550 lines
17 KiB
YAML
550 lines
17 KiB
YAML
|
apiVersion: v1
|
||
|
|
kind: Namespace
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
control-plane: controller-manager
|
||
|
|
name: eraser-system
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
annotations:
|
||
|
|
controller-gen.kubebuilder.io/version: v0.9.0
|
||
|
|
creationTimestamp: null
|
||
|
|
name: imagejobs.eraser.sh
|
||
|
|
spec:
|
||
|
|
group: eraser.sh
|
||
|
|
names:
|
||
|
|
kind: ImageJob
|
||
|
|
listKind: ImageJobList
|
||
|
|
plural: imagejobs
|
||
|
|
singular: imagejob
|
||
|
|
scope: Cluster
|
||
|
|
versions:
|
||
|
|
- name: v1
|
||
|
|
schema:
|
||
|
|
openAPIV3Schema:
|
||
|
|
description: ImageJob is the Schema for the imagejobs API.
|
||
|
|
properties:
|
||
|
|
apiVersion:
|
||
|
|
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||
|
|
type: string
|
||
|
|
kind:
|
||
|
|
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||
|
|
type: string
|
||
|
|
metadata:
|
||
|
|
type: object
|
||
|
|
status:
|
||
|
|
description: ImageJobStatus defines the observed state of ImageJob.
|
||
|
|
properties:
|
||
|
|
deleteAfter:
|
||
|
|
description: Time to delay deletion until
|
||
|
|
format: date-time
|
||
|
|
type: string
|
||
|
|
desired:
|
||
|
|
description: desired number of pods
|
||
|
|
type: integer
|
||
|
|
failed:
|
||
|
|
description: number of pods that failed
|
||
|
|
type: integer
|
||
|
|
phase:
|
||
|
|
description: job running, successfully completed, or failed
|
||
|
|
type: string
|
||
|
|
skipped:
|
||
|
|
description: number of nodes that were skipped e.g. because they are not a linux node
|
||
|
|
type: integer
|
||
|
|
succeeded:
|
||
|
|
description: number of pods that completed successfully
|
||
|
|
type: integer
|
||
|
|
required:
|
||
|
|
- desired
|
||
|
|
- failed
|
||
|
|
- phase
|
||
|
|
- skipped
|
||
|
|
- succeeded
|
||
|
|
type: object
|
||
|
|
type: object
|
||
|
|
served: true
|
||
|
|
storage: true
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
- deprecated: true
|
||
|
|
deprecationWarning: v1alpha1 of the eraser API has been deprecated. Please migrate to v1.
|
||
|
|
name: v1alpha1
|
||
|
|
schema:
|
||
|
|
openAPIV3Schema:
|
||
|
|
description: ImageJob is the Schema for the imagejobs API.
|
||
|
|
properties:
|
||
|
|
apiVersion:
|
||
|
|
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||
|
|
type: string
|
||
|
|
kind:
|
||
|
|
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||
|
|
type: string
|
||
|
|
metadata:
|
||
|
|
type: object
|
||
|
|
status:
|
||
|
|
description: ImageJobStatus defines the observed state of ImageJob.
|
||
|
|
properties:
|
||
|
|
deleteAfter:
|
||
|
|
description: Time to delay deletion until
|
||
|
|
format: date-time
|
||
|
|
type: string
|
||
|
|
desired:
|
||
|
|
description: desired number of pods
|
||
|
|
type: integer
|
||
|
|
failed:
|
||
|
|
description: number of pods that failed
|
||
|
|
type: integer
|
||
|
|
phase:
|
||
|
|
description: job running, successfully completed, or failed
|
||
|
|
type: string
|
||
|
|
skipped:
|
||
|
|
description: number of nodes that were skipped e.g. because they are not a linux node
|
||
|
|
type: integer
|
||
|
|
succeeded:
|
||
|
|
description: number of pods that completed successfully
|
||
|
|
type: integer
|
||
|
|
required:
|
||
|
|
- desired
|
||
|
|
- failed
|
||
|
|
- phase
|
||
|
|
- skipped
|
||
|
|
- succeeded
|
||
|
|
type: object
|
||
|
|
type: object
|
||
|
|
served: true
|
||
|
|
storage: false
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
---
|
||
|
|
apiVersion: apiextensions.k8s.io/v1
|
||
|
|
kind: CustomResourceDefinition
|
||
|
|
metadata:
|
||
|
|
annotations:
|
||
|
|
controller-gen.kubebuilder.io/version: v0.9.0
|
||
|
|
creationTimestamp: null
|
||
|
|
name: imagelists.eraser.sh
|
||
|
|
spec:
|
||
|
|
group: eraser.sh
|
||
|
|
names:
|
||
|
|
kind: ImageList
|
||
|
|
listKind: ImageListList
|
||
|
|
plural: imagelists
|
||
|
|
singular: imagelist
|
||
|
|
scope: Cluster
|
||
|
|
versions:
|
||
|
|
- name: v1
|
||
|
|
schema:
|
||
|
|
openAPIV3Schema:
|
||
|
|
description: ImageList is the Schema for the imagelists API.
|
||
|
|
properties:
|
||
|
|
apiVersion:
|
||
|
|
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||
|
|
type: string
|
||
|
|
kind:
|
||
|
|
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||
|
|
type: string
|
||
|
|
metadata:
|
||
|
|
type: object
|
||
|
|
spec:
|
||
|
|
description: ImageListSpec defines the desired state of ImageList.
|
||
|
|
properties:
|
||
|
|
images:
|
||
|
|
description: The list of non-compliant images to delete if non-running.
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
type: array
|
||
|
|
required:
|
||
|
|
- images
|
||
|
|
type: object
|
||
|
|
status:
|
||
|
|
description: ImageListStatus defines the observed state of ImageList.
|
||
|
|
properties:
|
||
|
|
failed:
|
||
|
|
description: Number of nodes that failed to run the job
|
||
|
|
format: int64
|
||
|
|
type: integer
|
||
|
|
skipped:
|
||
|
|
description: Number of nodes that were skipped due to a skip selector
|
||
|
|
format: int64
|
||
|
|
type: integer
|
||
|
|
success:
|
||
|
|
description: Number of nodes that successfully ran the job
|
||
|
|
format: int64
|
||
|
|
type: integer
|
||
|
|
timestamp:
|
||
|
|
description: Information when the job was completed.
|
||
|
|
format: date-time
|
||
|
|
type: string
|
||
|
|
required:
|
||
|
|
- failed
|
||
|
|
- skipped
|
||
|
|
- success
|
||
|
|
- timestamp
|
||
|
|
type: object
|
||
|
|
type: object
|
||
|
|
served: true
|
||
|
|
storage: true
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
- deprecated: true
|
||
|
|
deprecationWarning: v1alpha1 of the eraser API has been deprecated. Please migrate to v1.
|
||
|
|
name: v1alpha1
|
||
|
|
schema:
|
||
|
|
openAPIV3Schema:
|
||
|
|
description: ImageList is the Schema for the imagelists API.
|
||
|
|
properties:
|
||
|
|
apiVersion:
|
||
|
|
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||
|
|
type: string
|
||
|
|
kind:
|
||
|
|
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||
|
|
type: string
|
||
|
|
metadata:
|
||
|
|
type: object
|
||
|
|
spec:
|
||
|
|
description: ImageListSpec defines the desired state of ImageList.
|
||
|
|
properties:
|
||
|
|
images:
|
||
|
|
description: The list of non-compliant images to delete if non-running.
|
||
|
|
items:
|
||
|
|
type: string
|
||
|
|
type: array
|
||
|
|
required:
|
||
|
|
- images
|
||
|
|
type: object
|
||
|
|
status:
|
||
|
|
description: ImageListStatus defines the observed state of ImageList.
|
||
|
|
properties:
|
||
|
|
failed:
|
||
|
|
description: Number of nodes that failed to run the job
|
||
|
|
format: int64
|
||
|
|
type: integer
|
||
|
|
skipped:
|
||
|
|
description: Number of nodes that were skipped due to a skip selector
|
||
|
|
format: int64
|
||
|
|
type: integer
|
||
|
|
success:
|
||
|
|
description: Number of nodes that successfully ran the job
|
||
|
|
format: int64
|
||
|
|
type: integer
|
||
|
|
timestamp:
|
||
|
|
description: Information when the job was completed.
|
||
|
|
format: date-time
|
||
|
|
type: string
|
||
|
|
required:
|
||
|
|
- failed
|
||
|
|
- skipped
|
||
|
|
- success
|
||
|
|
- timestamp
|
||
|
|
type: object
|
||
|
|
type: object
|
||
|
|
served: true
|
||
|
|
storage: false
|
||
|
|
subresources:
|
||
|
|
status: {}
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: eraser-controller-manager
|
||
|
|
namespace: eraser-system
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: eraser-imagejob-pods
|
||
|
|
namespace: eraser-system
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
creationTimestamp: null
|
||
|
|
name: eraser-imagejob-pods-cluster-role
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
creationTimestamp: null
|
||
|
|
name: eraser-manager-role
|
||
|
|
rules:
|
||
|
|
- apiGroups:
|
||
|
|
- ""
|
||
|
|
resources:
|
||
|
|
- configmaps
|
||
|
|
verbs:
|
||
|
|
- create
|
||
|
|
- delete
|
||
|
|
- get
|
||
|
|
- list
|
||
|
|
- patch
|
||
|
|
- update
|
||
|
|
- watch
|
||
|
|
- apiGroups:
|
||
|
|
- ""
|
||
|
|
resources:
|
||
|
|
- nodes
|
||
|
|
verbs:
|
||
|
|
- get
|
||
|
|
- list
|
||
|
|
- watch
|
||
|
|
- apiGroups:
|
||
|
|
- ""
|
||
|
|
resources:
|
||
|
|
- pods
|
||
|
|
verbs:
|
||
|
|
- create
|
||
|
|
- delete
|
||
|
|
- get
|
||
|
|
- list
|
||
|
|
- update
|
||
|
|
- watch
|
||
|
|
- apiGroups:
|
||
|
|
- ""
|
||
|
|
resources:
|
||
|
|
- podtemplates
|
||
|
|
verbs:
|
||
|
|
- create
|
||
|
|
- delete
|
||
|
|
- get
|
||
|
|
- list
|
||
|
|
- patch
|
||
|
|
- update
|
||
|
|
- watch
|
||
|
|
- apiGroups:
|
||
|
|
- eraser.sh
|
||
|
|
resources:
|
||
|
|
- imagejobs
|
||
|
|
verbs:
|
||
|
|
- create
|
||
|
|
- delete
|
||
|
|
- get
|
||
|
|
- list
|
||
|
|
- patch
|
||
|
|
- update
|
||
|
|
- watch
|
||
|
|
- apiGroups:
|
||
|
|
- eraser.sh
|
||
|
|
resources:
|
||
|
|
- imagejobs/status
|
||
|
|
verbs:
|
||
|
|
- get
|
||
|
|
- patch
|
||
|
|
- update
|
||
|
|
- apiGroups:
|
||
|
|
- eraser.sh
|
||
|
|
resources:
|
||
|
|
- imagelists
|
||
|
|
verbs:
|
||
|
|
- create
|
||
|
|
- delete
|
||
|
|
- get
|
||
|
|
- list
|
||
|
|
- patch
|
||
|
|
- update
|
||
|
|
- watch
|
||
|
|
- apiGroups:
|
||
|
|
- eraser.sh
|
||
|
|
resources:
|
||
|
|
- imagelists/status
|
||
|
|
verbs:
|
||
|
|
- get
|
||
|
|
- patch
|
||
|
|
- update
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: eraser-imagejob-pods-cluster-rolebinding
|
||
|
|
roleRef:
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
kind: ClusterRole
|
||
|
|
name: eraser-imagejob-pods-cluster-role
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: eraser-imagejob-pods
|
||
|
|
namespace: eraser-system
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: eraser-manager-rolebinding
|
||
|
|
roleRef:
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
kind: ClusterRole
|
||
|
|
name: eraser-manager-role
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: eraser-controller-manager
|
||
|
|
namespace: eraser-system
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
data:
|
||
|
|
controller_manager_config.yaml: |
|
||
|
|
apiVersion: eraser.sh/v1alpha3
|
||
|
|
kind: EraserConfig
|
||
|
|
manager:
|
||
|
|
runtime:
|
||
|
|
name: containerd
|
||
|
|
address: unix:///run/containerd/containerd.sock
|
||
|
|
otlpEndpoint: ""
|
||
|
|
logLevel: info
|
||
|
|
scheduling:
|
||
|
|
repeatInterval: 24h
|
||
|
|
beginImmediately: true
|
||
|
|
profile:
|
||
|
|
enabled: false
|
||
|
|
port: 6060
|
||
|
|
imageJob:
|
||
|
|
successRatio: 1.0
|
||
|
|
cleanup:
|
||
|
|
delayOnSuccess: 0s
|
||
|
|
delayOnFailure: 24h
|
||
|
|
pullSecrets: [] # image pull secrets for collector/scanner/eraser
|
||
|
|
priorityClassName: "" # priority class name for collector/scanner/eraser
|
||
|
|
nodeFilter:
|
||
|
|
type: exclude # must be either exclude|include
|
||
|
|
selectors:
|
||
|
|
- eraser.sh/cleanup.filter
|
||
|
|
- kubernetes.io/os=windows
|
||
|
|
components:
|
||
|
|
collector:
|
||
|
|
enabled: true
|
||
|
|
image:
|
||
|
|
repo: ghcr.io/eraser-dev/collector
|
||
|
|
tag: v1.4.0-beta.0
|
||
|
|
request:
|
||
|
|
mem: 25Mi
|
||
|
|
cpu: 7m
|
||
|
|
limit:
|
||
|
|
mem: 500Mi
|
||
|
|
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
|
||
|
|
cpu: 0
|
||
|
|
scanner:
|
||
|
|
enabled: true
|
||
|
|
image:
|
||
|
|
repo: ghcr.io/eraser-dev/eraser-trivy-scanner # supply custom image for custom scanner
|
||
|
|
tag: v1.4.0-beta.0
|
||
|
|
request:
|
||
|
|
mem: 500Mi
|
||
|
|
cpu: 1000m
|
||
|
|
limit:
|
||
|
|
mem: 2Gi
|
||
|
|
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
|
||
|
|
cpu: 0
|
||
|
|
# The config needs to be passed through to the scanner as yaml, as a
|
||
|
|
# single string. Because we allow custom scanner images, the scanner is
|
||
|
|
# responsible for defining a schema, parsing, and validating.
|
||
|
|
config: |
|
||
|
|
# this is the schema for the provided 'trivy-scanner'. custom scanners
|
||
|
|
# will define their own configuration.
|
||
|
|
cacheDir: /var/lib/trivy
|
||
|
|
dbRepo: ghcr.io/aquasecurity/trivy-db
|
||
|
|
deleteFailedImages: true
|
||
|
|
deleteEOLImages: true
|
||
|
|
vulnerabilities:
|
||
|
|
ignoreUnfixed: true
|
||
|
|
types:
|
||
|
|
- os
|
||
|
|
- library
|
||
|
|
securityChecks:
|
||
|
|
- vuln
|
||
|
|
severities:
|
||
|
|
- CRITICAL
|
||
|
|
- HIGH
|
||
|
|
- MEDIUM
|
||
|
|
- LOW
|
||
|
|
ignoredStatuses:
|
||
|
|
timeout:
|
||
|
|
total: 23h
|
||
|
|
perImage: 1h
|
||
|
|
remover:
|
||
|
|
image:
|
||
|
|
repo: ghcr.io/eraser-dev/remover
|
||
|
|
tag: v1.4.0-beta.0
|
||
|
|
request:
|
||
|
|
mem: 25Mi
|
||
|
|
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
|
||
|
|
cpu: 0
|
||
|
|
limit:
|
||
|
|
mem: 30Mi
|
||
|
|
cpu: 0
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: eraser-manager-config
|
||
|
|
namespace: eraser-system
|
||
|
|
---
|
||
|
|
apiVersion: apps/v1
|
||
|
|
kind: Deployment
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
control-plane: controller-manager
|
||
|
|
name: eraser-controller-manager
|
||
|
|
namespace: eraser-system
|
||
|
|
spec:
|
||
|
|
replicas: 1
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
control-plane: controller-manager
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
control-plane: controller-manager
|
||
|
|
spec:
|
||
|
|
containers:
|
||
|
|
- args:
|
||
|
|
- --config=/config/controller_manager_config.yaml
|
||
|
|
command:
|
||
|
|
- /manager
|
||
|
|
env:
|
||
|
|
- name: POD_NAMESPACE
|
||
|
|
valueFrom:
|
||
|
|
fieldRef:
|
||
|
|
apiVersion: v1
|
||
|
|
fieldPath: metadata.namespace
|
||
|
|
- name: OTEL_SERVICE_NAME
|
||
|
|
value: eraser-manager
|
||
|
|
image: ghcr.io/eraser-dev/eraser-manager:v1.4.0-beta.0
|
||
|
|
livenessProbe:
|
||
|
|
httpGet:
|
||
|
|
path: /healthz
|
||
|
|
port: 8081
|
||
|
|
initialDelaySeconds: 15
|
||
|
|
periodSeconds: 20
|
||
|
|
name: manager
|
||
|
|
readinessProbe:
|
||
|
|
httpGet:
|
||
|
|
path: /readyz
|
||
|
|
port: 8081
|
||
|
|
initialDelaySeconds: 5
|
||
|
|
periodSeconds: 10
|
||
|
|
resources:
|
||
|
|
limits:
|
||
|
|
memory: 30Mi
|
||
|
|
requests:
|
||
|
|
cpu: 100m
|
||
|
|
memory: 20Mi
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities:
|
||
|
|
drop:
|
||
|
|
- ALL
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
runAsGroup: 65532
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
volumeMounts:
|
||
|
|
- mountPath: /config
|
||
|
|
name: manager-config
|
||
|
|
nodeSelector:
|
||
|
|
kubernetes.io/os: linux
|
||
|
|
serviceAccountName: eraser-controller-manager
|
||
|
|
terminationGracePeriodSeconds: 10
|
||
|
|
volumes:
|
||
|
|
- configMap:
|
||
|
|
name: eraser-manager-config
|
||
|
|
name: manager-config
|