diff --git a/stable/signalsciences/.helmignore b/stable/signalsciences/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/stable/signalsciences/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/stable/signalsciences/Chart.yaml b/stable/signalsciences/Chart.yaml new file mode 100644 index 0000000000..85ab8b0a15 --- /dev/null +++ b/stable/signalsciences/Chart.yaml @@ -0,0 +1,15 @@ +name: signalsciences +home: https://signalsciences.com +icon: https://dashboard.signalsciences.net/static/images/logo-icon-color.svg +version: 0.0.1 +appVersion: 3.12.1 +description: SignalSciences is a web application firewall. This chart is the installable agent. +keywords: +- signalsciences +- signal-sciences +- sigsci +- agent +- firewall +- waf +sources: +- https://github.com/marccampbell/docker-sigsci diff --git a/stable/signalsciences/README.md b/stable/signalsciences/README.md new file mode 100644 index 0000000000..829197cadd --- /dev/null +++ b/stable/signalsciences/README.md @@ -0,0 +1,79 @@ +# SignalSciences + +[SignalSciences](https://www.signalsciences.com/) is a hosted web application firewall. + +## Introduction + +This chart adds the SignalSciences agent to all nodes in your cluster via a DaemonSet. This chart exposes a shared unix socket file on every node for your application code to connect to the agent with. + +## Prerequisites + +Kubernetes 1.4+. + +## Installing the Chart + +To install the chart with the release name `my-release`, retrieve your SignalSciences accessKeyId and secretAccessKey from your [Agent Installation Instructions](https://dashboard.signalsciences.net) and run: + +```bash +$ helm install --name my-release \ + --set signalsciences.accessKeyId=YOUR-ACCESS-KEY-ID \ + --set signalsciences.secretAccessKey=YOUR-SECRET-ACCESS-KEY \ + stable/signalsciences +``` + +After a few minutes, you should see the agent in your SignalSciences dashboard. + +**Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```bash +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the SignalSciences chart and their default values. + +| Parameter | Description | Default | +|------------------------------------------------|---------------------------------------------------------------------------|-------------------------------------------------| +| `signalsciences.accessKeyId` | Your SignalSciences accessKeyId | `Nil` You must provide your own accessKeyId | +| `signalsciences.accessKeyIdExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | +| `signalsciences.secretAccessKey` | Your SignalSciences secretAccessKey | `Nil` You must provide your own secretAccessKey | +| `signalsciences.secretAccessKeyExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | +| `image.repository` | The image repository to pull from | `marc/sigsci-agent` | +| `image.tag` | The image tag to pull | `3.12.1` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `signalsciences.resources.requests.cpu` | CPU resource requests | `200m` | +| `signalsciences.resources.limits.cpu` | CPU resource limits | `200m` | +| `signalsciences.resources.requests.memory` | Memory resource requests | `256Mi` | +| `signalsciences.resources.limits.memory` | Memory resource limits | `256Mi` | +| `daemonset.podAnnotations` | Annotations to add to the DaemonSet's Pods | `nil` | +| `daemonset.tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `nil` | +| `daemonset.nodeSelector` | Node selectors | `nil` | +| `daemonset.affinity` | Node affinities | `nil` | +| `daemonset.updateStrategy` | Node affinities | `nil` | +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```bash +$ helm install --name my-release \ + --set signalsciences.accessKeyId=YOUR-ACCESS-KEY-ID,signalsciences.secretAccessKey=YOUR-SECRET-ACCESS-KEY \ + stable/signalsciences +``` + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```bash +$ helm install --name my-release -f my-values.yaml stable/signalsciences +``` + +**Tip**: You can copy and customize the default [values.yaml](values.yaml) + +### Secret + +By default, this Chart creates two Secrets and puts the accessKeyId and secretAccessKey in those Secrets. +However, you can use manually created secret by setting the `sginalsciences.accessKeyIdExistingSecret` and `signalsciences.secretAccessKeyExistingSecret` values. diff --git a/stable/signalsciences/templates/NOTES.txt b/stable/signalsciences/templates/NOTES.txt new file mode 100644 index 0000000000..8d46a33138 --- /dev/null +++ b/stable/signalsciences/templates/NOTES.txt @@ -0,0 +1,24 @@ +{{- if and ((or (.Values.signalsciences.accessKeyIdExistingSecret) (.Values.signalsciences.accessKeyId)) (or (.Values.signalsciences.accessKeyIdExistingSecret) (.Values.signalsciences.secretAccessKey))) }} +Signalsciences agents are spinning up on each node in your cluster. After a few +minutes, you should see your agents on the dashboard: + + https://dashboard.signalsciences.net + +{{- else }} +############################################################################## +#### ERROR: You did not set a signalsciences.accessKeyId or #### +##### signalsciences.secretAccessKey. #### +############################################################################## + +This deployment will not be complete until you get your accessKeyId and your +secretAccessKey from https://dashboard.signalsciences.net. + +Then run: + + helm upgrade {{ .Release.Name }} \ + --set signalsciences.accessKeyId=YOUR-ACCESSKEYID \ + --set signalsciences.secretAccessKey=YOUR-SECRETACCESSKEY \ + stable/signalsciences +{{- end }} + + diff --git a/stable/signalsciences/templates/_helpers.tpl b/stable/signalsciences/templates/_helpers.tpl new file mode 100644 index 0000000000..ebbc2ac14f --- /dev/null +++ b/stable/signalsciences/templates/_helpers.tpl @@ -0,0 +1,39 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "signalsciences.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "signalsciences.fullname" -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return secret name to be used based on provided values. +*/}} +{{- define "signalsciences.secretAccessKeySecretName" -}} +{{- $fullName := printf "%s-secretaccesskey" (include "signalsciences.fullname" .) -}} +{{- default $fullName .Values.signalsciences.secretAccessKeyExistingSecret | quote -}} +{{- end -}} + +{{/* +Return secret name to be used based on provided values. +*/}} +{{- define "signalsciences.accessKeyIdSecretName" -}} +{{- $fullName := printf "%s-accesskeyid" (include "signalsciences.fullname" .) -}} +{{- default $fullName .Values.signalsciences.accessKeyIdExistingSecret | quote -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "signalsciences.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/stable/signalsciences/templates/accesskeyid-secret.yaml b/stable/signalsciences/templates/accesskeyid-secret.yaml new file mode 100644 index 0000000000..4e9c850367 --- /dev/null +++ b/stable/signalsciences/templates/accesskeyid-secret.yaml @@ -0,0 +1,16 @@ +{{- if not .Values.signalsciences.accessKeyIdExistingSecret }} + +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "signalsciences.accessKeyIdSecretName" . }} + labels: + app: "{{ template "signalsciences.fullname" . }}" + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} +type: Opaque +data: + accessKeyId: {{ default "MISSING" .Values.signalsciences.accessKeyId | b64enc | quote }} + +{{- end }} diff --git a/stable/signalsciences/templates/daemonset.yaml b/stable/signalsciences/templates/daemonset.yaml new file mode 100644 index 0000000000..7b1f7dbe20 --- /dev/null +++ b/stable/signalsciences/templates/daemonset.yaml @@ -0,0 +1,67 @@ +{{- if .Values.daemonset.enabled }} +apiVersion: extensions/v1beta1 +kind: DaemonSet +metadata: + name: {{ template "signalsciences.fullname" . }} + labels: + app: {{ template "signalsciences.name" . }} + chart: {{ template "signalsciences.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + template: + metadata: + labels: + app: {{ template "signalsciences.name" . }} + release: {{ .Release.Name }} + {{- if .Values.daemonset.podAnnotations }} + annotations: +{{ toYaml .Values.daemonset.podAnnotations | indent 8 }} + {{- end }} + spec: + {{- if .Values.daemonset.tolerations }} + tolerations: +{{ toYaml .Values.daemonset.tolerations | indent 8 }} + {{- end }} + {{- if .Values.daemonset.affinity }} + affinity: +{{ toYaml .Values.daemonset.affinity | indent 8 }} + {{- end }} + {{- if .Values.daemonset.nodeSelector }} + nodeSelector: +{{ toYaml .Values.daemonset.nodeSelector | indent 8 }} + {{- end }} + volumes: + - name: var-run + hostPath: + path: {{ .Values.signalsciences.socketDir }} + containers: + - name: sigsci-agent + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + volumeMounts: + - mountPath: {{ .Values.signalsciences.socketDir }} + name: var-run + readOnly: false + env: + - name: SIGSCI_RPC_ADDRESS + value: unix:{{ .Values.signalsciences.socketDir }}/{{ .Values.signalsciences.socketFile }} + - name: SIGSCI_HOSTNAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: SIGSCI_SECRETACCESSKEY + valueFrom: + secretKeyRef: + name: {{ template "signalsciences.secretAccessKeySecretName" . }} + key: secretAccessKey + - name: SIGSCI_ACCESSKEYID + valueFrom: + secretKeyRef: + name: {{ template "signalsciences.accessKeyIdSecretName" . }} + key: accessKeyId + resources: +{{ toYaml .Values.signalsciences.resources | indent 12 }} + updateStrategy: + type: {{ default "OnDelete" .Values.daemonset.updateStrategy | quote }} +{{- end }} \ No newline at end of file diff --git a/stable/signalsciences/templates/secretaccesskey-secret.yaml b/stable/signalsciences/templates/secretaccesskey-secret.yaml new file mode 100644 index 0000000000..1a85a01621 --- /dev/null +++ b/stable/signalsciences/templates/secretaccesskey-secret.yaml @@ -0,0 +1,16 @@ +{{- if not .Values.signalsciences.secretAccessKeyExistingSecret }} + +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "signalsciences.secretAccessKeySecretName" . }} + labels: + app: "{{ template "signalsciences.fullname" . }}" + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} +type: Opaque +data: + secretAccessKey: {{ default "MISSING" .Values.signalsciences.secretAccessKey | b64enc | quote }} + +{{- end }} diff --git a/stable/signalsciences/values.yaml b/stable/signalsciences/values.yaml new file mode 100644 index 0000000000..8b8d4fc606 --- /dev/null +++ b/stable/signalsciences/values.yaml @@ -0,0 +1,60 @@ +# Default values for signalsciences. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: marc/sigsci-agent + tag: 3.12.1 + pullPolicy: IfNotPresent + +daemonset: {} + ## Annotations to add to the DaemonSet's Pods + # podAnnotations: + # scheduler.alpha.kubernetes.io/tolerations: '[{"key": "example", "value": "foo"}]' + + ## Allow the DaemonSet to schedule on tainted nodes (requires Kubernetes >= 1.6) + # tolerations: [] + + ## Allow the DaemonSet to schedule on selected nodes + # Ref: https://kubernetes.io/docs/user-guide/node-selection/ + # nodeSelector: {} + + ## Allow the DaemonSet to schedule ussing affinity rules + # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # affinity: {} + + ## Allow the DaemonSet to perform a rolling update on helm update + ## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ + # updateStrategy: RollingUpdate + +signalsciences: + ## You'll need to set this to your agent accessKeyId before the agent will run + ## ref: https://docs.signalsciences.net/install-guides/#step-1-agent-installation + ## + # accessKeyId: + + ## Use existing Secret which stores accessKeyId instead of creating a new one + # accessKeyIdExistingSecret: + + ## You'll need to set this to your agent secretAccessKey before the agent will run + ## ref: https://docs.signalsciences.net/install-guides/#step-1-agent-installation + # secretAccessKey: + + ## Use existing Secret which stores the secretAccessKey instead of creating a new one + # secretAccessKeyExistingSecret: + + ## Directory to mount and create the shared unix socket file for mdule installation + socketDir: /var/run/sigsci + + ## Filename of the shared socket file + socketFile: sigsci.sock + + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: 200m + memory: 256Mi