Skip to content

Commit 6ee32da

Browse files
jacobbednarzjacobbednarz
authored
Merge pull request #17 from timothyclarke/docker-helm
Added Helm chart for Kubernetes support
2 parents dee32ee + ab8adc1 commit 6ee32da

File tree

12 files changed

+371
-0
lines changed

12 files changed

+371
-0
lines changed

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,5 +81,12 @@ violation data because there are already a bunch of great solutions out
8181
there. Once you have your violations being collected, be sure to slurp
8282
them into your favourite log aggregation tool.
8383

84+
### Deployments
85+
86+
Currently supported deployment mechanisms:
87+
88+
- [kubernetes/helm][3]
89+
8490
[1]: https://github.com/jacobbednarz/go-csp-collector/blob/master/sample.filterlist.txt
8591
[2]: https://github.com/jacobbednarz/go-csp-collector/releases
92+
[3]: https://github.com/jacobbednarz/go-csp-collector/blob/master/deployment/kubernetes-helm/README.md

‎deployments/kubernetes-helm/.helmignore‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj

‎deployments/kubernetes-helm/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
appVersion: "1.0"
3+
description: A Content Security Policy violation collector
4+
name: csp-collector
5+
version: 0.1.0

‎deployments/kubernetes-helm/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Kubernetes / Helm Deployment Template for the CSP violation collector
2+
3+
## TL;DR;
4+
5+
```console
6+
$ helm upgrade csp-collector kubernetes-helm --values custom-values.yaml --install
7+
```
8+
9+
## Introduction
10+
11+
This chart deploys a Content Security Policy violation collector from
12+
https://github.com/jacobbednarz/go-csp-collector/
13+
14+
Using the [kubernetes-helm/values.yaml][1] file create a custom-values.yaml override
15+
with just the changed values then run the command above.
16+
eg.
17+
replicaCount: 2
18+
custom:
19+
filterlist: "custom.filter.list"
20+
21+
ingress:
22+
enabled: true
23+
annotations:
24+
kubernetes.io/ingress.class: nginx
25+
certmanager.k8s.io/cluster-issuer: 'my-key-name'
26+
certmanager.k8s.io/acme-challenge-type: 'dns01'
27+
certmanager.k8s.io/acme-dns01-provider: 'route53'
28+
nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
29+
hosts:
30+
- csp-reports.example.com
31+
tls:
32+
- secretName: csp-reports.example.com-tls
33+
hosts:
34+
- csp-reports.example.com
35+
```
36+
37+
## Config params
38+
39+
| Parameter | Description | Default |
40+
| --------------------------- | :------------------------------- | :----------------------------- |
41+
| `ingress` | A standard ingress block | |
42+
| `ingress.enabled` | Enables or Disables the ingress block | `false` |
43+
| `ingress.annotations` | Ingress annotations | `{}` |
44+
| `ingress.hosts` | List of FQDN's the be browsed to | Not Set |
45+
| `ingress.tls.secretName` | Name of the secret to use | Not Set |
46+
| `ingress.tls.hosts` | List of FQDN's the above secret is associated with| Not Set |
47+
| `service.type` | Service type | `ClusterIP` |
48+
| `service.port` | Service port | `80` |
49+
| `service.annotations` | Service annotations | `{}` |
50+
| `custom` | CLI Param Options (see Below) | |
51+
| `custom.debug` | Logs in debug mode | `false` |
52+
| `custom.filterlist` | Name of file within the configMaps dir for custom filters| `false` Uses list compiled into the app |
53+
| `custom.jsonOutput` | Log entries as json objects, use `false` for plain text | `true` |
54+
55+
[1]: https://github.com/jacobbednarz/go-csp-collector/blob/master/deployment/kubernetes-helm/values.yaml

‎deployments/kubernetes-helm/configMaps/filterlist.txt‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# hash indicates a comment
2+
resource://
3+
chromenull://
4+
chrome-extension://
5+
safari-extension://
6+
mxjscall://
7+
webviewprogressproxy://
8+
res://
9+
mx://
10+
safari-resource://
11+
chromeinvoke://
12+
chromeinvokeimmediate://
13+
mbinit://
14+
opera://
15+
ms-appx://
16+
ms-appx-web://
17+
localhost
18+
127.0.0.1
19+
none://
20+
about:blank
21+
android-webview
22+
ms-browser-extension
23+
wvjbscheme://__wvjb_queue_message__
24+
nativebaiduhd://adblock
25+
bdvideo://error

‎deployments/kubernetes-helm/templates/NOTES.txt‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if .Values.ingress.enabled }}
2+
1. The CSP violation collector is available by setting your report-uri to:
3+
{{- range .Values.ingress.hosts }}
4+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }}
5+
{{- end }}
6+
{{- else if contains "NodePort" .Values.service.type }}
7+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "csp-collector.fullname" . }})
8+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
9+
echo http://$NODE_IP:$NODE_PORT
10+
{{- else if contains "LoadBalancer" .Values.service.type }}
11+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
12+
You can watch the status of by running 'kubectl get svc -w {{ template "csp-collector.fullname" . }}'
13+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "csp-collector.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
14+
echo http://$SERVICE_IP:{{ .Values.service.port }}
15+
{{- else if contains "ClusterIP" .Values.service.type }}
16+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "csp-collector.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
17+
echo "Visit http://127.0.0.1:8080 to use your application"
18+
kubectl port-forward $POD_NAME 8080:{{ .Values.service.port }}
19+
{{- end }}

‎deployments/kubernetes-helm/templates/_helpers.tpl‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "csp-collector.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "csp-collector.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "csp-collector.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "csp-collector.labels" -}}
38+
helm.sh/chart: {{ include "csp-collector.chart" . }}
39+
{{ include "csp-collector.selectorLabels" . }}
40+
app.kubernetes.io/managed-by: {{ .Release.Service }}
41+
{{- end -}}
42+
43+
{{/*
44+
Selector labels
45+
*/}}
46+
{{- define "csp-collector.selectorLabels" -}}
47+
app.kubernetes.io/name: {{ include "csp-collector.name" . }}
48+
app.kubernetes.io/instance: {{ .Release.Name }}
49+
{{- end -}}
50+

‎deployments/kubernetes-helm/templates/configMap.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ template "csp-collector.fullname" . }}
6+
labels:
7+
{{- include "csp-collector.labels" . | nindent 4 }}
8+
data:
9+
{{ (.Files.Glob "configMaps/*").AsConfig | indent 2 }}

‎deployments/kubernetes-helm/templates/deployment.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ template "csp-collector.fullname" . }}
5+
labels:
6+
{{- include "csp-collector.labels" . | nindent 4 }}
7+
checksum/config: {{ include (print $.Template.BasePath "/configMap.yaml") . | sha256sum | trunc 63 }}
8+
spec:
9+
replicas: {{ .Values.replicaCount }}
10+
selector:
11+
matchLabels:
12+
{{- include "csp-collector.selectorLabels" . | nindent 6 }}
13+
template:
14+
metadata:
15+
annotations:
16+
checksum/config: {{ include (print $.Template.BasePath "/configMap.yaml") . | sha256sum | trunc 63 }}
17+
labels:
18+
{{- include "csp-collector.selectorLabels" . | nindent 8 }}
19+
spec:
20+
containers:
21+
- name: {{ .Chart.Name }}
22+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
23+
imagePullPolicy: {{ .Values.image.pullPolicy }}
24+
volumeMounts:
25+
- name: config-volume
26+
mountPath: /configs
27+
args:
28+
- "/csp_collector"
29+
{{- if .Values.custom.jsonOutput }}
30+
- "--output-format"
31+
- "json"
32+
{{- end }}
33+
{{- if .Values.custom.filterlist }}
34+
- "--filter-file"
35+
- "/configs/{{- .Values.custom.filterlist -}}"
36+
{{- end }}
37+
{{- if .Values.custom.debug }}
38+
- "--debug"
39+
{{- end }}
40+
ports:
41+
- name: http
42+
containerPort: 8080
43+
protocol: TCP
44+
livenessProbe:
45+
httpGet:
46+
path: /_healthcheck
47+
port: http
48+
readinessProbe:
49+
httpGet:
50+
path: /_healthcheck
51+
port: http
52+
resources:
53+
{{ toYaml .Values.resources | indent 12 }}
54+
{{- with .Values.nodeSelector }}
55+
nodeSelector:
56+
{{ toYaml . | indent 8 }}
57+
{{- end }}
58+
volumes:
59+
- name: config-volume
60+
configMap:
61+
name: {{ template "csp-collector.fullname" . }}
62+
{{- with .Values.affinity }}
63+
affinity:
64+
{{ toYaml . | indent 8 }}
65+
{{- end }}
66+
{{- with .Values.tolerations }}
67+
tolerations:
68+
{{ toYaml . | indent 8 }}
69+
{{- end }}

‎deployments/kubernetes-helm/templates/ingress.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{{- if .Values.ingress.enabled -}}
2+
{{- $fullName := include "csp-collector.fullname" . -}}
3+
{{- $servicePort := .Values.service.port -}}
4+
{{- $ingressPath := .Values.ingress.path -}}
5+
apiVersion: extensions/v1beta1
6+
kind: Ingress
7+
metadata:
8+
name: {{ $fullName }}
9+
labels:
10+
{{- include "csp-collector.labels" . | nindent 4 }}
11+
{{- with .Values.ingress.annotations }}
12+
annotations:
13+
{{ toYaml . | indent 4 }}
14+
{{- end }}
15+
spec:
16+
{{- if .Values.ingress.tls }}
17+
tls:
18+
{{- range .Values.ingress.tls }}
19+
- hosts:
20+
{{- range .hosts }}
21+
- {{ . }}
22+
{{- end }}
23+
secretName: {{ .secretName }}
24+
{{- end }}
25+
{{- end }}
26+
rules:
27+
{{- range .Values.ingress.hosts }}
28+
- host: {{ . }}
29+
http:
30+
paths:
31+
- path: {{ $ingressPath }}
32+
backend:
33+
serviceName: {{ $fullName }}
34+
servicePort: http
35+
{{- end }}
36+
{{- end }}

0 commit comments

Comments
 (0)