From e5bc78b6deb4b40d2e09316d771dfe9ad1697d2e Mon Sep 17 00:00:00 2001 From: Ofir Cohen Date: Sat, 11 Jan 2025 16:37:11 +0200 Subject: [PATCH] k8s helm charts - make proxy great again Changes: 1. Block https scheme in httpsProxy Rather than allowing users to install the chart and fail miserably later, we shift left the check to template render time. 2. Check if proxy is configured but is not enabled --- wiz-kubernetes-integration/Chart.lock | 12 ++++++++++++ .../charts/wiz-sensor-1.0.5429.tgz | Bin 0 -> 9930 bytes .../templates/secret-proxy.yaml | 7 +++++++ 3 files changed, 19 insertions(+) create mode 100644 wiz-kubernetes-integration/Chart.lock create mode 100644 wiz-kubernetes-integration/charts/wiz-sensor-1.0.5429.tgz diff --git a/wiz-kubernetes-integration/Chart.lock b/wiz-kubernetes-integration/Chart.lock new file mode 100644 index 00000000..d1c9a1c4 --- /dev/null +++ b/wiz-kubernetes-integration/Chart.lock @@ -0,0 +1,12 @@ +dependencies: +- name: wiz-kubernetes-connector + repository: https://wiz-sec.github.io/charts + version: 3.2.9 +- name: wiz-admission-controller + repository: https://wiz-sec.github.io/charts + version: 3.7.10 +- name: wiz-sensor + repository: https://wiz-sec.github.io/charts + version: 1.0.5429 +digest: sha256:1cc41e848d2c0583638ac0783e892a77608e96aee5a6d6a3f2364c24b89935ff +generated: "2025-01-11T16:35:35.918316+02:00" diff --git a/wiz-kubernetes-integration/charts/wiz-sensor-1.0.5429.tgz b/wiz-kubernetes-integration/charts/wiz-sensor-1.0.5429.tgz new file mode 100644 index 0000000000000000000000000000000000000000..60a0b6459d5ff5a5d4ee507d8a323a78275f616f GIT binary patch literal 9930 zcmV;*CNDc zVQyr3R8em|NM&qo0PKD3a@)4HXn*S|aOm!--4oHWoj9%L^v+RbInjx2X(TymZ+EW- zA|VMiNw5HD$8mFKzs8-p=jHa3+`$(Ke(A$@l6GJ7Mly@g@$)#E;`R;zXV{JH$U)oK<0Zyg>Ue|7Nu<;Us8;7bH33J_%Ipa1wj42ZgJW1a-THmyW`-L$a- z&fp9MOz|D$0}=rk1iB3)3H1;IyAk0a5jYDfFcct9FsQwTN5YUq3Pc;+eG~vYQAD_8 zU~;_B_r-q#pk|LT@f$Jmt$Jxw-^Zc=1^`9Zn35<&5zo`lg6EMiCJ~A_14H6702zoO zrVRY^AOBa3@1Otp?`Pt-oWXzoTLZlfe)&~kq0ns3pcwECp;rNc zK42bn7wcW-MxS$zTMo%>}u@6sNDcy2lNySP2?)cD~h~d&C;y6T_5_(O`)iJxZ=ee4IE*L__1hHTQP#E)DKxV%o zkAoW=1OkqP;p^R}IuY2YUvjB{YNP*|~E^YB#tSFhn1lf{aap zT~pO}(#|fVjCP#Ts^|>+fFUoTnBM|Mf<($|7~`=nY?sN`*a5xwF<}TW5+V>HPO)cL zf=42jgo=biN#^6T@o=)Ar{-NJ35gB7feiG zhCS4To=1|1gQi*&H%k-&95D`qKui{iz#vA^c!}p6ctOHAqO3t;6fsd`QHvoC7!KnA z(Ucc~m;~6vdPlr^(*rQ!B*p;|9nK)b9t?t8&A)z65aSF89xMu&SRatd-vJIWXR;TR z>SuC?xeG!T0dhSO?q4M{L?grzYocg@Bed@mkL`OT@=(m#e%g7{AlNj$?xZEED?SOc3nZ0h=sl+pbUVO9l;gS3y%F1MC`!Lo z5T#_WOU?!ORA7jODnt@Zkoe!n3<`mevLT9COd^KBoRZMSNc7Kz7U82fAh&|?Hcac0 zYCO_y3;V+AjwZQL>M<_~;~+v@uwO|{7DEp;MDc|xwIFr?6^l=B3Whuq`OF2c@HL76 zRO%1->6y*hC8ze5gvdonVdRrgR~&&E;x`CIpe4E2Ph#2kHFM{J7x*ZEw?OO&pz-|b!kZhe{zo~fSo?<-^1duKe zfNDvQxgLaK3lasvmc*7$C`AzuZrz3~J`sqH1Yz1ha>P+0IGNO+Zb3}(H4czqv?1}4 z3oh-I1sO2A3F^fse+(rhcxQntW*6M+eX2}8sWU&w!?`rZ0pz@6@ z)tnY!#uCK#T%%zmOl)yc7lN1)Kam=oweZ}A1Y#jECxYRUz;7~s8z2Bvg-ycg#Bqm) zVqZ}rG+wZqA92cBzyfm;i)~2)w$~tmZ<=N*VA`$b8@=}&(Fg{8Uu&}?!`(#JgEzfY zbbuycG4iz1WQxCGV9@QKG*~iAZS)e%f#xn^?vT_fA!EeDLhK1xnwDzFaySr-Er0;e zK|~^C)+?EDh$Dfc*ysK8lQGyu?!q++)}9&N1TLh`o5SG@Gr2sk&~009CJq-yL4dxm zP<)e$B+U$s`jq1CD_kXGv4@Z&#zRoZ(O~1=8#`tl2ZFUA#>C2*A1VvE-LvjwE8(M`AA| z(GtOcFK;CX-E6X?h%HIrx51GhIz`aOn~*!LcrSVvySXpHi*UB2c%k{DlU(pp(Z@=X z3-SsR;R@XX?4yX|`K@5irA+~LrC~?HQ0TNIrFvft3`nob;OOgb>vFAetu(xf$wW3K-(g0Myzg0}B)( zDw$8h6rm9?ZjscxA|XVn>S(%@j#{OkP&AkJCrQO<5(Q!{DRW#Z3<{%b7+_z!hQz+m zB$AMUO{ZK*FY;r8Bd+C-kn&oiNBWJBX6d9kbL3MP#*SRsr@fO==X{v6(i;t7x(q3K zFRZi7FQGgFtWt{*v`Lg%C{=;?x2~Q@2B0CjoOt;%@9?NFYipLHZoOh9u3Lv{5a7TC zU1N&c*h!;J4qYmm9_(fcylQ#qN)oF^7jh{GRdS9fiaexTZ|SNmtmUjx-knzIZ^#W* zmhR?!4B+2^)0CB(IchpW`PI<&6eSD$XQoyhQA)ktPounzBmf95M`vaW%?Se3MOUX6s8M zya^M&6tl{gYBCh+qExU$b-)2a#Fs=Yg={Xfy_p$*K+SUAMiZL&uy+oW+tp3IvD8)+ zCud`TBaWyr*Ch^E?N@uTtmsm0+pW8;XqF$jn{pqiIcqX%Q7r6yyJh6d-Gr~jUs9yx zP)NB;X-GJP3p7lEV4TX1)U;5$4bOqBq(;CgM%PAtg@B?3W}MzC4}(t-i@xDzpde0y zAX|z%;N4Qn9Se9K zLG%6UWjjN{psvNzz(wz4smbQJ%tD&M66OpEqh9O6*ANHLcu=&>t+o3iGtqO6nO3Rg zkwKU+>7O9fM^pfngOOH;oDe++X4)x=3B#PwTNk`j{CkOlQ0-Tek;Et76`~+Ji};O^ z=ovtfM||ZHoI!?;pQ{Df*B(N_bZ=n9m6s_3=sjj!`LhMWvE*bRg!BqHsw)S;8M&6; zG)YDU@03t2iUZ(ds!j=*;9g5bxtOA+##QPWWW=Zewm|soRb<+%4peHpp7_gKZ8it?l2<2gr zoK~qPnX5?-1T%1hKVag*4+%vcbun=zb&L=fO>Xc9E#T8?iS)atTw3W4W*ujID(5%L zNh8hoi<>jknv|?eg|1kj_fe!WHA=gEJId?Zu2lzgJz(6!RT@Eg+pJP2bMWfKVOgon zqmgNspOi`hyw+kyKX$s-*;>JUZV*!#T_B`w?m6P#5@dTo$WG`(4l}1BjInlo37$HG zo*|^%1DQ&g@pY1&!7xsx`)F?QAk08OJQ(OxE-a+JdL!1CU?*yeIO(>^*i@Utg(Jx* zUEW-aNvF6i_LZg8zCLg=9mg_BlzoXV<&4h*X8(gu|;Q}ne3D3%pn7%PRt zMH@KR2Xa>?K`n)+IAN)aqW*~&zTS`_S{vOMNWOD`0(mq7X?Xk`h_w{@$IlfO%1$Ic>f~Bxddf*6_R3gbnglpn^cN9H zi+k^pmlzvNJ@!~8h=weC)l@_7y^kqkOtP-@op>ufae2u{m{kJ+5(`!&h}4gAFO+fG z&XqOQu-A0~skeMcCz7hgGC^Q5ADje;YBnt=^&DOy24dnfGdG>l`SEk1Til=^Xskmr zL$3FG0)s}1SKC4a&F9GDZE!*KyrH!3T-UGO^Z<*AkN`qk5zJ8@l$n*GQE^H~g^MfH z6b+qqI5}dUIQ2-a?7>3m!5vkMz9aaQ8h>HH7VRZ7lNd1%28bbU_TD;-1mIQpTt*%V zWyl97AS@y$G&@RyW*opsPlyYInSCu(S9vaw9xP`E=L`k&=8`ZWt<&RX0Cx1a1ehiz z0dn)J3rBMbl^dZN+55CtykV2(A=H+{CjGm_V{UqaE`=&56fU$Iq_`ZaLCO~_SXWdWK!q@lh&<`PlohlVhP9{UW{LA^%nihx6@Ah%QEDEd zA&x}n3kp3X&)tL!H|3Z_uf&UC-Y@)pt085%*055(Z$b#HfG*MJ4gR3}eI|`LlJIZrFe)!y|lGyP7g7cq{uhOKGqK5UIy78U$cDxLy> zir7F|xF&KBfO5=6zRZf+s8BF1O;Kz6mZGA8J?`N&0QJYyS#Rc~wou(F))h}MivxI@ zPRExHq5VrgR{VDwox49>q98_;xjcT1Q1I39-v@^W2QLfp-!EPs9zVr@e~#zwZvWdx z?|m#3NnY?FNfzxkzTN-$v2l0T6!t!jkhJwpc(|zUfTphC5uqo02)J+6w*-p4yEYR~ z-{lL{$4BxI=?`IHM;l}68pg=m za~u7+iA7gHw7Zt+V_4;3(++uatOOZ=cGUVR!W-F`5g*TsWG~83L%ns?Hkkl@s$xK` z>+0Tp=-*#Ug0+8mq$QS-ES(qCL;g6^3?f&!CFU{35uXF+Z>;$@<`iJ5PB&lh)jxCF zz*=8oPwQ{1#M-hIGgT`PI@IcQCM#x(tT-Brruw)3d<^^nD2fBjPG1DvU|{l1oZ zo4wTTrs4awSNFC4loDKe>&;9kgr`17wPiy*+xw)U!!QcL_z4X<-R0R z8{FLq+ayT*N)o!Fg#@!N{i}C(HlFUZmA%hY%DcPT6|XQ#o!ogu)8daG8+vS6ul8Vd zzcr{ctvH@(0=w4E(evF&zZewnU>p}L{Pg3#ySs`ee}LZ;!ck%V%TPiX!3FZ0Gewhh z7mf94LWb6E9ldO`A$?a_n415&*L$WD6+`^>6}o)}zE&rP?H@jQzp_K{@uM6+j|0>7 z*EKX;#VU+Fu*u#kE`es{{3uJRW)&$p)?Vz+8Indo)*(z(k+lS8f{y)*$=VpgyhYf!UTvD(f_5L}^KXFbw;d1jIIRD<>= zNSN2fImQlBOgT^e3z560#FmIT!57Xb?t#RHybpom=J5M zFven&u9_-UWvfY2P4aVN2EIz`wtONQaRtLv+vdFr_PXCVwkNX;qAD-`+L2cKZmii# z8?3LnyHa6us-oNWHrz5sd+4Sg-PMoG)OE8j^wyzP`o6CMul;WulflWL4Ss~))eWS6 z;q#3qpeQ8Qt2w6%7*O-G%|4LvO@&phgAbYoyJB|<*&B3QwH8fij_!Z2#7XRRYggT- z6TKqRFrd}F=-pE_7V(EXFs|AH&CU6%>@`R1T7_dH#c;1^pWOZ3feBx-zdLPk_jl)S z=7%U0KULAkj~|@}_iU}>wphozX;7il(GkaKfZLoSbLTHundZ z9Y05rx0n7}Wyftnr{efcl*3<$05u9^Ko%fC*Xwl0IS$YnS)7TQm5f4t>7~mZ`InR5 zKLr-z;Al>=K?fRmQLta!NN(sF`dUEO^N3J@2szfUHVKXSdx4wKdZ|4vP z!0F1kF&P8kk&e( z3Pu~qKJ+eo4P>#Z6__JpfoBEaAoXfxw&ioxR5X!s@nv1dR{X3`+*OL9Rc%kfw_|wa zp|R*t8@e^&3dA#SgnPB{FwW2>+TMewGHz+i`+ML{ta9TEw(9x zg|*7AEC1lSu2a(I4J6AeRrpYB1qONnZH|R%umTeeF^7#Uz8{G+Ih&)BK2aq{S;rl9;u@FOKu8j@U9Gli(L8CO*^U z*NDz!*#dFr8E^v3Ze`aY*nDfj4`i;!wOOKMs{AL_-G*5y895FdMoH#&K)l@UA4@wN!%?M!ot-kca zeR>|{S;zlpIP!6{c#s%am;d+WQ7g~?4_gPv&!71J=XgFj|Nl`fpf4c?SR!-wuy&&f zjOl3)Z@uAJJ|W)102SM3gyv$vWvRF=5scVbLH>KO=gR$`1tL63GT_zw|M|<~=dGgt zcX<4y|9zGxx2a10=hV&f^;I%MCTOSqgB1tn>H~}gdOuPDU!5QT&M*I~)%^Zf2e@4r zLwUG}5p&;UP~3C)8==5)_U_jjN4j-^I|+3xV?-x%C6BjpH$5Kz*^EszSd2WC`AA3U zOI=KUFL}16>vDWnhQhG~UjBgT?k;sSmEw-_b-^FN9*+DXNwElxqD4~q(a=2z^__+c zK!sDR>Bu$i39iS(Wbc{To}htRCLW(Q|=6L zSO~Gorl1XyNCpQ)`a7=*8mEy5`m3u4cAQ2fM5w;|)N4~&kbe2mgb63|V@z7;N#WY` zSrc7jPi0yx%>D|Ou0Fobe~?pAFWV@Es-{A|crQ0;H6GsYigoNoWLQJRG!-;89ea?% zD(f!yQFH1S_G(JnA01Ut&wg#uDEFz-7IdrKdKL3l{CYlvQt@HEwdpqkaUW8dkFhFx zGOsKW!NRBdk3ycpk+G_i%b=Skz5~FInEAL(>$9hrGX4(pYCf(sS*ya-4 zR_PU`47lb&?=t~t_E#9f$S z?GI_K`u=H-8a=^JsrHe=#5rmBXaA2M4&0+w$H>f~VO2cNW!bK+=9MYF6{sG3pGP&11w)=k z!uSD5*s$cKCMqL-fh#6*>KsMxX_A*DlmsYySr9WaB3Qg_<;x3exOA;barLUvIGL|t z%F6)Dj6QA1Vz07AVJc8`T@qEBa1f)}2}3H?sOR zS&5z>JU?_wFkbi0&ZphiozcX=sBV4WtlBIF+PnV$oKDV%)A3|5>Qz9o6oe+@grfa2 zMgqp`!FW;tQfpCHCdtcBOs;!j@HJ)9y?tkmZP-zHg<0iFLmy%?PIrWc*_60lQB!u-aQc?R@>QK?+z;$boJr1#_khN!B$;o#)) zdNclA`Sn*_ZXFPs47*$Yn zHTa?VFlIIQZf`W%7Iar8WM5%5uJXPc98UVvY+Gsj{-5K>xrf&xo zGn!{`OSq2L7O?m5Iq@r}rQ4sL4^FCBYS~L)!_R;0bl>zYPNuz!x0Phyof)Ur*FDeE)>0NX#Ce!id>1qF`l`E_c(h4dXjpgie zJn4<<8Cq>RgHjSM>qw$-cU@Kgqs#GRdNz2qF&E8$L{`a1$CH!6<#teupMSX()47c@ zD8y6$yz{CzopefAJWM>PW7A*0Nwau-^XrQ4N4;15@nrP#r^Layge^o?tT=(&dGCCB z)<5r0#_RDi!IP&o_@y4ri#oS@9!^_lvvgJR#6m3}Ut@VP>KvGCj78+T!^7R?GG#(Bv#v3#3dbv=zXK)2y8c&2RbkaNP{5&0X zE?!kLCl&O+0rXnT*08rMNns}2N^h#foMx-NpC&@JIh&TX<4w5hw%ylAW_7JqO;^=9 z88f0*zpk3O%OA(xQGYn;4=&aY+|7To@i^#D;DS{mE?=xedD3}R+SnUYP};h;+2T^|{<2@+P$-c_1!??RYI!X^_2+2yD| zDapC*nNylkx~j*)uy-+j-9N1w`6m73jtEyKcP;yUw>T%P?J^5(`9wXZW!HA@*?NS^ ziE2OTz&~Mk_j8Atg{5t*%pGPSC9m*R8d%Y1wu!=J`=?ew&AG8kKzJChguuhN+z7_F zsqCkwbq!*1Wc0cNMVgX#TK_TIC61*|)yID1ry09^4z>nq$xn9V}J2 znA-`8hm0oS{$?Xep=>jz_3??dyv2?kvm7`beal1pv!7IKGlWggE1qIy{^GGRU&1dT@5-L4 zyY_d$rM}qW6%nci#~}ios6>~do^nF0Cxh}#yg|1Wq*(dIa4B82TNF`1U1FGB|6dx> zczh-UN~S0MQSFd)c(TxivAV$DzCoXvE0QtOx02_1NE+f{yKJ^`(r<8zC%F0GVmRuZ zPY0v!>)v=W>P!Zs>3Qd;>3{Vnlio<3?X8w%<&N0K5q~S9L>_USo1~0V;oUD{<*{BpB&Uc-0C>z zFLl)Ld5#6DoWc1UUmxNqFF@MfVg4}Rc=7t#hxy1$(C+CgubbXA*CJO2;I3?w@64L? zV#fS5BWv2AbhWEBkWH?lQP<{FXIoGO*ZP`Q>wT?+VMR(-@cQEweQhFE9;1)@oSd&e zH<#%J1gEf8m`d_exg-kxosz&uG`~KTXX(V~(gUiHsvFvR5tF}u7!RLOh9d3b#Al>hN_ zJR5Aw>RUXz#?92&JhkEq_tK|MvS{#AOS%pIXsC_0_U1j{I9Y&o;qJCCJ$aAtRPO)u zKGDay0%+a-KR!4v?*Hd6p6>tuERW?pSZnpxRj}?oTy^1(vZnHR8-3zkA*y!TZ;V8n z^OE{IT|YT9G5EPf?A6`OdK+zUn`7w;+Rs1#mHR*aBI0x8e{LNfy{yRp{PJo4e~zd2 zTbSZ*PV>BGi^ID zPJbMpN)9c44|}82^TEYlqm+7#As#WXo2Jmps+1FrtxPYrE~(fCsl?VK5L=lxtSVVp zeTuN^#9(QvVf@O+r(FH8C7W{r>L5ncMv5((3tC>$cFJWj*_Uu zI?-)oVQ!fDwPDiDwn3}0GBh%azbwPkk$+aqZ?QrW#{mja#9^SXx2b|+$0F+0>wN1p z5~kCgHi1Sdf6Gj}PL#H{O-XEd!<)b-H_;8GerMR1e;W&1{$YFt3M-|7d`7$aukuvN zf9dghwCg|D-v4#@q9p&1UmQKj|IhIhhC6hMxzkvy5T%32Jv64Hx?e?yKsQ{MK-^h0EH$DS^xk5 literal 0 HcmV?d00001 diff --git a/wiz-kubernetes-integration/templates/secret-proxy.yaml b/wiz-kubernetes-integration/templates/secret-proxy.yaml index 6af3cfab..fc3cc6b6 100644 --- a/wiz-kubernetes-integration/templates/secret-proxy.yaml +++ b/wiz-kubernetes-integration/templates/secret-proxy.yaml @@ -1,4 +1,11 @@ +{{- if and (not (empty .Values.global.httpProxyConfiguration.httpsProxy)) (eq .Values.global.httpProxyConfiguration.enabled false) }} + {{- fail "Error: httpsProxy is set but httpProxyConfiguration.enabled is false. Please enable the proxy configuration or unset httpsProxy." }} +{{- end }} + {{- if and .Values.global.httpProxyConfiguration.enabled .Values.global.httpProxyConfiguration.create }} + {{- if hasPrefix "https://" .Values.global.httpProxyConfiguration.httpsProxy }} + {{- fail "Error: httpsProxy must start with 'http://', https or any other protocol is not supported." }} + {{- end }} apiVersion: v1 kind: Secret type: Opaque