andata
/
rancher-charts
mirror of https://git.rancher.io/charts
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make Remove

pull/2146/head
Kevin Joiner 2022-10-11 08:39:31 -04:00
parent 6bad16bbf8
commit dea2a8d0a7
26 changed files with 0 additions and 1141 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
assets/rancher-external-ip-webhook/rancher-external-ip-webhook-101.0.0+up1.0.1.tgz
View File

Binary file not shown.

21
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/.helmignore
View File

@ -1,21 +0,0 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*~
# Various IDEs
.project
.idea/
*.tmproj

29
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/Chart.yaml
View File

@ -1,29 +0,0 @@
annotations:
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: External IP Webhook
catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'
catalog.cattle.io/namespace: cattle-externalip-system
catalog.cattle.io/os: linux
catalog.cattle.io/permits-os: linux,windows
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
catalog.cattle.io/release-name: rancher-external-ip-webhook
catalog.cattle.io/ui-component: rancher-external-ip-webhook
catalog.cattle.io/upstream-version: 1.0.1
apiVersion: v1
appVersion: v1.0.1
description: |
Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
home: https://github.com/rancher/externalip-webhook
keywords:
- cve
- externalip
- webhook
- security
kubeVersion: < 1.22.0
maintainers:
- email: raul@rancher.com
name: rawmind0
name: rancher-external-ip-webhook
sources:
- https://github.com/rancher/externalip-webhook
version: 101.0.0+up1.0.1

71
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/README.md
View File

@ -1,71 +0,0 @@
# externalip-webhook
## Chart Details
This chart will create a deployment of `externalip-webhook` within your Kubernetes Cluster. It is required on kubernetes versions prior to 1.21 to mitigate CVE-2020-8554.
**Note:** This chart is deprecated for kubernetes version 1.21 and unsupported starting with 1.22. To mitigate CVE-2020-8554, enable the [`DenyServiceExternalIPs` admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#denyserviceexternalips) on the cluster.
## Installing the Chart
To install the chart with the release name `rancher-external-ip-webhook`:
```bash
$ helm repo add rancher-chart https://charts.rancher.io
$ helm repo update
$ helm install rancher-external-ip-webhook rancher-chart/rancher-external-ip-webhook --namespace cattle-externalip-system -f values.yaml
```
## Configuration
The following table lists the configurable parameters of the externalip-webhook chart and their default values.
| Parameter | Description | Default |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
| `allowedExternalIPCidrs` | Set allowed external IP CIDRs separated by a comma | `""` |
| `certificates.caBundle` | If cert-manager integration is disabled, add here self signed ca.crt in base64 format | `""` |
| `certificates.certManager.enabled` | Enable cert manager integration. Cert manager should be already installed at the k8s cluster | `true` |
| `certificates.certManager.version` | Cert manager version to use | `""` |
| `certificates.secretName` | If cert-manager integration is disabled, upload certs data (ca.crt, tls.crt & tls.key) as k8s secretName in the namespace | `"webhook-server-cert"` |
| `global.cattle.systemDefaultRegistry`| Pull docker images from systemDefaultRegistry | `""` |
| `image.pullPolicy` | Webhook server docker pull policy | `"IfNotPresent"` |
| `image.pullSecrets` | Webhook server docker pull secret | `""` |
| `image.repository` | Webhook server docker image repository | `"rancher/externalip-webhook"` |
| `image.tag` | Webhook server docker image tag Defaults to | `".Chart.appVersion"` |
| `metrics.enabled` | Enable metrics endpoint | `false` |
| `metrics.port` | Webhook metrics pod port | `8443` |
| `metrics.prometheusExport` | Enable Prometheus export. Follow [exporting-metrics-for-prometheus](https://book.kubebuilder.io/reference/metrics.html#exporting-metrics-for-prometheus) to export the webhook metrics | `false` |
| `metrics.authProxy.enabled` | Enable auth proxy for metrics endpoint | `false` |
| `metrics.authProxy.port` | Webhook auth proxy pod port | `8080` |
| `metrics.authProxy.image.pullPolicy` | Webhook auth proxy docker pull policy | `"IfNotPresent"` |
| `metrics.authProxy.image.pullSecrets`| Webhook auth proxy docker pull secrets | `""` |
| `metrics.authProxy.image.repository` | Webhook auth proxy docker image repository | `"gcr.io/kubebuilder/kube-rbac-proxy"` |
| `metrics.authProxy.image.pullPolicy` | Webhook auth proxy docker image tag | `"v0.5.0"` |
| `metrics.authProxy.resources.limits.cpu` | Webhook auth proxy resource cpu limit | `"100m"` |
| `metrics.authProxy.resources.limits.memory` | Webhook auth proxy resource memory limit | `"30Mi"` |
| `metrics.authProxy.resources.requests.cpu` | Webhook auth proxy wesource cpu reservation | `"100m"` |
| `metrics.authProxy.resources.requests.memory` | Webhook auth proxy resource memory reservation | `"20Mi"` |
| `nodeSelector` | Node labels for pod assignment | `{}` |
| `rbac.apiVersion` | Rbac API version to use | `"v1"` |
| `resources.limits.cpu` | Resource cpu limit | `"100m"` |
| `resources.limits.memory` | Resource memory limit | `"30Mi"` |
| `resources.requests.cpu` | Resource cpu reservation | `"100m"` |
| `resources.requests.memory` | Resource memory reservation | `"20Mi"` |
| `service.metricsPort` | Webhook metrics service port | `8443` |
| `service.webhookPort` | Webhook server service port | `443` |
| `serviceAccountName` | Webhook serviceAccountName. Just used if metrics.authProxy.enabled = false | `"default"` |
| `tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `[]` |
| `webhookPort` | Webhook server pod port | `9443` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
```bash
$ helm repo add rancher-chart https://charts.rancher.io
$ helm repo update
$ helm install rancher-external-ip-webhook rancher-chart/rancher-external-ip-webhook --namespace cattle-externalip-system -f values.yaml
```
> **Tip**: You can use the default [values.yaml](https://github.com/rancher/externalip-webhook/blob/master/chart/values.yaml)

12
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/app-README.md
View File

@ -1,12 +0,0 @@
# externalip-webhook
This chart was created to mitigate [CVE-2020-8554](https://www.cvedetails.com/cve/CVE-2020-8554/)
External IP Webhook is a validating k8s webhook which prevents services from using random external IPs.
Cluster administrators can specify list of CIDRs allowed to be used as external IP by specifying `allowed-external-ip-cidrs` parameter. The webhook will only allow services which either don’t set external IP, or whose external IPs are within the range specified by the administrator.
External IP Webhook certificates are required. They can be generated in 2 ways:
* cert-manager: This is the default chart configuration. Cert manager should be already installed at the k8s cluster
* uploading certs: Disable `Cert Manager integration` and set `Secret name` and `CA Bundle` at `Certificates` section.
For more information, review the Helm README of this chart.

26
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/questions.yaml
View File

@ -1,26 +0,0 @@
questions:
# allowedExternalIPCidrs
- variable: allowedExternalIPCidrs
label: Allowed external IP cidrs
description: Set allowed external IP CIDRs separated by a comma
type: string
group: Configuration
- variable: certificates.certManager.enabled
default: true
description: Enable cert manager integration. Cert manager should be already installed
label: Enable Cert Manager integration
type: boolean
group: "Certificates"
show_subquestion_if: false
subquestions:
- variable: certificates.secretName
default: webhook-server-cert
description: Use certificates from secret. Secret should exists in the app namespace, with certs data (ca.crt, tls.crt & tls.key)
label: Secret name
type: string
required: true
- variable: certificates.caBundle
description: Use self signed CA Bundle. It should be provided in base64 format
label: CA Bundle
type: string
required: true

3
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/NOTES.txt
View File

@ -1,3 +0,0 @@
To verify that externalip-webhook has started, run:
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "externalip-webhook.name" . }},release={{ .Release.Name }}"

50
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/_helpers.tpl
View File

@ -1,50 +0,0 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "externalip-webhook.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "externalip-webhook.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if ne $name .Release.Name -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/* Generate basic labels */}}
{{- define "externalip-webhook.labels" }}
app: {{ template "externalip-webhook.name" . }}
heritage: {{.Release.Service }}
release: {{.Release.Name }}
{{- end }}
{{/*
Windows cluster will add default taint for linux nodes,
add below linux tolerations to workloads could be scheduled to those linux nodes
*/}}
{{- define "linux-node-tolerations" -}}
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
{{- end -}}
{{- define "linux-node-selector" -}}
kubernetes.io/os: linux
{{- end -}}
{{- define "system_default_registry" -}}
{{- if .Values.global.cattle.systemDefaultRegistry -}}
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
{{- else -}}
{{- "" -}}
{{- end -}}
{{- end -}}

30
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/admissionregistration.yaml
View File

@ -1,30 +0,0 @@
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
{{- if .Values.certificates.certManager.enabled }}
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "externalip-webhook.fullname" . }}-server-cert
{{- end }}
creationTimestamp: null
name: {{ template "externalip-webhook.fullname" . }}-validating-webhook-configuration
webhooks:
- clientConfig:
{{- if not (.Values.certificates.certManager.enabled) }}
caBundle: {{ .Values.certificates.caBundle }}
{{- end }}
service:
name: {{ template "externalip-webhook.fullname" . }}
namespace: {{ .Release.Namespace }}
path: /validate-service
failurePolicy: Ignore
name: {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
rules:
- apiGroups:
- ""
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- services

33
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/clusterrole.yaml
View File

@ -1,33 +0,0 @@
{{- if and (.Values.metrics.enabled) (.Values.metrics.authProxy.enabled) -}}
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: ClusterRole
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-proxy-role
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: ClusterRole
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-metrics-reader
rules:
- nonResourceURLs:
- /metrics
verbs:
- get
{{- end -}}

31
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/clusterrolebinding.yaml
View File

@ -1,31 +0,0 @@
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: ClusterRoleBinding
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-cluster-view
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: view
subjects:
- kind: ServiceAccount
name: {{ template "externalip-webhook.fullname" . }}
namespace: {{ .Release.Namespace }}
{{- if and (.Values.metrics.enabled) (.Values.metrics.authProxy.enabled) }}
---
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: ClusterRoleBinding
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-proxy-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "externalip-webhook.fullname" . }}-proxy-role
subjects:
- kind: ServiceAccount
name: {{ template "externalip-webhook.fullname" . }}
namespace: {{ .Release.Namespace }}
{{- end }}

107
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/deployment.yaml
View File

@ -1,107 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
seccomp.security.alpha.kubernetes.io/pod: runtime/default
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}
namespace: {{ .Release.Namespace }}
spec:
replicas: {{ .Values.replicas }}
selector:
matchLabels:
app: {{ template "externalip-webhook.name" . }}
template:
metadata:
annotations:
seccomp.security.alpha.kubernetes.io/pod: runtime/default
labels: {{ include "externalip-webhook.labels" . | indent 8 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
spec:
containers:
{{- if and (.Values.metrics.enabled) (.Values.metrics.authProxy.enabled) }}
- name: {{ template "externalip-webhook.fullname" . }}-auth-proxy
args:
- --secure-listen-address=0.0.0.0:{{ .Values.metrics.port }}
- --upstream=http://127.0.0.1:{{ .Values.metrics.authProxy.port }}/
- --logtostderr=true
- --v=10
image: {{ template "system_default_registry" . }}{{ .Values.metrics.authProxy.image.repository}}:{{ .Values.metrics.authProxy.image.tag }}
imagePullPolicy: "{{ .Values.metrics.authProxy.image.pullPolicy }}"
ports:
- containerPort: {{ .Values.metrics.port }}
name: webhook-metrics
protocol: TCP
resources:
{{ toYaml .Values.metrics.authProxy.resources | indent 10 }}
readinessProbe:
tcpSocket:
port: webhook-metrics
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
tcpSocket:
port: webhook-metrics
initialDelaySeconds: 5
failureThreshold: 10
periodSeconds: 30
{{- end }}
- name: {{ template "externalip-webhook.fullname" . }}
image: {{ template "system_default_registry" . }}{{ .Values.image.repository}}:{{ default .Chart.AppVersion .Values.image.tag }}
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
command:
- /webhook
args:
- --webhook-port={{ .Values.webhookPort }}
{{- if .Values.allowedExternalIPCidrs }}
- --allowed-external-ip-cidrs={{ .Values.allowedExternalIPCidrs }}
{{- end }}
{{- if .Values.metrics.enabled }}
{{- if .Values.metrics.authProxy.enabled }}
- --metrics-addr=127.0.0.1:{{ .Values.metrics.authProxy.port }}
{{- else }}
- --metrics-addr=0.0.0.0:{{ .Values.metrics.port }}
{{- end }}
{{- end }}
ports:
- containerPort: {{ .Values.webhookPort }}
name: webhook-server
protocol: TCP
{{- if and (.Values.metrics.enabled) (not (.Values.metrics.authProxy.enabled)) }}
- containerPort: {{ .Values.metrics.port }}
name: webhook-metrics
protocol: TCP
{{- end }}
volumeMounts:
- name: server-cert
mountPath: /tmp/k8s-webhook-server/serving-certs
readOnly: true
resources:
{{ toYaml .Values.resources | indent 10 }}
readinessProbe:
tcpSocket:
port: webhook-server
initialDelaySeconds: 5
failureThreshold: 10
periodSeconds: 30
livenessProbe:
tcpSocket:
port: webhook-server
initialDelaySeconds: 5
failureThreshold: 10
periodSeconds: 30
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
{{- if .Values.nodeSelector }}
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
tolerations: {{ include "linux-node-tolerations" . | nindent 6}}
{{- if .Values.tolerations }}
{{ toYaml .Values.tolerations | indent 6 }}
{{- end }}
serviceAccountName: {{ template "externalip-webhook.fullname" . }}
volumes:
- name: server-cert
secret:
defaultMode: 420
secretName: {{ .Values.certificates.secretName }}

52
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/issuer.yaml
View File

@ -1,52 +0,0 @@
{{- if .Values.certificates.certManager.enabled -}}
{{- $certmanagerVer := split "." .Values.certificates.certManager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 1) (ge (int $certmanagerVer._1) 0)) }}
apiVersion: cert-manager.io/v1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
# Setting latest version as default
apiVersion: cert-manager.io/v1
{{- end }}
kind: Certificate
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-server-cert
namespace: {{ .Release.Namespace }}
spec:
dnsNames:
- {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
- {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
issuerRef:
kind: Issuer
name: {{ template "externalip-webhook.fullname" . }}-issuer
secretName: {{ .Values.certificates.secretName }}
---
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 1) (ge (int $certmanagerVer._1) 0)) }}
apiVersion: cert-manager.io/v1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
# Setting latest version as default
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-issuer
namespace: {{ .Release.Namespace }}
spec:
selfSigned: {}
{{- end -}}

35
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/service.yaml
View File

@ -1,35 +0,0 @@
apiVersion: v1
kind: Service
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}
namespace: {{ .Release.Namespace }}
spec:
ports:
- name: webhook-server
port: {{ .Values.service.webhookPort }}
protocol: TCP
targetPort: {{ .Values.webhookPort }}
selector:
app: {{ template "externalip-webhook.name" . }}
type: "ClusterIP"
{{- if .Values.metrics.enabled }}
---
apiVersion: v1
kind: Service
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-metrics-service
namespace: {{ .Release.Namespace }}
spec:
ports:
- name: webhook-metrics
port: {{ .Values.service.metricsPort }}
protocol: TCP
targetPort: {{ .Values.metrics.port }}
selector:
app: {{ template "externalip-webhook.name" . }}
type: "ClusterIP"
{{- end }}

7
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/serviceaccount.yaml
View File

@ -1,7 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}
namespace: {{ .Release.Namespace }}

16
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/templates/servicemonitor.yaml
View File

@ -1,16 +0,0 @@
{{- if and (.Values.metrics.enabled) (.Values.metrics.prometheusExport) -}}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
name: {{ template "externalip-webhook.fullname" . }}-monitor
namespace: {{ .Release.Namespace }}
spec:
endpoints:
- path: /metrics
port: https
selector:
matchLabels:
app: {{ template "externalip-webhook.name" . }}
{{- end }}

32
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/admissionregistration_test.yaml
View File

@ -1,32 +0,0 @@
suite: Test Admission Registration
templates:
- admissionregistration.yaml
tests:
- it: should render Admission Registration
asserts:
- equal:
path: apiVersion
value: admissionregistration.k8s.io/v1beta1
- it: should render Admission Registration annotation and not caBundle if certificates.certManager.enabled = true
release:
name: rancher-externalip-webhook
namespace: test
set:
certificates.certManager.enabled: true
asserts:
- equal:
path: metadata.annotations
value:
cert-manager.io/inject-ca-from: test/rancher-externalip-webhook-server-cert
- isNull:
path: webhooks[0].clientConfig.caBundle
- it: should render Admission Registration caBundle and not annotation if certificates.certManager.enabled = false
set:
certificates.caBundle: test
certificates.certManager.enabled: false
asserts:
- equal:
path: webhooks[0].clientConfig.caBundle
value: test
- isNull:
path: metadata.annotations

37
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/clusterrole_test.yaml
View File

@ -1,37 +0,0 @@
suite: Test Cluster Roles
templates:
- clusterrole.yaml
tests:
- it: should not render Cluster Roles if metrics.enabled = false or metrics.authProxy.enabled = false
set:
metrics.enabled: false
metrics.authProxy.enabled: false
asserts:
- hasDocuments:
count: 0
template: clusterrole.yaml
- it: should render Cluster Roles if metrics.enabled = true and metrics.authProxy.enabled = true
set:
metrics.enabled: true
metrics.authProxy.enabled: true
asserts:
- hasDocuments:
count: 2
template: clusterrole.yaml
- it: should render Cluster Roles with default rbac api version if metrics.enabled = true and metrics.authProxy.enabled = true
set:
metrics.enabled: true
metrics.authProxy.enabled: true
asserts:
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- it: should render Cluster Roles with custom rbac api version if metrics.enabled = true and metrics.authProxy.enabled = true
set:
metrics.enabled: true
metrics.authProxy.enabled: true
rbac.apiVersion: v1beta
asserts:
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1beta

42
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/clusterrolebinding_test.yaml
View File

@ -1,42 +0,0 @@
suite: Test Cluster Role Bindings
templates:
- clusterrolebinding.yaml
tests:
- it: should render Cluster Role Bindings with default rbac api version
set:
rbac.apiVersion: v1
asserts:
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- it: should render Cluster Role Bindings with custom rbac api version
set:
rbac.apiVersion: v1beta
asserts:
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1beta
- it: should not render Cluster Role Binding proxy if metrics.enabled = false or metrics.authProxy.enabled = false
set:
metrics.enabled: false
metrics.authProxy.enabled: false
asserts:
- hasDocuments:
count: 1
template: clusterrolebinding.yaml
- it: should render Cluster Role Bindings proxy if metrics.enabled = true and metrics.authProxy.enabled = true
set:
metrics.enabled: true
metrics.authProxy.enabled: true
asserts:
- hasDocuments:
count: 2
template: clusterrolebinding.yaml
- it: should render Cluster Role Bindings with default rbac api version if metrics.enabled = true and metrics.authProxy.enabled = true
set:
metrics.enabled: true
metrics.authProxy.enabled: true
asserts:
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1

202
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/deployment_test.yaml
View File

@ -1,202 +0,0 @@
suite: Test Deployments
templates:
- deployment.yaml
tests:
- it: should render Deployment with allowed-external-ip-cidrs arg if allowedExternalIPCidrs is set
release:
name: rancher-externalip-webhook
set:
allowedExternalIPCidrs: "1,2"
asserts:
- equal:
path: spec.template.spec.containers[0].args[1]
value: --allowed-external-ip-cidrs=1,2
- it: should render Deployment with default port, nodeSelector and tolerations if metrics.enabled = false and metrics.authProxy.enabled = false
release:
name: rancher-externalip-webhook
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 9443
name: webhook-server
protocol: TCP
- equal:
path: spec.template.spec.tolerations[0]
value:
key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
- equal:
path: spec.template.spec.nodeSelector
value:
kubernetes.io/os: linux
- it: should render Deployment with default port and custom nodeSelector and tolerations if metrics.enabled = false and metrics.authProxy.enabled = false
release:
name: rancher-externalip-webhook
set:
tolerations:
- key: "cattle.io/test"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
nodeSelector:
kubernetes.io/test: linux
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 9443
name: webhook-server
protocol: TCP
- equal:
path: spec.template.spec.tolerations[0]
value:
key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
- equal:
path: spec.template.spec.tolerations[1]
value:
key: "cattle.io/test"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
- equal:
path: spec.template.spec.nodeSelector
value:
kubernetes.io/os: linux
kubernetes.io/test: linux
- it: should render Deployment with custom port and image if metrics.enabled = false and metrics.authProxy.enabled = false
release:
name: rancher-externalip-webhook
set:
webhookPort: 9000
image.repository: test
image.tag: dev-test
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[0].image
value: test:dev-test
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 9000
name: webhook-server
protocol: TCP
- it: should render Deployment with default metrics port if metrics.enabled = true and metrics.authProxy.enabled = false
release:
name: rancher-externalip-webhook
set:
metrics.enabled: true
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 9443
name: webhook-server
protocol: TCP
- equal:
path: spec.template.spec.containers[0].ports[1]
value:
containerPort: 8443
name: webhook-metrics
protocol: TCP
- it: should render Deployment with custom metrics port if metrics.enabled = true and metrics.authProxy.enabled = false
release:
name: rancher-externalip-webhook
set:
metrics.enabled: true
metrics.port: 8000
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 9443
name: webhook-server
protocol: TCP
- equal:
path: spec.template.spec.containers[0].ports[1]
value:
containerPort: 8000
name: webhook-metrics
protocol: TCP
- it: should render Deployment with default metrics port if metrics.enabled = true and metrics.authProxy.enabled = true
release:
name: rancher-externalip-webhook
set:
metrics.enabled: true
metrics.authProxy.enabled: true
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook-auth-proxy
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 8443
name: webhook-metrics
protocol: TCP
- equal:
path: spec.template.spec.containers[1].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[1].ports[0]
value:
containerPort: 9443
name: webhook-server
protocol: TCP
- it: should render Deployment with custom metrics port and image if metrics.enabled = true and metrics.authProxy.enabled = true
release:
name: rancher-externalip-webhook
set:
metrics.enabled: true
metrics.authProxy.enabled: true
metrics.port: 8000
webhookPort: 9000
image.repository: test
image.tag: dev-test
metrics.authProxy.image.repository: auth
metrics.authProxy.image.tag: auth-test
asserts:
- equal:
path: spec.template.spec.containers[0].name
value: rancher-externalip-webhook-auth-proxy
- equal:
path: spec.template.spec.containers[0].image
value: auth:auth-test
- equal:
path: spec.template.spec.containers[0].ports[0]
value:
containerPort: 8000
name: webhook-metrics
protocol: TCP
- equal:
path: spec.template.spec.containers[1].name
value: rancher-externalip-webhook
- equal:
path: spec.template.spec.containers[1].image
value: test:dev-test
- equal:
path: spec.template.spec.containers[1].ports[0]
value:
containerPort: 9000
name: webhook-server
protocol: TCP

106
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/issuer_test.yaml
View File

@ -1,106 +0,0 @@
suite: Test Issuers
templates:
- issuer.yaml
tests:
- it: should not render issuer if certificates.certManager.enabled = false
set:
certificates.certManager.enabled: false
asserts:
- hasDocuments:
count: 0
template: issuer.yaml
- it: should render issuer if certificates.certManager.enabled = true
set:
certificates.certManager.enabled: true
asserts:
- hasDocuments:
count: 2
template: issuer.yaml
- it: should set issuer apiVersion with default cert-manager
set:
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager >= 1.0.0 using capabilities
capabilities:
apiversions:
- cert-manager.io/v1
set:
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager >= 0.16.0 using capabilities
capabilities:
apiversions:
- cert-manager.io/v1beta1
set:
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1beta1
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager >= 0.11.0 using capabilities
capabilities:
apiversions:
- cert-manager.io/v1alpha2
set:
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1alpha2
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager < 0.11.0 using capabilities
capabilities:
apiversions:
- certmanager.k8s.io/v1alpha1
set:
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: certmanager.k8s.io/v1alpha1
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager >= 1.0.0 using parameter
set:
certificates.certManager.version: 1.0.0
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager >= 0.16.0 using parameter
set:
certificates.certManager.version: 0.16.0
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1beta1
template: issuer.yaml
- it: should set issuer apiVersion with cert-manager >= 0.11.0 using parameter
set:
certificates.certManager.version: 0.11.0
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: cert-manager.io/v1alpha2
template: issuer.yaml
- it: should set letsEncrypt apiVersion with cert-manager < 0.11.0 using parameter
set:
certificates.certManager.version: 0.9.0
certificates.certManager.enabled: true
asserts:
- equal:
path: apiVersion
value: certmanager.k8s.io/v1alpha1
template: issuer.yaml

69
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/service_test.yaml
View File

@ -1,69 +0,0 @@
suite: Test Services
templates:
- service.yaml
tests:
- it: should render webhook-server service with default webhookPort if metrics.enabled = false
set:
metrics.enabled: false
asserts:
- equal:
path: spec.ports[0]
value:
name: webhook-server
port: 443
protocol: TCP
targetPort: 9443
- it: should render webhook-server service with custom webhookPort if metrics.enabled = false
set:
metrics.enabled: false
webhookPort: 9000
asserts:
- equal:
path: spec.ports[0]
value:
name: webhook-server
port: 443
protocol: TCP
targetPort: 9000
- it: should render webhook-server and webhook-metrics services with default webhookPort and metrics.port, if metrics.enabled = true
set:
metrics.enabled: true
asserts:
- equal:
path: spec.ports[0]
value:
name: webhook-server
port: 443
protocol: TCP
targetPort: 9443
documentIndex: 0
- equal:
path: spec.ports[0]
value:
name: webhook-metrics
port: 8443
protocol: TCP
targetPort: 8443
documentIndex: 1
- it: should render webhook-server and webhook-metrics services with custom webhookPort and metrics.port, if metrics.enabled = true
set:
metrics.enabled: true
metrics.port: 8000
webhookPort: 9000
asserts:
- equal:
path: spec.ports[0]
value:
name: webhook-server
port: 443
protocol: TCP
targetPort: 9000
documentIndex: 0
- equal:
path: spec.ports[0]
value:
name: webhook-metrics
port: 8443
protocol: TCP
targetPort: 8000
documentIndex: 1

9
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/serviceaccount_test.yaml
View File

@ -1,9 +0,0 @@
suite: Test Service Accounts
templates:
- serviceaccount.yaml
tests:
- it: should render Service Account
asserts:
- hasDocuments:
count: 1
template: serviceaccount.yaml

20
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/tests/servicemonitor_test.yaml
View File

@ -1,20 +0,0 @@
suite: Test Service Monitors
templates:
- servicemonitor.yaml
tests:
- it: should not render Service Monitor if metrics.enabled = false or metrics.prometheusExport = false
set:
metrics.enabled: false
metrics.prometheusExport: false
asserts:
- hasDocuments:
count: 0
template: servicemonitor.yaml
- it: should render Service Account if metrics.enabled = true and metrics.authProxy.enabled = true
set:
metrics.enabled: true
metrics.prometheusExport: true
asserts:
- hasDocuments:
count: 1
template: servicemonitor.yaml

68
charts/rancher-external-ip-webhook/101.0.0+up1.0.1/values.yaml
View File

@ -1,68 +0,0 @@
## Allowed external IP cidrs
allowedExternalIPCidrs: ""
## Certificates generation for webhook
certificates:
certManager:
# Enable cert manager integration. Cert manager should be already installed at the k8s cluster
enabled: true
version: ""
# If cert-manager integration is disabled, add self signed ca.crt in base64 format
caBundle: ""
# If cert-manager integration is disabled, upload certs data (ca.crt, tls.crt and tls.key) as k8s secretName in the namespace
secretName: webhook-server-cert
## Details about the image to be pulled.
image:
pullPolicy: IfNotPresent
pullSecrets: []
repository: rancher/externalip-webhook
tag: v1.0.1
## Enabling metrics endpoint
# Webhook emits `webhook_failed_request_count` metrics whenever it rejects service creation or update operation
metrics:
enabled: false
port: 8443
# Enable webhook metrics export to Prometheus
prometheusExport: false
# Webhook metrics auth proxy. This option is just available for amd64 arch
authProxy:
enabled: false
port: 8080
image:
pullPolicy: IfNotPresent
pullSecrets: []
repository: rancher/mirrored-kube-rbac-proxy
tag: v0.5.0
resources:
limits:
memory: 30Mi
cpu: 100m
requests:
memory: 20Mi
cpu: 100m
## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
## RBAC
rbac:
apiVersion: v1
## CPU and Memory limit and request for externalip-webhook
resources:
limits:
memory: 30Mi
cpu: 100m
requests:
memory: 20Mi
cpu: 100m
service:
metricsPort: 8443
webhookPort: 443
## Webhook serviceAccountName. Just used if metrics.authProxy.enabled = false
serviceAccountName: default
## List of node taints to tolerate (requires Kubernetes >= 1.6)
tolerations: []
## Webhook server pod port
webhookPort: 9443
global:
cattle:
systemDefaultRegistry: ""

33
index.yaml
View File

@ -4147,39 +4147,6 @@ entries:
- assets/rancher-eks-operator-crd/rancher-eks-operator-crd-100.0.0+up1.1.1.tgz
version: 100.0.0+up1.1.1
rancher-external-ip-webhook:
- annotations:
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: External IP Webhook
catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'
catalog.cattle.io/namespace: cattle-externalip-system
catalog.cattle.io/os: linux
catalog.cattle.io/permits-os: linux,windows
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
catalog.cattle.io/release-name: rancher-external-ip-webhook
catalog.cattle.io/ui-component: rancher-external-ip-webhook
catalog.cattle.io/upstream-version: 1.0.1
apiVersion: v1
appVersion: v1.0.1
created: "2022-09-22T08:28:58.214603-04:00"
description: |
Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
digest: 3c239ed2e9eb65c9e65fd4c4e915669469b1fdd08265e3ff7a4f92a22efab718
home: https://github.com/rancher/externalip-webhook
keywords:
- cve
- externalip
- webhook
- security
kubeVersion: < 1.22.0
maintainers:
- email: raul@rancher.com
name: rawmind0
name: rancher-external-ip-webhook
sources:
- https://github.com/rancher/externalip-webhook
urls:
- assets/rancher-external-ip-webhook/rancher-external-ip-webhook-101.0.0+up1.0.1.tgz
version: 101.0.0+up1.0.1
- annotations:
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: External IP Webhook