Skip to content

Commit d28409b

Browse files
mcrowsonmcrowson
committed
adding self-hosted-registry-assessment
1 parent 98ac15d commit d28409b

22 files changed

+1912
-0
lines changed

‎helm-charts/falcon-self-hosted-registry-assessment/.helmignore

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎helm-charts/falcon-self-hosted-registry-assessment/Chart.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: registry-scanner
3+
description: CrowdStrike Self-hosted Registry Assessment
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.0.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.0.0"

‎helm-charts/falcon-self-hosted-registry-assessment/README.md

+866
Large diffs are not rendered by default.

‎helm-charts/falcon-self-hosted-registry-assessment/ci/cid-values.yaml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
fullnameOverride: "shra"
2+
executor:
3+
image:
4+
registry: "registry.crowdstrike.com"
5+
repository: "falcon-selfhostedregistryassessment/release/falcon-registryassessmentexecutor"
6+
tag: "0.11.0"
7+
8+
dbStorage:
9+
storageClass: "standard"
10+
11+
assessmentStorage:
12+
type: "local"
13+
14+
jobController:
15+
image:
16+
registry: "registry.crowdstrike.com"
17+
repository: "falcon-selfhostedregistryassessment/release/falcon-jobcontroller"
18+
tag: "0.19.0"
19+
20+
dbStorage:
21+
storageClass: "standard"
22+
23+
crowdstrikeConfig:
24+
clientID: "abcdefABCDEF0123456789abcdefABCD"
25+
clientSecret: "abcdefABCDEF0123456789abcdefABCDEF012345"
26+
27+
registryConfigs:
28+
- type: dockerhub
29+
credentials:
30+
username: "userName"
31+
password: "password"
32+
port: "443"
33+
host: "https://registry-1.docker.io"
34+
cronSchedule: "* * * * *"

‎helm-charts/falcon-self-hosted-registry-assessment/self-hosted-registry-assessment-flow.png

361 KB
Loading

‎helm-charts/falcon-self-hosted-registry-assessment/templates/NOTES.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
The Crowdstrike Self-hosted Registry Assessment is now deployed to your cluster under the {{ .Release.Namespace }} namespace as {{ include "ra-self-hosted.fullname" . }}. You can now check if the agent is running by running the following command:
2+
3+
"kubectl -n {{ .Release.Namespace}} get pods"

‎helm-charts/falcon-self-hosted-registry-assessment/templates/_helpers.tpl

+234
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "ra-self-hosted.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "ra-self-hosted.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{- define "ra-self-hosted-executor.fullname" -}}
27+
{{- printf "%s-%s" (include "ra-self-hosted.fullname" .) "executor" | trunc 63 | trimSuffix "-" }}
28+
{{- end -}}
29+
30+
{{- define "ra-self-hosted-executor.pullsecret-name" -}}
31+
{{- printf "%s-%s-pullsecret" (include "ra-self-hosted.fullname" .) "executor" | trunc 63 | trimSuffix "-" }}
32+
{{- end -}}
33+
34+
{{- define "ra-self-hosted-job-controller.fullname" -}}
35+
{{- printf "%s-%s" (include "ra-self-hosted.fullname" .) "job-controller" | trunc 63 | trimSuffix "-" }}
36+
{{- end -}}
37+
38+
{{- define "ra-self-hosted-job-controller.pullsecret-name" -}}
39+
{{- printf "%s-%s-pullsecret" (include "ra-self-hosted.fullname" .) "job-controller" | trunc 63 | trimSuffix "-" }}
40+
{{- end -}}
41+
42+
{{/*
43+
Create chart name and version as used by the chart label.
44+
*/}}
45+
{{- define "ra-self-hosted.chart" -}}
46+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
47+
{{- end }}
48+
49+
{{/*
50+
Common labels
51+
*/}}
52+
{{- define "ra-self-hosted.labels-executor" -}}
53+
helm.sh/chart: {{ include "ra-self-hosted.chart" . }}
54+
{{ include "ra-self-hosted-executor.selectorLabels" . }}
55+
{{- if .Chart.AppVersion }}
56+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
57+
{{- end }}
58+
app.kubernetes.io/managed-by: {{ .Release.Service }}
59+
{{- if .Values.executor.labels }}
60+
{{ .Values.executor.labels }}
61+
{{- end }}
62+
{{- end }}
63+
64+
{{- define "ra-self-hosted-job-controller.labels" -}}
65+
helm.sh/chart: {{ include "ra-self-hosted.chart" . }}
66+
{{ include "ra-self-hosted-job-controller.selectorLabels" . }}
67+
{{- if .Chart.AppVersion }}
68+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
69+
{{- end }}
70+
app.kubernetes.io/managed-by: {{ .Release.Service }}
71+
{{- if .Values.jobController.labels }}
72+
{{ .Values.jobController.labels }}
73+
{{- end }}
74+
{{- end }}
75+
76+
{{- define "ra-self-hosted.labels" -}}
77+
helm.sh/chart: {{ include "ra-self-hosted.chart" . }}
78+
{{ include "ra-self-hosted.selectorLabels" . }}
79+
{{- if .Chart.AppVersion }}
80+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
81+
{{- end }}
82+
app.kubernetes.io/managed-by: {{ .Release.Service }}
83+
{{- if .Values.jobController.labels }}
84+
{{ .Values.jobController.labels }}
85+
{{- end }}
86+
{{- end }}
87+
88+
{{/*
89+
Selector labels
90+
*/}}
91+
{{- define "ra-self-hosted-executor.selectorLabels" -}}
92+
app.kubernetes.io/name: {{ include "ra-self-hosted.name" . }}
93+
app.kubernetes.io/instance: {{ .Release.Name }}
94+
app.kubernetes.io/component: executor
95+
{{- end }}
96+
97+
{{- define "ra-self-hosted-job-controller.selectorLabels" -}}
98+
app.kubernetes.io/name: {{ include "ra-self-hosted.name" . }}
99+
app.kubernetes.io/instance: {{ .Release.Name }}
100+
app.kubernetes.io/component: job-controller
101+
{{- end }}
102+
103+
{{- define "ra-self-hosted.selectorLabels" -}}
104+
app.kubernetes.io/name: {{ include "ra-self-hosted.name" . }}
105+
app.kubernetes.io/instance: {{ .Release.Name }}
106+
{{- end }}
107+
108+
{{- define "ra-self-hosted-executor.imageRegistry" -}}
109+
{{- .Values.executor.image.registry -}}
110+
{{- end -}}
111+
112+
{{- define "ra-self-hosted-executor.imageRepo" -}}
113+
{{- .Values.executor.image.repository -}}
114+
{{- end -}}
115+
116+
117+
{{- define "ra-self-hosted-executor.image" -}}
118+
{{- if .Values.executor.image.digest -}}
119+
{{- if contains "sha256:" .Values.executor.image.digest -}}
120+
{{- printf "%s/%s@%s" (include "ra-self-hosted-executor.imageRegistry" .) (include "ra-self-hosted-executor.imageRepo" .) .Values.executor.image.digest -}}
121+
{{- else -}}
122+
{{- printf "%s/%s@%s" (include "ra-self-hosted-executor.imageRegistry" .) (include "ra-self-hosted-executor.imageRepo" .) "sha256" .Values.executor.image.digest -}}
123+
{{- end -}}
124+
{{- else -}}
125+
{{- printf "%s/%s:%s" (include "ra-self-hosted-executor.imageRegistry" .) (include "ra-self-hosted-executor.imageRepo" .) .Values.executor.image.tag -}}
126+
{{- end -}}
127+
{{- end -}}
128+
129+
{{- define "ra-self-hosted-job-controller.imageRegistry" -}}
130+
{{- .Values.jobController.image.registry -}}
131+
{{- end -}}
132+
133+
{{- define "ra-self-hosted-job-controller.imageRepo" -}}
134+
{{- .Values.jobController.image.repository -}}
135+
{{- end -}}
136+
137+
138+
{{- define "ra-self-hosted-job-controller.image" -}}
139+
{{- if .Values.jobController.image.digest -}}
140+
{{- if contains "sha256:" .Values.jobController.image.digest -}}
141+
{{- printf "%s/%s@%s" (include "ra-self-hosted-job-controller.imageRegistry" .) (include "ra-self-hosted-job-controller.imageRepo" .) .Values.jobController.image.digest -}}
142+
{{- else -}}
143+
{{- printf "%s/%s@%s" (include "ra-self-hosted-job-controller.imageRegistry" .) (include "ra-self-hosted-job-controller.imageRepo" .) "sha256" .Values.jobController.image.digest -}}
144+
{{- end -}}
145+
{{- else -}}
146+
{{- printf "%s/%s:%s" (include "ra-self-hosted-job-controller.imageRegistry" .) (include "ra-self-hosted-job-controller.imageRepo" .) .Values.jobController.image.tag -}}
147+
{{- end -}}
148+
{{- end -}}
149+
150+
{{- define "ra-self-hosted-job-controller.db-pvc-name" -}}
151+
{{- if .Values.jobController.dbStorage.create -}} {{- printf "%s-%s" (include "ra-self-hosted-job-controller.fullname" .) "db" | trunc 63 -}} {{- else -}} {{ .Values.jobController.dbStorage.existingClaimName }} {{- end -}}
152+
{{- end -}}
153+
154+
{{- define "ra-self-hosted-executor.db-pvc-name" -}}
155+
{{- if .Values.executor.dbStorage.create -}} {{- printf "%s-%s" (include "ra-self-hosted-executor.fullname" .) "db" | trunc 63 -}} {{- else -}} {{ .Values.executor.dbStorage.existingClaimName }} {{- end -}}
156+
{{- end -}}
157+
158+
{{- define "ra-self-hosted-executor.storage-pvc-name" -}}
159+
{{- if .Values.executor.assessmentStorage.pvc.create -}} {{- printf "%s-%s" (include "ra-self-hosted-executor.fullname" .) "storage" | trunc 63 -}} {{- else -}} {{ .Values.executor.assessmentStorage.pvc.existingClaimName }} {{- end -}}
160+
{{- end -}}
161+
162+
{{- define "ra-self-hosted-executor.registry-credentials-json" -}}
163+
{{- $creds := list -}}
164+
{{- range $k, $v := .Values.registryConfigs -}}
165+
{{- $cred := dict -}}
166+
{{- $cred = set $cred "registry_type" $v.type -}}
167+
{{- $cred = set $cred "registry_host" $v.host -}}
168+
{{- $cred = set $cred "registry_port" $v.port -}}
169+
{{- $credDetails := dict -}}
170+
{{- $credsDict := (include "yamlToJson" $v.credentials | fromYaml )}}
171+
{{- $credString := ($credsDict | toString)}}
172+
{{- $credDetails = set $credDetails "details" $credsDict -}}
173+
{{- $cred = set $cred "credential" $credDetails -}}
174+
{{- $cred = set $cred "registry_id" (sha256sum (printf "%v:%v:%v" $v.host $v.port $credString)) -}}
175+
{{- $creds = append $creds $cred }}
176+
{{- end -}}
177+
{{ toPrettyJson $creds }}
178+
{{- end -}}
179+
180+
{{- define "ra-self-hosted-job-controller.job-configs-json" -}}
181+
{{- $jobs := list -}}
182+
{{- $heartBeatJob := dict }}
183+
{{- $heartBeatJob = set $heartBeatJob "type" "agent_heartbeat" -}}
184+
{{- $heartBeatJob = set $heartBeatJob "cron_schedule" "* * * * *" -}}
185+
{{- $jobs = append $jobs $heartBeatJob -}}
186+
{{- range $k, $v := .Values.registryConfigs -}}
187+
{{- $job := dict -}}
188+
{{- $job = set $job "type" "registry_collection" -}}
189+
{{- $job = set $job "cron_schedule" $v.cronSchedule -}}
190+
{{- $props := dict -}}
191+
{{- $props = set $props "registry_host" $v.host -}}
192+
{{- $props = set $props "registry_port" $v.port -}}
193+
{{- $props = set $props "registry_type" $v.type -}}
194+
{{- $credsDict := (include "yamlToJson" $v.credentials | fromYaml )}}
195+
{{- $credString := ($credsDict | toString)}}
196+
{{- $props = set $props "registry_allowed_repositories" $v.allowedRepositories -}}
197+
{{- $props = set $props "registry_id" (sha256sum (printf "%v:%v:%v" $v.host $v.port $credString)) -}}
198+
{{- $job = set $job "properties" $props -}}
199+
{{- $jobs = append $jobs $job -}}
200+
{{- end -}}
201+
{{- toPrettyJson $jobs -}}
202+
{{- end -}}
203+
204+
{{- define "ra-self-hosted-job-controller.job-type-configs-json" -}}
205+
{{- $configs := list -}}
206+
{{- range $k, $v := .Values.crowdstrikeConfig.jobTypeConfigs -}}
207+
{{- $configs = append $configs (set (include "yamlToJson" $v | fromYaml) "name" (snakecase $k)) -}}
208+
{{- end -}}
209+
{{- $heartBeatConfig := dict }}
210+
{{- $heartBeatConfig = set $heartBeatConfig "name" "agent_heartbeat" -}}
211+
{{- $heartBeatConfig = set $heartBeatConfig "threads_per_pod" 1 -}}
212+
{{- $configs = append $configs $heartBeatConfig -}}
213+
{{- toPrettyJson $configs -}}
214+
{{- end -}}
215+
216+
{{- define "yamlToJson" -}}
217+
{{- $config := dict -}}
218+
{{- range $k, $v := . -}}
219+
{{- if kindIs "map" $v -}}
220+
{{- $config = set $config (snakecase $k) (include "yamlToJson" $v | fromYaml ) -}}
221+
{{- else -}}
222+
{{- $config = set $config (snakecase $k) $v -}}
223+
{{- end -}}
224+
{{- end -}}
225+
{{- $config | toYaml -}}
226+
{{- end -}}
227+
228+
{{- define "ra-self-hosted.cert-secret-name" }}
229+
{{- if .Values.tls.useCertManager -}}
230+
{{- printf "%s-%s" (include "ra-self-hosted.fullname" .) "tls" | trunc 63 }}
231+
{{- else -}}
232+
{{- .Values.tls.existingSecret -}}
233+
{{- end -}}
234+
{{- end -}}

‎helm-charts/falcon-self-hosted-registry-assessment/templates/cetificate.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if (and .Values.tls.enable .Values.tls.useCertManager) -}}
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: {{ include "ra-self-hosted.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{ include "ra-self-hosted.labels" . | indent 4 }}
9+
spec:
10+
secretName: {{ include "ra-self-hosted.cert-secret-name" . }}
11+
issuerRef:
12+
{{ .Values.tls.issuer | toYaml | indent 4 }}
13+
dnsNames:
14+
- {{ include "ra-self-hosted-job-controller.fullname" . }}
15+
duration: "2160h"
16+
renewBefore: "360h"
17+
{{- end -}}

‎helm-charts/falcon-self-hosted-registry-assessment/templates/executor-cluster-role.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "ra-self-hosted-executor.fullname" . }}
5+
labels:
6+
{{- include "ra-self-hosted.labels-executor" . | nindent 4 }}
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- secrets
12+
- namespaces
13+
verbs:
14+
- get
15+
- watch
16+
- list

‎helm-charts/falcon-self-hosted-registry-assessment/templates/executor-comfigmap.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if .Values.registryConfigs -}}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "ra-self-hosted-executor.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "ra-self-hosted.labels-executor" . | nindent 4 }}
9+
data:
10+
REGISTRY_CREDENTIALS: |-
11+
{{ include "ra-self-hosted-executor.registry-credentials-json" . | indent 4 }}
12+
{{- if .Values.proxyConfig.HTTP_PROXY }}
13+
HTTP_PROXY: {{ .Values.proxyConfig.HTTP_PROXY }}
14+
{{- end }}
15+
{{- if .Values.proxyConfig.HTTPS_PROXY }}
16+
HTTPS_PROXY: {{ .Values.proxyConfig.HTTPS_PROXY }}
17+
{{- end }}
18+
{{- if .Values.proxyConfig.NO_PROXY }}
19+
NO_PROXY: {{ .Values.proxyConfig.NO_PROXY }}
20+
{{- end }}
21+
{{- end -}}

‎helm-charts/falcon-self-hosted-registry-assessment/templates/executor-db-pvc.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{ if .Values.executor.dbStorage.create -}}
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: {{ include "ra-self-hosted-executor.db-pvc-name" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "ra-self-hosted.labels-executor" . | nindent 4 }}
9+
spec:
10+
accessModes:
11+
{{- .Values.executor.dbStorage.accessModes | toYaml | nindent 4 }}
12+
storageClassName: {{ .Values.executor.dbStorage.storageClass }}
13+
resources:
14+
requests:
15+
storage: {{ .Values.executor.dbStorage.size }}
16+
{{ end -}}

0 commit comments

Comments
 (0)