Update Helm chart with ClusterRole secret option and Curl Registry (#287

) * Update Helm chart with ClusterRole secret option and Curl Image registry Define whether we would like to allow Secret Read Cluster wide Define Curl Image registry/repo/tag
openclarity · Jan 16, 2023 · 01a8c4a · 01a8c4a
1 parent 7e34769
commit 01a8c4a
Show file tree

Hide file tree

Showing 5 changed files with 33 additions and 8 deletions.
diff --git a/charts/kubeclarity/templates/clusterrole.yaml b/charts/kubeclarity/templates/clusterrole.yaml
@@ -9,9 +9,11 @@ rules:
   - apiGroups: [""]
     resources: ["configmaps"]
     verbs: ["get"]
+  {{- if index .Values "kubeclarity" "clusterRole" "readClusterSecrets" }}
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get"]
+  {{- end}}
   - apiGroups: [""]
     resources: ["pods"]
     verbs: ["list"]

diff --git a/charts/kubeclarity/templates/deployment.yaml b/charts/kubeclarity/templates/deployment.yaml
@@ -38,7 +38,7 @@ spec:
           resources:
 {{- toYaml .Values.kubeclarity.initContainers.resources | nindent 12 }}
         - name: '{{ include "kubeclarity.name" . }}-wait-for-sbom-db'
-          image: curlimages/curl:7.84.0
+          image: {{ index .Values "curl" "image" "registry" }}/{{ index .Values "curl" "image" "repository" }}:{{ index .Values "curl" "image" "tag" }}
           args:
             - /bin/sh
             - -c
@@ -62,7 +62,7 @@ spec:
 {{- toYaml .Values.kubeclarity.initContainers.resources | nindent 12 }}
 {{- if index .Values "kubeclarity-grype-server" "enabled" }}
         - name: '{{ include "kubeclarity.name" . }}-wait-for-grype-server'
-          image: curlimages/curl:7.84.0
+          image: {{ index .Values "curl" "image" "registry" }}/{{ index .Values "curl" "image" "repository" }}:{{ index .Values "curl" "image" "tag" }}
           args:
             - /bin/sh
             - -c
@@ -125,6 +125,8 @@ spec:
               value: "{{ include "kubeclarity.name" . }}-scanner-template"
             - name: SCANNER_JOB_TEMPLATE_CONFIG_MAP_NAMESPACE
               value: "{{ .Release.Namespace }}"
+            - name: READ_CLUSTER_SECRETS
+              value: "{{ index .Values "kubeclarity" "clusterRole" "readClusterSecrets" }}"
           readinessProbe:
             httpGet:
               path: /healthz/ready

diff --git a/charts/kubeclarity/values.yaml b/charts/kubeclarity/values.yaml
@@ -22,6 +22,16 @@ global:
 ## End of Global Values
 #######################################################################################
 
+#######################################################################################
+## Curl Values
+curl:
+  image:
+    registry: "docker.io"
+    repository: curlimages/curl
+    tag: 7.84.0
+## End of Curl Values
+#######################################################################################
+
 #######################################################################################
 ## KubeClarity Values
 
@@ -53,6 +63,9 @@ kubeclarity:
       memory: "1000Mi"
       cpu: "1000m"
 
+  clusterRole:
+    readClusterSecrets: true
+
   initContainers:
     resources:
       requests:

diff --git a/runtime_scan/pkg/config/config.go b/runtime_scan/pkg/config/config.go
@@ -29,19 +29,22 @@ const (
 	ScannerJobTemplateConfigMapName      = "SCANNER_JOB_TEMPLATE_CONFIG_MAP_NAME"
 	ScannerJobTemplateConfigMapNamespace = "SCANNER_JOB_TEMPLATE_CONFIG_MAP_NAMESPACE"
 	defaultScannerJobResultListenPort    = 8888
+	ReadClusterSecrets                   = "READ_CLUSTER_SECRETS" // nolint: gosec
 )
 
 type Config struct {
 	ScannerJobResultListenPort int
 	CredsSecretNamespace       string
 	ScannerJobTemplate         *batchv1.Job
+	ReadClusterSecrets         bool
 }
 
 func setConfigDefaults() {
 	viper.SetDefault(CredsSecretNamespace, "kubeclarity")
 	viper.SetDefault(ScannerJobTemplateConfigMapName, "")
 	viper.SetDefault(ScannerJobTemplateConfigMapNamespace, "kubeclarity")
 	viper.SetDefault(ScannerJobResultListenPort, defaultScannerJobResultListenPort)
+	viper.SetDefault(ReadClusterSecrets, "true")
 
 	viper.AutomaticEnv()
 }
@@ -59,6 +62,7 @@ func LoadConfig(clientset kubernetes.Interface) (*Config, error) {
 		ScannerJobResultListenPort: viper.GetInt(ScannerJobResultListenPort),
 		CredsSecretNamespace:       viper.GetString(CredsSecretNamespace),
 		ScannerJobTemplate:         scannerJobTemplate,
+		ReadClusterSecrets:         viper.GetBool(ReadClusterSecrets),
 	}
 
 	return config, nil

diff --git a/runtime_scan/pkg/scanner/scanner.go b/runtime_scan/pkg/scanner/scanner.go
@@ -51,6 +51,14 @@ type Scanner struct {
 }
 
 func CreateScanner(config *_config.Config, clientset kubernetes.Interface) *Scanner {
+	credentialAdders := []_creds.CredentialAdder{}
+	if config.ReadClusterSecrets {
+		credentialAdders = []_creds.CredentialAdder{
+			_creds.CreateBasicRegCred(clientset, config.CredsSecretNamespace),
+			_creds.CreateECR(clientset, config.CredsSecretNamespace),
+			_creds.CreateGCR(clientset, config.CredsSecretNamespace),
+		}
+	}
 	s := &Scanner{
 		progress: _types.ScanProgress{
 			Status: _types.Idle,
@@ -59,12 +67,8 @@ func CreateScanner(config *_config.Config, clientset kubernetes.Interface) *Scan
 		killSignal:         make(chan bool),
 		clientset:          clientset,
 		logFields:          log.Fields{"scanner id": uuid.NewV4().String()},
-		credentialAdders: []_creds.CredentialAdder{
-			_creds.CreateBasicRegCred(clientset, config.CredsSecretNamespace),
-			_creds.CreateECR(clientset, config.CredsSecretNamespace),
-			_creds.CreateGCR(clientset, config.CredsSecretNamespace),
-		},
-		Mutex: sync.Mutex{},
+		credentialAdders:   credentialAdders,
+		Mutex:              sync.Mutex{},
 	}
 
 	return s