Skip to content

Commit b296eef

Browse files
rfelberrfelber
authored
Merge pull request #1342 from secureCodeBox/feature/parser-and-hook-resources
Add Resources to Scan, ParseDefinition & ScanCompletionHook CRDs
2 parents 27a72b9 + c1ec9eb commit b296eef

141 files changed

Lines changed: 682 additions & 25 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.templates/new-scanner/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,13 @@ Please include any extra Helm chart configurations that can be useful.
6060
| Key | Type | Default | Description |
6161
|-----|------|---------|-------------|
6262
| cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner |
63+
| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) |
6364
| parser.affinity | object | `{}` | Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) |
6465
| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
6566
| parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
6667
| parser.image.repository | string | `"docker.io/securecodebox/scanner-new-scanner"` | Parser image repository |
6768
| parser.image.tag | string | defaults to the charts version | Parser image tag |
69+
| parser.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
6870
| parser.scopeLimiterAliases | object | `{}` | Optional finding aliases to be used in the scopeLimiter. |
6971
| parser.tolerations | list | `[]` | Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
7072
| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |

‎.templates/new-scanner/templates/new-scanner-parse-definition.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,11 @@ spec:
1515
{{- toYaml .Values.parser.scopeLimiterAliases | nindent 4}}
1616
affinity: {{- toYaml .Values.parser.affinity | nindent 4}}
1717
tolerations: {{- toYaml .Values.parser.tolerations | nindent 4}}
18+
{{- with .Values.imagePullSecrets }}
19+
imagePullSecrets:
20+
{{- toYaml . | nindent 4 }}
21+
{{- end }}
22+
{{- with .Values.parser.resources }}
23+
resources:
24+
{{- toYaml . | nindent 4 }}
25+
{{- end }}

‎.templates/new-scanner/values.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
#
33
# SPDX-License-Identifier: Apache-2.0
44

5+
# -- Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/)
6+
imagePullSecrets: []
7+
58
parser:
69
image:
710
# parser.image.repository -- Parser image repository
@@ -26,6 +29,10 @@ parser:
2629
# parser.tolerations -- Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
2730
tolerations: []
2831

32+
# -- Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
33+
# @default -- { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }
34+
resources: {}
35+
2936
scanner:
3037
image:
3138
# scanner.image.repository -- Container Image to run the scan

‎hooks/cascading-scans/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ zap-http zap-baseline-scan non-invasive medium
165165
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
166166
| hook.labels | object | `{}` | Add Kubernetes Labels to the hook definition |
167167
| hook.priority | int | `0` | Hook priority. Higher priority Hooks are guaranteed to execute before low priority Hooks. |
168+
| hook.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
168169
| hook.tolerations | list | `[]` | Optional tolerations settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
169170
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
170171
| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) |

‎hooks/cascading-scans/docs/README.ArtifactHub.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ zap-http zap-baseline-scan non-invasive medium
173173
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
174174
| hook.labels | object | `{}` | Add Kubernetes Labels to the hook definition |
175175
| hook.priority | int | `0` | Hook priority. Higher priority Hooks are guaranteed to execute before low priority Hooks. |
176+
| hook.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
176177
| hook.tolerations | list | `[]` | Optional tolerations settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
177178
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
178179
| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) |

‎hooks/cascading-scans/templates/cascading-scans-hook.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,8 @@ spec:
2525
{{- with .Values.imagePullSecrets }}
2626
imagePullSecrets:
2727
{{- toYaml . | nindent 4 }}
28-
{{- end }}
28+
{{- end }}
29+
{{- with .Values.hook.resources }}
30+
resources:
31+
{{- toYaml . | nindent 4 }}
32+
{{- end }}

‎hooks/cascading-scans/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,7 @@ hook:
3131

3232
# hook.tolerations -- Optional tolerations settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
3333
tolerations: []
34+
35+
# -- Optional resources lets you control resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
36+
# @default -- { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }
37+
resources: {}

‎hooks/finding-post-processing/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ The `override` field specifies the desired fields and values that need to be upd
9292
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
9393
| hook.labels | object | `{}` | Add Kubernetes Labels to the hook definition |
9494
| hook.priority | int | `0` | Hook priority. Higher priority Hooks are guaranteed to execute before low priority Hooks. |
95+
| hook.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
9596
| hook.tolerations | list | `[]` | Optional tolerations settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
9697
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
9798
| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) |

‎hooks/finding-post-processing/docs/README.ArtifactHub.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ The `override` field specifies the desired fields and values that need to be upd
100100
| hook.image.tag | string | defaults to the charts version | The image Tag defaults to the charts version if not defined. |
101101
| hook.labels | object | `{}` | Add Kubernetes Labels to the hook definition |
102102
| hook.priority | int | `0` | Hook priority. Higher priority Hooks are guaranteed to execute before low priority Hooks. |
103+
| hook.resources | object | { requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } } | Optional resources lets you control resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
103104
| hook.tolerations | list | `[]` | Optional tolerations settings that control how the hook job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
104105
| hook.ttlSecondsAfterFinished | string | `nil` | Seconds after which the kubernetes job for the hook will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
105106
| imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) |

‎hooks/finding-post-processing/templates/finding-post-processing-hook.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,7 @@ spec:
2727
imagePullSecrets:
2828
{{- toYaml . | nindent 4 }}
2929
{{- end }}
30+
{{- with .Values.hook.resources }}
31+
resources:
32+
{{- toYaml . | nindent 4 }}
33+
{{- end }}

0 commit comments

Comments
 (0)