init trivy plugin chart

Signed-off-by: Frank Jogeleit <[email protected]>

.github/workflows/kyverno-chart.yaml

@@ -1,4 +1,4 @@
-name: kyverno-plugin-helm-release
+name: Publish Kyverno Plugin OCI Chart
 
 permissions: {}
 

.github/workflows/trivy-chart.yaml.yaml

@@ -0,0 +1,70 @@
+name: Publish Trivy Plugin OCI Chart
+
+permissions: {}
+
+on:
+  push:
+    tags:
+      - 'trivy-plugin-chart-*'
+
+jobs:
+  helm-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+        with:
+          python-version: 3.7
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
+
+#      - name: Run chart-testing (lint)
+#        run: ct lint --target-branch=main --check-version-increment=false --validate-maintainers=false
+
+  linter-artifacthub:
+    runs-on: ubuntu-latest
+    container:
+      image: artifacthub/ah
+      options: --user root
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Run ah lint
+        working-directory: ./charts/
+        run: ah lint
+
+  create-release:
+    runs-on: ubuntu-latest
+    needs: helm-tests
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Install Helm
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
+        with:
+          version: v3.10.3
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
+
+      - name: Login to GitHub Container Registry
+        run: |
+          helm registry login --username ${GITHUB_ACTOR} --password ${{ secrets.GITHUB_TOKEN }} ghcr.io
+      
+      - name: Login to Cosign
+        run: |
+          cosign login --username ${GITHUB_ACTOR} --password ${{ secrets.GITHUB_TOKEN }} ghcr.io
+      
+      - name: Publish OCI Charts
+        run: |
+          helm package charts/trivy-plugin --destination .dist
+          helm push .dist/trivy-plugin-*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts/policy-reporter |& tee .digest
+          cosign sign --yes ghcr.io/${{ github.repository_owner }}/charts/policy-reporter/trivy-plugin@$(cat .digest | awk -F "[, ]+" '/Digest/{print $NF}')

charts/trivy-plugin/.helmignore

@@ -0,0 +1,24 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+README.md.gotmpl

charts/trivy-plugin/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: trivy-plugin
+description: Trivy Plugin for Policy Reporter UI
+type: application
+version: 0.0.1
+appVersion: "0.0.2"

charts/trivy-plugin/README.md

@@ -0,0 +1,69 @@
+# trivy-plugin
+
+Trivy Plugin for Policy Reporter UI
+
+![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.2](https://img.shields.io/badge/AppVersion-0.0.2-informational?style=flat-square)
+
+## Documentation
+
+You can find detailed Information and Screens about Features and Configurations in the [Documentation](https://kyverno.github.io/policy-reporter).
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| image.registry | string | `"ghcr.io"` | Image registry |
+| image.repository | string | `"kyverno/policy-reporter/trivy-plugin"` | Image repository |
+| image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
+| image.tag | string | `""` | Image tag Defaults to `Chart.AppVersion` if omitted |
+| replicaCount | int | `1` | Deployment replica count |
+| logging.encoding | string | `"console"` | log encoding possible encodings are console and json |
+| logging.logLevel | int | `0` | log level default info |
+| server.port | int | `8080` | Application port |
+| server.logging | bool | `false` | Enables Access logging |
+| server.basicAuth.username | string | `""` | HTTP BasicAuth username |
+| server.basicAuth.password | string | `""` | HTTP BasicAuth password |
+| server.basicAuth.secretRef | string | `""` | Read HTTP BasicAuth credentials from secret |
+| policyReporter.host | string | `""` | Host of the Policy Reporter Core App |
+| policyReporter.skipTLS | bool | `false` | Skip TLS Verification |
+| policyReporter.certificate | string | `""` | TLS Certificate |
+| policyReporter.basicAuth.username | string | `""` | HTTP BasicAuth Username |
+| policyReporter.basicAuth.password | string | `""` | HTTP BasicAuth Password |
+| policyReporter.secretRef | string | `""` | Secret to read the API configuration from supports `host`, `certificate`, `skipTLS`, `username`, `password` key |
+| imagePullSecrets | list | `[]` | Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument |
+| nameOverride | string | `""` | Override the name of the chart |
+| fullnameOverride | string | `""` | Override the expanded name of the chart |
+| serviceAccount.create | bool | `true` | Create ServiceAccount |
+| serviceAccount.automount | bool | `true` | Enable ServiceAccount automaount |
+| serviceAccount.annotations | object | `{}` | Annotations for the ServiceAccount |
+| serviceAccount.name | string | `""` | The ServiceAccount name |
+| podAnnotations | object | `{}` | Additional annotations to add to each pod |
+| podLabels | object | `{}` | Additional labels to add to each pod |
+| updateStrategy | object | `{}` | Deployment update strategy. Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy |
+| revisionHistoryLimit | int | `10` | The number of revisions to keep |
+| podSecurityContext | object | `{"runAsGroup":1234,"runAsUser":1234}` | Security context for the pod |
+| envVars | list | `[]` | Allow additional env variables to be added |
+| rbac.enabled | bool | `true` | Create RBAC resources |
+| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":1234,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context |
+| service.type | string | `"ClusterIP"` | Service type. |
+| service.port | int | `8080` | Service port. |
+| service.annotations | object | `{}` | Service annotations. |
+| service.labels | object | `{}` | Service labels. |
+| ingress.enabled | bool | `false` | Create ingress resource. |
+| ingress.className | string | `""` | Ingress class name. |
+| ingress.labels | object | `{}` | Ingress labels. |
+| ingress.annotations | object | `{}` | Ingress annotations. |
+| ingress.hosts | list | `[]` | List of ingress host configurations. |
+| ingress.tls | list | `[]` | List of ingress TLS configurations. |
+| networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. |
+| networkPolicy.egress | list | `[{"ports":[{"port":6443,"protocol":"TCP"}]}]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. Enables Kubernetes API Server by default |
+| networkPolicy.ingress | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. |
+| resources | object | `{}` |  |
+| podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for kyvernoPlugin disruptions. Cannot be used if `maxUnavailable` is set. |
+| podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for kyvernoPlugin disruptions. Cannot be used if `minAvailable` is set. |
+| nodeSelector | object | `{}` | Node labels for pod assignment |
+| tolerations | list | `[]` | List of node taints to tolerate |
+| affinity | object | `{}` | Affinity constraints. |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

charts/trivy-plugin/README.md.gotmpl

@@ -0,0 +1,19 @@
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+{{ template "chart.description" . }}
+
+{{ template "chart.badgesSection" . }}
+
+## Documentation
+
+You can find detailed Information and Screens about Features and Configurations in the [Documentation](https://kyverno.github.io/policy-reporter).
+
+{{ template "chart.valuesSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "helm-docs.versionFooter" . }}

charts/trivy-plugin/config.tmpl

@@ -0,0 +1,20 @@
+logging:
+  encoding: {{ .Values.logging.encoding }}
+  logLevel: {{ .Values.logging.logLevel }}
+
+server:
+  logging: {{ .Values.server.logging }}
+  basicAuth:
+    username: {{ .Values.server.basicAuth.username }}
+    password: {{ .Values.server.basicAuth.password }}
+    secretRef: {{ .Values.server.basicAuth.secretRef }}
+
+core:
+  host: {{ .Values.policyReporter.host }}
+  skipTLS: {{ .Values.policyReporter.skipTLS }}
+  certificate: {{ .Values.policyReporter.certificate }}
+  secretRef: {{ .Values.policyReporter.secretRef }}
+  basicAuth:
+    username: {{ .Values.policyReporter.basicAuth.username }}
+    password: {{ .Values.policyReporter.basicAuth.password }}
+

charts/trivy-plugin/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "trivy-plugin.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "trivy-plugin.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "trivy-plugin.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "trivy-plugin.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

charts/trivy-plugin/templates/_helpers.tpl

@@ -0,0 +1,74 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "trivy-plugin.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "trivy-plugin.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "trivy-plugin.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "trivy-plugin.labels" -}}
+helm.sh/chart: {{ include "trivy-plugin.chart" . }}
+{{ include "trivy-plugin.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "trivy-plugin.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "trivy-plugin.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "trivy-plugin.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "trivy-plugin.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "trivy-plugin.podDisruptionBudget" -}}
+{{- if and .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable }}
+{{- fail "Cannot set both .Values.podDisruptionBudget.minAvailable and .Values.podDisruptionBudget.maxUnavailable" -}}
+{{- end }}
+{{- if not .Values.podDisruptionBudget.maxUnavailable }}
+minAvailable: {{ default 1 .Values.podDisruptionBudget.minAvailable }}
+{{- end }}
+{{- if .Values.podDisruptionBudget.maxUnavailable }}
+maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+{{- end }}
+{{- end }}

charts/trivy-plugin/templates/config-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "trivy-plugin.fullname" . }}-config
+  labels:
+    {{- include "trivy-plugin.labels" . | nindent 4 }}
+type: Opaque
+data:
+  config.yaml: {{ tpl (.Files.Get "config.tmpl") . | b64enc }}