cs_sensor/cssensor-containerd-ds.yml at master · TannerSet/cs_sensor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
kind: List
apiVersion: v1
items:
  # Create custom namespace qualys
  - kind: Namespace
    apiVersion: v1
    metadata:
      name: qualys
  # Service Account
  - kind: ServiceAccount
    apiVersion: v1
    metadata:
      name: qualys-service-account
      namespace: qualys
  # Role for all permission to qualys namespace
  - kind: Role
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: qualys-reader-role
      namespace: qualys
    rules:
    - apiGroups: ["","batch"]
      resources: ["pods","jobs"]
      verbs: ["get", "list", "watch","create", "delete", "deletecollection"]
    - apiGroups: [""]
      resources: ["pods/attach", "pods/exec"]
      verbs: ["create"]
  # ClusterRole for read permission to whole cluster
  - kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: qualys-cluster-reader-role
    rules:
    - apiGroups: [""]
      resources: ["pods/exec"]
      verbs: ["create"]
    - apiGroups: [""]
      resources: ["nodes", "pods", "pods/status", "replicationcontrollers/status", "nodes/status"]
      verbs: ["get"]
    - apiGroups: ["apps"]
      resources: ["replicasets/status", "daemonsets/status", "deployments/status", "statefulsets/status"]
      verbs: ["get"]
    - apiGroups: ["batch"]
      resources: ["jobs/status", "cronjobs/status"]
      verbs: ["get"]
  # RoleBinding to assign permissions in qualys-reader-role to qualys-service-account
  - kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: qualys-reader-rb
      namespace: qualys
    subjects:
    - kind: ServiceAccount
      name: qualys-service-account
      namespace: qualys
    roleRef:
      kind: Role
      name: qualys-reader-role
      apiGroup: rbac.authorization.k8s.io
  # ClusterRoleBinding to assign permissions in qualys-cluster-reader-role to qualys-service-account
  - kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: qualys-cluster-reader-rb
    subjects:
    - kind: ServiceAccount
      name: qualys-service-account
      namespace: qualys
    roleRef:
      kind: ClusterRole
      name: qualys-cluster-reader-role
      apiGroup: rbac.authorization.k8s.io
  # Qualys Container Sensor pod with
  - apiVersion: apps/v1
    kind: DaemonSet
    metadata:
      name: qualys-container-sensor
      namespace: qualys
      labels:
        k8s-app: qualys-cs-sensor
    spec:
      selector:
        matchLabels:
          name: qualys-container-sensor
      updateStrategy:
          type: RollingUpdate
      template:
        metadata:
          labels:
            name: qualys-container-sensor
        spec:
          #tolerations:
          # this toleration is to have the daemonset runnable on master nodes
          # uncomment it if want your masters to run sensor pod
          #- key: node-role.kubernetes.io/master
          #  effect: NoSchedule
          serviceAccountName: qualys-service-account
          containers:
          - name: qualys-container-sensor
            image: qualys/qcs-sensor:latest
            imagePullPolicy : IfNotPresent
            resources:
              limits:
                cpu: "0.2" # Default CPU usage limit on each node for sensor.
            args: ["--k8s-mode", "--container-runtime", "containerd"]
            env:
            - name: CUSTOMERID
              value: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
            - name: ACTIVATIONID
              value: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
            - name: POD_URL
              value:
            - name: QUALYS_SCANNING_CONTAINER_LAUNCH_TIMEOUT
              value: "10"
# uncomment(and indent properly) below section if proxy is required to connect Qualys Cloud
            #- name: qualys_https_proxy
            #  value: <proxy FQDN or Ip address>:<port#>
            volumeMounts:
            - mountPath: /var/run
              name: socket-volume
            - mountPath: /usr/local/qualys/qpa/data
              name: persistent-volume
            - mountPath: /usr/local/qualys/qpa/data/conf/agent-data
              name: agent-volume
# uncomment(and indent properly) below section if proxy(with CA cert) required to connect Qualys Cloud
            #- mountPath: /etc/qualys/qpa/cert/custom-ca.crt
            #  name: proxy-cert-path
            securityContext:
              allowPrivilegeEscalation: false
          volumes:
            - name: socket-volume
              hostPath:
                path: /var/run
                type: Directory
            - name: persistent-volume
              hostPath:
                path: /usr/local/qualys/sensor/data
                type: DirectoryOrCreate
            - name: agent-volume
              hostPath:
                path: /etc/qualys
                type: DirectoryOrCreate
# uncomment(and indent properly) below section if proxy(with CA cert) required to connect Qualys Cloud
            #- name: proxy-cert-path
            #  hostPath:
            #    path: <proxy certificate path>
            #    type: File
          hostNetwork: true