add missing egress rules

Signed-off-by: Matthias Bertschy <[email protected]>
kubescape · Oct 4, 2024 · 6e83470 · 6e83470
1 parent c254f60
commit 6e83470
Show file tree

Hide file tree

Showing 7 changed files with 958 additions and 856 deletions.
diff --git a/charts/kubescape-operator/Chart.yaml b/charts/kubescape-operator/Chart.yaml
@@ -9,14 +9,14 @@ type: application
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 
-version: 1.22.3
+version: 1.22.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
 
-appVersion: 1.22.3
+appVersion: 1.22.4
 
 maintainers:
 - name: Ben Hirschberg

diff --git a/charts/kubescape-operator/assets/common-egress-rules.yaml b/charts/kubescape-operator/assets/common-egress-rules.yaml
@@ -11,6 +11,8 @@
 - ports:
     - port: 4317
       protocol: TCP
+    - port: 4318
+      protocol: TCP
   to:
     - podSelector:
         matchLabels:

diff --git a/charts/kubescape-operator/templates/_common.tpl b/charts/kubescape-operator/templates/_common.tpl
@@ -4,16 +4,16 @@
 {{- end }}
 
 {{- define "checksums" -}}
-capabilitiesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "components-configmap.yaml") . | sha256sum }}
-cloudConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "cloudapi-configmap.yaml") . | sha256sum }}
-cloudSecret: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "cloud-secret.yaml" ) . | sha256sum }}
-hostScannerConfig: {{ include (printf "%s/kubescape/host-scanner-definition-configmap.yaml" $.Template.BasePath ) . | sha256sum }}
-matchingRulesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "matchingRules-configmap.yaml") . | sha256sum }}
-nodeAgentConfig: {{ include (printf "%s/node-agent/configmap.yaml" $.Template.BasePath) . | sha256sum }}
-operatorConfig: {{ include (printf "%s/operator/configmap.yaml" $.Template.BasePath) . | sha256sum }}
-otelConfig: {{ include (printf "%s/otel-collector/configmap.yaml" $.Template.BasePath) . | sha256sum }}
-proxySecret: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.proxySecretDirectory "proxy-secret.yaml") . | sha256sum }}
-synchronizerConfig: {{ include (printf "%s/synchronizer/configmap.yaml" $.Template.BasePath) . | sha256sum }}
+capabilitiesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "components-configmap.yaml") . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+cloudConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "cloudapi-configmap.yaml") . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+cloudSecret: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "cloud-secret.yaml" ) . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+hostScannerConfig: {{ include (printf "%s/kubescape/host-scanner-definition-configmap.yaml" $.Template.BasePath ) . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+matchingRulesConfig: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.configMapsDirectory "matchingRules-configmap.yaml") . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+nodeAgentConfig: {{ include (printf "%s/node-agent/configmap.yaml" $.Template.BasePath) . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+operatorConfig: {{ include (printf "%s/operator/configmap.yaml" $.Template.BasePath) . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+otelConfig: {{ include (printf "%s/otel-collector/configmap.yaml" $.Template.BasePath) . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+proxySecret: {{ include (printf "%s/%s/%s" $.Template.BasePath $.Values.global.proxySecretDirectory "proxy-secret.yaml") . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
+synchronizerConfig: {{ include (printf "%s/synchronizer/configmap.yaml" $.Template.BasePath) . | regexReplaceAll .Chart.AppVersion "" | sha256sum }}
 {{- end -}}
 
 

diff --git a/charts/kubescape-operator/templates/node-agent/networkpolicy.yaml b/charts/kubescape-operator/templates/node-agent/networkpolicy.yaml
@@ -14,5 +14,6 @@ spec:
   policyTypes:
     - Egress
   egress:
+{{ tpl (.Files.Get "assets/api-server-egress-rules.yaml") . | indent 4 }}
 {{ tpl (.Files.Get "assets/common-egress-rules.yaml") . | indent 4 }}
 {{- end }}
diff --git a/charts/kubescape-operator/templates/operator/networkpolicy.yaml b/charts/kubescape-operator/templates/operator/networkpolicy.yaml
@@ -48,6 +48,7 @@ spec:
         - podSelector:
             matchLabels:
               {{- include "kubescape-operator.selectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "app" .Values.kubevuln.name) | nindent 14 }}
+{{ tpl (.Files.Get "assets/api-server-egress-rules.yaml") . | indent 4 }}
 {{ tpl (.Files.Get "assets/common-egress-rules.yaml") . | indent 4 }}
   {{- end }}
   ingress:

diff --git a/charts/kubescape-operator/templates/synchronizer/networkpolicy.yaml b/charts/kubescape-operator/templates/synchronizer/networkpolicy.yaml
@@ -20,6 +20,7 @@ spec:
     - ports:
       - port: 443
         protocol: TCP
+{{ tpl (.Files.Get "assets/api-server-egress-rules.yaml") . | indent 4 }}
 {{ tpl (.Files.Get "assets/common-egress-rules.yaml") . | indent 4 }}
   {{- end }}
   ingress: