Skip to content

Commit 0b85bd6

Browse files
Rolika4Kostiantyn Krykun
Rolika4
authored and
Kostiantyn Krykun
committed
EPMDEDP-16261: feat: add kube-audit application
1 parent 4456631 commit 0b85bd6

17 files changed

Lines changed: 348 additions & 6 deletions

File tree

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@ bin/
22

33
charts/
44
Chart.lock
5+
6+
.vscode/

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ The repository provides a wide range of pre-configured add-ons for Kubernetes cl
200200
| keycloak-postgresql | 0.1.1 | 1.0 | security | False | False |
201201
| keycloak-operator | 1.29.0 | 1.29.0 | keycloak-operator | False | False |
202202
| krakend | 0.1.36 | 2.7.2 | krci-krakend | False | False |
203+
| kube-audit-rest | 1.0.26 | 1.0.26 | kube-audit-rest | False | False |
203204
| kuberocketci-pipelines | N/A | N/A | krci | False | False |
204205
| kuberocketci-rbac | 0.1.0 | 0.1.0 | krci-security | False | False |
205206
| kuberocketci | 3.12.4 | 3.12.4 | krci | False | False |

‎clusters/core/addons/kube-audit-rest/Chart.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v2
2+
name: kube-audit-rest
3+
description: A Helm chart for Kube Audit REST - a simple logger of mutation/creation requests to the k8s API
4+
5+
# Application charts are a collection of templates that can be packaged into versioned archives
6+
# to be deployed.
7+
type: application
8+
9+
# The chart version. This version number should be incremented each time you make changes
10+
# to the chart and its templates, including the app version.
11+
version: 1.0.28
12+
13+
# Version number of the application being deployed. This version number should be
14+
# incremented each time you make changes to the application.
15+
appVersion: "1.0.28"

‎clusters/core/addons/kube-audit-rest/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# kube-audit-rest
2+
3+
![Version: 1.0.26](https://img.shields.io/badge/Version-1.0.26-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.26](https://img.shields.io/badge/AppVersion-1.0.26-informational?style=flat-square)
4+
5+
A Helm chart for Kube Audit REST - a simple logger of mutation/creation requests to the k8s API
6+
7+
## Values
8+
9+
| Key | Type | Default | Description |
10+
|-----|------|---------|-------------|
11+
| args | list | `["--logger-filename=/dev/stdout"]` | kube-audit-rest binary args |
12+
| automountServiceAccountToken | bool | `false` | |
13+
| image.pullPolicy | string | `"IfNotPresent"` | |
14+
| image.repository | string | `"ghcr.io/richardoc/kube-audit-rest"` | |
15+
| image.tag | string | `"1.0.26-distroless"` | |
16+
| metricsPort | int | `55555` | Prometheus metrics port |
17+
| podSecurityContext.fsGroup | int | `255999` | |
18+
| podSecurityContext.runAsGroup | int | `255999` | |
19+
| podSecurityContext.runAsUser | int | `255999` | |
20+
| replicas | int | `1` | |
21+
| resources.limits.cpu | string | `"1"` | |
22+
| resources.limits.memory | string | `"32Mi"` | |
23+
| resources.requests.cpu | string | `"2m"` | |
24+
| resources.requests.memory | string | `"10Mi"` | |
25+
| securityContext.allowPrivilegeEscalation | bool | `false` | |
26+
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
27+
| securityContext.readOnlyRootFilesystem | bool | `true` | |
28+
| serverPort | int | `9090` | HTTPS server port |
29+
| service.port | int | `443` | |
30+
| service.type | string | `"ClusterIP"` | |
31+
| tls | object | `{"certManager":{"enabled":true,"issuerRef":{"kind":"Issuer","name":"selfsigned-issuer"}},"duration":"8760h","renewBefore":"720h"}` | TLS certificate configuration kube-audit-rest requires TLS for the webhook |
32+
| tls.certManager | object | `{"enabled":true,"issuerRef":{"kind":"Issuer","name":"selfsigned-issuer"}}` | Use cert-manager to generate certificates |
33+
| tls.duration | string | `"8760h"` | Certificate duration (e.g. 8760h = 1 year) |
34+
| tls.renewBefore | string | `"720h"` | Certificate renew before expiry |
35+
| tmpSizeLimit | string | `"2Gi"` | Volume size limit for audit log tmp storage |
36+
| webhook | object | `{"failurePolicy":"Ignore","rules":[{"apiGroups":["*"],"apiVersions":["*"],"operations":["CREATE","UPDATE","DELETE"],"resources":["*/*"],"scope":"*"}],"timeoutSeconds":1}` | ValidatingWebhookConfiguration settings |
37+
| webhook.failurePolicy | string | `"Ignore"` | Fail open so audit failures don't block API calls |
38+
| webhook.rules | list | `[{"apiGroups":["*"],"apiVersions":["*"],"operations":["CREATE","UPDATE","DELETE"],"resources":["*/*"],"scope":"*"}]` | Rules for which API calls to audit |
39+
| webhook.timeoutSeconds | int | `1` | Timeout in seconds for webhook calls |
40+

‎clusters/core/addons/kube-audit-rest/templates/kube-audit/certificate.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if .Values.tls.certManager.enabled }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: {{ .Release.Name }}-tls
6+
spec:
7+
secretName: {{ .Release.Name }}-tls
8+
duration: {{ .Values.tls.duration }}
9+
renewBefore: {{ .Values.tls.renewBefore }}
10+
issuerRef:
11+
name: {{ .Values.tls.certManager.issuerRef.name }}
12+
kind: {{ .Values.tls.certManager.issuerRef.kind }}
13+
dnsNames:
14+
- {{ .Release.Name }}
15+
- {{ .Release.Name }}.{{ .Release.Namespace }}
16+
- {{ .Release.Name }}.{{ .Release.Namespace }}.svc
17+
- {{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local
18+
{{- end }}

‎clusters/core/addons/kube-audit-rest/templates/kube-audit/deployment.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: kube-audit-rest
5+
labels:
6+
app: {{ .Release.Name }}
7+
spec:
8+
progressDeadlineSeconds: 600
9+
replicas: {{ .Values.replicas }}
10+
revisionHistoryLimit: 10
11+
selector:
12+
matchLabels:
13+
app: {{ .Release.Name }}
14+
strategy:
15+
rollingUpdate:
16+
maxSurge: 25%
17+
maxUnavailable: 25%
18+
type: RollingUpdate
19+
template:
20+
metadata:
21+
labels:
22+
app: {{ .Release.Name }}
23+
spec:
24+
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
25+
containers:
26+
- name: {{ .Release.Name }}
27+
image: "{{ .Values.image.repository }}{{- if .Values.image.tag }}:{{ .Values.image.tag }}{{- end }}{{- if .Values.image.digest }}@{{ .Values.image.digest }}{{- end }}"
28+
imagePullPolicy: {{ .Values.image.pullPolicy }}
29+
command:
30+
- "/kube-audit-rest"
31+
args:
32+
{{- toYaml .Values.args | nindent 12 }}
33+
ports:
34+
- containerPort: {{ .Values.serverPort }}
35+
protocol: TCP
36+
name: https
37+
- containerPort: {{ .Values.metricsPort }}
38+
protocol: TCP
39+
name: metrics
40+
resources:
41+
{{- toYaml .Values.resources | nindent 12 }}
42+
volumeMounts:
43+
- name: certs
44+
mountPath: "/etc/tls"
45+
readOnly: true
46+
- name: tmp
47+
mountPath: "/tmp"
48+
securityContext:
49+
{{- toYaml .Values.securityContext | nindent 12 }}
50+
securityContext:
51+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
52+
restartPolicy: Always
53+
terminationGracePeriodSeconds: 30
54+
volumes:
55+
- name: certs
56+
secret:
57+
secretName: {{ .Release.Name }}-tls
58+
- name: tmp
59+
emptyDir:
60+
sizeLimit: {{ .Values.tmpSizeLimit }}

‎clusters/core/addons/kube-audit-rest/templates/kube-audit/issuer.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if .Values.tls.certManager.enabled }}
2+
{{- if eq .Values.tls.certManager.issuerRef.kind "Issuer" }}
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: {{ .Values.tls.certManager.issuerRef.name }}
7+
spec:
8+
selfSigned: {}
9+
{{- end }}
10+
{{- end }}

‎clusters/core/addons/kube-audit-rest/templates/kube-audit/service.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Release.Name }}
5+
labels:
6+
app: {{ .Release.Name }}
7+
spec:
8+
type: {{ .Values.service.type }}
9+
ports:
10+
- name: https
11+
port: {{ .Values.service.port }}
12+
protocol: TCP
13+
targetPort: https
14+
- name: metrics
15+
port: {{ .Values.metricsPort }}
16+
protocol: TCP
17+
targetPort: metrics
18+
selector:
19+
app: {{ .Release.Name }}

‎clusters/core/addons/kube-audit-rest/templates/kube-audit/validating-webhook.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: ValidatingWebhookConfiguration
3+
metadata:
4+
name: {{ .Release.Name }}
5+
labels:
6+
app: {{ .Release.Name }}
7+
annotations:
8+
{{- if .Values.tls.certManager.enabled }}
9+
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Release.Name }}-tls
10+
{{- end }}
11+
webhooks:
12+
- name: {{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local
13+
failurePolicy: {{ .Values.webhook.failurePolicy }}
14+
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
15+
sideEffects: None
16+
admissionReviewVersions: ["v1"]
17+
clientConfig:
18+
service:
19+
name: {{ .Release.Name }}
20+
namespace: {{ .Release.Namespace }}
21+
path: "/log-request"
22+
rules:
23+
{{- toYaml .Values.webhook.rules | nindent 6 }}

‎clusters/core/addons/kube-audit-rest/values.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# kube-audit-rest configuration
2+
# https://github.com/RichardoC/kube-audit-rest
3+
4+
image:
5+
repository: ghcr.io/richardoc/kube-audit-rest
6+
tag: "1.0.28-distroless"
7+
digest: "sha256:d0e01df0f60c1cb96c85d9f31a6eb9c2d2a40e74ec78188da4d41cd09ce29e89"
8+
pullPolicy: IfNotPresent
9+
10+
replicas: 1
11+
12+
# -- kube-audit-rest binary args
13+
args:
14+
- "--logger-filename=/dev/stdout"
15+
16+
# -- HTTPS server port
17+
serverPort: 9090
18+
19+
# -- Prometheus metrics port
20+
metricsPort: 55555
21+
22+
resources:
23+
requests:
24+
cpu: "2m"
25+
memory: "10Mi"
26+
limits:
27+
cpu: "1"
28+
memory: "32Mi"
29+
30+
# -- Volume size limit for audit log tmp storage
31+
tmpSizeLimit: 2Gi
32+
33+
securityContext:
34+
allowPrivilegeEscalation: false
35+
readOnlyRootFilesystem: true
36+
capabilities:
37+
drop:
38+
- ALL
39+
40+
podSecurityContext:
41+
runAsUser: 255999
42+
runAsGroup: 255999
43+
fsGroup: 255999
44+
45+
automountServiceAccountToken: false
46+
47+
# -- TLS certificate configuration
48+
# kube-audit-rest requires TLS for the webhook
49+
tls:
50+
# -- Use cert-manager to generate certificates
51+
certManager:
52+
enabled: true
53+
issuerRef:
54+
name: selfsigned-issuer
55+
kind: Issuer
56+
# -- Certificate duration (e.g. 8760h = 1 year)
57+
duration: 8760h
58+
# -- Certificate renew before expiry
59+
renewBefore: 720h
60+
61+
service:
62+
type: ClusterIP
63+
port: 443
64+
65+
# -- ValidatingWebhookConfiguration settings
66+
webhook:
67+
# -- Fail open so audit failures don't block API calls
68+
failurePolicy: Ignore
69+
# -- Timeout in seconds for webhook calls
70+
timeoutSeconds: 1
71+
# -- Rules for which API calls to audit
72+
rules:
73+
- operations: ["CREATE", "UPDATE", "DELETE"]
74+
apiGroups: ["*"]
75+
apiVersions: ["*"]
76+
resources: ["*/*"]
77+
scope: "*"

0 commit comments

Comments
 (0)