initial commit

lp/clair/helm/clair-from-helm.yaml

@@ -0,0 +1,408 @@
+---
+# Source: clair/charts/postgresql/templates/networkpolicy.yaml
+kind: NetworkPolicy
+apiVersion: "networking.k8s.io/v1"
+metadata:
+  name: clair-postgresql
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.0.0
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/instance: clair
+  ingress:
+    # Allow inbound connections
+    - ports:
+        - port: 5432
+---
+# Source: clair/charts/postgresql/templates/secrets.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: clair-postgresql
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.0.0
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+type: Opaque
+data:
+  postgresql-postgres-password: "YjBRQTI1QjdnRw=="
+  postgresql-password: "Y2xhaXI="
+---
+# Source: clair/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: clair-clair
+  labels:
+    app.kubernetes.io/name: clair
+    helm.sh/chart: clair-0.2.9
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+data:
+  config.yaml: |
+    clair:
+      database:
+        # Database driver
+        type: pgsql
+        options:
+          # PostgreSQL Connection string
+          # https://www.postgresql.org/docs/current/static/libpq-connect.html#LIBPQ-CONNSTRING
+          # This should be done using secrets or Vault, but for now this will also work
+          source: "postgres://postgres:clair@clair-postgresql:5432/postgres?sslmode=disable"
+          # Number of elements kept in the cache
+          # Values unlikely to change (e.g. namespaces) are cached in order to save prevent needless roundtrips to the database.
+          cachesize: 16384
+
+          # 32-bit URL-safe base64 key used to encrypt pagination tokens
+          # If one is not provided, it will be generated.
+          # Multiple clair instances in the same cluster need the same value.
+          paginationkey: ""
+      api:
+        # v3 grpc/RESTful API server address
+        addr: "0.0.0.0:6060"
+
+        # Health server address
+        # This is an unencrypted endpoint useful for load balancers to check to healthiness of the clair server.
+        healthaddr: "0.0.0.0:6061"
+
+        # Deadline before an API request will respond with a 503
+        timeout: 900s
+
+        # Optional PKI configuration
+        # If you want to easily generate client certificates and CAs, try the following projects:
+        # https://github.com/coreos/etcd-ca
+        # https://github.com/cloudflare/cfssl
+        servername:
+        cafile:
+        keyfile:
+        certfile:
+
+      worker:
+        namespace_detectors:
+        - os-release
+        - lsb-release
+        - apt-sources
+        - alpine-release
+        - redhat-release
+
+        feature_listers:
+        - apk
+        - dpkg
+        - rpm
+
+      updater:
+        # Frequency the database will be updated with vulnerabilities from the default data sources
+        # The value 0 disables the updater entirely.
+        interval: "2h"
+        enabledupdaters:
+        - debian
+        - ubuntu
+        - rhel
+        - alpine
+
+      notifier:
+        # Number of attempts before the notification is marked as failed to be sent
+        attempts: 3
+
+        # Duration before a failed notification is retried
+        renotifyinterval: 2h
+
+        http:
+          # Optional endpoint that will receive notifications via POST requests
+          endpoint: ""
+
+          # Optional PKI configuration
+          # If you want to easily generate client certificates and CAs, try the following projects:
+          # https://github.com/cloudflare/cfssl
+          # https://github.com/coreos/etcd-ca
+          servername:
+          cafile:
+          keyfile:
+          certfile:
+
+          # Optional HTTP Proxy: must be a valid URL (including the scheme).
+          proxy:
+---
+# Source: clair/charts/postgresql/templates/svc-headless.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: clair-postgresql-headless
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.0.0
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+    # Use this annotation in addition to the actual publishNotReadyAddresses
+    # field below because the annotation will stop being respected soon but the
+    # field is broken in some versions of Kubernetes:
+    # https://github.com/kubernetes/kubernetes/issues/58662
+    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
+spec:
+  type: ClusterIP
+  clusterIP: None
+  # We want all pods in the StatefulSet to have their addresses published for
+  # the sake of the other Postgresql pods even before they're ready, since they
+  # have to be able to talk to each other in order to become ready.
+  publishNotReadyAddresses: true
+  ports:
+    - name: tcp-postgresql
+      port: 5432
+      targetPort: tcp-postgresql
+  selector:
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/instance: clair
+---
+# Source: clair/charts/postgresql/templates/svc.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: clair-postgresql
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.0.0
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+spec:
+  type: ClusterIP
+  ports:
+    - name: tcp-postgresql
+      port: 5432
+      targetPort: tcp-postgresql
+  selector:
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/instance: clair
+    role: primary
+---
+# Source: clair/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: clair-clair
+  labels:
+    app.kubernetes.io/name: clair
+    helm.sh/chart: clair-0.2.9
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: NodePort
+  ports:
+  - name: clair-api
+    port: 6060
+    nodePort: 30060
+    targetPort: 6060
+    protocol: TCP
+    name: "clair-api"
+  - name: clair-health
+    port: 6061
+    nodePort: 30061
+    targetPort: 6061
+    protocol: TCP
+    name: "clair-health"
+  selector:
+    app.kubernetes.io/name: clair
+    app.kubernetes.io/instance: clair
+---
+# Source: clair/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: clair-clair
+  labels:
+    app.kubernetes.io/name: clair
+    helm.sh/chart: clair-0.2.9
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: clair
+      app.kubernetes.io/instance: clair
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: clair
+        helm.sh/chart: clair-0.2.9
+        app.kubernetes.io/instance: clair
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      volumes:
+      - name: "clair-config"
+        configMap:
+          name: clair-clair
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      containers:
+      - name: clair
+        image: "quay.io/coreos/clair:v4.3.6"
+        imagePullPolicy: IfNotPresent
+        args:
+        - "-log-level=debug"
+        ports:
+        - name: clair-api
+          containerPort: 6060
+          protocol: TCP
+        - name: clair-health
+          containerPort: 6061
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 6061
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 6061
+        volumeMounts:
+        - name: "clair-config"
+          mountPath: /etc/clair
+        resources:
+          limits:
+            cpu: 2
+            memory: 3000Mi
+          requests:
+            cpu: 50m
+            memory: 2000Mi
+        env:
+        - name: CLAIR_CONF
+          value: "/clair/config.yaml"
+        - name: CLAIR_MODE
+          value: "combo"
+
+---
+# Source: clair/charts/postgresql/templates/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: clair-postgresql
+  labels:
+    app.kubernetes.io/name: postgresql
+    helm.sh/chart: postgresql-10.0.0
+    app.kubernetes.io/instance: clair
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+spec:
+  serviceName: clair-postgresql-headless
+  replicas: 1
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/instance: clair
+      role: primary
+  template:
+    metadata:
+      name: clair-postgresql
+      labels:
+        app.kubernetes.io/name: postgresql
+        helm.sh/chart: postgresql-10.0.0
+        app.kubernetes.io/instance: clair
+        app.kubernetes.io/managed-by: Helm
+        role: primary
+    spec:      
+      securityContext:
+        fsGroup: 1001
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      containers:
+        - name: clair-postgresql
+          image: docker.io/bitnami/postgresql:11.10.0-debian-10-r2
+          imagePullPolicy: "IfNotPresent"
+          resources:
+            limits:
+              cpu: 2
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 512Mi
+          securityContext:
+            runAsUser: 1001
+          env:
+            - name: BITNAMI_DEBUG
+              value: "true"
+            - name: POSTGRESQL_PORT_NUMBER
+              value: "5432"
+            - name: POSTGRESQL_VOLUME_DIR
+              value: "/bitnami/postgresql"
+            - name: PGDATA
+              value: "/bitnami/postgresql/data"
+            - name: POSTGRES_USER
+              value: "postgres"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: clair-postgresql
+                  key: postgresql-password
+            - name: POSTGRESQL_ENABLE_LDAP
+              value: "no"
+            - name: POSTGRESQL_ENABLE_TLS
+              value: "no"
+            - name: POSTGRESQL_LOG_HOSTNAME
+              value: "false"
+            - name: POSTGRESQL_LOG_CONNECTIONS
+              value: "false"
+            - name: POSTGRESQL_LOG_DISCONNECTIONS
+              value: "false"
+            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
+              value: "off"
+            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
+              value: "error"
+            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
+              value: "pgaudit"
+          ports:
+            - name: tcp-postgresql
+              containerPort: 5432
+          livenessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - -e
+                - |
+                  exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
+                  [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          volumeMounts:
+            - name: dshm
+              mountPath: /dev/shm
+            - name: data
+              mountPath: /bitnami/postgresql
+              subPath: 
+      volumes:
+        - name: dshm
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Gi
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "1Gi"

lp/clair/helm/values.yaml

@@ -0,0 +1,86 @@
+# Default values for clair.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+replicaCount: 1
+logLevel: debug
+insecureTls: false
+image:
+  repository: quay.io/coreos/clair
+  tag: v2.1.6
+  pullPolicy: IfNotPresent
+service:
+  name: clair
+  type: ClusterIP
+  internalApiPort: 6060
+  externalApiPort: 6060
+  internalHealthPort: 6061
+  externalHealthPort: 6061
+ingress:
+  enabled: false
+  # ingressClassName: ""
+  # Used to create Ingress record (should used with service.type: ClusterIP).
+  hosts:
+    - clair-clair
+  annotations:
+    # kubernetes.io/ingress.global-static-ip-name: "test-ip"
+    # kubernetes.io/tls-acme: "true"
+  tls:
+    # Secrets must be manually created in the namespace.
+    # - secretName: chart-example-tls
+    #   hosts:
+    #     - chart-example.local
+resources:
+  limits:
+    cpu: 2
+    memory: 3000Mi
+  requests:
+    cpu: 50m
+    memory: 2000Mi
+config:
+  #postgresURI: "postgres13.postgres://clair.clair@host:5432/clair?sslmode=disable"
+  # paginationKey: "XxoPtCUzrUv4JV5dS+yQ+MdW7yLEJnRMwigVY/bpgtQ="
+  updateInterval: 2h
+  # notificationWebhookEndpoint: https://example.com/notify/me
+  enabledUpdaters:
+  - debian
+  - ubuntu
+  - rhel
+  - oracle
+  - alpine
+  enabledNamespaceDetectors:
+  - os-release
+  - lsb-release
+  - apt-sources
+  - alpine-release
+  - redhat-release
+  enabledFeatureListers:
+  - apk
+  - dpkg
+  - rpm
+# Configuration values for the postgresql dependency.
+# ref: https://github.com/kubernetes/charts/blob/master/stable/postgresql/README.md
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+postgresql:
+# The dependant Postgres chart can be disabled, to connect to
+# an existing database by defining config.postgresURI
+  enabled: true
+  image:
+    debug: true
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      cpu: 2
+      memory: 512Mi
+  postgresqlUsername: clair
+  postgresqlPassword: clair
+  persistence:
+    size: 1Gi
+  networkPolicy:
+    enabled: true
+nodeSelector:
+  kubernetes.io/arch: amd64
+