deployment.yaml b/charts/kubescape-operator/templates/synchronizer/deployment.yaml
@@ -0,0 +1,168 @@
+{{- $checksums := fromYaml (include "checksums" .) }}
+{{- $components := fromYaml (include "components" .) }}
+{{- if $components.synchronizer.enabled }}
+{{- $no_proxy_envar_list := (include "no_proxy_envar_list" .) -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.synchronizer.name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app: {{ .Values.synchronizer.name }}
+    tier: {{ .Values.global.namespaceTier }}
+spec:
+  replicas: {{ .Values.synchronizer.replicaCount }}
+  revisionHistoryLimit: 2
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Values.synchronizer.name }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      tier: {{ .Values.global.namespaceTier }}
+  template:
+    metadata:
+      annotations:
+        checksum/synchronizer-configmap: {{ $checksums.synchronizerConfig }}
+        checksum/cloud-secret: {{ $checksums.cloudSecret }}
+        checksum/cloud-config: {{ $checksums.cloudConfig }}
+      {{- if ne .Values.global.proxySecretFile "" }}
+        checksum/proxy-config: {{ $checksums.proxySecret }}
+      {{- end }}
+      labels:
+        app.kubernetes.io/name: {{ .Values.synchronizer.name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        tier: {{ .Values.global.namespaceTier }}
+        app: {{ .Values.synchronizer.name }}
+      {{- if $components.otelCollector.enabled }}
+        otel: enabled
+      {{- end }}
+    spec:
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+      - name: {{ toYaml .Values.imagePullSecrets }}
+      {{- end }}
+      securityContext:
+        runAsUser: 65532
+        fsGroup: 65532
+      containers:
+        - name: {{ .Values.synchronizer.name }}
+          image: "{{ .Values.synchronizer.image.repository }}:{{ .Values.synchronizer.image.tag }}"
+          imagePullPolicy: {{ .Values.synchronizer.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 7888
+            initialDelaySeconds: 3
+            periodSeconds: 3
+          resources:
+{{ toYaml .Values.synchronizer.resources | indent 12 }}
+          env:
+            - name: GOMEMLIMIT
+              value: "{{ .Values.synchronizer.resources.requests.memory }}B"
+            - name: KS_LOGGER_LEVEL
+              value: "{{ .Values.logger.level }}"
+            - name: KS_LOGGER_NAME
+              value: "{{ .Values.logger.name }}"
+            {{- range .Values.synchronizer.env }}
+            - name: {{ .name }}
+              value: "{{ .value }}"
+            {{- end }}
+            {{- if $components.otelCollector.enabled }}
+            - name: ACCOUNT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $components.cloudSecret.name }}
+                  key: account
+            - name: OTEL_COLLECTOR_SVC
+              value: "otel-collector:4317"
+            {{- end }}
+            {{- if ne .Values.global.httpsProxy "" }}
+            - name: HTTPS_PROXY
+              value: "{{ .Values.global.httpsProxy }}"
+            - name : no_proxy
+              value: "{{ $no_proxy_envar_list }}"
+            {{- end }}
+          command: ["/usr/bin/client"]
+          volumeMounts:
+            - name: {{ $components.cloudSecret.name }}
+              mountPath: /etc/credentials
+              readOnly: true
+            - name: {{ .Values.global.cloudConfig }}
+              mountPath: /etc/config/clusterData.json
+              readOnly: true
+              subPath: "clusterData.json"
+            {{- if $components.serviceDiscovery.enabled }}
+            - name: {{ .Values.global.cloudConfig }}
+              mountPath: /etc/config/services.json
+              readOnly: true
+              subPath: "services.json"
+            {{- end }}
+            - name: config
+              mountPath: /etc/config/config.json
+              readOnly: true
+              subPath: "config.json"
+{{- if .Values.volumeMounts }}
+{{ toYaml .Values.volumeMounts | indent 12 }}
+{{- end }}
+{{- if .Values.synchronizer.volumeMounts }}
+{{ toYaml .Values.synchronizer.volumeMounts | indent 12 }}
+{{- end }}
+{{- if ne .Values.global.proxySecretFile "" }}
+            - name: proxy-secret
+              mountPath: /etc/ssl/certs/proxy.crt
+              subPath: proxy.crt
+{{- end }}
+      volumes:
+        - name: {{ $components.cloudSecret.name }}
+          secret:
+            secretName: {{ $components.cloudSecret.name }}
+      {{- if ne .Values.global.proxySecretFile "" }}
+        - name: proxy-secret
+          secret:
+            secretName: {{ .Values.global.proxySecretName }}
+      {{- end }}
+        - name: {{ .Values.global.cloudConfig }}
+          configMap:
+            name: {{ .Values.global.cloudConfig }}
+            items:
+            - key: "clusterData"
+              path: "clusterData.json"
+            {{- if $components.serviceDiscovery.enabled }}
+            - key: "services"
+              path: "services.json"
+            {{- end }}
+        - name: config
+          configMap:
+            name: {{ .Values.synchronizer.name }}
+            items:
+              - key: "config.json"
+                path: "config.json"
+{{- if .Values.volumes }}
+{{ toYaml .Values.volumes | indent 8 }}
+{{- end }}
+{{- if .Values.synchronizer.volumes }}
+{{ toYaml .Values.synchronizer.volumes | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ .Values.synchronizer.name }}
+      automountServiceAccountToken: true
+      {{- with .Values.synchronizer.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.synchronizer.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- end }}
diff --git a/charts/kubescape-operator/templates/synchronizer/networkpolicy.yaml b/charts/kubescape-operator/templates/synchronizer/networkpolicy.yaml
@@ -0,0 +1,27 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and .Values.global.networkPolicy.enabled $components.synchronizer.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:
+    app: {{ .Values.synchronizer.name }}
+    tier: {{ .Values.global.namespaceTier }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Values.synchronizer.name }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      tier: {{ .Values.global.namespaceTier }}
+  policyTypes:
+    - Ingress
+  {{- if .Values.global.networkPolicy.createEgressRules }}
+    - Egress
+  egress:
+      # - synchronizer server
+    - ports:
+        - port: 8443
+          protocol: TCP
+  {{- end }}
+{{- end }}
diff --git a/charts/kubescape-operator/templates/synchronizer/serviceaccount.yaml b/charts/kubescape-operator/templates/synchronizer/serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if $components.synchronizer.enabled }}
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+{{- if .Values.cloudProviderMetadata.awsIamRoleArn }}
+  annotations:
+    eks.amazonaws.com/role-arn: {{ .Values.cloudProviderMetadata.awsIamRoleArn }}
+  {{- else if .Values.cloudProviderMetadata.gkeServiceAccount }}
+  annotations:
+    iam.gke.io/gcp-service-account: {{ .Values.cloudProviderMetadata.gkeServiceAccount }}
+{{- end }}
+  labels:
+    app: {{ .Values.synchronizer.name }}
+  name: {{ .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+automountServiceAccountToken: false
+{{- end }}