From 197103b1da600e1fb5cfc85afde803c24745f653 Mon Sep 17 00:00:00 2001 From: Thomas Jungbauer Date: Fri, 12 Jul 2024 15:03:28 +0200 Subject: [PATCH] Importing remaining Charts --- README.md | 23 + _test/ct-config.yaml | 1 + charts/cert-manager/Chart.yaml | 20 + charts/cert-manager/LICENSE | 13 + charts/cert-manager/README.md | 192 ++++ charts/cert-manager/README.md.gotmpl | 84 ++ .../cert-manager/templates/CertManager.yaml | 24 + .../cert-manager/templates/ClusterIssuer.yaml | 41 + charts/cert-manager/templates/_helpers.tpl | 0 .../issueing-Certificate/Certificate.yaml | 112 +++ charts/cert-manager/values.yaml | 269 ++++++ .../.helmignore | 23 + .../compliance-operator-full-stack/Chart.yaml | 23 + charts/compliance-operator-full-stack/LICENSE | 13 + .../compliance-operator-full-stack/README.md | 177 ++++ .../README.md.gotmpl | 93 ++ .../templates/_helpers.tpl | 0 .../compliance/ScanSettingBinding.yaml | 23 + .../compliance/TailoredProfiles.yaml | 26 + .../values.yaml | 122 +++ charts/cost-management/.helmignore | 23 + charts/cost-management/Chart.yaml | 23 + charts/cost-management/LICENSE | 13 + charts/cost-management/README.md | 152 +++ charts/cost-management/README.md.gotmpl | 70 ++ .../CostManagementMetricsConfig.yaml | 46 + charts/cost-management/templates/_helpers.tpl | 0 charts/cost-management/values.yaml | 124 +++ charts/cyclonedx/Chart.yaml | 17 + charts/cyclonedx/LICENSE | 13 + charts/cyclonedx/README.md | 84 ++ charts/cyclonedx/README.md.gotmpl | 32 + charts/cyclonedx/templates/_helpers.tpl | 0 charts/cyclonedx/templates/deployment.yaml | 49 + charts/cyclonedx/templates/namespace.yaml | 10 + charts/cyclonedx/templates/route.yaml | 18 + charts/cyclonedx/templates/service.yaml | 19 + charts/cyclonedx/values.yaml | 9 + charts/file-integrity-operator/.helmignore | 23 + charts/file-integrity-operator/Chart.yaml | 17 + charts/file-integrity-operator/LICENSE | 13 + charts/file-integrity-operator/README.md | 174 ++++ .../file-integrity-operator/README.md.gotmpl | 98 ++ .../templates/_helpers.tpl | 0 .../templates/controlplane-aide-config.yaml | 68 ++ .../templates/fileintegrity.yaml | 32 + charts/file-integrity-operator/values.yaml | 108 +++ charts/generic-cluster-config/Chart.yaml | 16 + charts/generic-cluster-config/LICENSE | 13 + charts/generic-cluster-config/README.md | 734 ++++++++++++++ .../generic-cluster-config/README.md.gotmpl | 562 +++++++++++ .../images/ConsoleLink-ApplicationMenu.png | Bin 0 -> 89855 bytes .../images/ConsoleLink-HelpMenu.png | Bin 0 -> 59472 bytes .../images/ConsoleLink-NamespaceDashboard.png | Bin 0 -> 98746 bytes .../images/ConsoleLink-UserMenu.png | Bin 0 -> 38373 bytes .../images/YAMLSample.png | Bin 0 -> 203209 bytes .../templates/_helpers.tpl | 0 .../templates/console/console-banner.yaml | 22 + .../templates/console/console-links.yaml | 28 + .../console/console-yaml-samples.yaml | 19 + .../jobs/check_etcd_encryption-role.yaml | 27 + .../check_etcd_encryption-rolebinding.yaml | 26 + .../check_etcd_encryption-serviceaccount.yaml | 18 + .../templates/jobs/check_etcd_encryption.yaml | 87 ++ .../limit_registries/fix-sample-operator.yaml | 9 + .../limit_registries/image-config.yaml | 26 + .../templates/monitoring/monitoring.yaml | 209 ++++ .../monitoring/user-workload-monitoring.yaml | 129 +++ .../templates/security/apiserver.yaml | 32 + .../security/disable_self_provisioner.yaml | 17 + .../security/identity-providers.yaml | 70 ++ charts/generic-cluster-config/values.yaml | 897 ++++++++++++++++++ charts/helm-policy-generator/Chart.yaml | 21 + charts/helm-policy-generator/LICENSE | 201 ++++ charts/helm-policy-generator/README.md | 204 ++++ charts/helm-policy-generator/README.md.gotmpl | 101 ++ .../console-banner/console-banner.yaml | 14 + .../console-links/applicationlink.yaml | 11 + .../console-links/applicationlink2.yaml | 11 + .../cluster-operators-check.yaml | 21 + .../odf-healthcheck.yaml | 7 + .../pods-health-check/pods-crashing.yaml | 8 + .../pods-health-check/pods-errimagepull.yaml | 8 + .../pods-health-check/pods-failing.yaml | 4 + .../pods-imagepullbackoff.yaml | 8 + .../pods-health-check/pods-pending.yaml | 4 + .../terminating-namespaces.yaml | 4 + .../values-cluster-health-checks.yaml | 100 ++ .../console-banner/consol-banner.yaml | 12 + .../console-links/allnamespacesLink.yaml | 8 + .../console-links/applicationLink.yaml | 11 + .../console-links/helpLink.yaml | 8 + .../console-links/namespacedLink.yaml | 12 + .../console-links/userLink.yaml | 8 + .../console-plugins/console-plugins.yaml | 12 + .../values-console-customizations.yaml | 63 ++ .../templates/_helpers.tpl | 0 .../templates/namespace.yaml | 10 + .../templates/placement.yaml | 66 ++ .../templates/placementBinding.yaml | 58 ++ .../templates/policy.yaml | 277 ++++++ .../templates/policySet.yaml | 28 + charts/helm-policy-generator/values.yaml | 470 +++++++++ charts/helper-argocd/Chart.yaml | 17 + charts/helper-argocd/LICENSE | 13 + charts/helper-argocd/README.md | 197 ++++ charts/helper-argocd/README.md.gotmpl | 156 +++ .../ApplicationSets/applicationsset.yaml | 249 +++++ .../templates/Applications/applications.yaml | 80 ++ charts/helper-argocd/templates/_helpers.tpl | 0 .../templates/argocd-project.yaml | 21 + charts/helper-argocd/values.yaml | 301 ++++++ charts/helper-loki-bucket-secret/Chart.yaml | 16 + charts/helper-loki-bucket-secret/LICENSE | 13 + charts/helper-loki-bucket-secret/README.md | 105 ++ .../README.md.gotmpl | 50 + .../templates/_helpers.tpl | 0 .../create-loki-bucket-secret-crb.yaml | 23 + .../create-loki-bucket-secret-sa.yaml | 16 + .../templates/create-loki-bucket-secret.yaml | 75 ++ charts/helper-loki-bucket-secret/values.yaml | 19 + charts/helper-lokistack/Chart.yaml | 17 + charts/helper-lokistack/README.md | 238 +++++ charts/helper-lokistack/README.md.gotmpl | 160 ++++ .../helper-lokistack/templates/LokiStack.yaml | 185 ++++ .../helper-lokistack/templates/_helpers.tpl | 0 charts/helper-lokistack/values.yaml | 1 + charts/helper-lokistack/values_example.yaml | 228 +++++ charts/helper-objectstore/Chart.yaml | 17 + charts/helper-objectstore/README.md | 117 +++ charts/helper-objectstore/README.md.gotmpl | 52 + .../templates/BackingStore.yaml | 30 + .../templates/BucketClaim.yaml | 17 + .../templates/BucketClass.yaml | 21 + .../templates/StorageClass.yaml | 19 + .../helper-objectstore/templates/_helpers.tpl | 0 charts/helper-objectstore/values.yaml | 64 ++ charts/helper-operator/Chart.yaml | 8 +- charts/helper-operator/README.md | 145 --- charts/helper-operator/templates/_helpers.tpl | 52 - .../jobs/enable_console_plugin-crb.yaml | 2 +- .../jobs/enable_console_plugin-role.yaml | 2 +- .../jobs/enable_console_plugin-sa.yaml | 2 +- .../templates/jobs/enable_console_plugin.yaml | 2 +- .../helper-operator/templates/namespace.yaml | 4 +- .../templates/operators/operatorgroup.yaml | 4 +- .../templates/operators/subscription.yaml | 32 +- charts/helper-proj-onboarding/.helmignore | 23 + charts/helper-proj-onboarding/Chart.yaml | 16 + charts/helper-proj-onboarding/LICENSE | 13 + charts/helper-proj-onboarding/README.md | 643 +++++++++++++ .../helper-proj-onboarding/README.md.gotmpl | 516 ++++++++++ .../templates/_helpers.tpl | 73 ++ .../templates/argocd-project.yaml | 114 +++ .../templates/default_network_policies.yaml | 158 +++ .../templates/egressIP.yaml | 21 + .../templates/limitranges.yaml | 97 ++ .../templates/local-admin-group-rb.yaml | 24 + .../templates/local-admin-group.yaml | 19 + .../templates/namespace.yaml | 36 + .../templates/networkpolicy.yaml | 70 ++ .../templates/resourcequota.yaml | 81 ++ .../templates/tshirt-sizes/limitranges.yaml | 162 ++++ .../templates/tshirt-sizes/resourcequota.yaml | 106 +++ .../helper-proj-onboarding/values-global.yaml | 67 ++ charts/helper-proj-onboarding/values.yaml | 542 +++++++++++ charts/helper-status-checker/Chart.yaml | 6 +- charts/helper-status-checker/README.md | 96 -- .../templates/_helpers.tpl | 69 -- .../templates/check_if_operator_is_ready.yaml | 32 +- .../templates/clusterrole.yaml | 2 +- .../templates/clusterrolebinding.yaml | 2 +- .../templates/installplan-approver.yaml | 19 +- .../templates/serviceAccount.yaml | 2 +- charts/minio-configurator/Chart.yaml | 17 + charts/minio-configurator/LICENSE | 13 + charts/minio-configurator/README.md | 369 +++++++ charts/minio-configurator/README.md.gotmpl | 294 ++++++ .../minio-configurator/templates/_helpers.tpl | 52 + .../templates/provisioning-configmap.yaml | 76 ++ .../templates/provisioning-job.yaml | 383 ++++++++ .../provisioning-serviceaccount.yaml | 16 + .../minio-configurator/values-examples.yaml | 264 ++++++ charts/minio-configurator/values.yaml | 10 + charts/openshift-data-foundation/.helmignore | 23 + charts/openshift-data-foundation/Chart.yaml | 23 + charts/openshift-data-foundation/LICENSE | 13 + charts/openshift-data-foundation/README.md | 273 ++++++ .../README.md.gotmpl | 184 ++++ .../templates/MultiCloudGateway.yaml | 21 + .../templates/StorageCluster.yaml | 221 +++++ .../templates/_helpers.tpl | 0 charts/openshift-data-foundation/values.yaml | 170 ++++ charts/openshift-gitops/.helmignore | 23 + charts/openshift-gitops/Chart.yaml | 23 + charts/openshift-gitops/LICENSE | 13 + .../PATCH_openshift-gitops-crb.yaml | 12 + .../PATCH_openshift-gitops.yaml | 221 +++++ charts/openshift-gitops/README.md | 223 +++++ charts/openshift-gitops/README.md.gotmpl | 106 +++ .../openshift-gitops/templates/_helpers.tpl | 0 .../templates/argocd_instance/argocd.yaml | 341 +++++++ .../templates/argocd_instance/namespace.yaml | 12 + .../templates/clusteradmin-RoleBinding.yaml | 21 + charts/openshift-gitops/values.yaml | 336 +++++++ charts/openshift-logging/.helmignore | 23 + charts/openshift-logging/Chart.yaml | 40 + charts/openshift-logging/LICENSE | 13 + charts/openshift-logging/README.md | 115 +++ charts/openshift-logging/README.md.gotmpl | 45 + .../templates/ClusterLogging.yaml | 54 ++ .../openshift-logging/templates/_helpers.tpl | 0 charts/openshift-logging/values-examples.yaml | 134 +++ charts/openshift-logging/values.yaml | 1 + charts/rhacm-setup/.helmignore | 23 + charts/rhacm-setup/Chart.yaml | 19 + charts/rhacm-setup/LICENSE | 13 + charts/rhacm-setup/README.md | 149 +++ charts/rhacm-setup/README.md.gotmpl | 74 ++ charts/rhacm-setup/templates/_helpers.tpl | 0 .../templates/rhacm/multiclusterhub.yaml | 20 + charts/rhacm-setup/values.yaml | 68 ++ charts/rhacs-setup/.helmignore | 24 + charts/rhacs-setup/Chart.yaml | 16 + charts/rhacs-setup/LICENSE | 13 + charts/rhacs-setup/README.md | 521 ++++++++++ charts/rhacs-setup/README.md.gotmpl | 411 ++++++++ .../docs/img/RHACS-Deployment-Waves.png | Bin 0 -> 328423 bytes charts/rhacs-setup/templates/_helpers.tpl | 0 .../templates/jobs/configure-acs-oauth.yaml | 77 ++ .../jobs/create-cluster-init-bundle-job.yaml | 72 ++ .../templates/jobs/create-consolelink.yaml | 69 ++ charts/rhacs-setup/templates/namespace.yaml | 12 + .../rhacs-setup/templates/rhacs/central.yaml | 171 ++++ .../rhacs/create-cluster-init-bundle-sa.yaml | 120 +++ .../templates/rhacs/declerative-config.yaml | 43 + .../templates/rhacs/namespace.yaml | 11 + .../templates/rhacs/secured-cluster.yaml | 58 ++ .../tests/__snapshot__/central_test.yaml.snap | 48 + charts/rhacs-setup/tests/central_test.yaml | 106 +++ charts/rhacs-setup/tests/values-tests.yaml | 375 ++++++++ charts/rhacs-setup/values-example.yaml | 542 +++++++++++ charts/rhacs-setup/values.yaml | 583 ++++++++++++ .../.helmignore | 23 + .../Chart.yaml | 20 + .../setup-container-security-operator/LICENSE | 13 + .../README.md | 131 +++ .../README.md.gotmpl | 64 ++ .../templates/_helpers.tpl | 0 .../values.yaml | 31 + 250 files changed, 20661 insertions(+), 441 deletions(-) create mode 100644 charts/cert-manager/Chart.yaml create mode 100644 charts/cert-manager/LICENSE create mode 100644 charts/cert-manager/README.md create mode 100644 charts/cert-manager/README.md.gotmpl create mode 100644 charts/cert-manager/templates/CertManager.yaml create mode 100644 charts/cert-manager/templates/ClusterIssuer.yaml create mode 100644 charts/cert-manager/templates/_helpers.tpl create mode 100644 charts/cert-manager/templates/issueing-Certificate/Certificate.yaml create mode 100644 charts/cert-manager/values.yaml create mode 100644 charts/compliance-operator-full-stack/.helmignore create mode 100644 charts/compliance-operator-full-stack/Chart.yaml create mode 100644 charts/compliance-operator-full-stack/LICENSE create mode 100644 charts/compliance-operator-full-stack/README.md create mode 100644 charts/compliance-operator-full-stack/README.md.gotmpl create mode 100644 charts/compliance-operator-full-stack/templates/_helpers.tpl create mode 100644 charts/compliance-operator-full-stack/templates/compliance/ScanSettingBinding.yaml create mode 100755 charts/compliance-operator-full-stack/templates/compliance/TailoredProfiles.yaml create mode 100644 charts/compliance-operator-full-stack/values.yaml create mode 100644 charts/cost-management/.helmignore create mode 100644 charts/cost-management/Chart.yaml create mode 100644 charts/cost-management/LICENSE create mode 100644 charts/cost-management/README.md create mode 100644 charts/cost-management/README.md.gotmpl create mode 100644 charts/cost-management/templates/CostManagementMetricsConfig.yaml create mode 100644 charts/cost-management/templates/_helpers.tpl create mode 100644 charts/cost-management/values.yaml create mode 100644 charts/cyclonedx/Chart.yaml create mode 100644 charts/cyclonedx/LICENSE create mode 100644 charts/cyclonedx/README.md create mode 100644 charts/cyclonedx/README.md.gotmpl create mode 100644 charts/cyclonedx/templates/_helpers.tpl create mode 100644 charts/cyclonedx/templates/deployment.yaml create mode 100644 charts/cyclonedx/templates/namespace.yaml create mode 100644 charts/cyclonedx/templates/route.yaml create mode 100644 charts/cyclonedx/templates/service.yaml create mode 100644 charts/cyclonedx/values.yaml create mode 100644 charts/file-integrity-operator/.helmignore create mode 100644 charts/file-integrity-operator/Chart.yaml create mode 100644 charts/file-integrity-operator/LICENSE create mode 100644 charts/file-integrity-operator/README.md create mode 100644 charts/file-integrity-operator/README.md.gotmpl create mode 100644 charts/file-integrity-operator/templates/_helpers.tpl create mode 100644 charts/file-integrity-operator/templates/controlplane-aide-config.yaml create mode 100644 charts/file-integrity-operator/templates/fileintegrity.yaml create mode 100644 charts/file-integrity-operator/values.yaml create mode 100644 charts/generic-cluster-config/Chart.yaml create mode 100644 charts/generic-cluster-config/LICENSE create mode 100644 charts/generic-cluster-config/README.md create mode 100644 charts/generic-cluster-config/README.md.gotmpl create mode 100644 charts/generic-cluster-config/images/ConsoleLink-ApplicationMenu.png create mode 100644 charts/generic-cluster-config/images/ConsoleLink-HelpMenu.png create mode 100644 charts/generic-cluster-config/images/ConsoleLink-NamespaceDashboard.png create mode 100644 charts/generic-cluster-config/images/ConsoleLink-UserMenu.png create mode 100644 charts/generic-cluster-config/images/YAMLSample.png create mode 100644 charts/generic-cluster-config/templates/_helpers.tpl create mode 100644 charts/generic-cluster-config/templates/console/console-banner.yaml create mode 100644 charts/generic-cluster-config/templates/console/console-links.yaml create mode 100644 charts/generic-cluster-config/templates/console/console-yaml-samples.yaml create mode 100755 charts/generic-cluster-config/templates/jobs/check_etcd_encryption-role.yaml create mode 100755 charts/generic-cluster-config/templates/jobs/check_etcd_encryption-rolebinding.yaml create mode 100755 charts/generic-cluster-config/templates/jobs/check_etcd_encryption-serviceaccount.yaml create mode 100755 charts/generic-cluster-config/templates/jobs/check_etcd_encryption.yaml create mode 100755 charts/generic-cluster-config/templates/limit_registries/fix-sample-operator.yaml create mode 100755 charts/generic-cluster-config/templates/limit_registries/image-config.yaml create mode 100644 charts/generic-cluster-config/templates/monitoring/monitoring.yaml create mode 100644 charts/generic-cluster-config/templates/monitoring/user-workload-monitoring.yaml create mode 100644 charts/generic-cluster-config/templates/security/apiserver.yaml create mode 100644 charts/generic-cluster-config/templates/security/disable_self_provisioner.yaml create mode 100644 charts/generic-cluster-config/templates/security/identity-providers.yaml create mode 100644 charts/generic-cluster-config/values.yaml create mode 100644 charts/helm-policy-generator/Chart.yaml create mode 100644 charts/helm-policy-generator/LICENSE create mode 100644 charts/helm-policy-generator/README.md create mode 100644 charts/helm-policy-generator/README.md.gotmpl create mode 100644 charts/helm-policy-generator/console-banner/console-banner.yaml create mode 100644 charts/helm-policy-generator/console-links/applicationlink.yaml create mode 100644 charts/helm-policy-generator/console-links/applicationlink2.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/cluster-operators-healthcheck/cluster-operators-check.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/openshift-data-foundation-healthcheck/odf-healthcheck.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/pods-health-check/pods-crashing.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/pods-health-check/pods-errimagepull.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/pods-health-check/pods-failing.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/pods-health-check/pods-imagepullbackoff.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/pods-health-check/pods-pending.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/terminating-namespaces/terminating-namespaces.yaml create mode 100644 charts/helm-policy-generator/examples/cluster-health-checks/values-cluster-health-checks.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-banner/consol-banner.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-links/allnamespacesLink.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-links/applicationLink.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-links/helpLink.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-links/namespacedLink.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-links/userLink.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/console-plugins/console-plugins.yaml create mode 100644 charts/helm-policy-generator/examples/console-customizations/values-console-customizations.yaml create mode 100644 charts/helm-policy-generator/templates/_helpers.tpl create mode 100644 charts/helm-policy-generator/templates/namespace.yaml create mode 100644 charts/helm-policy-generator/templates/placement.yaml create mode 100644 charts/helm-policy-generator/templates/placementBinding.yaml create mode 100644 charts/helm-policy-generator/templates/policy.yaml create mode 100644 charts/helm-policy-generator/templates/policySet.yaml create mode 100644 charts/helm-policy-generator/values.yaml create mode 100644 charts/helper-argocd/Chart.yaml create mode 100644 charts/helper-argocd/LICENSE create mode 100644 charts/helper-argocd/README.md create mode 100644 charts/helper-argocd/README.md.gotmpl create mode 100644 charts/helper-argocd/templates/ApplicationSets/applicationsset.yaml create mode 100644 charts/helper-argocd/templates/Applications/applications.yaml create mode 100644 charts/helper-argocd/templates/_helpers.tpl create mode 100644 charts/helper-argocd/templates/argocd-project.yaml create mode 100644 charts/helper-argocd/values.yaml create mode 100644 charts/helper-loki-bucket-secret/Chart.yaml create mode 100644 charts/helper-loki-bucket-secret/LICENSE create mode 100644 charts/helper-loki-bucket-secret/README.md create mode 100644 charts/helper-loki-bucket-secret/README.md.gotmpl create mode 100644 charts/helper-loki-bucket-secret/templates/_helpers.tpl create mode 100644 charts/helper-loki-bucket-secret/templates/create-loki-bucket-secret-crb.yaml create mode 100644 charts/helper-loki-bucket-secret/templates/create-loki-bucket-secret-sa.yaml create mode 100644 charts/helper-loki-bucket-secret/templates/create-loki-bucket-secret.yaml create mode 100644 charts/helper-loki-bucket-secret/values.yaml create mode 100644 charts/helper-lokistack/Chart.yaml create mode 100644 charts/helper-lokistack/README.md create mode 100644 charts/helper-lokistack/README.md.gotmpl create mode 100644 charts/helper-lokistack/templates/LokiStack.yaml create mode 100644 charts/helper-lokistack/templates/_helpers.tpl create mode 100644 charts/helper-lokistack/values.yaml create mode 100644 charts/helper-lokistack/values_example.yaml create mode 100644 charts/helper-objectstore/Chart.yaml create mode 100644 charts/helper-objectstore/README.md create mode 100644 charts/helper-objectstore/README.md.gotmpl create mode 100644 charts/helper-objectstore/templates/BackingStore.yaml create mode 100644 charts/helper-objectstore/templates/BucketClaim.yaml create mode 100644 charts/helper-objectstore/templates/BucketClass.yaml create mode 100644 charts/helper-objectstore/templates/StorageClass.yaml create mode 100644 charts/helper-objectstore/templates/_helpers.tpl create mode 100644 charts/helper-objectstore/values.yaml create mode 100644 charts/helper-proj-onboarding/.helmignore create mode 100644 charts/helper-proj-onboarding/Chart.yaml create mode 100644 charts/helper-proj-onboarding/LICENSE create mode 100644 charts/helper-proj-onboarding/README.md create mode 100644 charts/helper-proj-onboarding/README.md.gotmpl create mode 100644 charts/helper-proj-onboarding/templates/_helpers.tpl create mode 100644 charts/helper-proj-onboarding/templates/argocd-project.yaml create mode 100644 charts/helper-proj-onboarding/templates/default_network_policies.yaml create mode 100644 charts/helper-proj-onboarding/templates/egressIP.yaml create mode 100644 charts/helper-proj-onboarding/templates/limitranges.yaml create mode 100644 charts/helper-proj-onboarding/templates/local-admin-group-rb.yaml create mode 100644 charts/helper-proj-onboarding/templates/local-admin-group.yaml create mode 100644 charts/helper-proj-onboarding/templates/namespace.yaml create mode 100644 charts/helper-proj-onboarding/templates/networkpolicy.yaml create mode 100644 charts/helper-proj-onboarding/templates/resourcequota.yaml create mode 100644 charts/helper-proj-onboarding/templates/tshirt-sizes/limitranges.yaml create mode 100644 charts/helper-proj-onboarding/templates/tshirt-sizes/resourcequota.yaml create mode 100644 charts/helper-proj-onboarding/values-global.yaml create mode 100644 charts/helper-proj-onboarding/values.yaml create mode 100755 charts/minio-configurator/Chart.yaml create mode 100755 charts/minio-configurator/LICENSE create mode 100755 charts/minio-configurator/README.md create mode 100755 charts/minio-configurator/README.md.gotmpl create mode 100755 charts/minio-configurator/templates/_helpers.tpl create mode 100755 charts/minio-configurator/templates/provisioning-configmap.yaml create mode 100755 charts/minio-configurator/templates/provisioning-job.yaml create mode 100755 charts/minio-configurator/templates/provisioning-serviceaccount.yaml create mode 100755 charts/minio-configurator/values-examples.yaml create mode 100644 charts/minio-configurator/values.yaml create mode 100644 charts/openshift-data-foundation/.helmignore create mode 100644 charts/openshift-data-foundation/Chart.yaml create mode 100644 charts/openshift-data-foundation/LICENSE create mode 100644 charts/openshift-data-foundation/README.md create mode 100644 charts/openshift-data-foundation/README.md.gotmpl create mode 100644 charts/openshift-data-foundation/templates/MultiCloudGateway.yaml create mode 100644 charts/openshift-data-foundation/templates/StorageCluster.yaml create mode 100644 charts/openshift-data-foundation/templates/_helpers.tpl create mode 100644 charts/openshift-data-foundation/values.yaml create mode 100644 charts/openshift-gitops/.helmignore create mode 100644 charts/openshift-gitops/Chart.yaml create mode 100644 charts/openshift-gitops/LICENSE create mode 100644 charts/openshift-gitops/PATCH_openshift-gitops-crb.yaml create mode 100644 charts/openshift-gitops/PATCH_openshift-gitops.yaml create mode 100644 charts/openshift-gitops/README.md create mode 100644 charts/openshift-gitops/README.md.gotmpl create mode 100644 charts/openshift-gitops/templates/_helpers.tpl create mode 100644 charts/openshift-gitops/templates/argocd_instance/argocd.yaml create mode 100644 charts/openshift-gitops/templates/argocd_instance/namespace.yaml create mode 100644 charts/openshift-gitops/templates/clusteradmin-RoleBinding.yaml create mode 100644 charts/openshift-gitops/values.yaml create mode 100644 charts/openshift-logging/.helmignore create mode 100644 charts/openshift-logging/Chart.yaml create mode 100644 charts/openshift-logging/LICENSE create mode 100644 charts/openshift-logging/README.md create mode 100644 charts/openshift-logging/README.md.gotmpl create mode 100644 charts/openshift-logging/templates/ClusterLogging.yaml create mode 100644 charts/openshift-logging/templates/_helpers.tpl create mode 100644 charts/openshift-logging/values-examples.yaml create mode 100644 charts/openshift-logging/values.yaml create mode 100644 charts/rhacm-setup/.helmignore create mode 100644 charts/rhacm-setup/Chart.yaml create mode 100644 charts/rhacm-setup/LICENSE create mode 100644 charts/rhacm-setup/README.md create mode 100644 charts/rhacm-setup/README.md.gotmpl create mode 100644 charts/rhacm-setup/templates/_helpers.tpl create mode 100644 charts/rhacm-setup/templates/rhacm/multiclusterhub.yaml create mode 100644 charts/rhacm-setup/values.yaml create mode 100644 charts/rhacs-setup/.helmignore create mode 100644 charts/rhacs-setup/Chart.yaml create mode 100644 charts/rhacs-setup/LICENSE create mode 100644 charts/rhacs-setup/README.md create mode 100644 charts/rhacs-setup/README.md.gotmpl create mode 100644 charts/rhacs-setup/docs/img/RHACS-Deployment-Waves.png create mode 100644 charts/rhacs-setup/templates/_helpers.tpl create mode 100644 charts/rhacs-setup/templates/jobs/configure-acs-oauth.yaml create mode 100644 charts/rhacs-setup/templates/jobs/create-cluster-init-bundle-job.yaml create mode 100644 charts/rhacs-setup/templates/jobs/create-consolelink.yaml create mode 100644 charts/rhacs-setup/templates/namespace.yaml create mode 100644 charts/rhacs-setup/templates/rhacs/central.yaml create mode 100644 charts/rhacs-setup/templates/rhacs/create-cluster-init-bundle-sa.yaml create mode 100644 charts/rhacs-setup/templates/rhacs/declerative-config.yaml create mode 100644 charts/rhacs-setup/templates/rhacs/namespace.yaml create mode 100644 charts/rhacs-setup/templates/rhacs/secured-cluster.yaml create mode 100644 charts/rhacs-setup/tests/__snapshot__/central_test.yaml.snap create mode 100644 charts/rhacs-setup/tests/central_test.yaml create mode 100644 charts/rhacs-setup/tests/values-tests.yaml create mode 100644 charts/rhacs-setup/values-example.yaml create mode 100644 charts/rhacs-setup/values.yaml create mode 100755 charts/setup-container-security-operator/.helmignore create mode 100755 charts/setup-container-security-operator/Chart.yaml create mode 100644 charts/setup-container-security-operator/LICENSE create mode 100755 charts/setup-container-security-operator/README.md create mode 100644 charts/setup-container-security-operator/README.md.gotmpl create mode 100755 charts/setup-container-security-operator/templates/_helpers.tpl create mode 100755 charts/setup-container-security-operator/values.yaml diff --git a/README.md b/README.md index 7d8b1f6a..ea4e6a1e 100644 --- a/README.md +++ b/README.md @@ -75,3 +75,26 @@ For more info on each chart checkout these! * [static-site](/charts/static-site) * [tekton-demo](/charts/tekton-demo) * [operators-installer](/charts/operators-installer) +* [compliance-operator-full-stack](/charts/compliance-operator-full-stack) +* [cost-management](/charts/cost-management) +* [cyclonedx](/charts/cyclonedx) +* [file-integrity-operator](/charts/file-integrity-operator) +* [generic-cluster-config](/charts/generic-cluster-config) +* [helm-policy-generator](/charts/helm-policy-generator) +* [helper-argocd](/charts/helper-argocd) +* [helper-loki-bucket-secret](/charts/helper-loki-bucket-secret) +* [helper-lokistack](/charts/helper-lokistack) +* [helper-objectstore](/charts/helper-objectstore) +* [helper-operator](/charts/helper-operator) +* [helper-proj-onboarding](/charts/helper-proj-onboarding) +* [elper-status-checker](/charts/elper-status-checker) +* [minio-configurator](/charts/minio-configurator) +* [openshift-data-foundation](/charts/openshift-data-foundation) +* [openshift-gitops](/charts/openshift-gitops) +* [openshift-logging](/charts/openshift-logging) +* [rhacm-setup](/charts/rhacm-setup) +* [rhacs-setup](/charts/rhacs-setup) +* [setup-container-security-operator](/charts/setup-container-security-operator) +* [update-clusterversion](/charts/update-clusterversion) +* [tpl](/charts/tpl) + diff --git a/_test/ct-config.yaml b/_test/ct-config.yaml index 9fb56832..8232e306 100644 --- a/_test/ct-config.yaml +++ b/_test/ct-config.yaml @@ -34,3 +34,4 @@ excluded-charts: - stackrox - static-site - tekton-demo +- update-clusterversion diff --git a/charts/cert-manager/Chart.yaml b/charts/cert-manager/Chart.yaml new file mode 100644 index 00000000..48fb601d --- /dev/null +++ b/charts/cert-manager/Chart.yaml @@ -0,0 +1,20 @@ +apiVersion: v2 +name: cert-manager +description: Install and configure the Cert-Manager +version: 1.0.5 +home: https://github.com/redhat-cop/helm-charts/tree/main/charts/cert-manager +maintainers: + - name: tjungbauer + email: tjungbau@redhat.com + url: https://blog.stderr.at/ +dependencies: + - name: tpl + version: ~1.0.0 + repository: https://redhat-cop.github.io/helm-charts +sources: + - https://github.com/tjungbauer/helm-charts + - https://charts.stderr.at/ + - https://github.com/tjungbauer/openshift-clusterconfig-gitops +keywords: + - generic + - clusterconfig \ No newline at end of file diff --git a/charts/cert-manager/LICENSE b/charts/cert-manager/LICENSE new file mode 100644 index 00000000..1652d17e --- /dev/null +++ b/charts/cert-manager/LICENSE @@ -0,0 +1,13 @@ +Copyright 2022 Thomas Jungbauer + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/cert-manager/README.md b/charts/cert-manager/README.md new file mode 100644 index 00000000..849daedb --- /dev/null +++ b/charts/cert-manager/README.md @@ -0,0 +1,192 @@ + + +# cert-manager + + [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + + ![Version: 1.0.5](https://img.shields.io/badge/Version-1.0.5-informational?style=flat-square) + + + + ## Description + + Install and configure the Cert-Manager + +This Helm Chart installs and configures the Cert-Manager Operator. It can patch the ClusterManager resource in order to override arguments (for example the list of recursive nameservers) + and to configure ClusterIssuer or Issuers. Moreover, it is possible to order a certificate by creating a Certificate resource. + +Currently, the built-in in-tree issuers are supported: https://cert-manager.io/docs/configuration/selfsigned/ + +. selfSigned +. ACME +. CA +. Venafi +. Vault + +## Dependencies + +This chart has the following dependencies: + +| Repository | Name | Version | +|------------|------|---------| +| https://redhat-cop.github.io/helm-charts | tpl | ~1.0.0 | + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops (see folder cluster/management-cluster/cert-manager) + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| tjungbauer | | | + +## Sources +Source: +* +* +* + +Source code: https://github.com/redhat-cop/helm-charts/tree/main/charts/cert-manager + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| certManager.enable_patch | bool | false | Enable pathing of the certManager resource, for the ACME provider. This is required, when the recusrive nameserver shall be changed. For example, when private and public define-domains in AWS Route 53 are used, then the DNS server must be set. Verify the documentation at: https://docs.openshift.com/container-platform/4.15/security/cert_manager_operator/cert-manager-operator-issuer-acme.html The resource itself it created automatically and is therefor patched. | +| certManager.overrideArgs | list | `["--dns01-recursive-nameservers-only","--dns01-recursive-nameservers=ns-362.awsdns-45.com:53,ns-930.awsdns-52.net:53"]` | List of arguments that should be overwritten. | +| certificates.certificate[0] | object | `{"dnsNames":["example.com","www.example.com"],"duration":"2160h0m0s","emailAddresses":["john.doe@cert-manager.io"],"enabled":false,"ipAddresses":["192.168.0.5"],"isCA":false,"issuerRef":{"group":"cert-manager.io","kind":"Issuer","name":"ca-issuer"},"name":"example-cert","namespace":"example","privateKey":{"algorithm":"RSA","encoding":"PKCS1","rotationPolicy":"Always","size":2048},"renewBefore":"360h0m0s","secretName":"example-cert-tls","secretTemplate":{"annotations":{"my-secret-annotation-1":"foo","my-secret-annotation-2":"bar"},"labels":{"my-secret-label":"foo"}},"subject":{"countries":["Country"],"localities":["Cities"],"organizationalUnits":["OrganizationalUnit"],"organizations":["Organization"],"postalCodes":["PostalCode"],"provinces":["State"],"serialNumber":"SerialNumber","streetAddresses":["StreetAddress"]},"syncwave":"0","uris":["spiffe://cluster.local/ns/sandbox/sa/example"],"usages":["server auth","client auth"]}` | Name of the certificate resource. This is not the dnsName of commonName. | +| certificates.certificate[0].dnsNames | list | `["example.com","www.example.com"]` | Requested DNS subject alternative names. | +| certificates.certificate[0].duration | string | 2160h0m0s (90d) | The duration of the certificated (X.509 certificate's duration) Some issuers might be configured to only issue certificates with a set durationt
Minimum value for spec.duration is 1 hour
It is required that spec.duration > spec.renewBefore Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration | +| certificates.certificate[0].emailAddresses | list | `["john.doe@cert-manager.io"]` | Requested email subject alternative names. | +| certificates.certificate[0].enabled | bool | false | Enable ordering of this certificate | +| certificates.certificate[0].ipAddresses | list | `["192.168.0.5"]` | Requested IP address subject alternative names. | +| certificates.certificate[0].isCA | bool | `false` | Requested basic constraints isCA value. If true, this will automatically add the `cert sign` usage to the list of requested `usages`. | +| certificates.certificate[0].issuerRef.group | string | UNSET (cert-manager.io) | Optional parameter that is only required when external issuers are used. | +| certificates.certificate[0].issuerRef.kind | string | Issuer | The reference can either be ClusterIssuers or Issuer | +| certificates.certificate[0].issuerRef.name | string | `"ca-issuer"` | Name of the Issuer that shall be used. | +| certificates.certificate[0].namespace | string | `"example"` | Namespace for this certificate | +| certificates.certificate[0].privateKey.algorithm | string | RSA | Algorithm of the private key. Possible values (with default sizes if size is not provided):
RSA (2048), ECDSA (256) or Ed25519 (ignored)

| +| certificates.certificate[0].privateKey.encoding | string | PKSC1 | The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. Allowed values are PKCS1 an dPKCS8. | +| certificates.certificate[0].privateKey.rotationPolicy | string | Always | RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. Possible values are 'Never' (the private key will only be generated if it does not already exist) or 'Always' (the private key will aleays be generated whenever a re-issuance occurs. | +| certificates.certificate[0].privateKey.size | int | `2048` | Size is the key bit size of the corresponding private key for this certificate.
If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified.
If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified.
If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed. | +| certificates.certificate[0].renewBefore | string | 1/3 of duration if not set | How long before the currently issued certificate's expiry cert-manager should renew the certificate. For example, if a certificate is valid for 60 minutes, and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate 50 minutes after it was issued If unset, this defaults to 1/3 of the issued certificate's lifetime.
Minimum accepted value is 5 minutes.
Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration | +| certificates.certificate[0].secretName | string | `"example-cert-tls"` | Name of the Secret resource that will be created and managed by the Certificate. It will be populated with a private key and certificate, signed by the denoted issuer. | +| certificates.certificate[0].secretTemplate | object | N/A | secretTemplate is optional. If set, these annotations and labels will be copied to the Secret created by this Certificate. | +| certificates.certificate[0].subject | object | N/A | Requested set of X509 certificate subject attributes. More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 Might be replaced in the future by literalSubject | +| certificates.certificate[0].subject.countries | list | N/A | Countries to be used on the Certificate. | +| certificates.certificate[0].subject.localities | list | N/A | Cities to be used on the Certificate. | +| certificates.certificate[0].subject.organizationalUnits | list | N/A | Organizational Units to be used on the Certificate. | +| certificates.certificate[0].subject.organizations | list | N/A | Organizations to be used on the Certificate. | +| certificates.certificate[0].subject.postalCodes | list | N/A | Postal Codes to be used on the Certificate. | +| certificates.certificate[0].subject.provinces | list | N/A | States/Provinces to be used on the Certificate. | +| certificates.certificate[0].subject.serialNumber | string | N/A | Serial number to be used on the Certificate. | +| certificates.certificate[0].subject.streetAddresses | list | N/A | Street addresses to be used on the Certificate. | +| certificates.certificate[0].syncwave | string | 1 | Syncwave when the certificate shall be ordered. | +| certificates.certificate[0].uris | list | `["spiffe://cluster.local/ns/sandbox/sa/example"]` | Requested URI subject alternative names. | +| certificates.certificate[0].usages | list | `["server auth","client auth"]` | Set usages for the certificate full list https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage default if not set, cert manager will set: digital signature, key encipherment, and server auth | +| certificates.enabled | bool | false | Enable ordering of certificates | +| issuer[0].acme | object | `{"email":"your@email.com","solvers":[{"dns01":{"route53":{"accessKeyIDSecretRef":{"key":"access-key-id","name":"prod-route53-credentials-secret"},"region":"your-region","secretAccessKeySecretRef":{"key":"secret-access-key","name":"prod-route53-credentials-secret"}}},"selector":{"dnsZones":["define-domains"]}}]}` | Create ACME issuer. ACME CA servers rely on a challenge to verify that a client owns the domain names that the certificate is being requested for. | +| issuer[0].acme.email | string | `"your@email.com"` | Email address, Let's Encrypt will use this to contact you about expiring certificates, and issues related to your account. | +| issuer[0].acme.solvers | list | `[{"dns01":{"route53":{"accessKeyIDSecretRef":{"key":"access-key-id","name":"prod-route53-credentials-secret"},"region":"your-region","secretAccessKeySecretRef":{"key":"secret-access-key","name":"prod-route53-credentials-secret"}}},"selector":{"dnsZones":["define-domains"]}}]` | add a challenge solver. This coulr be DNS01 or HTTP01 The yaml specification will be used as is Verify the official documentation for detailed information: https://cert-manager.io/docs/configuration/acme/ | +| issuer[0].enabled | bool | false | Enable this issuer. | +| issuer[0].name | string | `"acme"` | | +| issuer[0].syncwave | int | `20` | Syncewave to create this issuer | +| issuer[0].type | string | `"ClusterIssuer"` | Type can be either ClusterIssuer or Issuer | +| issuer[1].enabled | bool | false | Enable this issuer. | +| issuer[1].name | string | `"selfsigned"` | | +| issuer[1].selfSigned | bool | `true` | Create a selfSigned issuer. The SelfSigned issuer doesn't represent a certificate authority as such, but instead denotes that certificates will "sign themselves" using a given private key. Detailed information can be found at: https://cert-manager.io/docs/configuration/selfsigned/ | +| issuer[1].type | string | `"ClusterIssuer"` | Type can be either ClusterIssuer or Issuer | +| issuer[2].ca | object | `{"secretName":"ca-key-pair"}` | Create CA issuer, CA issuers are generally either for trying cert-manager out or else for advanced users with a good idea of how to run a PKI. Detailed information can be found at: https://cert-manager.io/docs/configuration/ca/ | +| issuer[2].enabled | bool | false | Enable this issuer. | +| issuer[2].name | string | `"ca"` | | +| issuer[2].type | string | `"ClusterIssuer"` | Type can be either ClusterIssuer or Issuer | +| issuer[3].enabled | bool | false | Enable this issuer. | +| issuer[3].name | string | `"vault"` | | +| issuer[3].type | string | `"ClusterIssuer"` | Type can be either ClusterIssuer or Issuer | +| issuer[3].vault | object | `{"auth":{"tokenSecretRef":{"key":"token","name":"cert-manager-vault-token"}},"caBundle":"","path":"pki_int/sign/example-dot-com","server":"https://vault.local"}` | Enable Vault issuer. The Vault Issuer represents the certificate authority Vault. Detailed information can be found at: https://cert-manager.io/docs/configuration/vault/ | +| issuer[4].enabled | bool | false | Enable this issuer. | +| issuer[4].name | string | `"venafi"` | | +| issuer[4].type | string | `"ClusterIssuer"` | Type can be either ClusterIssuer or Issuer | +| issuer[4].venafi | object | `{"cloud":{"apiTokenSecretRef":{"key":"apikey","name":"vaas-secret"}},"zone":"My Application\\My CIT"}` | The Venafi Issuer types allows you to obtain certificates from Venafi as a Service (VaaS) and Venafi Trust Protection Platform (TPP) instances. Detailed information can be found at: https://cert-manager.io/docs/configuration/venafi/ | + +## Example values - for the cert manager + +```yaml +--- +clusterManager: + enable_patch: true + + overrideArgs: + - '--dns01-recursive-nameservers-only' + - --dns01-recursive-nameservers=ns-362.awsdns-45.com:53,ns-930.awsdns-52.net:53 + +issuer: + - name: letsencrypt-prod + type: ClusterIssuer + enabled: true + syncwave: 20 + + acme: + email: <-your-email-address> + + solvers: + - dns01: + route53: + accessKeyIDSecretRef: + key: access-key-id + name: prod-route53-credentials-secret + region: us-west-1 + secretAccessKeySecretRef: + key: secret-access-key + name: prod-route53-credentials-secret + selector: + dnsZones: + - +``` + +## Example values - to order a certificate + +```yaml +--- +certificates: + enabled: true + + # List of certificates + certificate: + - name: router-certificate + enabled: true + namespace: openshift-ingress + syncwave: "0" + secretName: router-certificate + + dnsNames: + - apps.ocp.aws.ispworld.at + - '*.apps.ocp.aws.ispworld.at' + + # Reference to the issuer that shall be used. + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer +``` + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release repo/> +``` + +The command deploys the chart on the Kubernetes cluster in the default configuration. + +## Uninstalling the Chart + +To uninstall/delete the my-release deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0) diff --git a/charts/cert-manager/README.md.gotmpl b/charts/cert-manager/README.md.gotmpl new file mode 100644 index 00000000..0b54e222 --- /dev/null +++ b/charts/cert-manager/README.md.gotmpl @@ -0,0 +1,84 @@ +{{ template "doc.header" . }} + +This Helm Chart installs and configures the Cert-Manager Operator. It can patch the ClusterManager resource in order to override arguments (for example the list of recursive nameservers) + and to configure ClusterIssuer or Issuers. Moreover, it is possible to order a certificate by creating a Certificate resource. + +Currently, the built-in in-tree issuers are supported: https://cert-manager.io/docs/configuration/selfsigned/ + +. selfSigned +. ACME +. CA +. Venafi +. Vault + + +{{ template "doc.deps" . }} + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops (see folder cluster/management-cluster/cert-manager) + + +{{ template "doc.maintainer_and_sources" . }} + +{{ template "doc.values" . }} + +## Example values - for the cert manager + +```yaml +--- +clusterManager: + enable_patch: true + + overrideArgs: + - '--dns01-recursive-nameservers-only' + - --dns01-recursive-nameservers=ns-362.awsdns-45.com:53,ns-930.awsdns-52.net:53 + +issuer: + - name: letsencrypt-prod + type: ClusterIssuer + enabled: true + syncwave: 20 + + acme: + email: <-your-email-address> + + solvers: + - dns01: + route53: + accessKeyIDSecretRef: + key: access-key-id + name: prod-route53-credentials-secret + region: us-west-1 + secretAccessKeySecretRef: + key: secret-access-key + name: prod-route53-credentials-secret + selector: + dnsZones: + - +``` + +## Example values - to order a certificate + +```yaml +--- +certificates: + enabled: true + + # List of certificates + certificate: + - name: router-certificate + enabled: true + namespace: openshift-ingress + syncwave: "0" + secretName: router-certificate + + dnsNames: + - apps.ocp.aws.ispworld.at + - '*.apps.ocp.aws.ispworld.at' + + # Reference to the issuer that shall be used. + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer +``` + +{{ template "doc.footer" . }} diff --git a/charts/cert-manager/templates/CertManager.yaml b/charts/cert-manager/templates/CertManager.yaml new file mode 100644 index 00000000..9c4c4c45 --- /dev/null +++ b/charts/cert-manager/templates/CertManager.yaml @@ -0,0 +1,24 @@ +{{- with .Values.certManager }} +{{ if eq (.enable_patch | toString) "true" }} +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: CertManager +metadata: + name: cluster + labels: + {{- include "tpl.labels" $ | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: {{ .syncwave | default 10 | quote }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + logLevel: Normal + managementState: Managed + observedConfig: null + operatorLogLevel: Normal + controllerConfig: + overrideArgs: + {{- range .overrideArgs }} + - {{ . }} + {{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/cert-manager/templates/ClusterIssuer.yaml b/charts/cert-manager/templates/ClusterIssuer.yaml new file mode 100644 index 00000000..19acaafb --- /dev/null +++ b/charts/cert-manager/templates/ClusterIssuer.yaml @@ -0,0 +1,41 @@ +{{- range .Values.issuer }} +{{ if eq (.enabled | toString) "true" }} +--- +apiVersion: cert-manager.io/v1 +kind: {{ .type | default "ClusterIssuer"}} +metadata: + name: {{ .name }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: {{ .syncwave | default 20 | quote }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true +spec: + {{- if .selfSigned }} + selfSigned: {} + {{- end }} + {{- if .ca }} + ca: + secretName: {{ .ca.secretName }} + {{- end }} + {{- if .vault }} + vault: + {{- toYaml .vault | nindent 4 }} + {{- end }} + {{- if .venafi }} + venafi: + {{- toYaml .venafi | nindent 4 }} + {{- end }} + {{- if .acme }} + {{- with .acme }} + acme: + email: {{ .email }} + privateKeySecretRef: + name: {{ .privKeyRef | default "letsencrypt-account-key" }} + server: {{ .server | default "https://acme-v02.api.letsencrypt.org/directory" }} + solvers: + {{- toYaml .solvers | nindent 6 }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/cert-manager/templates/_helpers.tpl b/charts/cert-manager/templates/_helpers.tpl new file mode 100644 index 00000000..e69de29b diff --git a/charts/cert-manager/templates/issueing-Certificate/Certificate.yaml b/charts/cert-manager/templates/issueing-Certificate/Certificate.yaml new file mode 100644 index 00000000..acc6ee26 --- /dev/null +++ b/charts/cert-manager/templates/issueing-Certificate/Certificate.yaml @@ -0,0 +1,112 @@ +{{- with .Values.certificates }} +{{ if eq (.enabled | toString) "true" }} +{{- range .certificate }} +{{ if eq (.enabled | toString) "true" }} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ .name }} + namespace: {{ .namespace }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} + annotations: + argocd.argoproj.io/sync-wave: {{ .syncwave | default 1 | quote }} +spec: + secretName: {{ .secretName }} + + {{- if .secretTemplate }} + secretTemplate: + {{- if .secretTemplate.annotations }} + annotations: + {{- range $key, $value := .secretTemplate.annotations }} + {{ $key }}: {{ $value }} + {{- end }} + {{- end }} + {{- if .secretTemplate.labels }} + labels: + {{- range $key, $value := .secretTemplate.labels }} + {{ $key }}: {{ $value }} + {{- end }} + {{- end }} + {{- end }} + + {{- $privKey := .privateKey | default dict }} + privateKey: + algorithm: {{ $privKey.algorithm | default "RSA" }} + encoding: {{ $privKey.encoding | default "PKCS1" }} + + {{- if eq ($privKey.algorithm | toString) "RSA" }} + {{- if not $privKey.size }} + size: 2048 + {{- else }} + size: {{ $privKey.size }} + {{- end }} + {{- end }} + + {{- if eq ($privKey.algorithm | toString) "ECDSA" }} + {{- if not $privKey.size }} + size: 256 + {{- else }} + size: {{ $privKey.size }} + {{- end }} + {{- end }} + rotationPolicy: {{ $privKey.rotationPolicy | default "Always" }} + duration: {{ .duration | default "2160h0m0s" }} + {{- if .renewBefore }} + renewBefore: {{ .renewBefore }} + {{- end }} + + {{- if eq (.isCA | toString) "true" }} + isCA: true + {{- end }} + + {{- if .usages }} + usages: + {{- range .usages }} + - {{ . }} + {{- end }} + {{- end }} + + {{- if .subject }} + subject: +{{ toYaml .subject | indent 4}} + {{- end }} + + {{- if .dnsNames }} + dnsNames: + {{- range .dnsNames }} + - {{ . | quote }} + {{- end }} + {{- end }} + + {{- if .uris }} + uris: + {{- range .uris }} + - {{ . }} + {{- end }} + {{- end }} + + {{- if .emailAddresses }} + emailAddresses: + {{- range .emailAddresses }} + - {{ . }} + {{- end }} + {{- end }} + + {{- if .ipAddresses }} + ipAddresses: + {{- range .ipAddresses }} + - {{ . }} + {{- end }} + {{- end }} + issuerRef: + name: {{ .issuerRef.name }} + kind: {{ .issuerRef.kind | default "Issuer" }} + {{- if .issuerRef.group }} + group: {{ .issuerRef.group }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml new file mode 100644 index 00000000..4cb21851 --- /dev/null +++ b/charts/cert-manager/values.yaml @@ -0,0 +1,269 @@ +--- +certManager: + # -- Enable pathing of the certManager resource, for the ACME provider. This is required, when the recusrive nameserver shall be changed. For example, when private and public define-domains in AWS Route 53 are + # used, then the DNS server must be set. + # Verify the documentation at: https://docs.openshift.com/container-platform/4.15/security/cert_manager_operator/cert-manager-operator-issuer-acme.html + # The resource itself it created automatically and is therefor patched. + # @default -- false + enable_patch: false + + # -- List of arguments that should be overwritten. + overrideArgs: + - '--dns01-recursive-nameservers-only' + - --dns01-recursive-nameservers=ns-362.awsdns-45.com:53,ns-930.awsdns-52.net:53 + +# List of issuers that shall be created +issuer: + # Name of first issuer + # Multiple can be defined + - name: acme + # -- Type can be either ClusterIssuer or Issuer + type: ClusterIssuer + # -- Enable this issuer. + # @default -- false + enabled: false + # -- Syncewave to create this issuer + syncwave: 20 + + # -- Create ACME issuer. ACME CA servers rely on a challenge to verify that a client owns the domain names that the certificate is being requested for. + acme: + # -- Email address, Let's Encrypt will use this to contact you about expiring + # certificates, and issues related to your account. + email: your@email.com + + # -- add a challenge solver. This coulr be DNS01 or HTTP01 + # The yaml specification will be used as is + # Verify the official documentation for detailed information: https://cert-manager.io/docs/configuration/acme/ + solvers: + - dns01: + route53: + accessKeyIDSecretRef: + key: access-key-id + name: prod-route53-credentials-secret + region: your-region + secretAccessKeySecretRef: + key: secret-access-key + name: prod-route53-credentials-secret + selector: + dnsZones: + - define-domains + + # Name of issuer + - name: selfsigned + # -- Type can be either ClusterIssuer or Issuer + type: ClusterIssuer + # -- Enable this issuer. + # @default -- false + enabled: false + + # -- Create a selfSigned issuer. The SelfSigned issuer doesn't represent a certificate authority as such, but instead denotes that certificates will "sign themselves" using a given private key. + # Detailed information can be found at: https://cert-manager.io/docs/configuration/selfsigned/ + selfSigned: true + + # Name of issuer + - name: ca + # -- Type can be either ClusterIssuer or Issuer + type: ClusterIssuer + # -- Enable this issuer. + # @default -- false + enabled: false + + # -- Create CA issuer, CA issuers are generally either for trying cert-manager out or else for advanced users with a good idea of how to run a PKI. + # Detailed information can be found at: https://cert-manager.io/docs/configuration/ca/ + ca: + secretName: ca-key-pair + + # Name of issuer + - name: vault + # -- Type can be either ClusterIssuer or Issuer + type: ClusterIssuer + # -- Enable this issuer. + # @default -- false + enabled: false + + # -- Enable Vault issuer. The Vault Issuer represents the certificate authority Vault. + # Detailed information can be found at: https://cert-manager.io/docs/configuration/vault/ + vault: + path: pki_int/sign/example-dot-com + server: https://vault.local + caBundle: + auth: + tokenSecretRef: + name: cert-manager-vault-token + key: token + + # Name of issuer + - name: venafi + # -- Type can be either ClusterIssuer or Issuer + type: ClusterIssuer + # -- Enable this issuer. + # @default -- false + enabled: false + + # -- The Venafi Issuer types allows you to obtain certificates from Venafi as a Service (VaaS) and Venafi Trust Protection Platform (TPP) instances. + # Detailed information can be found at: https://cert-manager.io/docs/configuration/venafi/ + venafi: + zone: "My Application\\My CIT" + cloud: + apiTokenSecretRef: + name: vaas-secret + key: apikey + +# Define a list of Certificates that shall be issues +certificates: + # -- Enable ordering of certificates + # @default -- false + enabled: false + + # List of certificates + certificate: + # -- Name of the certificate resource. This is not the dnsName of commonName. + - name: example-cert + + # -- Enable ordering of this certificate + # @default -- false + enabled: false + + # -- Namespace for this certificate + namespace: example + + # -- Syncwave when the certificate shall be ordered. + # @default -- 1 + syncwave: "0" + + # -- Name of the Secret resource that will be created and managed by the Certificate. + # It will be populated with a private key and certificate, signed by the denoted issuer. + secretName: example-cert-tls + + + # -- The duration of the certificated (X.509 certificate's duration) + # Some issuers might be configured to only issue certificates with a set durationt
+ # Minimum value for spec.duration is 1 hour
+ # It is required that spec.duration > spec.renewBefore + # Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + # @default -- 2160h0m0s (90d) + duration: 2160h0m0s # 90d + + # -- How long before the currently issued certificate's expiry cert-manager should renew the + # certificate. For example, if a certificate is valid for 60 minutes, and `renewBefore=10m`, + # cert-manager will begin to attempt to renew the certificate 50 minutes after it was issued + # If unset, this defaults to 1/3 of the issued certificate's lifetime.
+ # Minimum accepted value is 5 minutes.
+ # Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration + # @default -- 1/3 of duration if not set + renewBefore: 360h0m0s # 15d + + # -- secretTemplate is optional. If set, these annotations and labels will be + # copied to the Secret created by this Certificate. + # @default -- N/A + secretTemplate: + annotations: + my-secret-annotation-1: "foo" + my-secret-annotation-2: "bar" + labels: + my-secret-label: foo + + # At least one of commonName (possibly through literalSubject), dnsNames, uris, emailAddresses, + # ipAddresses or otherNames is required. + + # -- Requested set of X509 certificate subject attributes. + # More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + # Might be replaced in the future by literalSubject + # @default -- N/A + subject: + # -- Countries to be used on the Certificate. + # @default -- N/A + countries: + - Country + # -- Cities to be used on the Certificate. + # @default -- N/A + localities: + - Cities + # -- Organizational Units to be used on the Certificate. + # @default -- N/A + organizationalUnits: + - OrganizationalUnit + # -- Organizations to be used on the Certificate. + # @default -- N/A + organizations: + - Organization + # -- Postal Codes to be used on the Certificate. + # @default -- N/A + postalCodes: + - 'PostalCode' + # -- States/Provinces to be used on the Certificate. + # @default -- N/A + provinces: + - 'State' + # -- Street addresses to be used on the Certificate. + # @default -- N/A + streetAddresses: + - StreetAddress + # -- Serial number to be used on the Certificate. + # @default -- N/A + serialNumber: 'SerialNumber' + + # -- Requested DNS subject alternative names. + dnsNames: + - example.com + - www.example.com + + # -- Requested URI subject alternative names. + uris: + - spiffe://cluster.local/ns/sandbox/sa/example + + # -- Requested email subject alternative names. + emailAddresses: + - john.doe@cert-manager.io + + # -- Requested IP address subject alternative names. + ipAddresses: + - 192.168.0.5 + + privateKey: + + # -- Algorithm of the private key. Possible values (with default sizes if size is not provided): + #
RSA (2048), ECDSA (256) or Ed25519 (ignored)

+ # @default -- RSA + algorithm: RSA + + # -- Size is the key bit size of the corresponding private key for this certificate.
+ # If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified.
+ # If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified.
+ # If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed. + size: 2048 + + # -- The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. + # Allowed values are PKCS1 an dPKCS8. + # @default -- PKSC1 + encoding: PKCS1 + + # -- RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. + # Possible values are 'Never' (the private key will only be generated if it does not already exist) or + # 'Always' (the private key will aleays be generated whenever a re-issuance occurs. + # @default -- Always + rotationPolicy: Always + + # -- Requested basic constraints isCA value. + # If true, this will automatically add the `cert sign` usage to the list of requested `usages`. + isCA: false + + # -- Set usages for the certificate + # full list https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage + # default if not set, cert manager will set: digital signature, key encipherment, and server auth + usages: + - server auth + - client auth + + # Reference to the issuer that shall be used. + issuerRef: + # -- Name of the Issuer that shall be used. + name: ca-issuer + + # -- The reference can either be ClusterIssuers or Issuer + # @default -- Issuer + kind: Issuer + + # -- Optional parameter that is only required when external issuers are used. + # @default -- UNSET (cert-manager.io) + group: cert-manager.io \ No newline at end of file diff --git a/charts/compliance-operator-full-stack/.helmignore b/charts/compliance-operator-full-stack/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/compliance-operator-full-stack/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/compliance-operator-full-stack/Chart.yaml b/charts/compliance-operator-full-stack/Chart.yaml new file mode 100644 index 00000000..07f3945d --- /dev/null +++ b/charts/compliance-operator-full-stack/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: compliance-operator-full-stack +description: Master chart to deploy and configure the Compliance Operator +version: 1.0.30 +home: https://redhat-cop.github.io/helm-charts/tree/main/charts/compliance-operator-full-stack +dependencies: + - name: helper-operator + version: ~1.0.21 + repository: https://redhat-cop.github.io/helm-charts + - name: helper-status-checker + version: ~4.0.0 + repository: https://redhat-cop.github.io/helm-charts + condition: helper-status-checker.enabled + - name: tpl + version: ~1.0.0 + repository: https://redhat-cop.github.io/helm-charts +maintainers: + - name: tjungbauer + email: tjungbau@redhat.com + url: https://blog.stderr.at/ +keywords: + - security + - compliance \ No newline at end of file diff --git a/charts/compliance-operator-full-stack/LICENSE b/charts/compliance-operator-full-stack/LICENSE new file mode 100644 index 00000000..1652d17e --- /dev/null +++ b/charts/compliance-operator-full-stack/LICENSE @@ -0,0 +1,13 @@ +Copyright 2022 Thomas Jungbauer + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/compliance-operator-full-stack/README.md b/charts/compliance-operator-full-stack/README.md new file mode 100644 index 00000000..fcdb5d6c --- /dev/null +++ b/charts/compliance-operator-full-stack/README.md @@ -0,0 +1,177 @@ + + +# compliance-operator-full-stack + + [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + + ![Version: 1.0.30](https://img.shields.io/badge/Version-1.0.30-informational?style=flat-square) + + + + ## Description + + Master chart to deploy and configure the Compliance Operator + +This Helm Chart is installing and configuring the Compliance operator, using the following workflow: + +1. Create required Namespace +2. Installing the Compliance operator by applying the Subscription and OperatorGroup object. (In addition, the InstallPlan can be approved if required) +3. Verifying if the operator is ready to use Install and configure the compliance operator. +4. Apply a ScanSettingBinding and, optionally, a TailoredProfile. + +## Dependencies + +This chart has the following dependencies: + +| Repository | Name | Version | +|------------|------|---------| +| https://redhat-cop.github.io/helm-charts | helper-operator | ~1.0.21 | +| https://redhat-cop.github.io/helm-charts | helper-status-checker | ~4.0.0 | +| https://redhat-cop.github.io/helm-charts | tpl | ~1.0.0 | + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| tjungbauer | | | + +## Sources +Source: + +Source code: https://redhat-cop.github.io/helm-charts/tree/main/charts/compliance-operator-full-stack + +## Parameters + +:bulb: **TIP**: See README files of sub Charts for additional possible settings: [helper-operator](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) and [helper-status-checker](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator). + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| compliance.namespace | object | `{"name":"openshift-compliance"}` | Settings for namespace where compliance operator will be installed. | +| compliance.namespace.name | string | `"openshift-compliance"` | Namespace of the operator | +| compliance.scansettingbinding | object | `{"enabled":false,"profiles":[{"kind":"Profile","name":"ocp4-cis-node"},{"kind":"Profile","name":"ocp4-cis"}],"scansetting":"default","syncwave":"3","tailored":{"enabled":false,"modified_profiles":[{"description":"Modified ocp4-cis profile","disableRule":[{"name":"ocp4-scc-limit-container-allowed-capabilities","rationale":"Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration"}],"extends":"ocp4-cis","name":"tailoredprofile-ocp4-cis","title":"Tailored Profile of ocp4-cis"}]}}` | Settings for the ScanSettings Here ScanSettingBinding and TailoredProfile can be configured | +| compliance.scansettingbinding.enabled | bool | false | Enable ScanSetting cnofiguration | +| compliance.scansettingbinding.profiles | list | `[{"kind":"Profile","name":"ocp4-cis-node"},{"kind":"Profile","name":"ocp4-cis"}]` | A list of Profiles that shall be used for scanning | +| compliance.scansettingbinding.profiles[0] | object | `{"kind":"Profile","name":"ocp4-cis-node"}` | The name of the Profile | +| compliance.scansettingbinding.profiles[0].kind | string | `"Profile"` | The kind of the profile. This can either be Profile or TailoredProfile | +| compliance.scansettingbinding.scansetting | string | `"default"` | Use the default ScanSettings that a provided by the Operator. | +| compliance.scansettingbinding.syncwave | string | `"3"` | Syncwave for the ScanSetting | +| compliance.scansettingbinding.tailored | object | `{"enabled":false,"modified_profiles":[{"description":"Modified ocp4-cis profile","disableRule":[{"name":"ocp4-scc-limit-container-allowed-capabilities","rationale":"Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration"}],"extends":"ocp4-cis","name":"tailoredprofile-ocp4-cis","title":"Tailored Profile of ocp4-cis"}]}` | Example of a TailoredProfile With TailoredProfiles you can disable specific checks | +| compliance.scansettingbinding.tailored.enabled | bool | false | Enable TailoredProfile | +| compliance.scansettingbinding.tailored.modified_profiles[0] | object | `{"description":"Modified ocp4-cis profile","disableRule":[{"name":"ocp4-scc-limit-container-allowed-capabilities","rationale":"Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration"}],"extends":"ocp4-cis","name":"tailoredprofile-ocp4-cis","title":"Tailored Profile of ocp4-cis"}` | Name of the TailoredProfile | +| compliance.scansettingbinding.tailored.modified_profiles[0].description | string | `"Modified ocp4-cis profile"` | Description of the Profile | +| compliance.scansettingbinding.tailored.modified_profiles[0].disableRule | list | `[{"name":"ocp4-scc-limit-container-allowed-capabilities","rationale":"Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration"}]` | A list of rules that might be disabled. | +| compliance.scansettingbinding.tailored.modified_profiles[0].disableRule[0] | object | `{"name":"ocp4-scc-limit-container-allowed-capabilities","rationale":"Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration"}` | Name of the rule that shall be disabled | +| compliance.scansettingbinding.tailored.modified_profiles[0].disableRule[0].rationale | string | `"Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration"` | A Reason why this rule is excluded. | +| compliance.scansettingbinding.tailored.modified_profiles[0].extends | string | `"ocp4-cis"` | Which Profile is extended here. Here we are using ocp4-cis as basis. This Profile must exist. | +| compliance.scansettingbinding.tailored.modified_profiles[0].title | string | `"Tailored Profile of ocp4-cis"` | Title of the profile (visible in the reports) | +| helper-operator.operators.compliance-operator.enabled | bool | false | Enabled yes/no | +| helper-operator.operators.compliance-operator.namespace.create | bool | "" | Description of the namespace. | +| helper-operator.operators.compliance-operator.namespace.name | string | `"openshift-compliance"` | The Namespace the Operator should be installed in. The compliance operator should be deployed into **openshift-compliance** Namepsace that must be created. | +| helper-operator.operators.compliance-operator.operatorgroup.create | bool | false | Create an Operatorgroup object | +| helper-operator.operators.compliance-operator.operatorgroup.notownnamespace | bool | false | Monitor own Namespace. For some Operators no `targetNamespaces` must be defined | +| helper-operator.operators.compliance-operator.subscription.approval | string | Automatic | Update behavior of the Operator. Manual/Automatic | +| helper-operator.operators.compliance-operator.subscription.channel | string | stable | Channel of the Subscription | +| helper-operator.operators.compliance-operator.subscription.operatorName | string | "empty" | Name of the Operator The name for the compliance operator is **compliance-operator** | +| helper-operator.operators.compliance-operator.subscription.source | string | redhat-operators | Source of the Operator | +| helper-operator.operators.compliance-operator.subscription.sourceNamespace | string | openshift-marketplace | Namespace of the source | +| helper-operator.operators.compliance-operator.syncwave | string | 0 | Syncwave for the operator deployment | +| helper-status-checker.checks[0] | object | "" | Define the name of the operator that shall be verified. Use the value of the currentCSV (packagemanifest) but WITHOUT the version !! For the compliance operator the name should be "**compliance-operator**" | +| helper-status-checker.checks[0].namespace | object | "" | Define where the operator is installed For the compliance operator this should be "**openshift-compliance**" | +| helper-status-checker.checks[0].serviceAccount | object | `{"name":"sa-compliance"}` | Set the values of the ServiceAccount that will execute the status checker Job. | +| helper-status-checker.enabled | bool | false | Enable status checker | + +## Example values + +```yaml +--- +# Install Operator Compliance Operator +# Deploys Operator --> Subscription and Operatorgroup +# Syncwave: 0 +helper-operator: + operators: + compliance-operator: + enabled: true + syncwave: '0' + namespace: + name: openshift-compliance + create: true + subscription: + channel: stable + approval: Automatic + operatorName: compliance-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + operatorgroup: + create: true + notownnamespace: true + +helper-status-checker: + enabled: true + + # use the value of the currentCSV (packagemanifest) but WITHOUT the version !! + operatorName: compliance-operator + + # where operator is installed + namespace: + name: openshift-compliance + + serviceAccount: + create: true + name: "sa-compliance" + +compliance: + namespace: + name: openshift-compliance + syncwave: '0' + descr: 'Red Hat Compliance' + scansettingbinding: + enabled: true + syncwave: '3' + + # Example + tailored: + enabled: false + modified_profiles: + - name: tailoredprofile-ocp4-cis + description: Modified ocp4-cis profile + title: Tailored Profile of ocp4-cis + extends: ocp4-cis + disableRule: + - name: ocp4-scc-limit-container-allowed-capabilities + rationale: Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration + + profiles: + - name: ocp4-cis-node + kind: Profile # Could be Profile or TailedProfile + - name: ocp4-cis + kind: Profile + scansetting: default + +``` + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release repo/> +``` + +The command deploys the chart on the Kubernetes cluster in the default configuration. + +## Uninstalling the Chart + +To uninstall/delete the my-release deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0) diff --git a/charts/compliance-operator-full-stack/README.md.gotmpl b/charts/compliance-operator-full-stack/README.md.gotmpl new file mode 100644 index 00000000..20f1f56b --- /dev/null +++ b/charts/compliance-operator-full-stack/README.md.gotmpl @@ -0,0 +1,93 @@ +{{ template "doc.header" . }} + +This Helm Chart is installing and configuring the Compliance operator, using the following workflow: + +1. Create required Namespace +2. Installing the Compliance operator by applying the Subscription and OperatorGroup object. (In addition, the InstallPlan can be approved if required) +3. Verifying if the operator is ready to use Install and configure the compliance operator. +4. Apply a ScanSettingBinding and, optionally, a TailoredProfile. + + +{{ template "doc.deps" . }} + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + + +{{ template "doc.maintainer_and_sources" . }} + +## Parameters + +:bulb: **TIP**: See README files of sub Charts for additional possible settings: [helper-operator](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) and [helper-status-checker](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator). + +{{ template "doc.values" . }} + +## Example values + +```yaml +--- +# Install Operator Compliance Operator +# Deploys Operator --> Subscription and Operatorgroup +# Syncwave: 0 +helper-operator: + operators: + compliance-operator: + enabled: true + syncwave: '0' + namespace: + name: openshift-compliance + create: true + subscription: + channel: stable + approval: Automatic + operatorName: compliance-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + operatorgroup: + create: true + notownnamespace: true + +helper-status-checker: + enabled: true + + # use the value of the currentCSV (packagemanifest) but WITHOUT the version !! + operatorName: compliance-operator + + # where operator is installed + namespace: + name: openshift-compliance + + serviceAccount: + create: true + name: "sa-compliance" + +compliance: + namespace: + name: openshift-compliance + syncwave: '0' + descr: 'Red Hat Compliance' + scansettingbinding: + enabled: true + syncwave: '3' + + # Example + tailored: + enabled: false + modified_profiles: + - name: tailoredprofile-ocp4-cis + description: Modified ocp4-cis profile + title: Tailored Profile of ocp4-cis + extends: ocp4-cis + disableRule: + - name: ocp4-scc-limit-container-allowed-capabilities + rationale: Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration + + profiles: + - name: ocp4-cis-node + kind: Profile # Could be Profile or TailedProfile + - name: ocp4-cis + kind: Profile + scansetting: default + +``` + +{{ template "doc.footer" . }} diff --git a/charts/compliance-operator-full-stack/templates/_helpers.tpl b/charts/compliance-operator-full-stack/templates/_helpers.tpl new file mode 100644 index 00000000..e69de29b diff --git a/charts/compliance-operator-full-stack/templates/compliance/ScanSettingBinding.yaml b/charts/compliance-operator-full-stack/templates/compliance/ScanSettingBinding.yaml new file mode 100644 index 00000000..dd7f5ac5 --- /dev/null +++ b/charts/compliance-operator-full-stack/templates/compliance/ScanSettingBinding.yaml @@ -0,0 +1,23 @@ +{{ if eq (.Values.compliance.scansettingbinding.enabled | toString) "true" }} +--- +apiVersion: compliance.openshift.io/v1alpha1 +kind: ScanSettingBinding +metadata: + name: cis-compliance + annotations: + argocd.argoproj.io/sync-wave: {{ .Values.compliance.scansettingbinding.syncwave | quote }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + namespace: {{ .Values.compliance.namespace.name | default "openshift-compliance" | quote }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} +profiles: +{{- range $key, $value := .Values.compliance.scansettingbinding.profiles }} + - name: {{ $value.name }} + kind: {{ $value.kind }} + apiGroup: compliance.openshift.io/v1alpha1 +{{- end }} +settingsRef: + name: {{ .Values.compliance.scansettingbinding.scansetting }} + kind: ScanSetting + apiGroup: compliance.openshift.io/v1alpha1 +{{- end }} diff --git a/charts/compliance-operator-full-stack/templates/compliance/TailoredProfiles.yaml b/charts/compliance-operator-full-stack/templates/compliance/TailoredProfiles.yaml new file mode 100755 index 00000000..9c6fa0db --- /dev/null +++ b/charts/compliance-operator-full-stack/templates/compliance/TailoredProfiles.yaml @@ -0,0 +1,26 @@ +{{ if eq (.Values.compliance.scansettingbinding.tailored.enabled | toString) "true" }} +{{- range $key, $value := .Values.compliance.scansettingbinding.tailored.modified_profiles }} +--- +apiVersion: compliance.openshift.io/v1alpha1 +kind: TailoredProfile +metadata: + name: {{ $value.name }} + namespace: {{ $.Values.compliance.namespace.name | default "openshift-compliance" | quote }} + annotations: + argocd.argoproj.io/sync-wave: {{ $.Values.compliance.scansettingbinding.syncwave | quote }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + labels: + {{- include "tpl.labels" $ | nindent 4 }} +spec: + description: {{ $value.description }} + {{ if .disableRule }} + disableRules: + {{- range $rulekey, $rulevalue := .disableRule }} + - name: {{ $rulevalue.name }} + rationale: {{ $rulevalue.rationale }} + {{- end }} + {{- end }} + extends: {{ $value.extends }} + title: {{ $value.title }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/compliance-operator-full-stack/values.yaml b/charts/compliance-operator-full-stack/values.yaml new file mode 100644 index 00000000..d597e4c1 --- /dev/null +++ b/charts/compliance-operator-full-stack/values.yaml @@ -0,0 +1,122 @@ +--- +# Using sub-chart helper-operator +helper-operator: + operators: + compliance-operator: + # -- Enabled yes/no + # @default -- false + enabled: false + # -- Syncwave for the operator deployment + # @default -- 0 + syncwave: '0' + namespace: + # -- The Namespace the Operator should be installed in. + # The compliance operator should be deployed into **openshift-compliance** Namepsace + # that must be created. + name: openshift-compliance + # -- Description of the namespace. + # @default -- "" + create: true + subscription: + # -- Channel of the Subscription + # @default -- stable + channel: stable + # -- Update behavior of the Operator. Manual/Automatic + # @default -- Automatic + approval: Automatic + # -- Name of the Operator + # The name for the compliance operator is **compliance-operator** + # @default -- "empty" + operatorName: compliance-operator + # -- Source of the Operator + # @default -- redhat-operators + source: redhat-operators + # -- Namespace of the source + # @default -- openshift-marketplace + sourceNamespace: openshift-marketplace + operatorgroup: + # -- Create an Operatorgroup object + # @default -- false + create: true + # -- Monitor own Namespace. For some Operators no `targetNamespaces` must be defined + # @default -- false + notownnamespace: true + +# Using sub-chart helper-status-checker +helper-status-checker: + # -- Enable status checker + # @default -- false + enabled: false + + checks: + + # -- Define the name of the operator that shall be verified. + # Use the value of the currentCSV (packagemanifest) but WITHOUT the version !! + # For the compliance operator the name should be "**compliance-operator**" + # @default -- "" + - operatorName: compliance-operator + # -- Define where the operator is installed + # For the compliance operator this should be "**openshift-compliance**" + # @default -- "" + namespace: + name: openshift-compliance + syncwave: 3 + + # -- Set the values of the ServiceAccount that will execute the status checker Job. + serviceAccount: + name: "sa-compliance" + +compliance: + # -- Settings for namespace where compliance operator will be installed. + namespace: + # -- Namespace of the operator + name: openshift-compliance + + # -- Settings for the ScanSettings + # Here ScanSettingBinding and TailoredProfile can be configured + scansettingbinding: + + # -- Enable ScanSetting cnofiguration + # @default -- false + enabled: false + + # -- Syncwave for the ScanSetting + syncwave: '3' + + # -- Example of a TailoredProfile + # With TailoredProfiles you can disable specific checks + tailored: + + # -- Enable TailoredProfile + # @default -- false + enabled: false + + modified_profiles: + + # -- Name of the TailoredProfile + - name: tailoredprofile-ocp4-cis + # -- Description of the Profile + description: Modified ocp4-cis profile + # -- Title of the profile (visible in the reports) + title: Tailored Profile of ocp4-cis + # -- Which Profile is extended here. Here we are using ocp4-cis as basis. + # This Profile must exist. + extends: ocp4-cis + # -- A list of rules that might be disabled. + disableRule: + # -- Name of the rule that shall be disabled + - name: ocp4-scc-limit-container-allowed-capabilities + # -- A Reason why this rule is excluded. + rationale: Disabling CIS-OCP 5.2.8 that will always be triggered as long nutanix-csi does not provide SCC configuration + + # -- A list of Profiles that shall be used for scanning + profiles: + # -- The name of the Profile + - name: ocp4-cis-node + # -- The kind of the profile. This can either be Profile or TailoredProfile + kind: Profile # Could be Profile or TailedProfile + - name: ocp4-cis + kind: Profile + + # -- Use the default ScanSettings that a provided by the Operator. + scansetting: default \ No newline at end of file diff --git a/charts/cost-management/.helmignore b/charts/cost-management/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/cost-management/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/cost-management/Chart.yaml b/charts/cost-management/Chart.yaml new file mode 100644 index 00000000..33539a1d --- /dev/null +++ b/charts/cost-management/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: cost-management +description: Setup and configure cost-management Operator +home: https://redhat-cop.github.io/helm-charts/tree/main/charts/network-observability +version: 1.0.10 +dependencies: + - name: helper-operator + version: ~1.0.21 + repository: https://redhat-cop.github.io/helm-charts + - name: helper-status-checker + version: ~4.0.0 + repository: https://redhat-cop.github.io/helm-charts + condition: helper-status-checker.enabled + - name: tpl + version: ~1.0.0 + repository: https://redhat-cop.github.io/helm-charts +maintainers: + - name: tjungbauer + email: tjungbau@redhat.com + url: https://blog.stderr.at/ +keywords: + - configuration + - cost-management \ No newline at end of file diff --git a/charts/cost-management/LICENSE b/charts/cost-management/LICENSE new file mode 100644 index 00000000..1652d17e --- /dev/null +++ b/charts/cost-management/LICENSE @@ -0,0 +1,13 @@ +Copyright 2022 Thomas Jungbauer + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/cost-management/README.md b/charts/cost-management/README.md new file mode 100644 index 00000000..10397b0f --- /dev/null +++ b/charts/cost-management/README.md @@ -0,0 +1,152 @@ + + +# cost-management + + [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + + ![Version: 1.0.10](https://img.shields.io/badge/Version-1.0.10-informational?style=flat-square) + + + + ## Description + + Setup and configure cost-management Operator + +This Helm Chart is installing and configuring the Cost Management operator, using the following workflow: + +1. Create required Namespace +2. Installing the Compliance operator by applying the Subscription and OperatorGroup object. (In addition, the InstallPlan can be approved if required) +3. Verifying if the operator is ready to use Install and configure the compliance operator. +4. Apply a ScanSettingBinding and, optionally, a TailoredProfile. + +## Dependencies + +This chart has the following dependencies: + +| Repository | Name | Version | +|------------|------|---------| +| https://redhat-cop.github.io/helm-charts | helper-operator | ~1.0.21 | +| https://redhat-cop.github.io/helm-charts | helper-status-checker | ~4.0.0 | +| https://redhat-cop.github.io/helm-charts | tpl | ~1.0.0 | + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| tjungbauer | | | + +## Sources +Source: + +Source code: https://redhat-cop.github.io/helm-charts/tree/main/charts/network-observability + +## Parameters + +:bulb: **TIP**: See README files of sub Charts for additional possible settings: [helper-operator](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) and [helper-status-checker](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator). + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| costmgmt.airgapped | bool | false | Is the cluster running in an airgapped or disconnected environment, we cannot upload the cost management data. | +| costmgmt.auth_secret | string | `"mysecret"` | The secret with the user and password used for uploads. | +| costmgmt.auth_type | string | token | Authentication: Valid values are: - "basic" (deprecated) : Enables authentication using user and password from authentication secret. - "service-account" : Enables authentication using client_id and client_secret from the secret containing service account information. - "token" (default): Uses cluster token for authentication. If the cluster is running in airgapped mode, then these settings can be ignored. | +| costmgmt.enabled | bool | false | Enable or disable the configuration of the cost management operator | +| costmgmt.max_reports_to_store | int | 30 | Represents the maximum number of reports to store. The default is 30 reports which corresponds to approximately 7 days worth of data given the other default values. | +| costmgmt.max_size_MB | int | 100 | Represents the max file size in megabytes that will be compressed for upload to Ingress. Must be less or euqal 100. | +| costmgmt.name | string | costmanagementmetricscfg | Name of the cost manager CRD | +| costmgmt.promconfig_collect_previous_data | string | true | Represents whether or not the operator will gather previous data upon CostManagementMetricsConfig creation. This toggle only changes operator behavior when a new CostManagementMetricsConfig is created. When `true`, the operator will gather all existing Prometheus data for the current month. | +| costmgmt.promconfig_context_time | int | 120 | How long a query to prometheus should run in seconds before timing out. | +| costmgmt.promconfig_disable_metric_coll_cost_management | string | false | Whether or not the operator will generate reports for cost-management metrics. | +| costmgmt.promconfig_disable_metric_coll_resource_optimization | string | false | Whether or not the operator will generate reports for resource-optimization metrics. | +| costmgmt.promconfig_service_address | string | "https://thanos-querier.openshift-monitoring.svc:9091" | Service addess to prometheus. For development only. | +| costmgmt.promconfig_skip_tls_verification | string | false | Skip TLS verification to thanos-querier endpoint. | +| costmgmt.upload_cycle | int | 360 | Represents the number of minutes between each upload schedule. | +| costmgmt.upload_toggle | bool | true | If `false`, the operator will not upload to console.redhat.com or check/create sources. | +| helper-operator.operators.cost-management-operator.enabled | bool | false | Enabled yes/no | +| helper-operator.operators.cost-management-operator.namespace.create | bool | "" | Description of the namespace. | +| helper-operator.operators.cost-management-operator.namespace.name | string | `"costmanagement-metrics-operator"` | The Namespace the Operator should be installed in. The cost-management operator should be deployed into **costmanagement-metrics-operator** Namepsace that must be created. | +| helper-operator.operators.cost-management-operator.operatorgroup.create | bool | false | Create an Operatorgroup object | +| helper-operator.operators.cost-management-operator.operatorgroup.notownnamespace | bool | false | Monitor own Namespace. For some Operators no `targetNamespaces` must be defined | +| helper-operator.operators.cost-management-operator.subscription.approval | string | Automatic | Update behavior of the Operator. Manual/Automatic | +| helper-operator.operators.cost-management-operator.subscription.channel | string | stable | Channel of the Subscription | +| helper-operator.operators.cost-management-operator.subscription.operatorName | string | "empty" | Name of the Operator The name for the cost-management operator is **costmanagement-metrics-operator** | +| helper-operator.operators.cost-management-operator.subscription.source | string | redhat-operators | Source of the Operator | +| helper-operator.operators.cost-management-operator.subscription.sourceNamespace | string | openshift-marketplace | Namespace of the source | +| helper-operator.operators.cost-management-operator.syncwave | string | 0 | Syncwave for the operator deployment | +| helper-status-checker.checks[0].namespace.name | string | `"costmanagement-metrics-operator"` | | +| helper-status-checker.checks[0].operatorName | string | `"costmanagement-metrics-operator"` | | +| helper-status-checker.checks[0].serviceAccount.name | string | `"sa-costmanagement-metrics"` | | +| helper-status-checker.checks[0].syncwave | int | `3` | | +| helper-status-checker.enabled | bool | `false` | | + +## Example values + +```yaml +--- +cost-management: + costmgmt: + enabled: false + name: costmanagementmetricscfg + airgapped: true + max_reports_to_store: 60 + upload_cycle: 360 + +# Using sub-chart helper-operator +helper-operator: + operators: + cost-management-operator: + enabled: false + syncwave: '0' + namespace: + name: costmanagement-metrics-operator + create: true + subscription: + channel: stable + approval: Automatic + operatorName: costmanagement-metrics-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + operatorgroup: + create: false + notownnamespace: false + +# Using sub-chart helper-status-checker +helper-status-checker: + enabled: false + + checks: + + - operatorName: costmanagement-metrics-operator + namespace: + name: costmanagement-metrics-operator + syncwave: 3 + + serviceAccount: + name: "sa-costmanagement-metrics" +``` + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release repo/> +``` + +The command deploys the chart on the Kubernetes cluster in the default configuration. + +## Uninstalling the Chart + +To uninstall/delete the my-release deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0) diff --git a/charts/cost-management/README.md.gotmpl b/charts/cost-management/README.md.gotmpl new file mode 100644 index 00000000..ccfdb77b --- /dev/null +++ b/charts/cost-management/README.md.gotmpl @@ -0,0 +1,70 @@ +{{ template "doc.header" . }} + +This Helm Chart is installing and configuring the Cost Management operator, using the following workflow: + +1. Create required Namespace +2. Installing the Compliance operator by applying the Subscription and OperatorGroup object. (In addition, the InstallPlan can be approved if required) +3. Verifying if the operator is ready to use Install and configure the compliance operator. +4. Apply a ScanSettingBinding and, optionally, a TailoredProfile. + + +{{ template "doc.deps" . }} + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + + +{{ template "doc.maintainer_and_sources" . }} + +## Parameters + +:bulb: **TIP**: See README files of sub Charts for additional possible settings: [helper-operator](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) and [helper-status-checker](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator). + +{{ template "doc.values" . }} + +## Example values + +```yaml +--- +cost-management: + costmgmt: + enabled: false + name: costmanagementmetricscfg + airgapped: true + max_reports_to_store: 60 + upload_cycle: 360 + +# Using sub-chart helper-operator +helper-operator: + operators: + cost-management-operator: + enabled: false + syncwave: '0' + namespace: + name: costmanagement-metrics-operator + create: true + subscription: + channel: stable + approval: Automatic + operatorName: costmanagement-metrics-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + operatorgroup: + create: false + notownnamespace: false + +# Using sub-chart helper-status-checker +helper-status-checker: + enabled: false + + checks: + + - operatorName: costmanagement-metrics-operator + namespace: + name: costmanagement-metrics-operator + syncwave: 3 + + serviceAccount: + name: "sa-costmanagement-metrics" +``` + +{{ template "doc.footer" . }} diff --git a/charts/cost-management/templates/CostManagementMetricsConfig.yaml b/charts/cost-management/templates/CostManagementMetricsConfig.yaml new file mode 100644 index 00000000..89245cba --- /dev/null +++ b/charts/cost-management/templates/CostManagementMetricsConfig.yaml @@ -0,0 +1,46 @@ +{{- if .Values.costmgmt }} +{{- if eq ( .Values.costmgmt.enabled | toString) "true" }} +{{- with .Values.costmgmt }} +--- +kind: CostManagementMetricsConfig +apiVersion: costmanagement-metrics-cfg.openshift.io/v1beta1 +metadata: + name: {{ .name | default "costmanagementmetricscfg" }} + namespace: costmanagement-metrics-operator + annotations: + argocd.argoproj.io/sync-wave: {{ .syncwave | default "10" | quote }} + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + labels: + {{- include "tpl.labels" $ | nindent 4 }} +spec: + {{- if eq ( .airgapped | toString) "true" }} + authentication: {} + {{- else }} + authentication: + token_url: "https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token" + type: {{ .auth_type | default "token" }} + secret_name: {{ .auth_secret }} + {{- end }} + packaging: + max_reports_to_store: {{ .max_reports_to_store | default 30 }} + max_size_MB: {{ .max_size_MB | default 100 }} + prometheus_config: + collect_previous_data: {{ .promconfig_collect_previous_data | default "true" }} + context_timeout: {{ .promconfig_context_time | default 120 }} + disable_metrics_collection_cost_management: {{ .promconfig_disable_metric_coll_cost_management | default "false" }} + disable_metrics_collection_resource_optimization: {{ .promconfig_disable_metric_coll_resource_optimization | default "false" }} + service_address: {{ .promconfig_service_address | default "https://thanos-querier.openshift-monitoring.svc:9091" }} + skip_tls_verification: {{ .promconfig_skip_tls_verification | default "false" }} + {{- if eq ( .airgapped | toString) "true" }} + source: {} + {{- end }} + upload: + upload_cycle: {{ .upload_cycle | default 360 }} + {{- if eq ( .airgapped | toString) "true" }} + upload_toggle: false + {{- else }} + upload_toggle: true + {{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/cost-management/templates/_helpers.tpl b/charts/cost-management/templates/_helpers.tpl new file mode 100644 index 00000000..e69de29b diff --git a/charts/cost-management/values.yaml b/charts/cost-management/values.yaml new file mode 100644 index 00000000..7cfbabac --- /dev/null +++ b/charts/cost-management/values.yaml @@ -0,0 +1,124 @@ +--- +costmgmt: + # -- Enable or disable the configuration of the cost management operator + # @default -- false + enabled: false + + # -- Name of the cost manager CRD + # @default -- costmanagementmetricscfg + name: costmanagementmetricscfg + + # -- Is the cluster running in an airgapped or disconnected environment, we cannot upload the cost management data. + # @default -- false + airgapped: true + + # -- Represents the maximum number of reports to store. The default is 30 reports which corresponds to approximately 7 days worth of data given the other default values. + # @default -- 30 + max_reports_to_store: 30 + + # -- Represents the max file size in megabytes that will be compressed for upload to Ingress. Must be less or euqal 100. + # @default -- 100 + max_size_MB: 100 + + # -- Represents the number of minutes between each upload schedule. + # @default -- 360 + upload_cycle: 360 + + # -- If `false`, the operator will not upload to console.redhat.com or check/create sources. + # @default -- true + upload_toggle: false + + # -- Authentication: Valid values are: + # - "basic" (deprecated) : Enables authentication using user and password from authentication secret. + # - "service-account" : Enables authentication using client_id and client_secret from the secret containing service account information. + # - "token" (default): Uses cluster token for authentication. + # If the cluster is running in airgapped mode, then these settings can be ignored. + # @default -- token + auth_type: token + + # -- The secret with the user and password used for uploads. + auth_secret: mysecret + + # Prometheus Configuration + # -- Represents whether or not the operator will gather previous data upon CostManagementMetricsConfig creation. + # This toggle only changes operator behavior when a new CostManagementMetricsConfig is created. When `true`, the operator will gather all existing Prometheus data for the current month. + # @default -- true + promconfig_collect_previous_data: "true" + + # -- How long a query to prometheus should run in seconds before timing out. + # @default -- 120 + promconfig_context_time: 120 + + # -- Whether or not the operator will generate reports for cost-management metrics. + # @default -- false + promconfig_disable_metric_coll_cost_management: "false" + + # -- Whether or not the operator will generate reports for resource-optimization metrics. + # @default -- false + promconfig_disable_metric_coll_resource_optimization: "false" + + # -- Service addess to prometheus. For development only. + # @default -- "https://thanos-querier.openshift-monitoring.svc:9091" + promconfig_service_address: "https://thanos-querier.openshift-monitoring.svc:9091" + + # -- Skip TLS verification to thanos-querier endpoint. + # @default -- false + promconfig_skip_tls_verification: "false" + +# Using sub-chart helper-operator +helper-operator: + operators: + cost-management-operator: + # -- Enabled yes/no + # @default -- false + enabled: false + # -- Syncwave for the operator deployment + # @default -- 0 + syncwave: '0' + namespace: + # -- The Namespace the Operator should be installed in. + # The cost-management operator should be deployed into **costmanagement-metrics-operator** Namepsace + # that must be created. + name: costmanagement-metrics-operator + # -- Description of the namespace. + # @default -- "" + create: true + subscription: + # -- Channel of the Subscription + # @default -- stable + channel: stable + # -- Update behavior of the Operator. Manual/Automatic + # @default -- Automatic + approval: Automatic + # -- Name of the Operator + # The name for the cost-management operator is **costmanagement-metrics-operator** + # @default -- "empty" + operatorName: costmanagement-metrics-operator + # -- Source of the Operator + # @default -- redhat-operators + source: redhat-operators + # -- Namespace of the source + # @default -- openshift-marketplace + sourceNamespace: openshift-marketplace + operatorgroup: + # -- Create an Operatorgroup object + # @default -- false + create: false + # -- Monitor own Namespace. For some Operators no `targetNamespaces` must be defined + # @default -- false + notownnamespace: false + + +# Using sub-chart helper-status-checker +helper-status-checker: + enabled: false + + checks: + + - operatorName: costmanagement-metrics-operator + namespace: + name: costmanagement-metrics-operator + syncwave: 3 + + serviceAccount: + name: "sa-costmanagement-metrics" \ No newline at end of file diff --git a/charts/cyclonedx/Chart.yaml b/charts/cyclonedx/Chart.yaml new file mode 100644 index 00000000..86553209 --- /dev/null +++ b/charts/cyclonedx/Chart.yaml @@ -0,0 +1,17 @@ +apiVersion: v2 +name: cyclonedx +description: A Helm chart to deploy CycloneDX to generate SBOM +type: application +version: 1.0.7 +appVersion: 1.0.0 +home: https://redhat-cop.github.io/helm-charts/tree/main/charts/cyclonedx +maintainers: + - name: tjungbauer + email: tjungbau@redhat.com + url: https://blog.stderr.at/ +dependencies: + - name: tpl + version: ~1.0.0 + repository: https://redhat-cop.github.io/helm-charts +keywords: + - gitops \ No newline at end of file diff --git a/charts/cyclonedx/LICENSE b/charts/cyclonedx/LICENSE new file mode 100644 index 00000000..1652d17e --- /dev/null +++ b/charts/cyclonedx/LICENSE @@ -0,0 +1,13 @@ +Copyright 2022 Thomas Jungbauer + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/cyclonedx/README.md b/charts/cyclonedx/README.md new file mode 100644 index 00000000..b2756685 --- /dev/null +++ b/charts/cyclonedx/README.md @@ -0,0 +1,84 @@ + + +# cyclonedx + + [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + + ![Version: 1.0.7](https://img.shields.io/badge/Version-1.0.7-informational?style=flat-square) + + + + ## Description + + A Helm chart to deploy CycloneDX to generate SBOM + +CycloneDX provides advanced, supply chain capabilities for cyber risk reduction. We are using the Software Bill of Material (SBOM) parts. +SBOM is a complete and accurate inventory of all first-party and third-party components is essential for risk identification. + +This chart will install CycloneDX BOM Repo server, which enables you to store SBOM inventories on your cluster. + +For detailed information check: [CycloneDX SBOM](https://cyclonedx.org/capabilities/sbom/) + +For an example of how to use it during a pipeline run check: [Generating an SBOM](https://blog.stderr.at/securesupplychain/2023-06-22-securesupplychain-step7/) + +## Dependencies + +This chart has the following dependencies: + +| Repository | Name | Version | +|------------|------|---------| +| https://redhat-cop.github.io/helm-charts | tpl | ~1.0.0 | + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| tjungbauer | | | + +## Sources +Source: + +Source code: https://redhat-cop.github.io/helm-charts/tree/main/charts/cyclonedx + +## Parameters + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| namespace.create | bool | false | Create Namespace yes or not | +| namespace.name | string | `"cyclonedx"` | Name of the Namespace | + +## Example values + +```yaml +--- +namespace: + create: true + name: cyclonedx +``` + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release repo/> +``` + +The command deploys the chart on the Kubernetes cluster in the default configuration. + +## Uninstalling the Chart + +To uninstall/delete the my-release deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0) diff --git a/charts/cyclonedx/README.md.gotmpl b/charts/cyclonedx/README.md.gotmpl new file mode 100644 index 00000000..7a72fc6f --- /dev/null +++ b/charts/cyclonedx/README.md.gotmpl @@ -0,0 +1,32 @@ +{{ template "doc.header" . }} + +CycloneDX provides advanced, supply chain capabilities for cyber risk reduction. We are using the Software Bill of Material (SBOM) parts. +SBOM is a complete and accurate inventory of all first-party and third-party components is essential for risk identification. + +This chart will install CycloneDX BOM Repo server, which enables you to store SBOM inventories on your cluster. + +For detailed information check: [CycloneDX SBOM](https://cyclonedx.org/capabilities/sbom/) + +For an example of how to use it during a pipeline run check: [Generating an SBOM](https://blog.stderr.at/securesupplychain/2023-06-22-securesupplychain-step7/) + +{{ template "doc.deps" . }} + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + + +{{ template "doc.maintainer_and_sources" . }} + +## Parameters + +{{ template "doc.values" . }} + +## Example values + +```yaml +--- +namespace: + create: true + name: cyclonedx +``` + +{{ template "doc.footer" . }} diff --git a/charts/cyclonedx/templates/_helpers.tpl b/charts/cyclonedx/templates/_helpers.tpl new file mode 100644 index 00000000..e69de29b diff --git a/charts/cyclonedx/templates/deployment.yaml b/charts/cyclonedx/templates/deployment.yaml new file mode 100644 index 00000000..a2508900 --- /dev/null +++ b/charts/cyclonedx/templates/deployment.yaml @@ -0,0 +1,49 @@ +kind: Deployment +apiVersion: apps/v1 +metadata: + name: cyclonedx-bom-repo-server + namespace: {{ .Values.namespace.name | quote }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + app: cyclonedx-bom-repo-server + template: + metadata: + creationTimestamp: null + labels: + app: cyclonedx-bom-repo-server + spec: + containers: + - name: container + image: cyclonedx/cyclonedx-bom-repo-server + ports: + - containerPort: 8080 + protocol: TCP + env: + - name: REPO__DIRECTORY + value: /repo + - name: ALLOWEDMETHODS__GET + value: 'true' + - name: ALLOWEDMETHODS__POST + value: 'true' + - name: ALLOWEDMETHODS__DELETE + value: 'true' + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + imagePullPolicy: Always + restartPolicy: Always + terminationGracePeriodSeconds: 30 + dnsPolicy: ClusterFirst + securityContext: {} + schedulerName: default-scheduler + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 25% + maxSurge: 25% + revisionHistoryLimit: 10 + progressDeadlineSeconds: 600 diff --git a/charts/cyclonedx/templates/namespace.yaml b/charts/cyclonedx/templates/namespace.yaml new file mode 100644 index 00000000..446d8fd9 --- /dev/null +++ b/charts/cyclonedx/templates/namespace.yaml @@ -0,0 +1,10 @@ +{{ if eq ( .Values.namespace.create | toString) "true" }} +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.namespace.name | quote }} + labels: + openshift.io/cluster-monitoring: "true" + {{- include "tpl.labels" $ | nindent 4 }} +{{- end }} diff --git a/charts/cyclonedx/templates/route.yaml b/charts/cyclonedx/templates/route.yaml new file mode 100644 index 00000000..243bd0c4 --- /dev/null +++ b/charts/cyclonedx/templates/route.yaml @@ -0,0 +1,18 @@ +kind: Route +apiVersion: route.openshift.io/v1 +metadata: + name: cyclonedx-bom-repo-server + namespace: {{ .Values.namespace.name | quote }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} +spec: + to: + kind: Service + name: cyclonedx-bom-repo-server + weight: 100 + port: + targetPort: http-listener + tls: + insecureEdgeTerminationPolicy: Redirect + termination: edge + wildcardPolicy: None diff --git a/charts/cyclonedx/templates/service.yaml b/charts/cyclonedx/templates/service.yaml new file mode 100644 index 00000000..0f3e220c --- /dev/null +++ b/charts/cyclonedx/templates/service.yaml @@ -0,0 +1,19 @@ +kind: Service +apiVersion: v1 +metadata: + name: cyclonedx-bom-repo-server + namespace: {{ .Values.namespace.name | quote }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} +spec: + ipFamilies: + - IPv4 + ports: + - name: http-listener + protocol: TCP + port: 8080 + targetPort: 8080 + internalTrafficPolicy: Cluster + type: ClusterIP + selector: + app: cyclonedx-bom-repo-server diff --git a/charts/cyclonedx/values.yaml b/charts/cyclonedx/values.yaml new file mode 100644 index 00000000..e74fb0f6 --- /dev/null +++ b/charts/cyclonedx/values.yaml @@ -0,0 +1,9 @@ +--- + +namespace: + # -- Create Namespace yes or not + # @default -- false + create: true + + # -- Name of the Namespace + name: cyclonedx \ No newline at end of file diff --git a/charts/file-integrity-operator/.helmignore b/charts/file-integrity-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/file-integrity-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/file-integrity-operator/Chart.yaml b/charts/file-integrity-operator/Chart.yaml new file mode 100644 index 00000000..233a8720 --- /dev/null +++ b/charts/file-integrity-operator/Chart.yaml @@ -0,0 +1,17 @@ +apiVersion: v2 +name: file-integrity-operator +description: Setup the FileIntegrity Operator (based on AIDE) +version: 1.0.11 +home: https://redhat-cop.github.io/helm-charts/tree/main/charts/file-integrity-operator +icon: https://github.com/tjungbauer/helm-charts/raw/gh-pages/images/file-integrity-operator-icon.png +dependencies: + - name: tpl + version: ~1.0.0 + repository: https://redhat-cop.github.io/helm-charts +maintainers: + - name: tjungbauer + email: tjungbau@redhat.com + url: https://blog.stderr.at/ +keywords: + - security + - clusterconfig \ No newline at end of file diff --git a/charts/file-integrity-operator/LICENSE b/charts/file-integrity-operator/LICENSE new file mode 100644 index 00000000..1652d17e --- /dev/null +++ b/charts/file-integrity-operator/LICENSE @@ -0,0 +1,13 @@ +Copyright 2022 Thomas Jungbauer + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/file-integrity-operator/README.md b/charts/file-integrity-operator/README.md new file mode 100644 index 00000000..2e9663fe --- /dev/null +++ b/charts/file-integrity-operator/README.md @@ -0,0 +1,174 @@ + + +# file-integrity-operator + + [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + + ![Version: 1.0.11](https://img.shields.io/badge/Version-1.0.11-informational?style=flat-square) + + + + ## Description + + Setup the FileIntegrity Operator (based on AIDE) + +This Helm Chart is installing and configuring the File Integrity Operator, which uses AIDE to check if any files have been changed +on the operating system. + +## Dependencies + +This chart has the following dependencies: + +| Repository | Name | Version | +|------------|------|---------| +| https://redhat-cop.github.io/helm-charts | tpl | ~1.0.0 | + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops (for example in the folder clusters/management-cluster/setup-file-integrity-operator) + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| tjungbauer | | | + +## Sources +Source: + +Source code: https://redhat-cop.github.io/helm-charts/tree/main/charts/file-integrity-operator + +## Parameters + +Verify the subcharts for additional settings: + +* [helper-operator](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) +* [helper-status-checker](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| aide.controlplane.config | object | `{"customconfig":{"enabled":true,"key":"controlplane-aide.conf","name":"controlplane-aide-conf","namespace":"openshift-file-integrity"},"gracePeriod":900,"maxBackups":5}` | FileIntegrity configuration | +| aide.controlplane.config.customconfig | object | `{"enabled":true,"key":"controlplane-aide.conf","name":"controlplane-aide-conf","namespace":"openshift-file-integrity"}` | Enable a custom configuration. This is usefull for control planes. If not defined a configuration will be created. | +| aide.controlplane.config.customconfig.enabled | bool | false | Enable custom configuration | +| aide.controlplane.config.customconfig.key | string | `"controlplane-aide.conf"` | The key that contains the actual AIDE configuration in a configmap specified by Name and Namespace. Defaults to aide.conf | +| aide.controlplane.config.customconfig.namespace | string | `"openshift-file-integrity"` | Namespace of a configMap that contains custom AIDE configuration. A default configuration would be created if omitted. | +| aide.controlplane.config.gracePeriod | int | 900 | Time between individual aide scans | +| aide.controlplane.config.maxBackups | int | 5 | The maximum number of AIDE database and log backups (leftover from the re-init process) to keep on a node. Older backups beyond this number are automatically pruned by the daemon. | +| aide.controlplane.enabled | bool | false | Enable worker node fileintegrity check | +| aide.controlplane.name | string | `"controlplane-fileintegrity"` | Name of this object | +| aide.controlplane.namespace | string | `"openshift-file-integrity"` | Namespace, typically openshift-file-integrity | +| aide.controlplane.selector | object | `{"key":"node-role.kubernetes.io/master","value":""}` | nodeSelector as key/value | +| aide.controlplane.syncwave | int | `10` | Syncwave when this object is created | +| aide.controlplane.tolerations | list | empty | If you want this component to only run on specific nodes, you can configure tolerations of tainted nodes. | +| aide.worker.config | object | `{"customconfig":{"enabled":false},"gracePeriod":900,"maxBackups":5}` | FileIntegrity configuration | +| aide.worker.config.customconfig | object | `{"enabled":false}` | Enable a custom configuration. This is usefull for control planes. If not defined a configuration will be created. | +| aide.worker.config.customconfig.enabled | bool | false | Enable custom configuration | +| aide.worker.config.gracePeriod | int | 900 | Time between individual aide scans | +| aide.worker.config.maxBackups | int | 5 | The maximum number of AIDE database and log backups (leftover from the re-init process) to keep on a node. Older backups beyond this number are automatically pruned by the daemon. | +| aide.worker.enabled | bool | false | Enable worker node fileintegrity check | +| aide.worker.name | string | `"worker-fileintegrity"` | Name of this object | +| aide.worker.namespace | string | `"openshift-file-integrity"` | Namespace, typically openshift-file-integrity | +| aide.worker.nodeSelector.key | string | `"node-role.kubernetes.io/worker"` | | +| aide.worker.nodeSelector.value | string | `""` | | +| aide.worker.selector | object | `{"key":"node-role.kubernetes.io/worker","value":""}` | nodeSelector as key/value | +| aide.worker.syncwave | int | `5` | Syncwave when this object is created | +| aide.worker.tolerations | list | empty | If you want this component to only run on specific nodes, you can configure tolerations of tainted nodes. | + +## Example values + +```yaml +--- +# Deploy operator using helper-operator sub chart +helper-operator: + operators: + quay-operator: + enabled: false + syncwave: '0' + namespace: + name: openshift-file-integrity + create: true + subscription: + channel: stable + approval: Automatic + operatorName: file-integrity-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + operatorgroup: + create: true + notownnamespace: true + +# Verify if operator has been deployed using helper-status-checker sub-chart +helper-status-checker: + enabled: false + + checks: + + - operatorName: file-integrity-operator + namespace: + name: openshift-file-integrity + syncwave: 3 + + serviceAccount: + name: "sa-file-integrity-checker" + +aide: + worker: + enabled: true + syncwave: 5 + name: worker-fileintegrity + namespace: openshift-file-integrity + selector: + key: node-role.kubernetes.io/worker + value: "" + + config: + gracePeriod: 900 + maxBackups: 5 + + controlplane: + enabled: false + syncwave: 10 + name: controlplane-fileintegrity + namespace: openshift-file-integrity + selector: + key: node-role.kubernetes.io/master + value: "" + + config: + gracePeriod: 900 + maxBackups: 5 + + customconfig: + enabled: true + name: controlplane-aide-conf + namespace: openshift-file-integrity + key: "controlplane-aide.conf" + + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists +``` + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release repo/> +``` + +The command deploys the chart on the Kubernetes cluster in the default configuration. + +## Uninstalling the Chart + +To uninstall/delete the my-release deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0) diff --git a/charts/file-integrity-operator/README.md.gotmpl b/charts/file-integrity-operator/README.md.gotmpl new file mode 100644 index 00000000..ef190e87 --- /dev/null +++ b/charts/file-integrity-operator/README.md.gotmpl @@ -0,0 +1,98 @@ +{{ template "doc.header" . }} + +This Helm Chart is installing and configuring the File Integrity Operator, which uses AIDE to check if any files have been changed +on the operating system. + +{{ template "doc.deps" . }} + +It is best used with a full GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops (for example in the folder clusters/management-cluster/setup-file-integrity-operator) + + +{{ template "doc.maintainer_and_sources" . }} + +## Parameters + +Verify the subcharts for additional settings: + +* [helper-operator](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) +* [helper-status-checker](https://github.com/tjungbauer/helm-charts/tree/main/charts/helper-operator) + +{{ template "doc.values" . }} + +## Example values + +```yaml +--- +# Deploy operator using helper-operator sub chart +helper-operator: + operators: + quay-operator: + enabled: false + syncwave: '0' + namespace: + name: openshift-file-integrity + create: true + subscription: + channel: stable + approval: Automatic + operatorName: file-integrity-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + operatorgroup: + create: true + notownnamespace: true + +# Verify if operator has been deployed using helper-status-checker sub-chart +helper-status-checker: + enabled: false + + checks: + + - operatorName: file-integrity-operator + namespace: + name: openshift-file-integrity + syncwave: 3 + + serviceAccount: + name: "sa-file-integrity-checker" + +aide: + worker: + enabled: true + syncwave: 5 + name: worker-fileintegrity + namespace: openshift-file-integrity + selector: + key: node-role.kubernetes.io/worker + value: "" + + config: + gracePeriod: 900 + maxBackups: 5 + + controlplane: + enabled: false + syncwave: 10 + name: controlplane-fileintegrity + namespace: openshift-file-integrity + selector: + key: node-role.kubernetes.io/master + value: "" + + config: + gracePeriod: 900 + maxBackups: 5 + + customconfig: + enabled: true + name: controlplane-aide-conf + namespace: openshift-file-integrity + key: "controlplane-aide.conf" + + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists +``` + +{{ template "doc.footer" . }} diff --git a/charts/file-integrity-operator/templates/_helpers.tpl b/charts/file-integrity-operator/templates/_helpers.tpl new file mode 100644 index 00000000..e69de29b diff --git a/charts/file-integrity-operator/templates/controlplane-aide-config.yaml b/charts/file-integrity-operator/templates/controlplane-aide-config.yaml new file mode 100644 index 00000000..0f026e66 --- /dev/null +++ b/charts/file-integrity-operator/templates/controlplane-aide-config.yaml @@ -0,0 +1,68 @@ +{{- range $key, $value := .Values.aide }} +{{- with $value }} +{{- if eq (.enabled | toString) "true" }} +{{- if eq (.config.customconfig.enabled | toString) "true" }} +{{- if eq (.config.customconfig.name | toString) "controlplane-aide-conf" }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: controlplane-aide-conf + namespace: openshift-file-integrity + labels: + {{- include "tpl.labels" $ | nindent 4 }} + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: "2" +data: + controlplane-aide.conf: |+ + @@define DBDIR /hostroot/etc/kubernetes + @@define LOGDIR /hostroot/etc/kubernetes + database=file:@@{DBDIR}/aide.db.gz + database_out=file:@@{DBDIR}/aide.db.gz.new + gzip_dbout=yes + verbose=5 + report_url=file:@@{LOGDIR}/aide.log.new + report_url=stdout + PERMS = p+u+g+acl+selinux+xattrs + CONTENT_EX = sha512+ftype+p+u+g+n+acl+selinux+xattrs + + /hostroot/boot/ CONTENT_EX + /hostroot/root/\..* PERMS + /hostroot/root/ CONTENT_EX + !/hostroot/root/\.kube + !/hostroot/usr/src/ + !/hostroot/usr/tmp/ + + /hostroot/usr/ CONTENT_EX + + # OpenShift specific excludes + !/hostroot/opt/ + !/hostroot/var + !/hostroot/etc/NetworkManager/system-connections/ + !/hostroot/etc/mtab$ + !/hostroot/etc/.*~ + !/hostroot/etc/kubernetes/static-pod-resources + !/hostroot/etc/kubernetes/aide.* + !/hostroot/etc/kubernetes/manifests + !/hostroot/etc/kubernetes/kubelet-ca.crt + !/hostroot/etc/docker/certs.d + !/hostroot/etc/selinux/targeted + !/hostroot/etc/openvswitch/conf.db + !/hostroot/etc/kubernetes/cni/net.d + !/hostroot/etc/kubernetes/cni/net.d/* + !/hostroot/etc/machine-config-daemon/currentconfig$ + !/hostroot/etc/machine-config-daemon/node-annotation.json* + !/hostroot/etc/pki/ca-trust/extracted/java/cacerts$ + !/hostroot/etc/cvo/updatepayloads + + # CP specific exclude + !/opt/mydaemon/ + + # Catch everything else in /etc + /hostroot/etc/ CONTENT_EX +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/file-integrity-operator/templates/fileintegrity.yaml b/charts/file-integrity-operator/templates/fileintegrity.yaml new file mode 100644 index 00000000..4bf78253 --- /dev/null +++ b/charts/file-integrity-operator/templates/fileintegrity.yaml @@ -0,0 +1,32 @@ +{{- range $key, $value := .Values.aide }} +{{- with $value }} +{{ if eq (.enabled | toString) "true" }} +--- +apiVersion: fileintegrity.openshift.io/v1alpha1 +kind: FileIntegrity +metadata: + name: {{ .name }} + namespace: {{ .namespace }} + labels: + {{- include "tpl.labels" $ | nindent 4 }} + annotations: + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + argocd.argoproj.io/sync-wave: {{ .syncwave | default "10" | quote }} +spec: + config: + gracePeriod: {{ .config.gracePeriod | default "900" }} + maxBackups: {{ .config.maxBackups | default "5" }} + {{- if eq (.config.customconfig.enabled | toString) "true" }} + name: {{ .config.customconfig.name }} + namespace: {{ .config.customconfig.namespace }} + key: {{ .config.customconfig.key | default "config" }} + {{- end }} + +{{- /* Set tolerations */}} +{{- if .tolerations }} +{{ include "tpl.tolerations" .tolerations | indent 4 }} +{{- end }} + +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/file-integrity-operator/values.yaml b/charts/file-integrity-operator/values.yaml new file mode 100644 index 00000000..a4a0837c --- /dev/null +++ b/charts/file-integrity-operator/values.yaml @@ -0,0 +1,108 @@ +--- +# Settings for File Integrity Operator +aide: + # Settings the are applicable for Worker nodes. + worker: + # -- Enable worker node fileintegrity check + # @default -- false + enabled: false + + # -- Syncwave when this object is created + syncwave: 5 + + # -- Name of this object + name: worker-fileintegrity + + # -- Namespace, typically openshift-file-integrity + namespace: openshift-file-integrity + + # -- nodeSelector as key/value + selector: + key: node-role.kubernetes.io/worker + value: "" + nodeSelector: + key: node-role.kubernetes.io/worker + value: "" + + # -- FileIntegrity configuration + config: + + # -- Time between individual aide scans + # @default -- 900 + gracePeriod: 900 + + # -- The maximum number of AIDE database and log backups (leftover from the re-init process) to keep on a node. Older backups beyond this number are automatically pruned by the daemon. + # @default -- 5 + maxBackups: 5 + + # -- Enable a custom configuration. This is usefull for control planes. If not defined a configuration will be created. + customconfig: + + # -- Enable custom configuration + # @default -- false + enabled: false + + # name: myconfig + # namespace: openshift-file-integrity + # key: "config" + + # -- If you want this component to only run on specific nodes, you can + # configure tolerations of tainted nodes. + # @default -- empty + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/worker + operator: Exists + + # Settings that are applicable for Control Plane nodes. + controlplane: + # -- Enable worker node fileintegrity check + # @default -- false + enabled: false + + # -- Syncwave when this object is created + syncwave: 10 + + # -- Name of this object + name: controlplane-fileintegrity + + # -- Namespace, typically openshift-file-integrity + namespace: openshift-file-integrity + + # -- nodeSelector as key/value + selector: + key: node-role.kubernetes.io/master + value: "" + + # -- FileIntegrity configuration + config: + # -- Time between individual aide scans + # @default -- 900 + gracePeriod: 900 + + # -- The maximum number of AIDE database and log backups (leftover from the re-init process) to keep on a node. Older backups beyond this number are automatically pruned by the daemon. + # @default -- 5 + maxBackups: 5 + + # -- Enable a custom configuration. This is usefull for control planes. If not defined a configuration will be created. + customconfig: + # -- Enable custom configuration + # @default -- false + enabled: true + + # Name of a configMap that contains custom AIDE configuration. A default configuration would be created if omitted. + name: controlplane-aide-conf + + # -- Namespace of a configMap that contains custom AIDE configuration. A default configuration would be created if omitted. + namespace: openshift-file-integrity + + # -- The key that contains the actual AIDE configuration in a configmap specified by Name and Namespace. Defaults to aide.conf + key: "controlplane-aide.conf" + + # -- If you want this component to only run on specific nodes, you can + # configure tolerations of tainted nodes. + # @default -- empty + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists \ No newline at end of file diff --git a/charts/generic-cluster-config/Chart.yaml b/charts/generic-cluster-config/Chart.yaml new file mode 100644 index 00000000..c285b3f0 --- /dev/null +++ b/charts/generic-cluster-config/Chart.yaml @@ -0,0 +1,16 @@ +apiVersion: v2 +name: generic-cluster-config +description: This Chart is responsible for deploying generic cluster configuration, for example, etcd encryption, OAuth etc. +version: 1.0.29 +home: https://redhat-cop.github.io/helm-charts/tree/main/charts/generic-cluster-config +maintainers: + - name: tjungbauer + email: tjungbau@redhat.com + url: https://blog.stderr.at/ +dependencies: + - name: tpl + version: ~1.0.0 + repository: https://redhat-cop.github.io/helm-charts +keywords: + - generic + - clusterconfig \ No newline at end of file diff --git a/charts/generic-cluster-config/LICENSE b/charts/generic-cluster-config/LICENSE new file mode 100644 index 00000000..1652d17e --- /dev/null +++ b/charts/generic-cluster-config/LICENSE @@ -0,0 +1,13 @@ +Copyright 2022 Thomas Jungbauer + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/generic-cluster-config/README.md b/charts/generic-cluster-config/README.md new file mode 100644 index 00000000..ff909c22 --- /dev/null +++ b/charts/generic-cluster-config/README.md @@ -0,0 +1,734 @@ + + +# generic-cluster-config + + [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + + ![Version: 1.0.29](https://img.shields.io/badge/Version-1.0.29-informational?style=flat-square) + + + + ## Description + + This Chart is responsible for deploying generic cluster configuration, for example, etcd encryption, OAuth etc. + +Configure your cluster with basic settings. Any generic and repeatable configuration goes in here. This helps me to quickly deploy Lab environments and demonstrate features. + +It is best used with a GitOps approach such as Argo CD does. For example, https://github.com/tjungbauer/openshift-clusterconfig-gitops + +Multiple Argo CD applications are using this Chart as a dependency to enable different aspects of the cluster (i.e., etcd encryption). + +Currently, the following settings can be done: + +- Encrypt ETCD +- Disable Self-Provisioner +- Configure Identity Providers (LDAP or htpasswd) +- Limit Allowed Registries +- Configure Monitoring and User-Workload Monitoring +- Add Console Banner (Top and Bottom) +- Add Console Links +- Add YAML Samples into the console + +## Dependencies + +This chart has the following dependencies: + +| Repository | Name | Version | +|------------|------|---------| +| https://redhat-cop.github.io/helm-charts | tpl | ~1.0.0 | + +None + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| tjungbauer | | | + +## Sources +Source: + +Source code: https://redhat-cop.github.io/helm-charts/tree/main/charts/generic-cluster-config + +## Parameters + +*TIP*: Verify the values.yaml to see possible additional settings. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| apiserver.audit.profile | string | Default | Set to Default, WriteRequestBodies, AllRequestBodies, or None. The default profile is Default | +| apiserver.custom_cert.cert_names | list | N/A | List of names the certificate is valid | +| apiserver.custom_cert.enabled | bool | false | custom certificate enabled? | +| apiserver.custom_cert.secretname | string | api-certificate | Name of the secret that holds the certificate | +| apiserver.enabled | bool | `false` | Enable APIServer configuration in general | +| apiserver.etcd_encryption.enabled | bool | false | Enable ETCD encryption in OpenShift | +| apiserver.etcd_encryption.encryption_type | string | aesgcm | Type of encryption. This can either be: