|
| 1 | +apiVersion: operators.coreos.com/v1alpha1 |
| 2 | +kind: ClusterServiceVersion |
| 3 | +metadata: |
| 4 | + name: aqua-operator.v1.0.0 |
| 5 | + namespace: placeholder |
| 6 | + annotations: |
| 7 | + capabilities: Basic Install |
| 8 | + categories: Security |
| 9 | + description: The Aqua Security Operator runs within a Openshift cluster and provides a means to deploy and manage Aqua Security cluster and components. |
| 10 | + certified: "false" |
| 11 | + containerImage: aquasec/aqua-operator:1.0.0 |
| 12 | + olm.skipRange: '<0.0.2' |
| 13 | + createdAt: 2019-12-30T08:00:00Z |
| 14 | + support: Aqua Security, Inc. |
| 15 | + repository: https://github.com/aquasecurity/aqua-operator |
| 16 | + alm-examples: |- |
| 17 | + [ |
| 18 | + { |
| 19 | + "apiVersion": "operator.aquasec.com/v1alpha1", |
| 20 | + "kind": "AquaCsp", |
| 21 | + "metadata": { |
| 22 | + "name": "aqua" |
| 23 | + }, |
| 24 | + "spec": { |
| 25 | + "infra": { |
| 26 | + "platform": "openshift", |
| 27 | + "requirements": true |
| 28 | + }, |
| 29 | + "registry": { |
| 30 | + "url": "registry.aquasec.com", |
| 31 | + "username": "example@gmail.com", |
| 32 | + "password": "", |
| 33 | + "email": "example@gmail.com" |
| 34 | + }, |
| 35 | + "database": { |
| 36 | + "replicas": 1, |
| 37 | + "service": "ClusterIP" |
| 38 | + }, |
| 39 | + "gateway": { |
| 40 | + "replicas": 1, |
| 41 | + "service": "ClusterIP" |
| 42 | + }, |
| 43 | + "server": { |
| 44 | + "replicas": 1, |
| 45 | + "service": "LoadBalancer" |
| 46 | + }, |
| 47 | + "adminPassword": "Password1", |
| 48 | + "licenseToken": null |
| 49 | + } |
| 50 | + }, |
| 51 | + { |
| 52 | + "apiVersion": "operator.aquasec.com/v1alpha1", |
| 53 | + "kind": "AquaDatabase", |
| 54 | + "metadata": { |
| 55 | + "name": "aqua" |
| 56 | + }, |
| 57 | + "spec": { |
| 58 | + "infra": { |
| 59 | + "serviceAccount": "aqua-sa", |
| 60 | + "version": "4.5", |
| 61 | + "platform": "openshift" |
| 62 | + }, |
| 63 | + "deploy": { |
| 64 | + "replicas": 1, |
| 65 | + "service": "ClusterIP" |
| 66 | + }, |
| 67 | + "diskSize": 10 |
| 68 | + } |
| 69 | + }, |
| 70 | + { |
| 71 | + "apiVersion": "operator.aquasec.com/v1alpha1", |
| 72 | + "kind": "AquaEnforcer", |
| 73 | + "metadata": { |
| 74 | + "name": "aqua" |
| 75 | + }, |
| 76 | + "spec": { |
| 77 | + "infra": { |
| 78 | + "serviceAccount": "aqua-sa", |
| 79 | + "version": "4.5" |
| 80 | + }, |
| 81 | + "gateway": { |
| 82 | + "host": "aqua-gateway-svc", |
| 83 | + "port": 3622 |
| 84 | + }, |
| 85 | + "token": "token" |
| 86 | + } |
| 87 | + }, |
| 88 | + { |
| 89 | + "apiVersion": "operator.aquasec.com/v1alpha1", |
| 90 | + "kind": "AquaGateway", |
| 91 | + "metadata": { |
| 92 | + "name": "aqua" |
| 93 | + }, |
| 94 | + "spec": { |
| 95 | + "infra": { |
| 96 | + "serviceAccount": "aqua-sa", |
| 97 | + "version": "4.5" |
| 98 | + }, |
| 99 | + "common": { |
| 100 | + "databaseSecret": { |
| 101 | + "name": "aqua-aqua-db", |
| 102 | + "key": "password" |
| 103 | + } |
| 104 | + }, |
| 105 | + "externalDb": { |
| 106 | + "host": "aqua-db", |
| 107 | + "port": 5432, |
| 108 | + "username": "postgres" |
| 109 | + }, |
| 110 | + "deploy": { |
| 111 | + "replicas": 1, |
| 112 | + "service": "ClusterIP" |
| 113 | + } |
| 114 | + } |
| 115 | + }, |
| 116 | + { |
| 117 | + "apiVersion": "operator.aquasec.com/v1alpha1", |
| 118 | + "kind": "AquaScanner", |
| 119 | + "metadata": { |
| 120 | + "name": "aqua" |
| 121 | + }, |
| 122 | + "spec": { |
| 123 | + "infra": { |
| 124 | + "serviceAccount": "aqua-sa", |
| 125 | + "version": "4.5" |
| 126 | + }, |
| 127 | + "deploy": { |
| 128 | + "replicas": 1 |
| 129 | + }, |
| 130 | + "login": { |
| 131 | + "username": "administrator", |
| 132 | + "password": "Password1", |
| 133 | + "host": "http://aqua-server:8080" |
| 134 | + } |
| 135 | + } |
| 136 | + }, |
| 137 | + { |
| 138 | + "apiVersion": "operator.aquasec.com/v1alpha1", |
| 139 | + "kind": "AquaServer", |
| 140 | + "metadata": { |
| 141 | + "name": "aqua" |
| 142 | + }, |
| 143 | + "spec": { |
| 144 | + "infra": { |
| 145 | + "serviceAccount": "aqua-sa", |
| 146 | + "version": "4.5" |
| 147 | + }, |
| 148 | + "common": { |
| 149 | + "databaseSecret": { |
| 150 | + "name": "aqua-aqua-db", |
| 151 | + "key": "password" |
| 152 | + } |
| 153 | + }, |
| 154 | + "externalDb": { |
| 155 | + "host": "aqua-db", |
| 156 | + "port": 5432, |
| 157 | + "username": "postgres" |
| 158 | + }, |
| 159 | + "deploy": { |
| 160 | + "replicas": 1, |
| 161 | + "service": "LoadBalancer" |
| 162 | + }, |
| 163 | + "adminPassword": "Password1", |
| 164 | + "licenseToken": null |
| 165 | + } |
| 166 | + } |
| 167 | + ] |
| 168 | +spec: |
| 169 | + displayName: Aqua Security Operator |
| 170 | + version: 1.0.0 |
| 171 | + description: |- |
| 172 | + The Aqua Security Operator runs within an OpenShift cluster, and provides a means to deploy and manage the Aqua Security cluster and components |
| 173 | + * Server (sometimes called “console”) |
| 174 | + * Database (not recommended for production environments) |
| 175 | + * Gateway |
| 176 | + * Enforcer (sometimes called “agent”) |
| 177 | + * Scanner |
| 178 | + * CSP (package containing the Server, Database, and Gateway - not supported, and not for production environments) |
| 179 | + Use the aqua-operator to |
| 180 | + * Deploy Aqua Security components on OpenShift |
| 181 | + * Scale up Aqua Security components with extra replicas |
| 182 | + * Assign metadata tags to Aqua Security components |
| 183 | + * Automatically scale the number of Aqua scanners according to the number of images in the scan queue |
| 184 | + ## Before You Begin Using the Operator CRDs |
| 185 | + Obtain access to the Aqua registry - https://www.aquasec.com/about-us/contact-us/ |
| 186 | + You need to create |
| 187 | + * A secret for the Docker registry |
| 188 | + * A secret for the database |
| 189 | + ```bash |
| 190 | + oc create secret docker-registry aqua-registry --docker-server=registry.aquasec.com --docker-username=<AQUA_USERNAME> --docker-password=<AQUA_PASSWORD> --docker-email=<user email> -n aqua |
| 191 | + oc create secret generic aqua-database-password --from-literal=db-password=<password> -n aqua |
| 192 | + oc secrets add aqua-sa aqua-registry --for=pull -n aqua |
| 193 | + ``` |
| 194 | + ## After the Installation |
| 195 | + Once the operator is installed in the cluster, you now can use the CRDs to install the Aqua cluster and components. |
| 196 | + keywords: ['aqua-security', 'scanning', 'security', 'runtime-security'] |
| 197 | + maintainers: |
| 198 | + - email: nissim.bitan@aquasec.com |
| 199 | + name: Nissim Bitan, Aqua Security |
| 200 | + provider: |
| 201 | + name: Aqua Security, Inc. |
| 202 | + maturity: alpha |
| 203 | + labels: |
| 204 | + name: aqua-operator |
| 205 | + selector: |
| 206 | + matchLabels: |
| 207 | + name: aqua-operator |
| 208 | + links: |
| 209 | + - name: Aqua Security |
| 210 | + url: https://www.aquasec.com/ |
| 211 | + - name: Aqua Operator Github |
| 212 | + url: https://github.com/aquasecurity/aqua-operator |
| 213 | + icon: |
| 214 | + - base64data: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIzLjAuMiwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IkxheWVyXzEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IgoJIHZpZXdCb3g9IjAgMCAxMDAgMTAwIiBzdHlsZT0iZW5hYmxlLWJhY2tncm91bmQ6bmV3IDAgMCAxMDAgMTAwOyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6I0YwREUzNDt9Cgkuc3Qxe2ZpbGw6I0Y5QUU0MTt9Cgkuc3Qye2ZpbGw6Izk5RDVFQjt9Cgkuc3Qze2ZpbGw6IzAyQjBENDt9Cgkuc3Q0e2ZpbGw6I0Y1OTMyMDt9Cgkuc3Q1e2ZpbGw6IzA5ODA5QTt9Cjwvc3R5bGU+CjxnPgoJPHBvbHlnb24gY2xhc3M9InN0MCIgcG9pbnRzPSI1MCwyLjEgMjUuNSwyNi4xIDc0LjUsMjYuMSA3NC41LDIuMSAJIi8+Cgk8cG9seWdvbiBjbGFzcz0ic3QxIiBwb2ludHM9Ijc0LjUsNzMuOSA5OSw1MCA5OSwyNi4xIDc0LjUsMjYuMSAJIi8+Cgk8cG9seWdvbiBjbGFzcz0ic3QyIiBwb2ludHM9IjI1LjUsNzMuOSAyNS41LDk3LjkgNTAsOTcuOSA3NC41LDczLjkgCSIvPgoJPHBvbHlnb24gY2xhc3M9InN0MyIgcG9pbnRzPSIxLDUwIDEsNzMuOSAyNS41LDczLjkgMjUuNSwyNi4xIAkiLz4KCTxyZWN0IHg9Ijc0LjUiIHk9IjIuMSIgY2xhc3M9InN0NCIgd2lkdGg9IjI0LjUiIGhlaWdodD0iMjMuOSIvPgoJPHJlY3QgeD0iMSIgeT0iNzMuOSIgY2xhc3M9InN0NSIgd2lkdGg9IjI0LjUiIGhlaWdodD0iMjMuOSIvPgo8L2c+Cjwvc3ZnPgo= |
| 215 | + mediatype: image/svg+xml |
| 216 | + miniKubeVersion: 1.11.0 |
| 217 | + installModes: |
| 218 | + - supported: true |
| 219 | + type: OwnNamespace |
| 220 | + - supported: true |
| 221 | + type: SingleNamespace |
| 222 | + - supported: false |
| 223 | + type: MultiNamespace |
| 224 | + - supported: false |
| 225 | + type: AllNamespaces |
| 226 | + install: |
| 227 | + strategy: deployment |
| 228 | + spec: |
| 229 | + clusterPermissions: |
| 230 | + - serviceAccountName: aqua-sa |
| 231 | + rules: |
| 232 | + - apiGroups: |
| 233 | + - "security.openshift.io" |
| 234 | + resources: |
| 235 | + - securitycontextconstraints |
| 236 | + verbs: |
| 237 | + - use |
| 238 | + resourceNames: |
| 239 | + - privileged |
| 240 | + - hostaccess |
| 241 | + - serviceAccountName: aqua-operator |
| 242 | + rules: |
| 243 | + - apiGroups: |
| 244 | + - "" |
| 245 | + resources: |
| 246 | + - pods |
| 247 | + - services |
| 248 | + - endpoints |
| 249 | + - persistentvolumeclaims |
| 250 | + - events |
| 251 | + - configmaps |
| 252 | + - secrets |
| 253 | + - serviceaccounts |
| 254 | + - nodes |
| 255 | + verbs: |
| 256 | + - '*' |
| 257 | + - apiGroups: |
| 258 | + - "" |
| 259 | + resources: |
| 260 | + - namespaces |
| 261 | + verbs: |
| 262 | + - get |
| 263 | + - apiGroups: |
| 264 | + - apps |
| 265 | + - extensions |
| 266 | + resources: |
| 267 | + - '*' |
| 268 | + - deployments |
| 269 | + - daemonsets |
| 270 | + - replicasets |
| 271 | + - statefulsets |
| 272 | + - podsecuritypolicies |
| 273 | + verbs: |
| 274 | + - '*' |
| 275 | + - apiGroups: |
| 276 | + - monitoring.coreos.com |
| 277 | + resources: |
| 278 | + - servicemonitors |
| 279 | + verbs: |
| 280 | + - get |
| 281 | + - create |
| 282 | + - apiGroups: |
| 283 | + - operator.aquasec.com |
| 284 | + resources: |
| 285 | + - '*' |
| 286 | + - aquagateways |
| 287 | + - aquaservers |
| 288 | + - aquacsps |
| 289 | + - aquaenforcers |
| 290 | + - aquascanners |
| 291 | + verbs: |
| 292 | + - '*' |
| 293 | + - apiGroups: |
| 294 | + - rbac.authorization.k8s.io |
| 295 | + - authorization.k8s.io |
| 296 | + resources: |
| 297 | + - '*' |
| 298 | + - clusterroles |
| 299 | + - clusterrolebindings |
| 300 | + verbs: |
| 301 | + - '*' |
| 302 | + - apiGroups: |
| 303 | + - policy |
| 304 | + resources: |
| 305 | + - '*' |
| 306 | + - podsecuritypolicies |
| 307 | + verbs: |
| 308 | + - '*' |
| 309 | + deployments: |
| 310 | + - name: aqua-operator |
| 311 | + spec: |
| 312 | + replicas: 1 |
| 313 | + selector: |
| 314 | + matchLabels: |
| 315 | + name: aqua-operator |
| 316 | + template: |
| 317 | + metadata: |
| 318 | + labels: |
| 319 | + name: aqua-operator |
| 320 | + spec: |
| 321 | + serviceAccountName: aqua-operator |
| 322 | + containers: |
| 323 | + - name: aqua-operator |
| 324 | + image: aquasec/aqua-operator:1.0.0 |
| 325 | + imagePullPolicy: Always |
| 326 | + command: |
| 327 | + - aqua-operator |
| 328 | + env: |
| 329 | + - name: WATCH_NAMESPACE |
| 330 | + valueFrom: |
| 331 | + fieldRef: |
| 332 | + fieldPath: metadata.annotations['olm.targetNamespaces'] |
| 333 | + - name: POD_NAME |
| 334 | + valueFrom: |
| 335 | + fieldRef: |
| 336 | + fieldPath: metadata.name |
| 337 | + - name: OPERATOR_NAME |
| 338 | + value: "aqua-operator" |
| 339 | + ports: |
| 340 | + - containerPort: 60000 |
| 341 | + name: metrics |
| 342 | + readinessProbe: |
| 343 | + exec: |
| 344 | + command: |
| 345 | + - stat |
| 346 | + - /tmp/operator-sdk-ready |
| 347 | + failureThreshold: 1 |
| 348 | + initialDelaySeconds: 4 |
| 349 | + periodSeconds: 10 |
| 350 | + customresourcedefinitions: |
| 351 | + owned: |
| 352 | + - kind: AquaCsp |
| 353 | + name: aquacsps.operator.aquasec.com |
| 354 | + version: v1alpha1 |
| 355 | + displayName: AquaCsp |
| 356 | + description: Aqua Security CSP Deployment with Aqua Operator |
| 357 | + - kind: AquaDatabase |
| 358 | + name: aquadatabases.operator.aquasec.com |
| 359 | + version: v1alpha1 |
| 360 | + displayName: AquaDatabase |
| 361 | + description: Aqua Security Database Deployment with Aqua Operator |
| 362 | + - kind: AquaEnforcer |
| 363 | + name: aquaenforcers.operator.aquasec.com |
| 364 | + version: v1alpha1 |
| 365 | + displayName: AquaEnforcer |
| 366 | + description: Aqua Security Enforcer Deployment with Aqua Operator |
| 367 | + - kind: AquaGateway |
| 368 | + name: aquagateways.operator.aquasec.com |
| 369 | + version: v1alpha1 |
| 370 | + displayName: AquaGateway |
| 371 | + description: Aqua Security Gateway Deployment with Aqua Operator |
| 372 | + - kind: AquaScanner |
| 373 | + name: aquascanners.operator.aquasec.com |
| 374 | + version: v1alpha1 |
| 375 | + displayName: AquaScanner |
| 376 | + description: Aqua Security Scanner Deployment with Aqua Operator |
| 377 | + - kind: AquaServer |
| 378 | + name: aquaservers.operator.aquasec.com |
| 379 | + version: v1alpha1 |
| 380 | + displayName: AquaServer |
| 381 | + description: Aqua Security Server Deployment with Aqua Operator |
0 commit comments