Skip to content

Commit ccff28f

Browse files
ofirc-wizofirc-wiz
committed
Added CA support
1 parent 667e3fb commit ccff28f

File tree

6 files changed

+107
-22
lines changed

6 files changed

+107
-22
lines changed

‎wiz-network-analyzer/templates/NOTES.txt

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,14 @@ Next steps:
66

77
2. Collect the support package from the cluster
88
POD_NAME=$(kubectl get pod -l app.kubernetes.io/name=wiz-network-analyzer -n {{ .Release.Namespace }})
9-
kubectl cp $POD_NAME:/support-package.zip .
9+
kubectl -n wiz cp $POD_NAME:/support-package.zip .
1010

1111
2. Upload it to Wiz
1212
Follow the instructions in the support package to upload it to Wiz.
1313

1414
3. (Optional) access the logs
15-
TODO: add commands
15+
POD_NAME=$(kubectl get pod -l app.kubernetes.io/name=wiz-network-analyzer -n {{ .Release.Namespace }})
16+
kubectl -n {{ .Release.Namespace }}) logs $POD_NAME > wiz-network-analyzer.log
1617

1718
Upon completion, the Job will remain for 5 minutes to allow extracting the support package.
1819
After that, the Job will be deleted automatically.

‎wiz-network-analyzer/templates/_helpers.tpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@ Secrets names
6060
{{ coalesce (.Values.global.httpProxyConfiguration.secretName) (.Values.httpProxyConfiguration.secretName) (printf "%s-na-proxy-configuration" .Release.Name) }}
6161
{{- end }}
6262

63+
{{- define "wiz-network-analyzer.caSecretName" -}}
64+
{{ coalesce (.Values.caCertificate.secretName) (printf "%s-na-ca" .Release.Name) }}
65+
{{- end }}
66+
6367
{{/*
6468
Input parameters
6569
*/}}

‎wiz-network-analyzer/templates/job-network-analyzer.yaml

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,6 @@ spec:
2323
{{- toYaml . | nindent 8 }}
2424
{{- end }}
2525
labels:
26-
{{/*
27-
`labels` includes `selectorLabels`
28-
*/}}
2926
{{- include "wiz-network-analyzer.labels" . | nindent 8 }}
3027
spec:
3128
{{- with .Values.global.imagePullSecrets }}
@@ -40,8 +37,17 @@ spec:
4037
{{- else }}
4138
{{- toYaml .Values.global.podSecurityContext | nindent 8 }}
4239
{{- end }}
43-
{{- if or .Values.global.customVolumes .Values.customVolumes }}
40+
{{- if or .Values.global.customVolumes .Values.customVolumes .Values.caCertificate.enabled }}
4441
volumes:
42+
{{- if .Values.caCertificate.enabled }}
43+
- name: additional-certs
44+
secret:
45+
secretName: {{ include "wiz-network-analyzer.caSecretName" . | trim }}
46+
items:
47+
- key: ca.crt
48+
path: ca-certificates.crt
49+
defaultMode: 420
50+
{{- end }}
4551
{{ with .Values.global.customVolumes }}
4652
{{- toYaml . | nindent 6 }}
4753
{{- end }}
@@ -96,12 +102,6 @@ spec:
96102
- name: WIZ_ENV
97103
value: {{ coalesce .Values.global.wizApiToken.clientEndpoint .Values.wizApiToken.clientEndpoint | quote }}
98104
{{- if (or .Values.global.httpProxyConfiguration.enabled .Values.httpProxyConfiguration.enabled) }}
99-
- name: HTTP_PROXY
100-
valueFrom:
101-
secretKeyRef:
102-
name: {{ include "wiz-network-analyzer.proxySecretName" . | trim }}
103-
key: httpProxy
104-
optional: false
105105
- name: HTTPS_PROXY
106106
valueFrom:
107107
secretKeyRef:
@@ -115,10 +115,20 @@ spec:
115115
key: noProxyAddress
116116
optional: false
117117
{{- end }}
118+
{{- if .Values.caCertificate.enabled }}
119+
- name: SSL_CERT_DIR
120+
value: /usr/local/share/ca-certificates/:/certificates/:/etc/ssl/certs
121+
{{- end }}
118122
resources:
119123
{{- toYaml .Values.resources | nindent 12 }}
120-
{{- if or .Values.customVolumeMounts .Values.global.customVolumeMounts }}
124+
{{- if or .Values.customVolumeMounts .Values.global.customVolumeMounts .Values.caCertificate.enabled }}
121125
volumeMounts:
126+
{{- if .Values.caCertificate.enabled }}
127+
- name: additional-certs
128+
mountPath: /certificates
129+
- name: additional-certs
130+
mountPath: /etc/ssl/certs
131+
{{- end }}
122132
{{- with .Values.customVolumeMounts }}
123133
{{- toYaml . | nindent 12 }}
124134
{{- end -}}
@@ -137,4 +147,4 @@ spec:
137147
{{- with (coalesce .Values.global.tolerations .Values.tolerations) }}
138148
tolerations:
139149
{{- toYaml . | nindent 8 }}
140-
{{- end }}
150+
{{- end }}

‎wiz-network-analyzer/templates/secret-ca.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if and .Values.caCertificate.enabled .Values.caCertificate.create }}
2+
apiVersion: v1
3+
kind: Secret
4+
type: Opaque
5+
metadata:
6+
name: {{ include "wiz-network-analyzer.caSecretName" . | trim }}
7+
namespace: {{ .Release.Namespace | quote }}
8+
annotations:
9+
"helm.sh/hook": pre-install,pre-upgrade
10+
"helm.sh/hook-weight": "-1"
11+
{{- with .Values.caCertificate.annotations }}
12+
{{- toYaml . | nindent 4 }}
13+
{{- end }}
14+
labels:
15+
{{- include "wiz-network-analyzer.labels" . | nindent 4 }}
16+
stringData:
17+
ca.crt: {{ .Values.caCertificate.certificate | quote }}
18+
{{- end }}

‎wiz-network-analyzer/templates/secret-proxy.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ metadata:
1414
labels:
1515
{{- include "wiz-network-analyzer.labels" . | nindent 4 }}
1616
stringData:
17-
httpProxy: {{ .Values.httpProxyConfiguration.httpProxy | quote }}
1817
httpsProxy: {{ .Values.httpProxyConfiguration.httpsProxy | quote }}
1918
noProxyAddress: {{ .Values.httpProxyConfiguration.noProxyAddress | quote }}
2019
{{- end }}

‎wiz-network-analyzer/values.yaml

Lines changed: 60 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,18 @@ clusterReader:
2525
resources: ["*"]
2626
verbs: ["get", "list", "watch"]
2727

28+
# Set this to true if you are using Istio in sidecar mode.
29+
# When Istio uses sidecars, there are 2 issues when using Wiz:
30+
# 1) The creation and deletion Jobs never complete (due to istio-proxy sidecar)
31+
# 2) There is a race condition and possible network connectivity failures
32+
# when contacting the Wiz backend.
33+
#
34+
# When either of this happens, either the installation, upgrade or uninstallation
35+
# of the charts fail.
36+
# Setting this to true ensures that the istio-proxy gets a graceful shutdown
37+
# and mitigates the networking race condition by sleeping before the Job starts.
38+
# Learn more:
39+
# https://istio.io/latest/blog/2023/native-sidecars/
2840
istio:
2941
enabled: false
3042
sleepBeforeJobSecs: 15
@@ -67,21 +79,49 @@ tolerations: []
6779

6880
affinity: {}
6981

70-
# Redirect HTTP and/or HTTPS traffic through a proxy.
82+
# Redirect HTTPS traffic through a proxy.
7183
httpProxyConfiguration:
72-
enabled: false # Should the components use a proxy.
84+
# Set to true to enable using a proxy.
85+
enabled: false
7386

7487
# Should a Secret be created by the chart or not.
75-
# Set this to false if you wish to create the Secret yourself or using another tool.
76-
# The Secret should contain httpProxy, httpsProxy and noProxyAddress.
88+
# Set this to false if you wish to create the Secret yourself or using another tool
89+
# (e.g. external secrets operator).
90+
# The Secret should contain httpsProxy and noProxyAddress.
7791
create: true
7892
secretName: "" # The name of the proxy Secret.
7993
annotations: {} # Annotations to be set on the secret
8094

81-
httpProxy: "" # URL to use as a proxy for outbound HTTP traffic.
95+
# URL to use as a proxy for outbound HTTPS traffic.
96+
# Leave blank for transparent proxy.
8297
httpsProxy: "" # URL to use as a proxy for outbound HTTPS traffic.
8398
noProxyAddress: "kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local"
8499

100+
caCertificate:
101+
# Set to true to enable using a custom CA certificate.
102+
# Useful only in man-in-the-middle (MitM) / TLS inspection / SSL bumping scenarios.
103+
# Regular/forward/CONNECT proxies do not require this.
104+
enabled: false
105+
106+
# Should a Secret be created by the chart or not.
107+
# Set this to false if you wish to create the Secret yourself or using another tool
108+
# (e.g. external secrets operator).
109+
# The Secret should contain a key called `ca.crt` and the value
110+
# should be a certificate in PEM format.
111+
create: true
112+
113+
# The certificate must be in PEM format.
114+
# Simply copy-n-paste the contents of the certificate file.
115+
certificate: |
116+
-----BEGIN CERTIFICATE-----
117+
-----END CERTIFICATE-----
118+
119+
# The name of the CA certificate Secret.
120+
# Must have a key called `ca.crt` with the certificate in PEM format.
121+
secretName: ""
122+
123+
annotations: {} # Annotations to be set on the secret.
124+
85125
# The address of the Kubernetes API server.
86126
# Override this if you are using a different endpoint for your Kubernetes API server.
87127
apiServerEndpoint: "https://kubernetes.default.svc.cluster.local"
@@ -153,7 +193,20 @@ global:
153193
secret:
154194
name: "" # Override with parent secret name
155195

196+
# Redirect HTTPS traffic through a proxy.
156197
httpProxyConfiguration:
157-
enabled: false # Should the components use a proxy.
158-
create: false # Secret created by wiz-network-analyzer.
198+
# Set to true to enable using a proxy.
199+
enabled: false
200+
201+
# Should a Secret be created by the chart or not.
202+
# Set this to false if you wish to create the Secret yourself or using another tool
203+
# (e.g. external secrets operator).
204+
# The Secret should contain httpsProxy and noProxyAddress.
205+
create: true
159206
secretName: "" # The name of the proxy Secret.
207+
annotations: {} # Annotations to be set on the secret
208+
209+
# URL to use as a proxy for outbound HTTPS traffic.
210+
# Leave blank for transparent proxy.
211+
httpsProxy: "" # URL to use as a proxy for outbound HTTPS traffic.
212+
noProxyAddress: "kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local"

0 commit comments

Comments
 (0)