Feat: Add scanners helm charts

.github/workflows/helm-release.yaml

@@ -9,6 +9,8 @@ on:
       - .github/workflows/helm-release.yaml
       - charts/heureka
       - scanner/k8s-assets/chart/k8s-assets-scanner
+      - scanner/keppel/chart/keppel-scanner
+      - scanner/nvd/chart/nvd-scanner
 
 
 permissions:
@@ -30,6 +32,10 @@ jobs:
             chartName: heureka
           - chartDir: scanner/k8s-assets/chart/k8s-assets-scanner
             chartName: k8s-assets-scanner
+          - chartDir: scanner/keppel/chart/keppel-scanner
+            chartName: keppel-scanner
+          - chartDir: scanner/nvd/chart/nvd-scanner
+            chartName: nvd-scanner
 
 
     steps:

scanner/k8s-assets/chart/k8s-assets-scanner/values.yaml

@@ -7,15 +7,15 @@
 
 scanner:
   api_token: "my_token"
-  heureka_url: "heureka.greehouse.com"
-  config_mount_path: "/etc/heureka/scanner/config"
+  heureka_url: "api.heureka.greenhouse-qa.eu-nl-1.cloud.sap"
+  config_mount_path: "/etc/heureka/config/k8s-assets-scanner"
   schedule: "0 * * * *"
 
 image:
   repository: ghcr.io/cloudoperators/heureka-scanner-k8s-assets
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  tag: "main"
 
 serviceAccount:
   # Specifies whether a service account should be created

scanner/keppel/chart/keppel-scanner/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

scanner/keppel/chart/keppel-scanner/Chart.yaml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v2
+name: keppel-scanner
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

scanner/keppel/chart/keppel-scanner/README.md

@@ -0,0 +1,22 @@
+Keppel Scanner for Heureka
+==============================
+
+This scanner is used to perform scans for the heureka project.
+
+## Usage
+```bash
+$ keppel-scanner --help
+```
+
+## Helm Chart
+Usage:
+```bash 
+helm upgrade --install --namespace heureka keppel-scanner heureka/scanner/keppel/chart/keppel-scanner/
+```
+
+#### Values
+In the `values.yaml` file, you can configure the following values:
+- `scanner.api_token`: The token used to authenticate the scanner.
+- `scanner.heureka_url`: The URL of the Heureka API.
+- `scanner.config_mount_path`: The path of the scanner config file inside the pod (e.g. "/etc/heureka/scanner/keppel/config")
+- `scanner.schedule`: The cronjob schedule string (e.g. "0 * * * *") that defines when the scanner should run.

scanner/keppel/chart/keppel-scanner/templates/NOTES.txt

@@ -0,0 +1 @@
+1. The Heureka Scanner {{ .Release.Name }} is being deployed. Be aware that this is a CronJob only deployment.

scanner/keppel/chart/keppel-scanner/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "keppel-scanner.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "keppel-scanner.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "keppel-scanner.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "keppel-scanner.labels" -}}
+helm.sh/chart: {{ include "keppel-scanner.chart" . }}
+{{ include "keppel-scanner.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "keppel-scanner.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "keppel-scanner.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "keppel-scanner.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "keppel-scanner.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

scanner/keppel/chart/keppel-scanner/templates/config/_scanner_config.yaml.tpl

@@ -0,0 +1,2 @@
+config:
+    some_key: some_value

scanner/keppel/chart/keppel-scanner/templates/configmap.yaml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-configmap
+data:
+  config.yaml: |
+{{ include (print .Template.BasePath "/config/_scanner_config.yaml.tpl") . | indent 4 }}

scanner/keppel/chart/keppel-scanner/templates/cronjob.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .Release.Name }}-cronjob
+spec:
+  schedule: "{{ .Values.scanner.schedule }}"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - name: config-volume
+            configMap:
+              name: {{ .Release.Name }}-configmap
+          containers:
+          - name: {{ .Release.Name }}
+            image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+            imagePullPolicy: {{ .Values.image.pullPolicy }}
+            volumeMounts:
+            - name: config-volume
+              mountPath: "{{ .Values.scanner.config_mount_path }}"
+              readOnly: true
+            env:
+            - name: HEUREKA_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-secret
+                  key: api_token
+            - name: HEUREKA_URL
+              value: {{ .Values.scanner.heureka_url }}
+            args:
+            - /bin/sh
+            - -c
+            - date; echo Hello from the Kubernetes cluster
+          restartPolicy: OnFailure

scanner/keppel/chart/keppel-scanner/templates/secrets.yaml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-secret
+type: Opaque
+data:
+  api_token: {{ .Values.scanner.api_token | b64enc }}

scanner/keppel/chart/keppel-scanner/templates/serviceaccount.yaml

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "keppel-scanner.serviceAccountName" . }}
+  labels:
+    {{- include "keppel-scanner.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}

scanner/keppel/chart/keppel-scanner/values.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Default values for keppel-scanner.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+scanner:
+  api_token: "my_token"
+  heureka_url: "api.heureka.greenhouse-qa.eu-nl-1.cloud.sap"
+  config_mount_path: "/etc/heureka/config/keppel-scanner"
+  schedule: "0 * * * *"
+
+image:
+  repository: ghcr.io/cloudoperators/heureka-scanner-keppel
+  pullPolicy: Always
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: "main"
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: false
+  # Automatically mount a ServiceAccount's API credentials?
+  automount: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""

scanner/nvd/chart/nvd-scanner/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

scanner/nvd/chart/nvd-scanner/Chart.yaml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v2
+name: nvd-scanner
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

scanner/nvd/chart/nvd-scanner/README.md

@@ -0,0 +1,22 @@
+NVD Scanner for Heureka
+==============================
+
+This scanner is used to perform scans for the heureka project.
+
+## Usage
+```bash
+$ nvd-scanner --help
+```
+
+## Helm Chart
+Usage:
+```bash 
+helm upgrade --install --namespace heureka nvd-scanner heureka/scanner/nvd/chart/nvd-scanner/
+```
+
+#### Values
+In the `values.yaml` file, you can configure the following values:
+- `scanner.api_token`: The token used to authenticate the scanner.
+- `scanner.heureka_url`: The URL of the Heureka API.
+- `scanner.config_mount_path`: The path of the scanner config file inside the pod (e.g. "/etc/heureka/scanner/nvd/config")
+- `scanner.schedule`: The cronjob schedule string (e.g. "0 * * * *") that defines when the scanner should run.

scanner/nvd/chart/nvd-scanner/templates/NOTES.txt

@@ -0,0 +1 @@
+1. The Heureka Scanner {{ .Release.Name }} is being deployed. Be aware that this is a CronJob only deployment.