Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit fec3474

Browse files
danielpacakdanielpacak
authored
chore: Create template for OLM bundle (#33)
Signed-off-by: Daniel Pacak <[email protected]>
1 parent d75694d commit fec3474

18 files changed

+737
-154
lines changed

‎CONTRIBUTING.md

+213
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
# Contributing
2+
3+
These guidelines will help you get started with the Starboard Operator project.
4+
5+
## Prerequisites
6+
7+
1. Install Go
8+
9+
The project requires [Go 1.14][go-download] or later. We also assume that you're familiar with
10+
Go's [GOPATH workspace][go-code] convention, and have the appropriate environment variables set.
11+
2. Get the source code:
12+
13+
```
14+
$ git clone [email protected]:aquasecurity/starboard-operator.git
15+
$ cd starboard-operator
16+
```
17+
3. Access to a dev Kubernetes cluster. We assume that you're using a single-node [KIND][kind] cluster created with the
18+
following command:
19+
20+
```
21+
$ kind create cluster
22+
```
23+
24+
## Deployment
25+
26+
You'll deploy the operator in the `starboard-operator` Namespace and configure it to watch the `starboard-operator`
27+
Namespace. In OLM terms such install mode is called `OwnNamespace` and is suitable for end users who want to install
28+
the operator in the same namespace as supervised workloads.
29+
30+
> The `OwnNamespace` mode is good to get started with a basic development workflow. For other install modes see
31+
> [Operator Multitenancy with OperatorGroups][olm-operator-groups].
32+
33+
### Prerequisites
34+
35+
1. Build Docker images:
36+
37+
```
38+
$ export GOOS=linux
39+
$ make docker-build
40+
```
41+
42+
This will build the `docker.io/aquasec/starboard-operator:dev` as well as `docker.io/aquasec/starboard-scanner-aqua:dev`
43+
images. The second image is only used when you enable the Aqua CSP scanner. By default Trivy is used as vulnerability
44+
scanner by pulling its official image accessible from DockerHub (`docker.io/aquasec/trivy:$TRIVY_VERSION`).
45+
2. Load Docker images into the cluster node:
46+
47+
```
48+
$ kind load docker-image aquasec/starboard-operator:dev
49+
$ kind load docker-image aquasec/starboard-scanner-aqua:dev
50+
```
51+
3. Send the definition of the VulnerabilityReport custom resource to the Kubernetes API:
52+
53+
```
54+
$ kubectl apply -f https://raw.githubusercontent.com/aquasecurity/starboard/master/kube/crd/vulnerabilityreports-crd.yaml
55+
```
56+
4. Send the following Kubernetes objects definitions to the Kubernetes API:
57+
58+
```
59+
$ kubectl apply -f deploy/kubectl/01-starboard-operator.ns.yaml \
60+
-f deploy/kubectl/02-starboard-operator.sa.yaml
61+
-f deploy/kubectl/03-starboard-operator.role.yaml
62+
-f deploy/kubectl/04-starboard-operator.rolebinding.yaml
63+
```
64+
65+
This will create the `starboard-operator` Namespace, and the `starboard-operator` ServiceAccount. Beyond that,
66+
it will create the `starboard-operator` Role and bind it to the `starboard-operator` ServiceAccount in the
67+
`starboard-operator` Namespace via the `starboard-operator` RoleBinding.
68+
69+
### In cluster
70+
71+
1. Create the `starboard-operator` Deployment in the `starboard-operator` namespace to run the operator's container:
72+
73+
```
74+
$ kubectl apply -f deploy/kubectl/05-starboard-operator.deployment.yaml
75+
```
76+
77+
### Out of cluster
78+
79+
1. Run the main method of the operator program:
80+
81+
```
82+
$ go run cmd/operator/main.go
83+
```
84+
85+
### Enable Aqua CSP scanner
86+
87+
1. Create the `starboard-operator` secret in the `starboard-operator` namespace that holds the scanner's configuration:
88+
89+
```
90+
$ kubectl create secret generic starboard-operator \
91+
--namespace starboard-operator \
92+
--from-literal OPERATOR_SCANNER_AQUA_CSP_USERNAME=$AQUA_CONSOLE_USERNAME \
93+
--from-literal OPERATOR_SCANNER_AQUA_CSP_PASSWORD=$AQUA_CONSOLE_PASSWORD \
94+
--from-literal OPERATOR_SCANNER_AQUA_CSP_VERSION=$AQUA_VERSION \
95+
--from-literal OPERATOR_SCANNER_AQUA_CSP_HOST=http://csp-console-svc.aqua:8080
96+
```
97+
98+
## Operator Lifecycle Manager
99+
100+
### Prerequisites
101+
102+
1. Install [Operator Lifecycle Manager][olm] (OLM) and [Operator Marketplace][operator-marketplace]:
103+
104+
```
105+
$ ./deploy/olm/install.sh
106+
```
107+
108+
2. Install [Operator Courier][operator-courier]:
109+
110+
```
111+
$ pip3 install operator-courier
112+
```
113+
3. [Sign up][quay] for a free Quay.io account if you're a new user.
114+
115+
### Build OLM bundle
116+
117+
1. Lint the OLM bundle:
118+
119+
```
120+
$ BUNDLE_SRC_DIR=deploy/olm/bundle
121+
$ operator-courier verify $BUNDLE_SRC_DIR
122+
```
123+
2. Retrieve a Quay.io token:
124+
```
125+
$ QUAY_USERNAME=<your quay.io username>
126+
$ QUAY_PASSWORD=<your quay.io password>
127+
$ QUAY_URL=https://quay.io/cnr/api/v1/users/login
128+
129+
$ QUAY_TOKEN=$(curl -s -H "Content-Type: application/json" -XPOST $QUAY_URL -d \
130+
'{"user":{"username":"'"${QUAY_USERNAME}"'","password": "'"${QUAY_PASSWORD}"'"}}' |
131+
jq -r .token)
132+
```
133+
3. Push the OLM bundle to Quay.io:
134+
```
135+
$ QUAY_NAMESPACE=<quay.io namespace>
136+
$ PACKAGE_NAME=starboard-operator
137+
$ PACKAGE_VERSION=<next package version>
138+
139+
$ operator-courier push "$BUNDLE_SRC_DIR" "$QUAY_NAMESPACE" \
140+
"$PACKAGE_NAME" "$PACKAGE_VERSION" "$QUAY_TOKEN"
141+
```
142+
143+
### Create ClusterServiceVersion
144+
145+
1. Create the OperatorSource resource:
146+
147+
```
148+
QUAY_FULL_NAME=<your quay.io full name>
149+
$ cat << EOF | kubectl apply -f -
150+
apiVersion: operators.coreos.com/v1
151+
kind: OperatorSource
152+
metadata:
153+
name: $QUAY_USERNAME-operators
154+
namespace: marketplace
155+
spec:
156+
type: appregistry
157+
endpoint: https://quay.io/cnr
158+
displayName: "$QUAY_FULL_NAME Quay.io Applications"
159+
publisher: "$QUAY_FULL_NAME"
160+
registryNamespace: "$QUAY_USERNAME"
161+
EOF
162+
```
163+
164+
An OperatorSource resource defines the external data store used to host operator bundles. In this case, you will be
165+
defining an OperatorSource to point to your Quay.io account, which will provide access to its hosted OLM bundles.
166+
167+
2. Create the OperatorGroup resource:
168+
169+
```
170+
$ cat << EOF | kubectl apply -f -
171+
apiVersion: operators.coreos.com/v1alpha2
172+
kind: OperatorGroup
173+
metadata:
174+
name: workloads
175+
namespace: marketplace
176+
spec:
177+
targetNamespaces:
178+
- marketplace
179+
EOF
180+
```
181+
182+
You'll need an OperatorGroup to denote which namespaces the operator should watch. It must exist in the namespace
183+
where you want to deploy the operator.
184+
185+
3. Create the Subscription resource:
186+
187+
```
188+
cat << EOF | kubectl apply -f -
189+
apiVersion: operators.coreos.com/v1alpha1
190+
kind: Subscription
191+
metadata:
192+
name: starboard-operator
193+
namespace: marketplace
194+
spec:
195+
channel: alpha
196+
name: starboard-operator
197+
source: $QUAY_NAMESPACE-operators
198+
sourceNamespace: marketplace
199+
EOF
200+
```
201+
202+
A Subscription links the previous steps together by selecting an operator and one of its channels. OLM uses this
203+
information to start the corresponding operator Pod. The example above creates a new Subscription to the `alpha`
204+
channel for the Starboard Operator.
205+
206+
[go-download]: https://golang.org/dl/
207+
[go-code]: https://golang.org/doc/code.html
208+
[kind]: https://github.com/kubernetes-sigs/kind
209+
[olm]: https://github.com/operator-framework/operator-lifecycle-manager
210+
[operator-marketplace]: https://github.com/operator-framework/operator-marketplace
211+
[operator-courier]: https://github.com/operator-framework/operator-courier
212+
[olm-operator-groups]: https://github.com/operator-framework/operator-lifecycle-manager/blob/master/doc/design/operatorgroups.md
213+
[quay]: https://quay.io

‎README.md

+7-28
Original file line numberDiff line numberDiff line change
@@ -9,40 +9,19 @@ This operator for Starboard automatically updates security report resources in r
99
a Kubernetes cluster - for example, initiating a vulnerability scan when a new pod is started. Please see the main
1010
[Starboard][starboard] repo for more info about the Starboard project.
1111

12-
## Getting started
12+
## Contributing
1313

14-
1. Run `make` to build operator binaries into Docker containers:
15-
```
16-
$ make docker-build
17-
```
18-
1. Define Custom Security Resources used by Starboard:
19-
```
20-
$ kubectl apply -f https://raw.githubusercontent.com/aquasecurity/starboard/master/kube/crd/vulnerabilityreports-crd.yaml
21-
```
22-
2. Create the `starboard-operator` Namespace:
23-
```
24-
$ kubectl create ns starboard-operator
25-
```
26-
3. Create a Secret that holds configuration of the Aqua CSP scanner:
27-
```
28-
$ kubectl create secret generic starboard-operator \
29-
--namespace starboard-operator \
30-
--from-literal OPERATOR_SCANNER_AQUA_CSP_USERNAME=$AQUA_CONSOLE_USERNAME \
31-
--from-literal OPERATOR_SCANNER_AQUA_CSP_PASSWORD=$AQUA_CONSOLE_PASSWORD \
32-
--from-literal OPERATOR_SCANNER_AQUA_CSP_VERSION=$AQUA_VERSION \
33-
--from-literal OPERATOR_SCANNER_AQUA_CSP_HOST=http://csp-console-svc.aqua:8080
34-
```
35-
5. Create a Deployment for the Starboard Operator:
36-
```
37-
$ kubectl apply -f deploy/starboard-operator.yaml
38-
```
14+
Thanks for taking the time to join our community and start contributing!
15+
16+
- See [CONTRIBUTING.md](CONTRIBUTING.md) for information about setting up your development environment and deploying the operator.
17+
- Check out the [open issues](https://github.com/aquasecurity/starboard-operator/issues).
3918

4019
## Configuration
4120

4221
| Name | Default | Description |
4322
|-----------------------------------------|----------------------|-------------|
44-
| `OPERATOR_NAMESPACE` | `` | The namespace the operator is running in. |
45-
| `OPERATOR_TARGET_NAMESPACE` | `` | The namespace the operator should be watching for changes. This can be a comma separated list of names to watch multiple namespaces (e.g. `ns1,ns2`). |
23+
| `OPERATOR_NAMESPACE` | N/A | The namespace the operator is running in. |
24+
| `OPERATOR_TARGET_NAMESPACES` | N/A | The namespace the operator should be watching for changes. This can be a comma separated list of names to watch multiple namespaces (e.g. `ns1,ns2`). |
4625
| `OPERATOR_SCAN_JOB_TIMEOUT` | `5m` | The length of time to wait before giving up on a scan job |
4726
| `OPERATOR_SCANNER_TRIVY_ENABLED` | `true` | The flag to enable Trivy vulnerability scanner |
4827
| `OPERATOR_SCANNER_TRIVY_VERSION` | `0.11.0` | The version of Trivy to be used |

‎cmd/operator/main.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -99,17 +99,18 @@ func run() error {
9999
Scheme: scheme,
100100
}
101101

102-
if len(targetNamespaces) == 1 {
103-
// Add support for OwnNamespace and SingleNamespace set in STARBOARD_TARGET_NAMESPACE (e.g. ns1).
102+
if len(targetNamespaces) == 1 && targetNamespaces[0] == operatorNamespace {
103+
// Add support for OwnNamespace set in STARBOARD_TARGET_NAMESPACES (e.g. ns1).
104104
setupLog.Info("Constructing single-namespaced cache", "namespace", targetNamespaces[0])
105105
options.Namespace = targetNamespaces[0]
106106
} else {
107-
// Add support for MultiNamespace set in STARBOARD_TARGET_NAMESPACE (e.g. ns1,ns2).
107+
// Add support for SingleNamespace and MultiNamespace set in STARBOARD_TARGET_NAMESPACES (e.g. ns1,ns2).
108108
// Note that we may face performance issues when using this with a high number of namespaces.
109109
// More: https://godoc.org/github.com/kubernetes-sigs/controller-runtime/pkg/cache#MultiNamespacedCacheBuilder
110-
setupLog.Info("Constructing multi-namespaced cache", "namespaces", targetNamespaces)
110+
cachedNamespaces := append(targetNamespaces, operatorNamespace)
111+
setupLog.Info("Constructing multi-namespaced cache", "namespaces", cachedNamespaces)
111112
options.Namespace = ""
112-
options.NewCache = cache.MultiNamespacedCacheBuilder(targetNamespaces)
113+
options.NewCache = cache.MultiNamespacedCacheBuilder(cachedNamespaces)
113114
}
114115

115116
kubernetesConfig, err := ctrl.GetConfig()
@@ -141,7 +142,7 @@ func run() error {
141142
Client: mgr.GetClient(),
142143
Store: store,
143144
Scanner: scanner,
144-
Log: ctrl.Log.WithName("controller").WithName("pods"),
145+
Log: ctrl.Log.WithName("controller").WithName("Pod"),
145146
Scheme: mgr.GetScheme(),
146147
}).SetupWithManager(mgr); err != nil {
147148
return fmt.Errorf("unable to create pod controller: %w", err)
@@ -153,7 +154,7 @@ func run() error {
153154
Client: mgr.GetClient(),
154155
Store: store,
155156
Scanner: scanner,
156-
Log: ctrl.Log.WithName("controller").WithName("scan-jobs"),
157+
Log: ctrl.Log.WithName("controller").WithName("Job"),
157158
Scheme: mgr.GetScheme(),
158159
}).SetupWithManager(mgr); err != nil {
159160
return fmt.Errorf("unable to create job controller: %w", err)

‎deploy/examples/aqua-scan-job.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ spec:
3030
mountPath: /downloads
3131
containers:
3232
- name: scanner
33-
image: docker.io/aquasec/starboard-scanner-aqua:0.0.1-alpha.2
33+
image: docker.io/aquasec/starboard-scanner-aqua:0.0.1-alpha.4
3434
imagePullPolicy: IfNotPresent
3535
command:
3636
- "/bin/sh"

‎deploy/kubectl/01-starboard-operator.ns.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: starboard-operator

‎deploy/kubectl/02-starboard-operator.sa.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: starboard-operator
6+
namespace: starboard-operator

‎deploy/kubectl/03-starboard-operator.role.yaml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: starboard-operator
6+
namespace: starboard-operator
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- "pods"
12+
- "pods/log"
13+
verbs:
14+
- get
15+
- list
16+
- watch
17+
- apiGroups:
18+
- apps
19+
resources:
20+
- replicasets
21+
verbs:
22+
- get
23+
- list
24+
- watch
25+
- apiGroups:
26+
- batch
27+
resources:
28+
- jobs
29+
verbs:
30+
- get
31+
- list
32+
- watch
33+
- create
34+
- delete
35+
- apiGroups:
36+
- aquasecurity.github.io
37+
resources:
38+
- vulnerabilityreports
39+
verbs:
40+
- get
41+
- list
42+
- watch
43+
- create

‎deploy/kubectl/04-starboard-operator.rolebinding.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: starboard-operator
6+
namespace: starboard-operator
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: Role
10+
name: starboard-operator
11+
subjects:
12+
- kind: ServiceAccount
13+
name: starboard-operator
14+
namespace: starboard-operator

0 commit comments

Comments
 (0)