feat: Added a helm chart for the k8s-assets scanner (#140)

* feat: Added a helm chart for the k8s-assets scanner

* Automatic application of license header

---------

Co-authored-by: License Bot <[email protected]>

.github/workflows/helm-release.yaml

@@ -8,6 +8,7 @@ on:
     paths:
       - .github/workflows/helm-release.yaml
       - charts/heureka
+      - scanner/k8s-assets/chart/k8s-assets-scanner
 
 
 permissions:
@@ -27,6 +28,8 @@ jobs:
         include:
           - chartDir: charts/heureka
             chartName: heureka
+          - chartDir: scanner/k8s-assets/chart/k8s-assets-scanner
+            chartName: k8s-assets-scanner
 
 
     steps:

scanner/k8s-assets/chart/k8s-assets-scanner/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

scanner/k8s-assets/chart/k8s-assets-scanner/Chart.yaml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v2
+name: k8s-assets-scanner
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

scanner/k8s-assets/chart/k8s-assets-scanner/README.md

@@ -0,0 +1,22 @@
+K8S Assets Scanner for Heureka
+==============================
+
+This scanner is used to scan the k8s assets in the heureka project.
+
+## Usage
+```bash
+$ k8s-assets-scanner --help
+```
+
+## Helm Chart
+Usage:
+```bash 
+helm upgrade --install --namespace heureka k8s-assets-scanner heureka/scanner/k8s-assets/chart/k8s-assets-scanner/
+```
+
+#### Values
+In the `values.yaml` file, you can configure the following values:
+- `scanner.api_token`: The token used to authenticate the scanner.
+- `scanner.heureka_url`: The URL of the Heureka API.
+- `scanner.config_mount_path`: The path of the scanner config file inside the pod (e.g. "/etc/heureka/scanner/config")
+- `scanner.schedule`: The cronjob schedule string (e.g. "0 * * * *") that defines when the scanner should run.

scanner/k8s-assets/chart/k8s-assets-scanner/templates/NOTES.txt

@@ -0,0 +1 @@
+1. The Heureka Scanner {{ .Release.Name }} is being deployed. Be aware that this is a CronJob only deployment.

scanner/k8s-assets/chart/k8s-assets-scanner/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "k8s-assets-scanner.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "k8s-assets-scanner.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "k8s-assets-scanner.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "k8s-assets-scanner.labels" -}}
+helm.sh/chart: {{ include "k8s-assets-scanner.chart" . }}
+{{ include "k8s-assets-scanner.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "k8s-assets-scanner.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "k8s-assets-scanner.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "k8s-assets-scanner.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "k8s-assets-scanner.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

scanner/k8s-assets/chart/k8s-assets-scanner/templates/config/_scanner_config.yaml.tpl

@@ -0,0 +1,2 @@
+config:
+    some_key: some_value

scanner/k8s-assets/chart/k8s-assets-scanner/templates/configmap.yaml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-configmap
+data:
+  config.yaml: |
+{{ include (print .Template.BasePath "/config/_scanner_config.yaml.tpl") . | indent 4 }}

scanner/k8s-assets/chart/k8s-assets-scanner/templates/cronjob.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .Release.Name }}-cronjob
+spec:
+  schedule: "{{ .Values.scanner.schedule }}"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - name: config-volume
+            configMap:
+              name: {{ .Release.Name }}-configmap
+          containers:
+          - name: {{ .Release.Name }}
+            image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+            imagePullPolicy: {{ .Values.image.pullPolicy }}
+            volumeMounts:
+            - name: config-volume
+              mountPath: "{{ .Values.scanner.config_mount_path }}"
+              readOnly: true
+            env:
+            - name: HEUREKA_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-secret
+                  key: api_token
+            - name: HEUREKA_URL
+              value: {{ .Values.scanner.heureka_url }}
+            args:
+            - /bin/sh
+            - -c
+            - date; echo Hello from the Kubernetes cluster
+          restartPolicy: OnFailure

scanner/k8s-assets/chart/k8s-assets-scanner/templates/secrets.yaml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-secret
+type: Opaque
+data:
+  api_token: {{ .Values.scanner.api_token | b64enc }}

scanner/k8s-assets/chart/k8s-assets-scanner/templates/serviceaccount.yaml

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "k8s-assets-scanner.serviceAccountName" . }}
+  labels:
+    {{- include "k8s-assets-scanner.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}

scanner/k8s-assets/chart/k8s-assets-scanner/values.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Default values for k8s-assets-scanner.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+scanner:
+  api_token: "my_token"
+  heureka_url: "heureka.greehouse.com"
+  config_mount_path: "/etc/heureka/scanner/config"
+  schedule: "0 * * * *"
+
+image:
+  repository: ghcr.io/cloudoperators/heureka-scanner-k8s-assets
+  pullPolicy: Always
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: false
+  # Automatically mount a ServiceAccount's API credentials?
+  automount: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""