-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for license and tests addition #25
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
{{ $aksIsEnabled := (eq .Values.aks.enabled true) }} | ||
{{ $gkeIsEnabled := (eq .Values.gke.enabled true) }} | ||
{{ $eksIsEnabled := (eq .Values.aws.enabled true) }} | ||
{{ $aksIsUsed := and (eq .Values.k8sAuditEnvironment "aks") (eq $aksIsEnabled true) }} | ||
{{ $gkeIsUsed := and (eq .Values.k8sAuditEnvironment "gke") (eq $gkeIsEnabled true) }} | ||
{{ $eksIsUsed := and (eq .Values.k8sAuditEnvironment "eks") (eq $eksIsEnabled true) }} | ||
{{ $s3IsUsed := and (eq .Values.k8sAuditEnvironment "s3") (eq .Values.aws.enabled true) }} | ||
|
||
{{ $enabledCount := add ($aksIsEnabled | int) ($gkeIsEnabled | int) ($eksIsUsed | int) }} | ||
# Debug: Number of cloud provers being used: {{ $enabledCount | toString | printf "%q"}} | ||
{{ if gt $enabledCount 1 }} | ||
{{ fail "Only one cloud provider can be used!" }} | ||
{{ else if eq $enabledCount 1 }} | ||
{{ if eq .Values.k8sAuditEnvironment "k8s" }} | ||
{{ fail "k8sAuditEnvironment of 'k8s' can't ne used with a cloud provider enabled!" }} | ||
{{ end }} | ||
{{ else }} | ||
{{ if not (eq .Values.k8sAuditEnvironment "k8s") }} | ||
{{ fail "You have to setup at least one cloud provider as enabled or k8 as the k8sAuditEnvironment!" }} | ||
{{ end }} | ||
{{ end }} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,165 @@ | ||
{ | ||
"$schema": "http://json-schema.org/draft-07/schema", | ||
"required": [ | ||
"namespace", | ||
"clusterName", | ||
"image", | ||
"tls", | ||
"k8sAuditEnvironment", | ||
"kauditPolicyFile", | ||
"kauditIntegrationsFile", | ||
"runOptions", | ||
"ingress", | ||
"storage", | ||
"resources", | ||
"aks", | ||
"gke", | ||
"aws", | ||
"k8s", | ||
"license" | ||
], | ||
"properties": { | ||
"image": { | ||
"required": [ | ||
"source","kaudit", "pullPolicy", "pullSecretToken" | ||
], | ||
"properties": { | ||
"Sales": { | ||
"type": "string" | ||
}, | ||
"kaudit": { | ||
"type": "string" | ||
}, | ||
"pullPolicy": { | ||
"type": "string" | ||
}, | ||
"pullSecretToken": { | ||
"type": "string" | ||
} | ||
} | ||
}, | ||
"tls": { | ||
"required": [ | ||
"mode","selfSigned" | ||
], | ||
"properties": { | ||
"mode": { | ||
"type": "string", | ||
"enum": ["self-signed" , "external"] | ||
}, | ||
"selfSigned": { | ||
"type": "object" | ||
} | ||
} | ||
}, | ||
"storage": { | ||
"required": [ | ||
"size" | ||
], | ||
"properties": { | ||
"className": { | ||
"type": "string" | ||
}, | ||
"size": { | ||
"type": "string" | ||
} | ||
} | ||
}, | ||
"resources": { | ||
"required": [ | ||
"javaXmX", | ||
"memoryRequest", | ||
"cpuRequest", | ||
"memoryLimit", | ||
"cpuLimit" | ||
], | ||
"properties": { | ||
"javaXmX": { | ||
"type": "string" | ||
}, | ||
"memoryRequest": { | ||
"type": "string" | ||
}, | ||
"cpuRequest": { | ||
"type": "string" | ||
}, | ||
"memoryLimit": { | ||
"type": "string" | ||
}, | ||
"cpuLimit": { | ||
"type": "string" | ||
} | ||
} | ||
}, | ||
"aks": { | ||
"type": "object", | ||
"required": [ | ||
"enabled" | ||
], | ||
"properties": { | ||
"enabled": { | ||
"type": "boolean" | ||
} | ||
} | ||
}, | ||
"gke": { | ||
"type": "object", | ||
"required": [ | ||
"enabled" | ||
], | ||
"properties": { | ||
"enabled": { | ||
"type": "boolean" | ||
} | ||
} | ||
}, | ||
"aws": { | ||
"type": "object", | ||
"required": [ | ||
"enabled", | ||
"kinesisStreamName", | ||
"region" | ||
], | ||
"properties": { | ||
"enabled": { | ||
"type": "boolean" | ||
}, | ||
"kinesisStreamName": { | ||
"type": "string" | ||
}, | ||
"region": { | ||
"type": "string" | ||
} | ||
} | ||
}, | ||
"k8s": { | ||
"type": "object", | ||
"required": [ | ||
"mode" | ||
], | ||
"properties": { | ||
"mode": { | ||
"type": "string", | ||
"enum": ["webhook" , "auditsink"] | ||
} | ||
} | ||
}, | ||
"license" : { | ||
"type": "object", | ||
"required": [ | ||
"enabled", "customerId", "entitlement" | ||
], | ||
"properties": { | ||
"enabled": { | ||
"type": "boolean" | ||
}, | ||
"customerId": { | ||
"type": "string" | ||
}, | ||
"entitlement": { | ||
"type": "string" | ||
} | ||
} | ||
} | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,10 +1,10 @@ | ||
namespace: alcide-kaudit | ||
clusterName: mycluster | ||
namespace: kaudit | ||
clusterName: my-cluster | ||
image: | ||
source: Sales | ||
kaudit: "gcr.io/dcvisor-162009/alcide/dcvisor/kaudit:latest" | ||
kaudit: "gcr.io/dcvisor-162009/alcide/dcvisor/kaudit-testing:license-test" | ||
pullPolicy: Always #Always for :latest or no tag, IfNotPresent for other tags | ||
pullSecretToken: GetYourTokenFromAlcide | ||
pullSecretToken: | ||
|
||
tls: | ||
# self-signed | external | ||
|
@@ -17,7 +17,7 @@ tls: | |
alternativeNames: [] #["kaudit.yourdomain.io"] | ||
|
||
|
||
k8sAuditEnvironment: k8s # Audit Logs Source - one of: k8s, gke, aks, eks, s3 | ||
k8sAuditEnvironment: eks # Audit Logs Source - one of: k8s, gke, aks, eks, s3 | ||
|
||
# Customise Alcide kAudit Policy | ||
kauditPolicyFile: kaudit-policy/default-policy.yaml | ||
|
@@ -57,7 +57,7 @@ ingress: | |
# AKS: "managed-premium" or default | ||
# "local-storage" (a configured StorageClass, see above, as well as related toleration/affinity configuration below) | ||
storage: | ||
className: | ||
className: "" | ||
size: 100Gi | ||
|
||
resources: | ||
|
@@ -70,26 +70,33 @@ resources: | |
|
||
# Azure | ||
aks: | ||
enabled : false | ||
eventHubName: "" # Azure EventHubName name (for AKS). If using a non-default ConsumerGroup ($Default), configure it in 'consumer-group-name'. | ||
eventHubconnectionString: "" # Azure EventHub connection string (for AKS) | ||
consumerGroupName: "" # Azure EventHubName ConsumerGroup name (for AKS), if using a non-default ConsumerGroup (i.e. \$Default). | ||
|
||
# GCP | ||
gke: | ||
enabled : false | ||
projectId: "" # GKE-project (for GKE) | ||
pubsubSubscriptionId: "" # GKE PubSub subscription ID (only if consuming audit logs via PubSub instead of StackDriver) | ||
token: "" | ||
storageType: "pd-ssd" # Or pd-standard | ||
|
||
# EKS or S3 | ||
aws: | ||
enabled : true | ||
kinesisStreamName: "" # AWS Kinesis stream name (for EKS) | ||
region: "" # AWS Kinesis stream region (for EKS and S3) | ||
region: "" # AWS Kinesis stream region (for EKS and S3) | ||
|
||
accessKeyId: "" # AWS Kinesis stream credentials (for EKS and S3) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. please add a comment with explanation regarding the use of credentials There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. OK, I haven't tested what will happen if both are included - I can add a test the throws a compeletion error. |
||
secretAccessKey: "" | ||
serviceAccountRoleArn: "" # Can be used instead of (accessKeyId + secretAccessKey) | ||
|
||
s3BucketName: "" # AWS S3 bucket name (for S3) | ||
s3ResourceKeyPrefix: "" # AWS S3 logs resources keys prefix (for S3) | ||
|
||
|
||
k8s: | ||
# webhook or auditsink | ||
mode: "auditsink" | ||
|
@@ -98,7 +105,7 @@ alcide: | |
token: | ||
|
||
prometheus: | ||
token: | ||
token: | ||
|
||
# | ||
# Vault | ||
|
@@ -132,4 +139,11 @@ vault: | |
mode: "none" # none | vault | agent-inject | ||
# For "vault" mode this parameter is required | ||
vaultServer: "http://vault.demo:8200" | ||
image: "vault:1.3.2" | ||
image: "vault:1.3.2" | ||
|
||
|
||
license: | ||
enabled : true | ||
customerId : "" | ||
entitlement: "" | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this one should be set back to "latest"
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
OK.