mirror of
https://github.com/kyverno/policy-reporter.git
synced 2024-12-14 11:57:32 +00:00
Add static install manifests (#38)
* Add static install manifests * Remove unused value
This commit is contained in:
Frank Jogeleit
GitHub
parent
af1285c08f
commit
ea0d079d01
17 changed files with 785 additions and 18 deletions
|
|
@ -1,5 +1,9 @@
|
|||
# Changelog
|
||||
|
||||
# 1.6.1
|
||||
* Add .global.fullnameOverride as new configuration for Policy Reporter Helm Chart
|
||||
* Add static manifests to install Policy Reporter without Helm or Kustomize
|
||||
|
||||
# 1.6.0
|
||||
* Internal refactoring
|
||||
* Unification of PolicyReports and ClusterPolicyReports processing, APIs still stable
|
||||
|
|
|
|||
|
|
@ -30,6 +30,10 @@ helm repo update
|
|||
helm install policy-reporter policy-reporter/policy-reporter -n policy-reporter --create-namespace
|
||||
```
|
||||
|
||||
### Installation without Helm or Kustomize
|
||||
|
||||
To install Policy Reporter without Helm or Kustomize have a look at [manifests](https://github.com/fjogeleit/policy-reporter/tree/main/manifest).
|
||||
|
||||
## Policy Reporter UI
|
||||
|
||||
You can use the Policy Reporter as standalone Application along with the optional UI SubChart.
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
dependencies:
|
||||
- name: monitoring
|
||||
repository: ""
|
||||
version: 1.1.0
|
||||
version: 1.2.0
|
||||
- name: ui
|
||||
repository: ""
|
||||
version: 1.5.0
|
||||
version: 1.6.0
|
||||
- name: kyvernoPlugin
|
||||
repository: ""
|
||||
version: 0.1.1
|
||||
digest: sha256:a80a1c39cbd48116dca9d4d70da23d00456c4e523914a176355c36f0d73ecd1b
|
||||
generated: "2021-05-12T10:32:58.510553+02:00"
|
||||
version: 0.2.0
|
||||
digest: sha256:c32c38e295ebe08651a81937858ba920212bd075aa7605189919c20820067e85
|
||||
generated: "2021-05-21T10:53:50.045598+02:00"
|
||||
|
|
|
|||
|
|
@ -5,19 +5,19 @@ description: |
|
|||
It creates Prometheus Metrics and can send rule validation events to different targets like Loki, Elasticsearch, Slack or Discord
|
||||
|
||||
type: application
|
||||
version: 1.6.0
|
||||
version: 1.6.1
|
||||
appVersion: 1.6.0
|
||||
|
||||
dependencies:
|
||||
- name: monitoring
|
||||
condition: monitoring.enabled
|
||||
repository: ""
|
||||
version: "1.1.0"
|
||||
version: "1.2.0"
|
||||
- name: ui
|
||||
condition: ui.enabled
|
||||
repository: ""
|
||||
version: "1.5.0"
|
||||
version: "1.6.0"
|
||||
- name: kyvernoPlugin
|
||||
condition: kyvernoPlugin.enabled
|
||||
repository: ""
|
||||
version: "0.1.1"
|
||||
version: "0.2.0"
|
||||
|
|
|
|||
|
|
@ -3,5 +3,5 @@ name: kyvernoPlugin
|
|||
description: Policy Reporter Kyverno Plugin
|
||||
|
||||
type: application
|
||||
version: 0.1.1
|
||||
version: 0.2.0
|
||||
appVersion: 0.1.1
|
||||
|
|
@ -5,7 +5,9 @@ If release name contains chart name it will be used as a full name.
|
|||
*/}}
|
||||
{{- define "kyvernoplugin.fullname" -}}
|
||||
{{- $name := "kyverno-plugin" }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- if .Values.global.fullnameOverride }}
|
||||
{{- printf "%s-%s" .Values.global.fullnameOverride $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
|
|
|
|||
|
|
@ -3,5 +3,5 @@ name: monitoring
|
|||
description: Policy Reporter Monitoring with predefined ServiceMonitor and Grafana Dashboards
|
||||
|
||||
type: application
|
||||
version: 1.1.0
|
||||
version: 1.2.0
|
||||
appVersion: 0.0.0
|
||||
|
|
|
|||
|
|
@ -5,7 +5,9 @@ If release name contains chart name it will be used as a full name.
|
|||
*/}}
|
||||
{{- define "monitoring.fullname" -}}
|
||||
{{- $name := .Chart.Name }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- if .Values.global.fullnameOverride }}
|
||||
{{- printf "%s-%s" .Values.global.fullnameOverride $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
|
|
|
|||
|
|
@ -3,5 +3,5 @@ name: ui
|
|||
description: Policy Reporter UI
|
||||
|
||||
type: application
|
||||
version: 1.5.0
|
||||
version: 1.6.0
|
||||
appVersion: 0.10.2
|
||||
|
|
|
|||
|
|
@ -5,7 +5,9 @@ If release name contains chart name it will be used as a full name.
|
|||
*/}}
|
||||
{{- define "ui.fullname" -}}
|
||||
{{- $name := .Chart.Name }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- if .Values.global.fullnameOverride }}
|
||||
{{- printf "%s-%s" .Values.global.fullnameOverride $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
|
|
@ -53,3 +55,23 @@ Create the name of the service account to use
|
|||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "ui.kyvernoPluginServiceName" -}}
|
||||
{{- $name := "kyverno-plugin" }}
|
||||
{{- if .Values.global.fullnameOverride }}
|
||||
{{- printf "%s-%s" .Values.global.fullnameOverride $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "ui.policyReportServiceName" -}}
|
||||
{{- $name := .Chart.Name }}
|
||||
{{- if .Values.global.fullnameOverride }}
|
||||
{{- .Values.global.fullnameOverride }}
|
||||
{{- else }}
|
||||
{{- .Values.global.backend }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -42,10 +42,10 @@ spec:
|
|||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- -backend=http://{{ .Values.global.backend }}:{{ .Values.global.port }}
|
||||
- -backend=http://{{ include "ui.policyReportServiceName" . }}:{{ .Values.global.port }}
|
||||
- -log-size={{ .Values.log.size }}
|
||||
{{- if or .Values.plugins.kyverno .Values.global.plugins.kyverno }}
|
||||
- -kyverno-plugin=http://policy-reporter-kyverno-plugin:8080
|
||||
- -kyverno-plugin=http://{{ include "ui.kyvernoPluginServiceName" . }}:8080
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
|
|
|
|||
|
|
@ -9,7 +9,9 @@ If release name contains chart name it will be used as a full name.
|
|||
*/}}
|
||||
{{- define "policyreporter.fullname" -}}
|
||||
{{- $name := .Chart.Name }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- if .Values.global.fullnameOverride }}
|
||||
{{- .Values.global.fullnameOverride }}
|
||||
{{- else if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
|
|
|
|||
|
|
@ -92,6 +92,7 @@ global:
|
|||
backend: policy-reporter
|
||||
# Service Port number
|
||||
port: 8080
|
||||
fullnameOverride: ""
|
||||
|
||||
# DEPRECTED - Can be removed
|
||||
# Policy Reporter watches now for both existing versions by default
|
||||
|
|
|
|||
50
manifest/README.md
Normal file
50
manifest/README.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
# Installation Manifests for Policy Reporter
|
||||
|
||||
You can use this manifests to install Policy Reporter without additional tools like Helm or Kustomize. The manifests are structured into three installations.
|
||||
|
||||
The installation requires a `policy-reporter` namespace. Because the installation includes RBAC resources which requires a serviceAccountName and a namespace configuration. The default namespace is `policy-reporter`. If this namespace will be created if it does not exist.
|
||||
|
||||
## Policy Reporter
|
||||
|
||||
The `policy-reporter` folder is the basic installation for Policy Reporter without the UI. Includes a basic Configuration Secret `policy-reporter-targets`, empty by default and the `http://policy-reporter:2112/metrics` Endpoint.
|
||||
|
||||
### Installation
|
||||
|
||||
```bash
|
||||
kubectl apply -f ./manifest/policy-reporter/install.yaml
|
||||
```
|
||||
|
||||
## Default Policy Reporter UI
|
||||
|
||||
The `default-policy-reporter-ui` folder is the extended Policy Reporter and the default Policy Reporter UI installation.
|
||||
|
||||
Enables:
|
||||
* Policy Reporter REST API (`http://policy-reporter:8080`)
|
||||
* Policy Reporter UI Endpoint (`http://policy-reporter-ui:8080`).
|
||||
|
||||
Configures Policy Reporter UI as Target for Policy Reporter.
|
||||
|
||||
### Installation
|
||||
|
||||
```bash
|
||||
kubectl apply -f ./manifest/default-policy-reporter-ui/install.yaml
|
||||
```
|
||||
|
||||
## Kyverno Policy Reporter UI
|
||||
|
||||
The `default-policy-reporter-ui` folder is the extended Policy Reporter, Policy Reporter Kyverno Plugin and the extended Policy Reporter UI installation.
|
||||
|
||||
Enables:
|
||||
* Policy Reporter REST API (`http://policy-reporter:8080`)
|
||||
* Policy Reporter Metrics API (`http://policy-reporter:2112/metrics`)
|
||||
* Kyverno Plugin Rest API (`http://policy-reporter-kyverno-plugin:2112/policies`)
|
||||
* Kyverno Plugin Metrics API (`http://policy-reporter-kyverno-plugin:2113/metrics`)
|
||||
* Policy Reporter UI Endpoint (`http://policy-reporter-ui:8080`).
|
||||
|
||||
Configures Policy Reporter UI as Target for Policy Reporter and enables the Kyverno Dashboard.
|
||||
|
||||
### Installation
|
||||
|
||||
```bash
|
||||
kubectl apply -f ./manifest/kyverno-policy-reporter-ui/install.yaml
|
||||
```
|
||||
211
manifest/default-policy-reporter-ui/install.yaml
Normal file
211
manifest/default-policy-reporter-ui/install.yaml
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
spec: {}
|
||||
status: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
name: policy-reporter
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: policy-reporter
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: "ServiceAccount"
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: policy-reporter-targets
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
type: Opaque
|
||||
data:
|
||||
config.yaml: bG9raToKICBob3N0OiAiIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCmVsYXN0aWNzZWFyY2g6CiAgaG9zdDogIiIKICBpbmRleDogInBvbGljeS1yZXBvcnRlciIKICByb3RhdGlvbjogImRheWxpIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCnNsYWNrOgogIHdlYmhvb2s6ICIiCiAgbWluaW11bVByaW9yaXR5OiAiIgogIHNraXBFeGlzdGluZ09uU3RhcnR1cDogdHJ1ZQoKZGlzY29yZDoKICB3ZWJob29rOiAiIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCnRlYW1zOgogIHdlYmhvb2s6ICIiCiAgbWluaW11bVByaW9yaXR5OiAiIgogIHNraXBFeGlzdGluZ09uU3RhcnR1cDogdHJ1ZQoKdWk6CiAgaG9zdDogaHR0cDovL3BvbGljeS1yZXBvcnRlci11aTo4MDgwCiAgbWluaW11bVByaW9yaXR5OiAid2FybmluZyIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUK
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: policy-reporter-ui
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 2112
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: 8080
|
||||
targetPort: rest
|
||||
protocol: TCP
|
||||
name: rest
|
||||
selector:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: policy-reporter-ui
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- name: ui
|
||||
image: "fjogeleit/policy-reporter-ui:0.10.2"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1234
|
||||
args:
|
||||
- -backend=http://policy-reporter:8080
|
||||
- -log-size=200
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
resources:
|
||||
{}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
spec:
|
||||
serviceAccountName: policy-reporter
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: policy-reporter
|
||||
image: "fjogeleit/policy-reporter:1.6.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1234
|
||||
args:
|
||||
- --config=/app/config.yaml
|
||||
- --apiPort=8080
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
- name: rest
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: http
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: config-file
|
||||
mountPath: /app/config.yaml
|
||||
subPath: config.yaml
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
value: policy-reporter
|
||||
volumes:
|
||||
- name: config-file
|
||||
secret:
|
||||
secretName: policy-reporter-targets
|
||||
optional: true
|
||||
333
manifest/kyverno-policy-reporter-ui/install.yaml
Normal file
333
manifest/kyverno-policy-reporter-ui/install.yaml
Normal file
|
|
@ -0,0 +1,333 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
spec: {}
|
||||
status: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
name: policy-reporter
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: policy-reporter
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: "ServiceAccount"
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: policy-reporter-kyverno-plugin
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: kyverno-plugin
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: policy-reporter-targets
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
helm.sh/chart: policy-reporter-1.6.0
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
app.kubernetes.io/version: "1.6.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
type: Opaque
|
||||
data:
|
||||
config.yaml: bG9raToKICBob3N0OiAiIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCmVsYXN0aWNzZWFyY2g6CiAgaG9zdDogIiIKICBpbmRleDogInBvbGljeS1yZXBvcnRlciIKICByb3RhdGlvbjogImRheWxpIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCnNsYWNrOgogIHdlYmhvb2s6ICIiCiAgbWluaW11bVByaW9yaXR5OiAiIgogIHNraXBFeGlzdGluZ09uU3RhcnR1cDogdHJ1ZQoKZGlzY29yZDoKICB3ZWJob29rOiAiIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCnRlYW1zOgogIHdlYmhvb2s6ICIiCiAgbWluaW11bVByaW9yaXR5OiAiIgogIHNraXBFeGlzdGluZ09uU3RhcnR1cDogdHJ1ZQoKdWk6CiAgaG9zdDogaHR0cDovL3BvbGljeS1yZXBvcnRlci11aTo4MDgwCiAgbWluaW11bVByaW9yaXR5OiAid2FybmluZyIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUK
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
name: policy-reporter-kyverno-plugin
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- policies
|
||||
- policies/status
|
||||
- clusterpolicies
|
||||
- clusterpolicies/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: policy-reporter-kyverno-plugin
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: policy-reporter-kyverno-plugin
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: "ServiceAccount"
|
||||
name: policy-reporter-kyverno-plugin
|
||||
namespace: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: policy-reporter-kyverno-plugin
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: kyverno-plugin
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 2113
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: 8080
|
||||
targetPort: rest
|
||||
protocol: TCP
|
||||
name: rest
|
||||
selector:
|
||||
app.kubernetes.io/name: kyverno-plugin
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: policy-reporter-ui
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 2112
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: 8080
|
||||
targetPort: rest
|
||||
protocol: TCP
|
||||
name: rest
|
||||
selector:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: policy-reporter-kyverno-plugin
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: kyverno-plugin
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kyverno-plugin
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kyverno-plugin
|
||||
app.kubernetes.io/instance: policy-reporter
|
||||
spec:
|
||||
serviceAccountName: policy-reporter-kyverno-plugin
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: "kyverno-plugin"
|
||||
image: "fjogeleit/policy-reporter-kyverno-plugin:0.1.1"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1234
|
||||
args:
|
||||
- --apiPort=8080
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2113
|
||||
protocol: TCP
|
||||
- name: rest
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /policies
|
||||
port: rest
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /policies
|
||||
port: rest
|
||||
resources:
|
||||
{}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: policy-reporter-ui
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter-ui
|
||||
spec:
|
||||
containers:
|
||||
- name: ui
|
||||
image: "fjogeleit/policy-reporter-ui:0.10.2"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1234
|
||||
args:
|
||||
- -backend=http://policy-reporter:8080
|
||||
- -log-size=200
|
||||
- -kyverno-plugin=http://policy-reporter-kyverno-plugin:8080
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
resources:
|
||||
{}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
serviceAccountName: policy-reporter
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: policy-reporter
|
||||
image: "fjogeleit/policy-reporter:1.6.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1234
|
||||
args:
|
||||
- --config=/app/config.yaml
|
||||
- --apiPort=8080
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
- name: rest
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: http
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: config-file
|
||||
mountPath: /app/config.yaml
|
||||
subPath: config.yaml
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
value: policy-reporter
|
||||
volumes:
|
||||
- name: config-file
|
||||
secret:
|
||||
secretName: policy-reporter-targets
|
||||
optional: true
|
||||
136
manifest/policy-reporter/install.yaml
Normal file
136
manifest/policy-reporter/install.yaml
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
spec: {}
|
||||
status: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: policy-reporter-targets
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
type: Opaque
|
||||
data:
|
||||
config.yaml: bG9raToKICBob3N0OiAiIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCmVsYXN0aWNzZWFyY2g6CiAgaG9zdDogIiIKICBpbmRleDogInBvbGljeS1yZXBvcnRlciIKICByb3RhdGlvbjogImRheWxpIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCnNsYWNrOgogIHdlYmhvb2s6ICIiCiAgbWluaW11bVByaW9yaXR5OiAiIgogIHNraXBFeGlzdGluZ09uU3RhcnR1cDogdHJ1ZQoKZGlzY29yZDoKICB3ZWJob29rOiAiIgogIG1pbmltdW1Qcmlvcml0eTogIiIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUKCnRlYW1zOgogIHdlYmhvb2s6ICIiCiAgbWluaW11bVByaW9yaXR5OiAiIgogIHNraXBFeGlzdGluZ09uU3RhcnR1cDogdHJ1ZQoKdWk6CiAgaG9zdDogCiAgbWluaW11bVByaW9yaXR5OiAid2FybmluZyIKICBza2lwRXhpc3RpbmdPblN0YXJ0dXA6IHRydWUK
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
name: policy-reporter
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: policy-reporter
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: "ServiceAccount"
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 2112
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: policy-reporter
|
||||
namespace: policy-reporter
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: policy-reporter
|
||||
spec:
|
||||
serviceAccountName: policy-reporter
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: policy-reporter
|
||||
image: "fjogeleit/policy-reporter:1.6.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1234
|
||||
args:
|
||||
- --config=/app/config.yaml
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: http
|
||||
resources:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: config-file
|
||||
mountPath: /app/config.yaml
|
||||
subPath: config.yaml
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
value: policy-reporter
|
||||
volumes:
|
||||
- name: config-file
|
||||
secret:
|
||||
secretName: policy-reporter-targets
|
||||
optional: true
|
||||
Loading…
Reference in a new issue