diff --git a/assets/neuvector-crd/neuvector-crd-100.0.0+up2.2.0-b2.tgz b/assets/neuvector-crd/neuvector-crd-100.0.0+up2.2.0-b2.tgz deleted file mode 100644 index 2b3837e96..000000000 Binary files a/assets/neuvector-crd/neuvector-crd-100.0.0+up2.2.0-b2.tgz and /dev/null differ diff --git a/assets/neuvector/neuvector-100.0.0+up2.2.0-b2.tgz b/assets/neuvector/neuvector-100.0.0+up2.2.0-b2.tgz deleted file mode 100644 index 5dcc0a607..000000000 Binary files a/assets/neuvector/neuvector-100.0.0+up2.2.0-b2.tgz and /dev/null differ diff --git a/charts/neuvector-crd/100.0.0+up2.2.0-b2/Chart.yaml b/charts/neuvector-crd/100.0.0+up2.2.0-b2/Chart.yaml deleted file mode 100644 index a6e1cdbaa..000000000 --- a/charts/neuvector-crd/100.0.0+up2.2.0-b2/Chart.yaml +++ /dev/null @@ -1,16 +0,0 @@ -annotations: - catalog.cattle.io/certified: rancher - catalog.cattle.io/hidden: "true" - catalog.cattle.io/namespace: cattle-neuvector-system - catalog.cattle.io/release-name: neuvector-crd -apiVersion: v1 -appVersion: 5.0.0-b2 -description: Helm chart for NeuVector's CRD services -home: https://neuvector.com -icon: https://avatars2.githubusercontent.com/u/19367275?s=200&v=4 -maintainers: -- email: support@neuvector.com - name: becitsthere -name: neuvector-crd -type: application -version: 100.0.0+up2.2.0-b2 diff --git a/charts/neuvector-crd/100.0.0+up2.2.0-b2/README.md b/charts/neuvector-crd/100.0.0+up2.2.0-b2/README.md deleted file mode 100644 index aff9c71bc..000000000 --- a/charts/neuvector-crd/100.0.0+up2.2.0-b2/README.md +++ /dev/null @@ -1,19 +0,0 @@ -# NeuVector Helm Chart - -Helm chart for NeuVector container security's CRD services. NeuVector's CRD (Custom Resource Definition) capture and declare application security policies early in the pipeline, then defined policies can be deployed together with the contaier applications. - -Because the CRD poclies can be deployed before NeuVector's core product, this separate helm chart is created. For the backward compatibility reason, crd.yaml is not removed in the 'core' chart. If you use this 'crd' chart, please set 'crdwebhook.enabled' to false in the 'core' chart. - -## Configuration - -The following table lists the configurable parameters of the NeuVector chart and their default values. - -Parameter | Description | Default | Notes ---------- | ----------- | ------- | ----- -`openshift` | If deploying in OpenShift, set this to true | `false` | -`serviceAccount` | Service account name for NeuVector components | `default` | -`crdwebhook.type` | crd webhook type | `ClusterIP` | - ---- -Contact for access to Docker Hub and docs. - diff --git a/charts/neuvector-crd/100.0.0+up2.2.0-b2/templates/_helpers.tpl b/charts/neuvector-crd/100.0.0+up2.2.0-b2/templates/_helpers.tpl deleted file mode 100644 index c0cc49294..000000000 --- a/charts/neuvector-crd/100.0.0+up2.2.0-b2/templates/_helpers.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "neuvector.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "neuvector.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "neuvector.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} diff --git a/charts/neuvector-crd/100.0.0+up2.2.0-b2/templates/crd.yaml b/charts/neuvector-crd/100.0.0+up2.2.0-b2/templates/crd.yaml deleted file mode 100644 index 7a969b61b..000000000 --- a/charts/neuvector-crd/100.0.0+up2.2.0-b2/templates/crd.yaml +++ /dev/null @@ -1,1104 +0,0 @@ -{{- if .Values.crdwebhook.enabled -}} -{{- $oc4 := and .Values.openshift (semverCompare ">=1.12-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} -{{- $oc3 := and .Values.openshift (not $oc4) (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apiextensions.k8s.io/v1 -{{- else }} -apiVersion: apiextensions.k8s.io/v1beta1 -{{- end }} -kind: CustomResourceDefinition -metadata: - name: nvsecurityrules.neuvector.com - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - group: neuvector.com - names: - kind: NvSecurityRule - listKind: NvSecurityRuleList - plural: nvsecurityrules - singular: nvsecurityrule - scope: Namespaced -{{- if (semverCompare "<1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - version: v1 -{{- end }} - versions: - - name: v1 - served: true - storage: true -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - schema: - openAPIV3Schema: - properties: - spec: - properties: - egress: - items: - properties: - action: - enum: - - allow - - deny - type: string - applications: - items: - type: string - type: array - name: - type: string - ports: - type: string - priority: - type: integer - selector: - properties: - comment: - type: string - criteria: - items: - properties: - key: - type: string - op: - type: string - value: - type: string - required: - - key - - op - - value - type: object - type: array - name: - type: string - original_name: - type: string - required: - - name - type: object - required: - - action - - name - - selector - type: object - type: array - file: - items: - properties: - app: - items: - type: string - type: array - behavior: - enum: - - monitor_change - - block_access - type: string - filter: - type: string - recursive: - type: boolean - required: - - behavior - - filter - type: object - type: array - ingress: - items: - properties: - action: - enum: - - allow - - deny - type: string - applications: - items: - type: string - type: array - name: - type: string - ports: - type: string - priority: - type: integer - selector: - properties: - comment: - type: string - criteria: - items: - properties: - key: - type: string - op: - type: string - value: - type: string - required: - - key - - op - - value - type: object - type: array - name: - type: string - original_name: - type: string - required: - - name - type: object - required: - - action - - name - - selector - type: object - type: array - process: - items: - properties: - action: - enum: - - allow - - deny - type: string - allow_update: - type: boolean - name: - type: string - path: - type: string - required: - - action - type: object - type: array - process_profile: - properties: - baseline: - enum: - - default - - shield - - basic - - zero-drift - type: string - type: object - target: - properties: - policymode: - enum: - - Discover - - Monitor - - Protect - - N/A - type: string - selector: - properties: - comment: - type: string - criteria: - items: - properties: - key: - type: string - op: - type: string - value: - type: string - required: - - key - - op - - value - type: object - type: array - name: - type: string - original_name: - type: string - required: - - name - type: object - required: - - selector - type: object - dlp: - properties: - settings: - items: - properties: - action: - enum: - - allow - - deny - type: string - name: - type: string - required: - - name - - action - type: object - type: array - status: - type: boolean - type: object - waf: - properties: - settings: - items: - properties: - action: - enum: - - allow - - deny - type: string - name: - type: string - required: - - name - - action - type: object - type: array - status: - type: boolean - type: object - required: - - target - type: object - type: object -{{- end }} ---- -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apiextensions.k8s.io/v1 -{{- else }} -apiVersion: apiextensions.k8s.io/v1beta1 -{{- end }} -kind: CustomResourceDefinition -metadata: - name: nvclustersecurityrules.neuvector.com - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - group: neuvector.com - names: - kind: NvClusterSecurityRule - listKind: NvClusterSecurityRuleList - plural: nvclustersecurityrules - singular: nvclustersecurityrule - scope: Cluster -{{- if (semverCompare "<1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - version: v1 -{{- end }} - versions: - - name: v1 - served: true - storage: true -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - schema: - openAPIV3Schema: - properties: - spec: - properties: - egress: - items: - properties: - action: - enum: - - allow - - deny - type: string - applications: - items: - type: string - type: array - name: - type: string - ports: - type: string - priority: - type: integer - selector: - properties: - comment: - type: string - criteria: - items: - properties: - key: - type: string - op: - type: string - value: - type: string - required: - - key - - op - - value - type: object - type: array - name: - type: string - original_name: - type: string - required: - - name - type: object - required: - - action - - name - - selector - type: object - type: array - file: - items: - properties: - app: - items: - type: string - type: array - behavior: - enum: - - monitor_change - - block_access - type: string - filter: - type: string - recursive: - type: boolean - required: - - behavior - - filter - type: object - type: array - ingress: - items: - properties: - action: - enum: - - allow - - deny - type: string - applications: - items: - type: string - type: array - name: - type: string - ports: - type: string - priority: - type: integer - selector: - properties: - comment: - type: string - criteria: - items: - properties: - key: - type: string - op: - type: string - value: - type: string - required: - - key - - op - - value - type: object - type: array - name: - type: string - original_name: - type: string - required: - - name - type: object - required: - - action - - name - - selector - type: object - type: array - process: - items: - properties: - action: - enum: - - allow - - deny - type: string - allow_update: - type: boolean - name: - type: string - path: - type: string - required: - - action - type: object - type: array - process_profile: - properties: - baseline: - enum: - - default - - shield - - basic - - zero-drift - type: string - type: object - target: - properties: - policymode: - enum: - - Discover - - Monitor - - Protect - - N/A - type: string - selector: - properties: - comment: - type: string - criteria: - items: - properties: - key: - type: string - op: - type: string - value: - type: string - required: - - key - - op - - value - type: object - type: array - name: - type: string - original_name: - type: string - required: - - name - type: object - required: - - selector - type: object - dlp: - properties: - settings: - items: - properties: - action: - enum: - - allow - - deny - type: string - name: - type: string - required: - - name - - action - type: object - type: array - status: - type: boolean - type: object - waf: - properties: - settings: - items: - properties: - action: - enum: - - allow - - deny - type: string - name: - type: string - required: - - name - - action - type: object - type: array - status: - type: boolean - type: object - required: - - target - type: object - type: object -{{- end }} ---- -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apiextensions.k8s.io/v1 -{{- else }} -apiVersion: apiextensions.k8s.io/v1beta1 -{{- end }} -kind: CustomResourceDefinition -metadata: - name: nvdlpsecurityrules.neuvector.com - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - group: neuvector.com - names: - kind: NvDlpSecurityRule - listKind: NvDlpSecurityRuleList - plural: nvdlpsecurityrules - singular: nvdlpsecurityrule - scope: Cluster -{{- if (semverCompare "<1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - version: v1 -{{- end }} - versions: - - name: v1 - served: true - storage: true -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - schema: - openAPIV3Schema: - properties: - spec: - properties: - sensor: - properties: - comment: - type: string - name: - type: string - rules: - items: - properties: - name: - type: string - patterns: - items: - properties: - context: - enum: - - url - - header - - body - - packet - type: string - key: - enum: - - pattern - type: string - op: - enum: - - regex - - '!regex' - type: string - value: - type: string - required: - - key - - op - - value - - context - type: object - type: array - required: - - name - - patterns - type: object - type: array - required: - - name - type: object - required: - - sensor - type: object - type: object -{{- end }} ---- -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apiextensions.k8s.io/v1 -{{- else }} -apiVersion: apiextensions.k8s.io/v1beta1 -{{- end }} -kind: CustomResourceDefinition -metadata: - name: nvadmissioncontrolsecurityrules.neuvector.com - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - group: neuvector.com - names: - kind: NvAdmissionControlSecurityRule - listKind: NvAdmissionControlSecurityRuleList - plural: nvadmissioncontrolsecurityrules - singular: nvadmissioncontrolsecurityrule - scope: Cluster -{{- if (semverCompare "<1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - version: v1 -{{- end }} - versions: - - name: v1 - served: true - storage: true -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - schema: - openAPIV3Schema: - properties: - spec: - properties: - config: - properties: - client_mode: - enum: - - service - - url - type: string - enable: - type: boolean - mode: - enum: - - monitor - - protect - type: string - required: - - enable - - mode - - client_mode - type: object - rules: - items: - properties: - action: - enum: - - allow - - deny - type: string - comment: - type: string - criteria: - items: - properties: - name: - type: string - op: - type: string - sub_criteria: - items: - properties: - name: - type: string - op: - type: string - value: - type: string - required: - - name - - op - - value - type: object - type: array - value: - type: string - required: - - name - - op - - value - type: object - type: array - disabled: - type: boolean - id: - type: integer - required: - - action - - criteria - type: object - type: array - type: object - type: object -{{- end }} ---- -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apiextensions.k8s.io/v1 -{{- else }} -apiVersion: apiextensions.k8s.io/v1beta1 -{{- end }} -kind: CustomResourceDefinition -metadata: - name: nvwafsecurityrules.neuvector.com - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - group: neuvector.com - names: - kind: NvWafSecurityRule - listKind: NvWafSecurityRuleList - plural: nvwafsecurityrules - singular: nvwafsecurityrule - scope: Cluster -{{- if (semverCompare "<1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - version: v1 -{{- end }} - versions: - - name: v1 - served: true - storage: true -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - schema: - openAPIV3Schema: - properties: - spec: - properties: - sensor: - properties: - comment: - type: string - name: - type: string - rules: - items: - properties: - name: - type: string - patterns: - items: - properties: - context: - enum: - - url - - header - - body - - packet - type: string - key: - enum: - - pattern - type: string - op: - enum: - - regex - - '!regex' - type: string - value: - type: string - required: - - key - - op - - value - - context - type: object - type: array - required: - - name - - patterns - type: object - type: array - required: - - name - type: object - required: - - sensor - type: object - type: object -{{- end }} ---- -apiVersion: v1 -kind: Service -metadata: - name: neuvector-svc-crd-webhook - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - ports: - - port: 443 - targetPort: 30443 - protocol: TCP - name: crd-webhook - type: {{ .Values.crdwebhook.type }} - selector: - app: neuvector-controller-pod ---- -# ClusterRole for NeuVector to operate CRD -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-customresourcedefinition - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - update - - watch - - create - - get ---- -# ClusterRoleBinding for NeuVector to operate CRD -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-customresourcedefinition - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-customresourcedefinition -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} ---- -# ClusterRole for NeuVector to manager user-created network/process CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-nvsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - neuvector.com - resources: - - nvsecurityrules - - nvclustersecurityrules - verbs: - - list - - delete ---- -# ClusterRoleBinding for NeuVector to manager user-created network/process CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-nvsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-nvsecurityrules -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} ---- -# ClusterRole for NeuVector to manager user-created dlp CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-nvdlpsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - neuvector.com - resources: - - nvdlpsecurityrules - verbs: - - list - - delete ---- -# ClusterRole for NeuVector to manager user-created admission control CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-nvadmissioncontrolsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - neuvector.com - resources: - - nvadmissioncontrolsecurityrules - verbs: - - list - - delete ---- -# ClusterRoleBinding for NeuVector to manager user-created admission control CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-nvdlpsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-nvdlpsecurityrules -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} ---- -# ClusterRoleBinding for NeuVector to manager user-created admission control CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-nvadmissioncontrolsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-nvadmissioncontrolsecurityrules -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} ---- -# ClusterRole for NeuVector to manager user-created waf CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-nvwafsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - neuvector.com - resources: - - nvwafsecurityrules - verbs: - - list - - delete ---- -# ClusterRoleBinding for NeuVector to manager user-created waf CRD rules -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-nvwafsecurityrules - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-nvwafsecurityrules -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} -{{- end }} diff --git a/charts/neuvector-crd/100.0.0+up2.2.0-b2/values.yaml b/charts/neuvector-crd/100.0.0+up2.2.0-b2/values.yaml deleted file mode 100644 index a7bc9a908..000000000 --- a/charts/neuvector-crd/100.0.0+up2.2.0-b2/values.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# Default values for neuvector. -# This is a YAML-formatted file. -# Declare variables to be passed into the templates. - -openshift: false - -serviceAccount: neuvector - -crdwebhook: - type: ClusterIP - enabled: true diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/.helmignore b/charts/neuvector/100.0.0+up2.2.0-b2/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/Chart.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/Chart.yaml deleted file mode 100644 index 55551434f..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/Chart.yaml +++ /dev/null @@ -1,28 +0,0 @@ -annotations: - catalog.cattle.io/auto-install: neuvector-crd=match - catalog.cattle.io/certified: rancher - catalog.cattle.io/display-name: NeuVector - catalog.cattle.io/kube-version: '>=1.18.0-0' - catalog.cattle.io/namespace: cattle-neuvector-system - catalog.cattle.io/os: linux - catalog.cattle.io/permit-os: linux - catalog.cattle.io/provides-gvr: neuvector.com/v1 - catalog.cattle.io/rancher-version: '>= 2.6.5-0 <= 2.6.100-0' - catalog.cattle.io/release-name: neuvector - catalog.cattle.io/type: cluster-tool - catalog.cattle.io/ui-component: neuvector - catalog.cattle.io/upstream-version: 2.2.0-b2 -apiVersion: v1 -appVersion: 5.0.0-b2 -description: Helm chart for NeuVector's core services -home: https://neuvector.com -icon: https://avatars2.githubusercontent.com/u/19367275?s=200&v=4 -keywords: -- security -maintainers: -- email: support@neuvector.com - name: becitsthere -name: neuvector -sources: -- https://github.com/neuvector/neuvector -version: 100.0.0+up2.2.0-b2 diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/README.md b/charts/neuvector/100.0.0+up2.2.0-b2/README.md deleted file mode 100644 index 197a6b584..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/README.md +++ /dev/null @@ -1,199 +0,0 @@ -# NeuVector Helm Chart - -Helm chart for NeuVector container security's core services. - -## Preparation if using Helm 2 - -- Kubernetes 1.7+ -- Helm installed and Tiller pod is running -- Cluster role `cluster-admin` available, check by: - -```console -$ kubectl get clusterrole cluster-admin -``` - -If nothing returned, then add the `cluster-admin`: - -cluster-admin.yaml -```yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cluster-admin -rules: -- apiGroups: - - '*' - resources: - - '*' - verbs: - - '*' -- nonResourceURLs: - - '*' - verbs: - - '*' -``` - -```console -$ kubectl create -f cluster-admin.yaml -``` - -- If you have not created a service account for tiller, and give it admin abilities on the cluster: - -```console -$ kubectl create serviceaccount --namespace kube-system tiller -$ kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller -$ kubectl patch deployment tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}' -n kube-system -``` - -## CRD -Because the CRD (Custom Resource Definition) policies can be deployed before NeuVector's core product, a new 'crd' helm chart is created. The crd template in the 'core' chart is kept for the backward compatibility. Please set 'crdwebhook.enabled' to false, if you use the new 'crd' chart. - -## Choosing container runtime -NeuVector platform support docker, cri-o and containerd as the container runtime. For the k3s or bottlerocket cluster, they have their own runtime socket path. You should enable their runtime, k3s.enabled and bottlerocket.enabled, respectively. - -## Configuration - -The following table lists the configurable parameters of the NeuVector chart and their default values. - -Parameter | Description | Default | Notes ---------- | ----------- | ------- | ----- -`openshift` | If deploying in OpenShift, set this to true | `false` | -`registry` | NeuVector container registry | `registry.neuvector.com` | -`tag` | image tag for controller enforcer manager | `latest` | -`oem` | OEM release name | `nil` | -`imagePullSecrets` | image pull secret | `nil` | -`psp` | NeuVector Pod Security Policy when psp policy is enabled | `false` | -`serviceAccount` | Service account name for NeuVector components | `default` | -`controller.enabled` | If true, create controller | `true` | -`controller.image.repository` | controller image repository | `neuvector/controller` | -`controller.image.hash` | controller image hash in the format of sha256:xxxx. If present it overwrites the image tag value. | | -`controller.replicas` | controller replicas | `3` | -`controller.schedulerName` | kubernetes scheduler name | `nil` | -`controller.affinity` | controller affinity rules | ... | spread controllers to different nodes | -`controller.tolerations` | List of node taints to tolerate | `nil` | -`controller.resources` | Add resources requests and limits to controller deployment | `{}` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`controller.nodeSelector` | Enable and specify nodeSelector labels | `{}` | -`controller.disruptionbudget` | controller PodDisruptionBudget. 0 to disable. Recommended value: 2. | `0` | -`controller.priorityClassName` | controller priorityClassName. Must exist prior to helm deployment. Leave empty to disable. | `nil` | -`controller.env` | User-defined environment variables for controller. | `[]` | -`controller.ranchersso.enabled` | If true, enable Rancher single sign on | `false` | Rancher server address auto configured.| -`controller.pvc.enabled` | If true, enable persistence for controller using PVC | `false` | Require persistent volume type RWX, and storage 1Gi -`controller.pvc.storageClass` | Storage Class to be used | `default` | -`controller.pvc.capacity` | Storage capacity | `1Gi` | -`controller.azureFileShare.enabled` | If true, enable the usage of an existing or statically provisioned Azure File Share | `false` | -`controller.azureFileShare.secretName` | The name of the secret containing the Azure file share storage account name and key | `nil` | -`controller.azureFileShare.shareName` | The name of the Azure file share to use | `nil` | -`controller.apisvc.type` | Controller REST API service type | `nil` | -`controller.apisvc.annotations` | Add annotations to controller REST API service | `{}` | -`controller.apisvc.route.enabled` | If true, create a OpenShift route to expose the Controller REST API service | `false` | -`controller.apisvc.route.termination` | Specify TLS termination for OpenShift route for Controller REST API service. Possible passthrough, edge, reencrypt | `passthrough` | -`controller.apisvc.route.host` | Set controller REST API service hostname | `nil` | -`controller.certificate.secret` | Replace controller REST API certificate using secret if secret name is specified | `nil` | -`controller.certificate.keyFile` | Replace controller REST API certificate key file | `tls.key` | -`controller.certificate.pemFile` | Replace controller REST API certificate pem file | `tls.pem` | -`controller.federation.mastersvc.type` | Multi-cluster primary cluster service type. If specified, the deployment will be used to manage other clusters. Possible values include NodePort, LoadBalancer and ClusterIP. | `nil` | -`controller.federation.mastersvc.route.enabled` | If true, create a OpenShift route to expose the Multi-cluster primary cluster service | `false` | -`controller.federation.mastersvc.route.host` | Set OpenShift route host for primary cluster service | `nil` | -`controller.federation.mastersvc.route.termination` | Specify TLS termination for OpenShift route for Multi-cluster primary cluster service. Possible passthrough, edge, reencrypt | `passthrough` | -`controller.federation.mastersvc.ingress.enabled` | If true, create ingress for federation master service, must also set ingress host value | `false` | enable this if ingress controller is installed -`controller.federation.mastersvc.ingress.tls` | If true, TLS is enabled for controller federation master ingress service |`false` | If set, the tls-host used is the one set with `controller.federation.mastersvc.ingress.host`. -`controller.federation.mastersvc.ingress.host` | Must set this host value if ingress is enabled | `nil` | -`controller.federation.mastersvc.ingress.secretName` | Name of the secret to be used for TLS-encryption | `nil` | Secret must be created separately (Let's encrypt, manually) -`controller.federation.mastersvc.ingress.path` | Set ingress path |`/` | If set, it might be necessary to set a rewrite rule in annotations. -`controller.federation.mastersvc.ingress.annotations` | Add annotations to ingress to influence behavior | `ingress.kubernetes.io/protocol: https ingress.kubernetes.io/rewrite-target: /` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`controller.federation.managedsvc.type` | Multi-cluster managed cluster service type. If specified, the deployment will be managed by the managed clsuter. Possible values include NodePort, LoadBalancer and ClusterIP. | `nil` | -`controller.federation.managedsvc.route.enabled` | If true, create a OpenShift route to expose the Multi-cluster managed cluster service | `false` | -`controller.federation.managedsvc.route.host` | Set OpenShift route host for manageed service | `nil` | -`controller.federation.managedsvc.route.termination` | Specify TLS termination for OpenShift route for Multi-cluster managed cluster service. Possible passthrough, edge, reencrypt | `passthrough` | -`controller.federation.managedsvc.ingress.enabled` | If true, create ingress for federation managed service, must also set ingress host value | `false` | enable this if ingress controller is installed -`controller.federation.managedsvc.ingress.tls` | If true, TLS is enabled for controller federation managed ingress service |`false` | If set, the tls-host used is the one set with `controller.federation.managedsvc.ingress.host`. -`controller.federation.managedsvc.ingress.host` | Must set this host value if ingress is enabled | `nil` | -`controller.federation.managedsvc.ingress.secretName` | Name of the secret to be used for TLS-encryption | `nil` | Secret must be created separately (Let's encrypt, manually) -`controller.federation.managedsvc.ingress.path` | Set ingress path |`/` | If set, it might be necessary to set a rewrite rule in annotations. -`controller.federation.managedsvc.ingress.annotations` | Add annotations to ingress to influence behavior | `ingress.kubernetes.io/protocol: https ingress.kubernetes.io/rewrite-target: /` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`controller.ingress.enabled` | If true, create ingress for rest api, must also set ingress host value | `false` | enable this if ingress controller is installed -`controller.ingress.tls` | If true, TLS is enabled for controller rest api ingress service |`false` | If set, the tls-host used is the one set with `controller.ingress.host`. -`controller.ingress.host` | Must set this host value if ingress is enabled | `nil` | -`controller.ingress.secretName` | Name of the secret to be used for TLS-encryption | `nil` | Secret must be created separately (Let's encrypt, manually) -`controller.ingress.path` | Set ingress path |`/` | If set, it might be necessary to set a rewrite rule in annotations. -`controller.ingress.annotations` | Add annotations to ingress to influence behavior | `ingress.kubernetes.io/protocol: https ingress.kubernetes.io/rewrite-target: /` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`controller.configmap.enabled` | If true, configure NeuVector global settings using a ConfigMap | `false` -`controller.configmap.data` | NeuVector configuration in YAML format | `{}` -`controller.secret.enabled` | If true, configure NeuVector global settings using secrets | `false` -`controller.secret.data` | NeuVector configuration in key/value pair format | `{}` -`enforcer.enabled` | If true, create enforcer | `true` | -`enforcer.image.repository` | enforcer image repository | `neuvector/enforcer` | -`enforcer.image.hash` | enforcer image hash in the format of sha256:xxxx. If present it overwrites the image tag value. | | -`enforcer.priorityClassName` | enforcer priorityClassName. Must exist prior to helm deployment. Leave empty to disable. | `nil` | -`enforcer.tolerations` | List of node taints to tolerate | `- effect: NoSchedule`
`key: node-role.kubernetes.io/master` | other taints can be added after the default -`enforcer.resources` | Add resources requests and limits to enforcer deployment | `{}` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`manager.enabled` | If true, create manager | `true` | -`manager.image.repository` | manager image repository | `neuvector/manager` | -`manager.image.hash` | manager image hash in the format of sha256:xxxx. If present it overwrites the image tag value. | | -`manager.priorityClassName` | manager priorityClassName. Must exist prior to helm deployment. Leave empty to disable. | `nil` | -`manager.env.ssl` | If false, manager will listen on HTTP access instead of HTTPS | `true` | -`manager.svc.type` | set manager service type for native Kubernetes | `NodePort`;
if it is OpenShift platform or ingress is enabled, then default is `ClusterIP` | set to LoadBalancer if using cloud providers, such as Azure, Amazon, Google -`manager.svc.loadBalancerIP` | if manager service type is LoadBalancer, this is used to specify the load balancer's IP | `nil` | -`manager.svc.annotations` | Add annotations to manager service | `{}` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`manager.route.enabled` | If true, create a OpenShift route to expose the management consol service | `true` | -`manager.route.host` | Set OpenShift route host for management consol service | `nil` | -`manager.route.termination` | Specify TLS termination for OpenShift route for management consol service. Possible passthrough, edge, reencrypt | `passthrough` | -`manager.certificate.secret` | Replace manager UI certificate using secret if secret name is specified | `nil` | -`manager.certificate.keyFile` | Replace manager UI certificate key file | `tls.key` | -`manager.certificate.pemFile` | Replace manager UI certificate pem file | `tls.pem` | -`manager.ingress.enabled` | If true, create ingress, must also set ingress host value | `false` | enable this if ingress controller is installed -`manager.ingress.host` | Must set this host value if ingress is enabled | `nil` | -`manager.ingress.path` | Set ingress path |`/` | If set, it might be necessary to set a rewrite rule in annotations. Currently only supports `/` -`manager.ingress.annotations` | Add annotations to ingress to influence behavior | `{}` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`manager.ingress.tls` | If true, TLS is enabled for manager ingress service |`false` | If set, the tls-host used is the one set with `manager.ingress.host`. -`manager.ingress.secretName` | Name of the secret to be used for TLS-encryption | `nil` | Secret must be created separately (Let's encrypt, manually) -`manager.resources` | Add resources requests and limits to manager deployment | `{}` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) -`manager.affinity` | manager affinity rules | `{}` | -`manager.tolerations` | List of node taints to tolerate | `nil` | -`manager.nodeSelector` | Enable and specify nodeSelector labels | `{}` | -`cve.updater.enabled` | If true, create cve updater | `true` | -`cve.updater.secure` | If ture, API server's certificate is validated | `false` | -`cve.updater.image.repository` | cve updater image repository | `neuvector/updater` | -`cve.updater.image.tag` | image tag for cve updater | `latest` | -`cve.updater.image.hash` | cve updateer image hash in the format of sha256:xxxx. If present it overwrites the image tag value. | | -`cve.updater.priorityClassName` | cve updater priorityClassName. Must exist prior to helm deployment. Leave empty to disable. | `nil` | -`cve.updater.schedule` | cronjob cve updater schedule | `0 0 * * *` | -`cve.scanner.enabled` | If true, cve scanners will be deployed | `true` | -`cve.scanner.image.repository` | cve scanner image repository | `neuvector/scanner` | -`cve.scanner.image.tag` | cve scanner image tag | `latest` | -`cve.updater.image.hash` | cve scanner image hash in the format of sha256:xxxx. If present it overwrites the image tag value. | | -`cve.scanner.priorityClassName` | cve scanner priorityClassName. Must exist prior to helm deployment. Leave empty to disable. | `nil` | -`cve.scanner.replicas` | external scanner replicas | `3` | -`cve.scanner.dockerPath` | the remote docker socket if CI/CD integration need scan images before they are pushed to the registry | `nil` | -`cve.scanner.resources` | Add resources requests and limits to scanner deployment | `{}` | see examples in [values.yaml](https://github.com/neuvector/neuvector-helm/blob/master/charts/core/values.yaml) | -`cve.scanner.affinity` | scanner affinity rules | `{}` | -`cve.scanner.tolerations` | List of node taints to tolerate | `nil` | -`cve.scanner.nodeSelector` | Enable and specify nodeSelector labels | `{}` | -`docker.path` | docker path | `/var/run/docker.sock` | -`containerd.enabled` | Set to true, if the container runtime is containerd | `false` | **Note**: For k3s cluster, set k3s.enabled to true instead -`containerd.path` | If containerd is enabled, this local containerd socket path will be used | `/var/run/containerd/containerd.sock` | -`crio.enabled` | Set to true, if the container runtime is cri-o | `false` | -`crio.path` | If cri-o is enabled, this local cri-o socket path will be used | `/var/run/crio/crio.sock` | -`k3s.enabled` | Set to true for k3s | `false` | -`k3s.runtimePath` | If k3s is enabled, this local containerd socket path will be used | `/run/k3s/containerd/containerd.sock` | -`bottlerocket.enabled` | Set to true if using AWS bottlerocket | `false` | -`bottlerocket.runtimePath` | If bottlerocket is enabled, this local containerd socket path will be used | `/run/dockershim.sock` | -`admissionwebhook.type` | admission webhook type | `ClusterIP` | -`crdwebhook.enabled` | Enable crd service and create crd related resources | `true` | -`crdwebhook.type` | crd webhook type | `ClusterIP` | - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```console -$ helm install my-release --namespace neuvector ./neuvector-helm/ --set manager.env.ssl=off -``` - -Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, - -```console -$ helm install my-release --namespace neuvector ./neuvector-helm/ -f values.yaml -``` - ---- -Contact for access to container registry and docs. - diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/app-readme.md b/charts/neuvector/100.0.0+up2.2.0-b2/app-readme.md deleted file mode 100644 index c47c81a3c..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/app-readme.md +++ /dev/null @@ -1,14 +0,0 @@ -### Run-Time Protection Without Compromise - -NeuVector delivers a complete run-time security solution with container process/file system protection and vulnerability scanning combined with the only true Layer 7 container firewall. Protect sensitive data with a complete container security platform. - -NeuVector integrates tightly with Rancher and Kubernetes to extend the built-in security features for applications that require defense in depth. Security features include: - -+ Build phase vulnerability scanning with Jenkins plug-in and registry scanning -+ Admission control to prevent vulnerable or unauthorized image deployments using Kubernetes admission control webhooks -+ Complete run-time scanning with network, process, and file system monitoring and protection -+ The industry's only layer 7 container firewall for multi-protocol threat detection and automated segmentation -+ Advanced network controls including DLP detection, service mesh integration, connection blocking and packet captures -+ Run-time vulnerability scanning and CIS benchmarks - -Please Note: Configure correct container runtime and runtime path under container runtime. Enable only one runtime. diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/crds/_helpers.tpl b/charts/neuvector/100.0.0+up2.2.0-b2/crds/_helpers.tpl deleted file mode 100644 index c0cc49294..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/crds/_helpers.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "neuvector.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "neuvector.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "neuvector.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/questions.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/questions.yaml deleted file mode 100644 index ba828b02a..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/questions.yaml +++ /dev/null @@ -1,224 +0,0 @@ -questions: -#image configurations -- variable: registry - default: "docker.io" - description: image registry - type: string - label: Image Registry - group: "Container Images" -- variable: controller.image.repository - default: "neuvector/controller" - description: controller image repository - type: string - label: Controller image path - group: "Container Images" -- variable: controller.image.tag - default: "" - description: image tag for controller - type: string - label: Controller Image Tag - group: "Container Images" -- variable: manager.image.repository - default: "neuvector/manager" - description: manager image repository - type: string - label: Manager image path - group: "Container Images" -- variable: manager.image.tag - default: "" - description: image tag for manager - type: string - label: Manager Image Tag - group: "Container Images" -- variable: enforcer.image.repository - default: "neuvector/enforcer" - description: enforcer image repository - type: string - label: Enforcer image path - group: "Container Images" -- variable: enforcer.image.tag - default: "" - description: image tag for enforcer - type: string - label: Enforcer Image Tag - group: "Container Images" -- variable: cve.scanner.image.repository - default: "neuvector/scanner" - description: scanner image repository - type: string - label: Scanner image path - group: "Container Images" -- variable: cve.scanner.image.tag - default: "" - description: image tag for scanner - type: string - label: Scanner Image Tag - group: "Container Images" -- variable: cve.updater.image.repository - default: "neuvector/updater" - description: cve updater image repository - type: string - label: CVE Updater image path - group: "Container Images" -- variable: cve.updater.image.tag - default: "" - description: image tag for updater - type: string - label: Updater Image Tag - group: "Container Images" -#Container Runtime configurations -- variable: docker.enabled - default: true - description: Docker runtime. Enable only one runtime. - type: boolean - label: Docker Runtime - show_subquestion_if: true - group: "Container Runtime" - subquestions: - - variable: docker.path - default: "/var/run/docker.sock" - description: "Docker Runtime Path" - type: string - label: Runtime Path -- variable: containerd.enabled - default: "false" - description: Containerd runtime. Enable only one runtime. - type: boolean - label: Containerd Runtime - show_subquestion_if: true - group: "Container Runtime" - subquestions: - - variable: containerd.path - default: " /var/run/containerd/containerd.sock" - description: "Containerd Runtime Path" - type: string - label: Runtime Path -- variable: crio.enabled - default: "false" - description: CRI-O runtime. Enable only one runtime. - type: boolean - label: CRI-O Runtime - show_subquestion_if: true - group: "Container Runtime" - subquestions: - - variable: crio.path - default: "/var/run/crio/crio.sock" - description: "CRI-O Runtime Path" - type: string - label: Runtime Path -- variable: k3s.enabled - default: "false" - description: k3s containerd runtime. Enable only one runtime. - type: boolean - label: k3s Containerd Runtime - show_subquestion_if: true - group: "Container Runtime" - subquestions: - - variable: k3s.runtimePath - default: " /run/k3s/containerd/containerd.sock" - description: "k3s Containerd Runtime Path" - type: string - label: Runtime Path -#storage configurations -- variable: controller.pvc.enabled - default: false - description: If true, enable persistence for controller using PVC - type: boolean - label: PVC status - group: "PVC Configuration" -- variable: controller.pvc.storageClass - default: "" - description: Storage Class to be used - type: string - label: Storage Class Name - group: "PVC Configuration" -#ingress configurations -- variable: manager.ingress.enabled - default: false - description: If true, create ingress, must also set ingress host value - type: boolean - label: Manager ingress status - group: "Ingress Configuration" -- variable: manager.ingress.host - default: "" - description: Must set this host value if ingress is enabled - type: string - label: Manager Ingress host - group: "Ingress Configuration" -- variable: manager.ingress.path - default: "/" - description: Set ingress path - type: string - label: Manager Ingress path - group: "Ingress Configuration" -- variable: manager.ingress.annotations - default: "{}" - description: Add annotations to ingress to influence behavior. Please use the 'Edit as YAML' feature in the Rancher UI to add single or multiple lines of annotation. - type: string - label: Manager Ingress annotations - group: "Ingress Configuration" -- variable: controller.ingress.enabled - default: false - description: If true, create ingress for rest api, must also set ingress host value - type: boolean - label: Controller ingress status - group: "Ingress Configuration" -- variable: controller.ingress.host - default: "" - description: Must set this host value if ingress is enabled - type: string - label: Controller Ingress host - group: "Ingress Configuration" -- variable: controller.ingress.path - default: "/" - description: Set ingress path - type: string - label: Controller Ingress path - group: "Ingress Configuration" -- variable: controller.ingress.annotations - default: "{}" - description: Add annotations to ingress to influence behavior. Please use the 'Edit as YAML' feature in the Rancher UI to add single or multiple lines of annotation. - type: string - label: Controller Ingress annotations - group: "Ingress Configuration" -#service configurations -- variable: manager.svc.type - default: "NodePort" - description: Set manager service type for native Kubernetes - type: enum - label: Manager service type - group: "Service Configuration" - options: - - "NodePort" - - "ClusterIP" - - "LoadBalancer" -- variable: controller.federation.mastersvc.type - default: "" - description: Multi-cluster master cluster service type. If specified, the deployment will be used to manage other clusters. Possible values include NodePort, LoadBalancer and Ingress - type: enum - label: Fed Master Service Type - group: "Service Configuration" - options: - - "NodePort" - - "Ingress" - - "LoadBalancer" -- variable: controller.federation.managedsvc.type - default: "" - description: Multi-cluster managed cluster service type. If specified, the deployment will be managed by the master clsuter. Possible values include NodePort, LoadBalancer and Ingress - type: enum - label: Fed Managed service type - group: "Service Configuration" - options: - - "NodePort" - - "Ingress" - - "LoadBalancer" -- variable: controller.apisvc.type - default: "NodePort" - description: Controller REST API service type - type: enum - label: Controller REST API Service Type - group: "Service Configuration" - options: - - "NodePort" - - "ClusterIP" - - "LoadBalancer" diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/NOTES.txt b/charts/neuvector/100.0.0+up2.2.0-b2/templates/NOTES.txt deleted file mode 100644 index e79b2cc21..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/NOTES.txt +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.manager.enabled .Values.manager.ingress.enabled }} -From outside the cluster, the NeuVector URL is: -http://{{ .Values.manager.ingress.host }} -{{- else if not .Values.openshift }} -Get the NeuVector URL by running these commands: -{{- if contains "NodePort" .Values.manager.svc.type }} - NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services neuvector-service-webui) - NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo https://$NODE_IP:$NODE_PORT -{{- else if contains "ClusterIP" .Values.manager.svc.type }} - CLUSTER_IP=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.clusterIP}" services neuvector-service-webui) - echo https://$CLUSTER_IP:8443 -{{- else if contains "LoadBalancer" .Values.manager.svc.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status by running 'kubectl get svc --namespace {{ .Release.Namespace }} -w neuvector-service-webui' - - SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} neuvector-service-webui -o jsonpath="{.status.loadBalancer.ingress[0].ip}") - echo https://$SERVICE_IP:8443 -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/_helpers.tpl b/charts/neuvector/100.0.0+up2.2.0-b2/templates/_helpers.tpl deleted file mode 100644 index 5d21a1824..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/_helpers.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "neuvector.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "neuvector.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "neuvector.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- define "system_default_registry" -}} -{{- if .Values.global.cattle.systemDefaultRegistry -}} -{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} -{{- else -}} -{{- "" -}} -{{- end -}} -{{- end -}} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/admission-webhook-service.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/admission-webhook-service.yaml deleted file mode 100644 index 8a0a76aaa..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/admission-webhook-service.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: neuvector-svc-admission-webhook - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - ports: - - port: 443 - targetPort: 20443 - protocol: TCP - name: admission-webhook - type: {{ .Values.admissionwebhook.type }} - selector: - app: neuvector-controller-pod \ No newline at end of file diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/clusterrole.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/clusterrole.yaml deleted file mode 100644 index 6673e2f6c..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/clusterrole.yaml +++ /dev/null @@ -1,119 +0,0 @@ -{{- $oc4 := and .Values.openshift (semverCompare ">=1.12-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} -{{- $oc3 := and .Values.openshift (not $oc4) (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-app - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - "" - resources: - - nodes - - pods - - services - - namespaces - verbs: - - get - - list - - watch - - update - ---- - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-rbac - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -{{- if .Values.openshift }} -- apiGroups: - - image.openshift.io - resources: - - imagestreams - verbs: - - get - - list - - watch -{{- end }} -- apiGroups: - - rbac.authorization.k8s.io - resources: - - rolebindings - - roles - - clusterrolebindings - - clusterroles - verbs: - - get - - list - - watch - ---- - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRole -metadata: - name: neuvector-binding-admission - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - - mutatingwebhookconfigurations - verbs: - - get - - list - - watch - - create - - update - - delete - ---- - -{{- if $oc4 }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: neuvector-binding-co - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - config.openshift.io - resources: - - clusteroperators - verbs: - - get - - list -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/clusterrolebinding.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/clusterrolebinding.yaml deleted file mode 100644 index 2ae8aed3a..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,145 +0,0 @@ -{{- $oc4 := and .Values.openshift (semverCompare ">=1.12-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} -{{- $oc3 := and .Values.openshift (not $oc4) (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-app - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-app -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} - ---- - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-rbac - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-rbac -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} - ---- - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-admission - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: neuvector-binding-admission -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} - ---- - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-view - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: view -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} - ---- - -{{- if $oc4 }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: neuvector-binding-co - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: neuvector-binding-co -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-deployment.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-deployment.yaml deleted file mode 100644 index 915d68f65..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-deployment.yaml +++ /dev/null @@ -1,193 +0,0 @@ -{{- if .Values.controller.enabled -}} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apps/v1 -{{- else }} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Deployment -metadata: - name: neuvector-controller-pod - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - replicas: {{ .Values.controller.replicas }} - minReadySeconds: 60 - strategy: -{{ toYaml .Values.controller.strategy | indent 4 }} - selector: - matchLabels: - app: neuvector-controller-pod - template: - metadata: - labels: - app: neuvector-controller-pod - release: {{ .Release.Name }} - spec: - {{- if .Values.controller.affinity }} - affinity: -{{ toYaml .Values.controller.affinity | indent 8 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: -{{ toYaml .Values.controller.tolerations | indent 8 }} - {{- end }} - {{- if .Values.controller.nodeSelector }} - nodeSelector: -{{ toYaml .Values.controller.nodeSelector | indent 8 }} - {{- end }} - {{- if .Values.controller.schedulerName }} - schedulerName: {{ .Values.controller.schedulerName }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - - name: {{ .Values.imagePullSecrets }} - {{- end }} - {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName }} - {{- end }} - serviceAccountName: {{ .Values.serviceAccount }} - serviceAccount: {{ .Values.serviceAccount }} - containers: - - name: neuvector-controller-pod - image: {{ template "system_default_registry" . }}{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }} - securityContext: - privileged: true - resources: - {{- if .Values.controller.resources }} -{{ toYaml .Values.controller.resources | indent 12 }} - {{- else }} -{{ toYaml .Values.resources | indent 12 }} - {{- end }} - readinessProbe: - exec: - command: - - cat - - /tmp/ready - initialDelaySeconds: 5 - periodSeconds: 5 - env: - - name: CLUSTER_JOIN_ADDR - value: neuvector-svc-controller.{{ .Release.Namespace }} - - name: CLUSTER_ADVERTISED_ADDR - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: CLUSTER_BIND_ADDR - valueFrom: - fieldRef: - fieldPath: status.podIP - {{- if .Values.controller.ranchersso.enabled }} - - name: RANCHER_SSO - value: "1" - - name: RANCHER_EP - value: "{{ .Values.global.cattle.url }}" - {{- end }} - {{- if or .Values.controller.pvc.enabled .Values.controller.azureFileShare.enabled }} - - name: CTRL_PERSIST_CONFIG - value: "1" - {{- end }} - {{- with .Values.controller.env }} -{{- toYaml . | nindent 12 }} - {{- end }} - volumeMounts: - - mountPath: /var/neuvector - name: nv-share - readOnly: false - {{- if .Values.containerd.enabled }} - - mountPath: /var/run/containerd/containerd.sock - {{- else if .Values.k3s.enabled }} - - mountPath: /var/run/containerd/containerd.sock - {{- else if .Values.bottlerocket.enabled }} - - mountPath: /var/run/containerd/containerd.sock - {{- else if .Values.crio.enabled }} - - mountPath: /var/run/crio/crio.sock - {{- else }} - - mountPath: /var/run/docker.sock - {{- end }} - name: runtime-sock - readOnly: true - - mountPath: /host/proc - name: proc-vol - readOnly: true - - mountPath: /host/cgroup - name: cgroup-vol - readOnly: true - - mountPath: /etc/config - name: config-volume - readOnly: true - {{- if .Values.controller.certificate.secret }} - - mountPath: /etc/neuvector/certs/ssl-cert.key - subPath: {{ .Values.controller.certificate.keyFile }} - name: cert - readOnly: true - - mountPath: /etc/neuvector/certs/ssl-cert.pem - subPath: {{ .Values.controller.certificate.pemFile }} - name: cert - readOnly: true - {{- end }} - terminationGracePeriodSeconds: 300 - restartPolicy: Always - volumes: - - name: nv-share - {{- if .Values.controller.pvc.enabled }} - persistentVolumeClaim: - claimName: neuvector-data - {{- else if .Values.controller.azureFileShare.enabled }} - azureFile: - secretName: {{ .Values.controller.azureFileShare.secretName }} - shareName: {{ .Values.controller.azureFileShare.shareName }} - readOnly: false - {{- else }} - hostPath: - path: /var/neuvector - {{- end }} - - name: runtime-sock - hostPath: - {{- if .Values.containerd.enabled }} - path: {{ .Values.containerd.path }} - {{- else if .Values.crio.enabled }} - path: {{ .Values.crio.path }} - {{- else if .Values.k3s.enabled }} - path: {{ .Values.k3s.runtimePath }} - {{- else if .Values.bottlerocket.enabled }} - path: {{ .Values.bottlerocket.runtimePath }} - {{- else }} - path: {{ .Values.docker.path }} - {{- end }} - - name: proc-vol - hostPath: - path: /proc - - name: cgroup-vol - hostPath: - path: /sys/fs/cgroup - - name: config-volume - projected: - sources: - - configMap: - name: neuvector-init - optional: true - - secret: - name: neuvector-init - optional: true - {{- if .Values.controller.certificate.secret }} - - name: cert - secret: - secretName: {{ .Values.controller.certificate.secret }} - {{- end }} -{{- if gt (int .Values.controller.disruptionbudget) 0 }} ---- -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: neuvector-controller-pdb - namespace: neuvector -spec: - minAvailable: {{ .Values.controller.disruptionbudget }} - selector: - matchLabels: - app: neuvector-controller-pod -{{- end }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-ingress.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-ingress.yaml deleted file mode 100644 index 2738f1791..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-ingress.yaml +++ /dev/null @@ -1,210 +0,0 @@ -{{- if .Values.controller.enabled }} -{{- if .Values.controller.ingress.enabled }} -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: neuvector-restapi-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.ingress.tls }} - tls: - - hosts: - - {{ .Values.controller.ingress.host }} -{{- if .Values.controller.ingress.secretName }} - secretName: {{ .Values.controller.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.controller.ingress.host }} - http: - paths: - - path: {{ .Values.controller.ingress.path }} - pathType: Prefix - backend: - service: - name: neuvector-svc-controller-api - port: - number: 10443 -{{- else }} -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: neuvector-restapi-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.ingress.tls }} - tls: - - hosts: - - {{ .Values.controller.ingress.host }} -{{- if .Values.controller.ingress.secretName }} - secretName: {{ .Values.controller.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.controller.ingress.host }} - http: - paths: - - path: {{ .Values.controller.ingress.path }} - backend: - serviceName: neuvector-svc-controller-api - servicePort: 10443 -{{- end }} -{{- end }} -{{- if .Values.controller.federation.mastersvc.ingress.enabled }} -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: neuvector-mastersvc-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.federation.mastersvc.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.federation.mastersvc.ingress.tls }} - tls: - - hosts: - - {{ .Values.controller.federation.mastersvc.ingress.host }} -{{- if .Values.controller.federation.mastersvc.ingress.secretName }} - secretName: {{ .Values.controller.federation.mastersvc.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.controller.federation.mastersvc.ingress.host }} - http: - paths: - - path: {{ .Values.controller.federation.mastersvc.ingress.path }} - pathType: Prefix - backend: - service: - name: neuvector-svc-controller-fed-master - port: - number: 11443 -{{- else }} ---- -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: neuvector-mastersvc-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.federation.mastersvc.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.federation.mastersvc.ingress.tls }} - tls: - - hosts: - - {{ .Values.controller.federation.mastersvc.ingress.host }} -{{- if .Values.controller.federation.mastersvc.ingress.secretName }} - secretName: {{ .Values.controller.federation.mastersvc.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.controller.federation.mastersvc.ingress.host }} - http: - paths: - - path: {{ .Values.controller.federation.mastersvc.ingress.path }} - backend: - serviceName: neuvector-svc-controller-fed-master - servicePort: 11443 -{{- end }} -{{- end }} -{{- if .Values.controller.federation.managedsvc.ingress.enabled }} -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: neuvector-managedsvc-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.federation.managedsvc.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.federation.managedsvc.ingress.tls }} - tls: - - hosts: - - {{ .Values.controller.federation.managedsvc.ingress.host }} -{{- if .Values.controller.federation.managedsvc.ingress.secretName }} - secretName: {{ .Values.controller.federation.managedsvc.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.controller.federation.managedsvc.ingress.host }} - http: - paths: - - path: {{ .Values.controller.federation.managedsvc.ingress.path }} - pathType: Prefix - backend: - service: - name: neuvector-svc-controller-fed-managed - port: - number: 10443 -{{- else }} ---- -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: neuvector-managedsvc-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.federation.managedsvc.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.federation.managedsvc.ingress.tls }} - tls: - - hosts: - - {{ .Values.controller.federation.managedsvc.ingress.host }} -{{- if .Values.controller.federation.managedsvc.ingress.secretName }} - secretName: {{ .Values.controller.federation.managedsvc.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.controller.federation.managedsvc.ingress.host }} - http: - paths: - - path: {{ .Values.controller.federation.managedsvc.ingress.path }} - backend: - serviceName: neuvector-svc-controller-fed-managed - servicePort: 10443 -{{- end }} -{{- end }} -{{- end -}} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-route.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-route.yaml deleted file mode 100644 index ad0720fab..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-route.yaml +++ /dev/null @@ -1,82 +0,0 @@ -{{- if .Values.openshift -}} -{{- if .Values.controller.apisvc.route.enabled }} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: route.openshift.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: Route -metadata: - name: neuvector-route-api - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.apisvc.route.host }} - host: {{ .Values.controller.apisvc.route.host }} -{{- end }} - to: - kind: Service - name: neuvector-svc-controller-api - port: - targetPort: controller-api - tls: - termination: {{ .Values.controller.apisvc.route.termination }} ---- -{{ end -}} -{{- if .Values.controller.federation.mastersvc.route.enabled }} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: route.openshift.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: Route -metadata: - name: neuvector-route-fed-master - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.federation.mastersvc.route.host }} - host: {{ .Values.controller.federation.mastersvc.route.host }} -{{- end }} - to: - kind: Service - name: neuvector-svc-controller-fed-master - port: - targetPort: fed - tls: - termination: {{ .Values.controller.federation.mastersvc.route.termination }} ---- -{{ end -}} -{{- if .Values.controller.federation.managedsvc.route.enabled }} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: route.openshift.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: Route -metadata: - name: neuvector-route-fed-managed - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.controller.federation.managedsvc.route.host }} - host: {{ .Values.controller.federation.managedsvc.route.host }} -{{- end }} - to: - kind: Service - name: neuvector-svc-controller-fed-managed - port: - targetPort: fed - tls: - termination: {{ .Values.controller.federation.managedsvc.route.termination }} -{{ end -}} -{{- end -}} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-service.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-service.yaml deleted file mode 100644 index e7971b2ed..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/controller-service.yaml +++ /dev/null @@ -1,89 +0,0 @@ -{{- if .Values.controller.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: neuvector-svc-controller - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - clusterIP: None - ports: - - port: 18300 - protocol: "TCP" - name: "cluster-tcp-18300" - - port: 18301 - protocol: "TCP" - name: "cluster-tcp-18301" - - port: 18301 - protocol: "UDP" - name: "cluster-udp-18301" - selector: - app: neuvector-controller-pod -{{- if .Values.controller.apisvc.type }} ---- -apiVersion: v1 -kind: Service -metadata: - name: neuvector-svc-controller-api - namespace: {{ .Release.Namespace }} -{{- with .Values.controller.apisvc.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - type: {{ .Values.controller.apisvc.type }} - ports: - - port: 10443 - protocol: "TCP" - name: "controller-api" - selector: - app: neuvector-controller-pod -{{ end -}} -{{- if .Values.controller.federation.mastersvc.type }} ---- -apiVersion: v1 -kind: Service -metadata: - name: neuvector-svc-controller-fed-master - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - type: {{ .Values.controller.federation.mastersvc.type }} - ports: - - port: 11443 - name: fed - protocol: TCP - selector: - app: neuvector-controller-pod -{{ end -}} -{{- if .Values.controller.federation.managedsvc.type }} ---- -apiVersion: v1 -kind: Service -metadata: - name: neuvector-svc-controller-fed-managed - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - type: {{ .Values.controller.federation.managedsvc.type }} - ports: - - port: 10443 - name: fed - protocol: TCP - selector: - app: neuvector-controller-pod -{{ end -}} -{{- end -}} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/enforcer-daemonset.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/enforcer-daemonset.yaml deleted file mode 100644 index 8785763df..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/enforcer-daemonset.yaml +++ /dev/null @@ -1,111 +0,0 @@ -{{- if .Values.enforcer.enabled -}} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apps/v1 -{{- else }} -apiVersion: extensions/v1beta1 -{{- end }} -kind: DaemonSet -metadata: - name: neuvector-enforcer-pod - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -spec: - updateStrategy: - type: RollingUpdate - selector: - matchLabels: - app: neuvector-enforcer-pod - template: - metadata: - labels: - app: neuvector-enforcer-pod - release: {{ .Release.Name }} - spec: - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - - name: {{ .Values.imagePullSecrets }} - {{- end }} - {{- if .Values.enforcer.tolerations }} - tolerations: -{{ toYaml .Values.enforcer.tolerations | indent 8 }} - {{- end }} - hostPID: true - {{- if .Values.enforcer.priorityClassName }} - priorityClassName: {{ .Values.enforcer.priorityClassName }} - {{- end }} - serviceAccountName: {{ .Values.serviceAccount }} - serviceAccount: {{ .Values.serviceAccount }} - containers: - - name: neuvector-enforcer-pod - image: {{ template "system_default_registry" . }}{{ .Values.enforcer.image.repository }}:{{ .Values.enforcer.image.tag }} - securityContext: - privileged: true - resources: - {{- if .Values.enforcer.resources }} -{{ toYaml .Values.enforcer.resources | indent 12 }} - {{- else }} -{{ toYaml .Values.resources | indent 12 }} - {{- end }} - env: - - name: CLUSTER_JOIN_ADDR - value: neuvector-svc-controller.{{ .Release.Namespace }} - - name: CLUSTER_ADVERTISED_ADDR - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: CLUSTER_BIND_ADDR - valueFrom: - fieldRef: - fieldPath: status.podIP - volumeMounts: - {{- if .Values.containerd.enabled }} - - mountPath: /var/run/containerd/containerd.sock - {{- else if .Values.k3s.enabled }} - - mountPath: /var/run/containerd/containerd.sock - {{- else if .Values.bottlerocket.enabled }} - - mountPath: /var/run/containerd/containerd.sock - {{- else if .Values.crio.enabled }} - - mountPath: /var/run/crio/crio.sock - {{- else }} - - mountPath: /var/run/docker.sock - {{- end }} - name: runtime-sock - readOnly: true - - mountPath: /host/proc - name: proc-vol - readOnly: true - - mountPath: /host/cgroup - name: cgroup-vol - readOnly: true - - mountPath: /lib/modules - name: modules-vol - readOnly: true - terminationGracePeriodSeconds: 1200 - restartPolicy: Always - volumes: - - name: runtime-sock - hostPath: - {{- if .Values.containerd.enabled }} - path: {{ .Values.containerd.path }} - {{- else if .Values.crio.enabled }} - path: {{ .Values.crio.path }} - {{- else if .Values.k3s.enabled }} - path: {{ .Values.k3s.runtimePath }} - {{- else if .Values.bottlerocket.enabled }} - path: {{ .Values.bottlerocket.runtimePath }} - {{- else }} - path: {{ .Values.docker.path }} - {{- end }} - - name: proc-vol - hostPath: - path: /proc - - name: cgroup-vol - hostPath: - path: /sys/fs/cgroup - - name: modules-vol - hostPath: - path: /lib/modules -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/init-configmap.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/init-configmap.yaml deleted file mode 100644 index 4d3b97129..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/init-configmap.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.controller.configmap.enabled }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: neuvector-init - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: -{{ toYaml .Values.controller.configmap.data | indent 4 }} -{{- end }} \ No newline at end of file diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/init-secret.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/init-secret.yaml deleted file mode 100644 index 8a5081408..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/init-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.controller.secret.enabled }} -apiVersion: v1 -kind: Secret -metadata: - name: neuvector-init - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: -{{- range $key, $val := .Values.controller.secret.data }} - {{ $key }}: | {{ toYaml $val | b64enc | nindent 4 }} -{{- end }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-deployment.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-deployment.yaml deleted file mode 100644 index 4c6ad7f62..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-deployment.yaml +++ /dev/null @@ -1,81 +0,0 @@ -{{- if .Values.manager.enabled -}} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apps/v1 -{{- else }} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Deployment -metadata: - name: neuvector-manager-pod - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - replicas: 1 - selector: - matchLabels: - app: neuvector-manager-pod - template: - metadata: - labels: - app: neuvector-manager-pod - release: {{ .Release.Name }} - spec: - {{- if .Values.manager.affinity }} - affinity: -{{ toYaml .Values.manager.affinity | indent 8 }} - {{- end }} - {{- if .Values.manager.tolerations }} - tolerations: -{{ toYaml .Values.manager.tolerations | indent 8 }} - {{- end }} - {{- if .Values.manager.nodeSelector }} - nodeSelector: -{{ toYaml .Values.manager.nodeSelector | indent 8 }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - - name: {{ .Values.imagePullSecrets }} - {{- end }} - {{- if .Values.manager.priorityClassName }} - priorityClassName: {{ .Values.manager.priorityClassName }} - {{- end }} - serviceAccountName: {{ .Values.serviceAccount }} - serviceAccount: {{ .Values.serviceAccount }} - containers: - - name: neuvector-manager-pod - image: {{ template "system_default_registry" . }}{{ .Values.manager.image.repository }}:{{ .Values.manager.image.tag }} - env: - - name: CTRL_SERVER_IP - value: neuvector-svc-controller.{{ .Release.Namespace }} - {{- if not .Values.manager.env.ssl }} - - name: MANAGER_SSL - value: "off" - {{- end }} - volumeMounts: - {{- if .Values.manager.certificate.secret }} - - mountPath: /etc/neuvector/certs/ssl-cert.key - subPath: {{ .Values.manager.certificate.keyFile }} - name: cert - readOnly: true - - mountPath: /etc/neuvector/certs/ssl-cert.pem - subPath: {{ .Values.manager.certificate.pemFile }} - name: cert - readOnly: true - {{- end }} - resources: - {{- if .Values.manager.resources }} -{{ toYaml .Values.manager.resources | indent 12 }} - {{- else }} -{{ toYaml .Values.resources | indent 12 }} - {{- end }} - restartPolicy: Always - volumes: - {{- if .Values.manager.certificate.secret }} - - name: cert - secret: - secretName: {{ .Values.manager.certificate.secret }} - {{- end }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-ingress.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-ingress.yaml deleted file mode 100644 index 456090208..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-ingress.yaml +++ /dev/null @@ -1,68 +0,0 @@ -{{- if and .Values.manager.enabled .Values.manager.ingress.enabled -}} -{{- if (semverCompare ">=1.19-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: neuvector-webui-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.manager.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.manager.ingress.tls }} - tls: - - hosts: - - {{ .Values.manager.ingress.host }} -{{- if .Values.manager.ingress.secretName }} - secretName: {{ .Values.manager.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.manager.ingress.host }} - http: - paths: - - path: {{ .Values.manager.ingress.path }} - pathType: Prefix - backend: - service: - name: neuvector-service-webui - port: - number: 8443 -{{- else }} -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: neuvector-webui-ingress - namespace: {{ .Release.Namespace }} -{{- with .Values.manager.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.manager.ingress.tls }} - tls: - - hosts: - - {{ .Values.manager.ingress.host }} -{{- if .Values.manager.ingress.secretName }} - secretName: {{ .Values.manager.ingress.secretName }} -{{- end }} -{{- end }} - rules: - - host: {{ .Values.manager.ingress.host }} - http: - paths: - - path: {{ .Values.manager.ingress.path }} - backend: - serviceName: neuvector-service-webui - servicePort: 8443 -{{- end }} -{{- end -}} \ No newline at end of file diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-route.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-route.yaml deleted file mode 100644 index 9723f28d5..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-route.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.openshift -}} -{{- if .Values.manager.route.enabled }} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: route.openshift.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: Route -metadata: - name: neuvector-route-webui - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if .Values.manager.route.host }} - host: {{ .Values.manager.route.host }} -{{- end }} - to: - kind: Service - name: neuvector-service-webui - port: - targetPort: manager - tls: - termination: {{ .Values.manager.route.termination }} -{{- end }} -{{- end -}} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-service.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-service.yaml deleted file mode 100644 index e18e55c35..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/manager-service.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if .Values.manager.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: neuvector-service-webui - namespace: {{ .Release.Namespace }} -{{- with .Values.manager.svc.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - type: {{ .Values.manager.svc.type }} -{{- if and .Values.manager.svc.loadBalancerIP (eq .Values.manager.svc.type "LoadBalancer") }} - loadBalancerIP: {{ .Values.manager.svc.loadBalancerIP }} -{{- end }} - ports: - - port: 8443 - name: manager - protocol: TCP - selector: - app: neuvector-manager-pod -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/psp.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/psp.yaml deleted file mode 100644 index c1d68857b..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/psp.yaml +++ /dev/null @@ -1,77 +0,0 @@ -{{- if .Values.psp -}} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: neuvector-binding-psp - annotations: - seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' - labels: - chart: {{ template "neuvector.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -spec: - privileged: true - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - allowedCapabilities: - - SYS_ADMIN - - NET_ADMIN - - SYS_PTRACE - - IPC_LOCK - requiredDropCapabilities: - - ALL - volumes: - - '*' - hostNetwork: true - hostPorts: - - min: 0 - max: 65535 - hostIPC: true - hostPID: true - runAsUser: - rule: 'RunAsAny' - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'RunAsAny' - fsGroup: - rule: 'RunAsAny' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: neuvector-binding-psp - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -rules: -- apiGroups: - - policy - - extensions - resources: - - podsecuritypolicies - verbs: - - use - resourceNames: - - neuvector-binding-psp ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: neuvector-binding-psp - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: neuvector-binding-psp -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/pvc.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/pvc.yaml deleted file mode 100644 index 1e976bbf6..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/pvc.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if and .Values.controller.enabled .Values.controller.pvc.enabled -}} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: neuvector-data - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - accessModes: -{{ toYaml .Values.controller.pvc.accessModes | indent 4 }} - volumeMode: Filesystem -{{- if .Values.controller.pvc.storageClass }} - storageClassName: {{ .Values.controller.pvc.storageClass }} -{{- end }} - resources: - requests: -{{- if .Values.controller.pvc.capacity }} - storage: {{ .Values.controller.pvc.capacity }} -{{- else }} - storage: 1Gi -{{- end }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/rolebinding.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/rolebinding.yaml deleted file mode 100644 index f2f49d7d7..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/rolebinding.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{- $oc4 := and .Values.openshift (semverCompare ">=1.12-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} -{{- $oc3 := and .Values.openshift (not $oc4) (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) -}} - -{{- if $oc3 }} -apiVersion: authorization.openshift.io/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: rbac.authorization.k8s.io/v1 -{{- else }} -apiVersion: v1 -{{- end }} -kind: RoleBinding -metadata: - name: neuvector-admin - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: -{{- if not $oc3 }} - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -{{- end }} - name: admin -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- if $oc3 }} -userNames: -- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }} -{{- end }} - ---- - -{{- if $oc4 }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: system:openshift:scc:privileged - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:openshift:scc:privileged -subjects: -- kind: ServiceAccount - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/scanner-deployment.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/scanner-deployment.yaml deleted file mode 100644 index 57e7bf35a..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/scanner-deployment.yaml +++ /dev/null @@ -1,62 +0,0 @@ -{{- if .Values.cve.scanner.enabled -}} -{{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: apps/v1 -{{- else }} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Deployment -metadata: - name: neuvector-scanner-pod - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -spec: - strategy: -{{ toYaml .Values.cve.scanner.strategy | indent 4 }} - replicas: {{ .Values.cve.scanner.replicas }} - selector: - matchLabels: - app: neuvector-scanner-pod - template: - metadata: - labels: - app: neuvector-scanner-pod - spec: - {{- if .Values.cve.scanner.affinity }} - affinity: -{{ toYaml .Values.cve.scanner.affinity | indent 8 }} - {{- end }} - {{- if .Values.cve.scanner.tolerations }} - tolerations: -{{ toYaml .Values.cve.scanner.tolerations | indent 8 }} - {{- end }} - {{- if .Values.cve.scanner.nodeSelector }} - nodeSelector: -{{ toYaml .Values.cve.scanner.nodeSelector | indent 8 }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - - name: {{ .Values.imagePullSecrets }} - {{- end }} - {{- if .Values.cve.scanner.priorityClassName }} - priorityClassName: {{ .Values.cve.scanner.priorityClassName }} - {{- end }} - serviceAccountName: {{ .Values.serviceAccount }} - serviceAccount: {{ .Values.serviceAccount }} - containers: - - name: neuvector-scanner-pod - image: {{ template "system_default_registry" . }}{{ .Values.cve.scanner.image.repository }}:{{ .Values.cve.scanner.image.tag }} - imagePullPolicy: Always - env: - - name: CLUSTER_JOIN_ADDR - value: neuvector-svc-controller.{{ .Release.Namespace }} - {{- if .Values.cve.scanner.dockerPath }} - - name: SCANNER_DOCKER_URL - value: {{ .Values.cve.scanner.dockerPath }} - {{- end }} - resources: -{{ toYaml .Values.cve.scanner.resources | indent 12 }} - restartPolicy: Always -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/serviceaccount.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/serviceaccount.yaml deleted file mode 100644 index 47da190a5..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/serviceaccount.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if not .Values.openshift}} -{{- if ne .Values.serviceAccount "default"}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ .Values.serviceAccount }} - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- end }} -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/templates/updater-cronjob.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/templates/updater-cronjob.yaml deleted file mode 100644 index 4cf9aeb0a..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/templates/updater-cronjob.yaml +++ /dev/null @@ -1,65 +0,0 @@ -{{- if .Values.cve.updater.enabled -}} -{{- if (semverCompare ">=1.21-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: batch/v1 -{{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} -apiVersion: batch/v1beta1 -{{- else }} -apiVersion: batch/v2alpha1 -{{- end }} -kind: CronJob -metadata: - name: neuvector-updater-pod - namespace: {{ .Release.Namespace }} - labels: - chart: {{ template "neuvector.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - schedule: {{ .Values.cve.updater.schedule | quote }} - jobTemplate: - spec: - template: - metadata: - labels: - app: neuvector-updater-pod - release: {{ .Release.Name }} - spec: - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - - name: {{ .Values.imagePullSecrets }} - {{- end }} - {{- if .Values.cve.updater.priorityClassName }} - priorityClassName: {{ .Values.cve.updater.priorityClassName }} - {{- end }} - serviceAccountName: {{ .Values.serviceAccount }} - serviceAccount: {{ .Values.serviceAccount }} - containers: - - name: neuvector-updater-pod - image: {{ template "system_default_registry" . }}{{ .Values.cve.updater.image.repository }}:{{ .Values.cve.updater.image.tag }} - imagePullPolicy: Always - command: - - /bin/sh - - -c - - sleep 30 - {{- if .Values.cve.scanner.enabled }} - lifecycle: - postStart: - exec: - command: - - /bin/sh - - -c - {{- if (semverCompare ">=1.9-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }} - {{- if .Values.cve.updater.secure }} - - /usr/bin/curl -v -X PATCH -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -H "Content-Type:application/strategic-merge-patch+json" -d '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt":"'`date +%Y-%m-%dT%H:%M:%S%z`'"}}}}}' 'https://kubernetes.default/apis/apps/v1/namespaces/{{ .Release.Namespace }}/deployments/neuvector-scanner-pod' - {{- else }} - - /usr/bin/curl -kv -X PATCH -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -H "Content-Type:application/strategic-merge-patch+json" -d '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt":"'`date +%Y-%m-%dT%H:%M:%S%z`'"}}}}}' 'https://kubernetes.default/apis/apps/v1/namespaces/{{ .Release.Namespace }}/deployments/neuvector-scanner-pod' - {{- end }} - {{- else }} - - /usr/bin/curl -kv -X PATCH -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -H "Content-Type:application/strategic-merge-patch+json" -d '{"spec":{"template":{"metadata":{"annotations":{"kubectl.kubernetes.io/restartedAt":"'`date +%Y-%m-%dT%H:%M:%S%z`'"}}}}}' 'https://kubernetes.default/apis/extensions/v1beta1/namespaces/{{ .Release.Namespace }}/deployments/neuvector-scanner-pod' - {{- end }} - {{- end }} - env: - - name: CLUSTER_JOIN_ADDR - value: neuvector-svc-controller.{{ .Release.Namespace }} - restartPolicy: Never -{{- end }} diff --git a/charts/neuvector/100.0.0+up2.2.0-b2/values.yaml b/charts/neuvector/100.0.0+up2.2.0-b2/values.yaml deleted file mode 100644 index 68747f85f..000000000 --- a/charts/neuvector/100.0.0+up2.2.0-b2/values.yaml +++ /dev/null @@ -1,295 +0,0 @@ -# Default values for neuvector. -# This is a YAML-formatted file. -# Declare variables to be passed into the templates. - -openshift: false - -registry: docker.io -oem: -psp: false -serviceAccount: neuvector - -controller: - # If false, controller will not be installed - enabled: true - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - image: - repository: rancher/mirrored-neuvector-controller - tag: 5.0.0-b2 - hash: - replicas: 3 - disruptionbudget: 0 - schedulerName: - priorityClassName: - env: [] - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - neuvector-controller-pod - topologyKey: "kubernetes.io/hostname" - tolerations: [] - nodeSelector: {} - # key1: value1 - # key2: value2 - apisvc: - type: - annotations: {} - # OpenShift Route configuration - route: - enabled: false - termination: passthrough - host: - ranchersso: - enabled: true - pvc: - enabled: false - accessModes: - - ReadWriteMany - storageClass: - capacity: - azureFileShare: - enabled: false - secretName: - shareName: - certificate: - secret: - keyFile: tls.key - pemFile: tls.pem - federation: - mastersvc: - type: - # Federation Master Ingress - ingress: - enabled: false - host: # MUST be set, if ingress is enabled - path: "/" # or this could be "/api", but might need "rewrite-target" annotation - annotations: - ingress.kubernetes.io/protocol: https - # ingress.kubernetes.io/rewrite-target: / - tls: false - secretName: - # OpenShift Route configuration - route: - enabled: false - termination: passthrough - host: - managedsvc: - type: - # Federation Managed Ingress - ingress: - enabled: false - host: # MUST be set, if ingress is enabled - path: "/" # or this could be "/api", but might need "rewrite-target" annotation - annotations: - ingress.kubernetes.io/protocol: https - # ingress.kubernetes.io/rewrite-target: / - tls: false - secretName: - # OpenShift Route configuration - route: - enabled: false - termination: passthrough - host: - ingress: - enabled: false - host: # MUST be set, if ingress is enabled - path: "/" # or this could be "/api", but might need "rewrite-target" annotation - annotations: - ingress.kubernetes.io/protocol: https - # ingress.kubernetes.io/rewrite-target: / - tls: false - secretName: - resources: {} - # limits: - # cpu: 400m - # memory: 2792Mi - # requests: - # cpu: 100m - # memory: 2280Mi - configmap: - enabled: false - data: - # eulainitcfg.yaml: | - # ... - # ldapinitcfg.yaml: | - # ... - # oidcinitcfg.yaml: | - # ... - # samlinitcfg.yaml: | - # ... - # sysinitcfg.yaml: | - # ... - # userinitcfg.yaml: | - # ... - secret: - # NOTE: files defined here have preferrence over the ones defined in the configmap section - enabled: false - data: {} - # eulainitcfg.yaml: - # license_key: 0Bca63Iy2FiXGqjk... - # ... - # ldapinitcfg.yaml: - # directory: OpenLDAP - # ... - # oidcinitcfg.yaml: - # Issuer: https://... - # ... - # samlinitcfg.yaml: - # ... - # sysinitcfg.yaml: - # ... - # userinitcfg.yaml: - # ... - -enforcer: - # If false, enforcer will not be installed - enabled: true - image: - repository: rancher/mirrored-neuvector-enforcer - tag: 5.0.0-b2 - hash: - priorityClassName: - tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/master - resources: {} - # limits: - # cpu: 400m - # memory: 2792Mi - # requests: - # cpu: 100m - # memory: 2280Mi - -manager: - # If false, manager will not be installed - enabled: true - image: - repository: rancher/mirrored-neuvector-manager - tag: 5.0.0-b2 - hash: - priorityClassName: - env: - ssl: true - svc: - type: NodePort - loadBalancerIP: - annotations: {} - # azure - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-load-balancer-internal-subnet: "apps-subnet" - # OpenShift Route configuration - route: - enabled: true - termination: passthrough - host: - certificate: - secret: - keyFile: tls.key - pemFile: tls.pem - ingress: - enabled: false - host: # MUST be set, if ingress is enabled - path: "/" - annotations: {} - # kubernetes.io/ingress.class: my-nginx - # nginx.ingress.kubernetes.io/whitelist-source-range: "1.1.1.1" - # nginx.ingress.kubernetes.io/rewrite-target: / - # nginx.ingress.kubernetes.io/enable-rewrite-log: "true" - # only for end-to-end tls conf - ingress-nginx accepts backend self-signed cert - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - tls: false - secretName: # my-tls-secret - resources: {} - # limits: - # cpu: 400m - # memory: 2792Mi - # requests: - # cpu: 100m - # memory: 2280Mi - affinity: {} - tolerations: [] - nodeSelector: {} - # key1: value1 - # key2: value2 - -cve: - updater: - # If false, cve updater will not be installed - enabled: true - secure: false - image: - repository: rancher/mirrored-neuvector-updater - tag: latest - hash: - schedule: "0 0 * * *" - priorityClassName: - scanner: - enabled: true - replicas: 3 - dockerPath: "" - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - image: - repository: rancher/mirrored-neuvector-scanner - tag: latest - hash: - priorityClassName: - resources: {} - # limits: - # cpu: 400m - # memory: 2792Mi - # requests: - # cpu: 100m - # memory: 2280Mi - affinity: {} - tolerations: [] - nodeSelector: {} - # key1: value1 - # key2: value2 -docker: - path: /var/run/docker.sock - -resources: {} - # limits: - # cpu: 400m - # memory: 2792Mi - # requests: - # cpu: 100m - # memory: 2280Mi - -k3s: - enabled: false - runtimePath: /run/k3s/containerd/containerd.sock - -bottlerocket: - enabled: false - runtimePath: /run/dockershim.sock - -containerd: - enabled: false - path: /var/run/containerd/containerd.sock - -crio: - enabled: false - path: /var/run/crio/crio.sock - -admissionwebhook: - type: ClusterIP - -crdwebhook: - enabled: true - type: ClusterIP diff --git a/index.yaml b/index.yaml index 0f8ed85dc..53ddcff27 100755 --- a/index.yaml +++ b/index.yaml @@ -1488,60 +1488,6 @@ entries: urls: - assets/longhorn-crd/longhorn-crd-1.0.200.tgz version: 1.0.200 - neuvector: - - annotations: - catalog.cattle.io/auto-install: neuvector-crd=match - catalog.cattle.io/certified: rancher - catalog.cattle.io/display-name: NeuVector - catalog.cattle.io/kube-version: '>=1.18.0-0' - catalog.cattle.io/namespace: cattle-neuvector-system - catalog.cattle.io/os: linux - catalog.cattle.io/permit-os: linux - catalog.cattle.io/provides-gvr: neuvector.com/v1 - catalog.cattle.io/rancher-version: '>= 2.6.5-0 <= 2.6.100-0' - catalog.cattle.io/release-name: neuvector - catalog.cattle.io/type: cluster-tool - catalog.cattle.io/ui-component: neuvector - catalog.cattle.io/upstream-version: 2.2.0-b2 - apiVersion: v1 - appVersion: 5.0.0-b2 - created: "2022-05-02T15:14:14.041865928-07:00" - description: Helm chart for NeuVector's core services - digest: 583a73ca1ffe2b8f6b05f5a849c6ee857f12a979a5a6dd8226dc7b723f0bd7fc - home: https://neuvector.com - icon: https://avatars2.githubusercontent.com/u/19367275?s=200&v=4 - keywords: - - security - maintainers: - - email: support@neuvector.com - name: becitsthere - name: neuvector - sources: - - https://github.com/neuvector/neuvector - urls: - - assets/neuvector/neuvector-100.0.0+up2.2.0-b2.tgz - version: 100.0.0+up2.2.0-b2 - neuvector-crd: - - annotations: - catalog.cattle.io/certified: rancher - catalog.cattle.io/hidden: "true" - catalog.cattle.io/namespace: cattle-neuvector-system - catalog.cattle.io/release-name: neuvector-crd - apiVersion: v1 - appVersion: 5.0.0-b2 - created: "2022-05-02T15:14:14.042450835-07:00" - description: Helm chart for NeuVector's CRD services - digest: f89e733d4290c7d9048eb000241e00ff98ee0cdda8ea13806faee1dbe9e0d4ea - home: https://neuvector.com - icon: https://avatars2.githubusercontent.com/u/19367275?s=200&v=4 - maintainers: - - email: support@neuvector.com - name: becitsthere - name: neuvector-crd - type: application - urls: - - assets/neuvector-crd/neuvector-crd-100.0.0+up2.2.0-b2.tgz - version: 100.0.0+up2.2.0-b2 prometheus-federator: - annotations: catalog.cattle.io/certified: rancher