2.17.0: new registries scan, IA list batching, RP limited GA (#110)

checkpoint/cloudguard/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 2.16.0
+appVersion: 2.17.0
 description: A Helm chart for Check Point CloudGuard Workload Security
 home: https://portal.checkpoint.com
 icon: https://www.checkpoint.com/wp-content/uploads/icon-cloudguard-nav.png
@@ -20,4 +20,4 @@ keywords:
 - ecr
 - ecs
 name: cloudguard
-version: 2.16.0
+version: 2.17.0

checkpoint/cloudguard/defaults.yaml

@@ -56,6 +56,8 @@ platform: kubernetes # kubernetes, openshift, openshift.v3, tanzu, eks, eks.bott
 seccompProfile:
   type: RuntimeDefault
 
+autoUpgrade: false # true or false
+
 daemonSetStrategy:
   rollingUpdate:
     maxUnavailable: 50%
@@ -66,7 +68,7 @@ inventory:
 
     ## Specify image and tag
     image: checkpoint/consec-inventory-agent
-    tag: 1.7.1
+    tag: 1.8.0
 
     ## Specify existing service account name ("" to create)
     serviceAccountName: ""
@@ -106,7 +108,7 @@ addons:
 
       ## Specify image and tag
       image: checkpoint/consec-imagescan-daemon
-      tag: 2.15.0
+      tag: 2.18.1
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -128,7 +130,7 @@ addons:
       shim:
         ## Specify image and tag
         image: checkpoint/consec-imagescan-shim
-        tag: 2.15.0
+        tag: 2.18.1
 
         ## Configure resource requests and limits
         ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
@@ -162,7 +164,7 @@ addons:
     engine:
       ## Specify image and tag
       image: checkpoint/consec-imagescan-engine
-      tag: 2.15.0
+      tag: 2.18.1
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -193,7 +195,7 @@ addons:
     list:
       ## Specify image and tag
       image: checkpoint/consec-imagescan-engine
-      tag: 2.15.0
+      tag: 2.18.1
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -226,7 +228,7 @@ addons:
     daemon:
       ## Specify image and tag
       image: checkpoint/consec-flowlogs-daemon
-      tag: 0.7.0
+      tag: 0.8.0
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -263,7 +265,7 @@ addons:
     policy:
       ## Specify image and tag
       image: checkpoint/consec-admission-policy
-      tag: 1.2.2
+      tag: 1.3.0
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -292,7 +294,7 @@ addons:
     enforcer:
       ## Specify image and tag
       image: checkpoint/consec-admission-enforcer
-      tag: 2.3.0
+      tag: 2.4.0
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -326,12 +328,13 @@ addons:
   runtimeProtection:
     enabled: false
     BPF: true
-
+    enableFileReputation: true 
+
     daemon:
       ## Main container settings
       ## Specify image and tag
       image: checkpoint/consec-runtime-daemon
-      tag: 0.0.740
+      tag: 0.0.822
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""
@@ -344,10 +347,10 @@ addons:
       resources:
         requests:
           cpu: 200m
-          memory: 500Mi
+          memory: 300Mi
         limits:
-          cpu: 2000m
-          memory: 1Gi
+          cpu: 400m
+          memory: 800Mi
 
       ## Sidecars
       probe:
@@ -362,13 +365,13 @@ addons:
             cpu: 100m
             memory: 128Mi
           limits:
-            cpu: 200m
-            memory: 128Mi
+            cpu: 400m
+            memory: 800Mi
 
       fluentbit:
         ## Specify image and tag
         image: checkpoint/consec-fluentbit
-        tag: 1.6.9-cp
+        tag: 1.6.9-cp2
 
         ## Configure resource requests and limits
         ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
@@ -395,7 +398,7 @@ addons:
 
       ## Specify custom image ("" to use default)
       image: checkpoint/consec-runtime-policy
-      tag: 1.2.0
+      tag: 1.3.0
 
       ## Specify existing service account name ("" to create)
       serviceAccountName: ""

checkpoint/cloudguard/templates/_helpers.tpl

@@ -29,25 +29,31 @@
 {{- default (include "agent.resource.name" .) .agentConfig.serviceAccountName }}
 {{- end -}}
 
-{{- /* Full path to the image of the main container of the provided agent */ -}}
+{{- /* Full path to the image of the main container of the provided agent. in case of autoUpgrade enabled we use the version without the patch */ -}}
 {{- define "agent.main.image" -}}
-{{- $tag := .agentConfig.tag }}
-{{- if or .Values.debugImages .featureConfig.debugImages .agentConfig.debugImages }}
-{{- $tag = printf "%s-debug" .agentConfig.tag }}
-{{- end }}
-{{- $image := printf "%s/%s:%s" .Values.imageRegistry.url .agentConfig.image $tag }}
-{{- default $image .agentConfig.fullImage }}
-{{- end -}}
-
-{{- /* Full path to the image of a provided side-car container */ -}}
+{{-     $tag := .agentConfig.tag }}
+{{-     if or .Values.debugImages .featureConfig.debugImages .agentConfig.debugImages }}
+{{-         $tag = printf "%s-debug" .agentConfig.tag }}
+{{-     end }}
+{{-     if and (eq (include "get.autoUpgrade" .) "true") (regexMatch "^\\d+.\\d+.\\d+$" $tag) (ne .agentConfig.image "checkpoint/consec-runtime-daemon") -}}
+{{-         $tag = regexFind "\\d+.\\d+" $tag }}
+{{-     end -}}
+{{-     $image := printf "%s/%s:%s" .Values.imageRegistry.url .agentConfig.image $tag }}
+{{-     default $image .agentConfig.fullImage }}
+{{- end -}}
+
+{{- /* Full path to the image of a provided side-car container. in case of autoUpgrade enabled we use the version without the patch */ -}}
 {{- define "agent.sidecar.image" -}}
-{{- $containerConfig := get .agentConfig .containerName }}
-{{- $tag := $containerConfig.tag }}
-{{- if or .Values.debugImages .featureConfig.debugImages .agentConfig.debugImages $containerConfig.debugImage }}
-{{- $tag = printf "%s-debug" $containerConfig.tag }}
-{{- end }}
-{{- $image := printf "%s/%s:%s" .Values.imageRegistry.url $containerConfig.image $tag }}
-{{- default $image $containerConfig.fullImage }}
+{{-     $containerConfig := get .agentConfig .containerName }}
+{{-     $tag := $containerConfig.tag }}
+{{-     if or .Values.debugImages .featureConfig.debugImages .agentConfig.debugImages $containerConfig.debugImage }}
+{{-         $tag = printf "%s-debug" $containerConfig.tag }}
+{{-     end }}
+{{-     if and (eq (include "get.autoUpgrade" .) "true") (regexMatch "^\\d+.\\d+.\\d+$" $tag) (ne .agentConfig.image "checkpoint/consec-runtime-probe") -}}
+{{-         $tag = regexFind "\\d+.\\d+" $tag }}
+{{-     end -}}
+{{-     $image := printf "%s/%s:%s" .Values.imageRegistry.url $containerConfig.image $tag }}
+{{-     default $image $containerConfig.fullImage }}
 {{- end -}}
 
 {{- /* Full path to the fluentbit image used in agent with provided config */ -}}
@@ -71,7 +77,6 @@ helm.sh/chart: {{ printf "%s-%s" .Chart.name .Chart.version | replace "+" "_" |
 
 {{- /* Pod annotations commonly used in agents */ -}}
 {{- define "common.pod.annotations" -}}
-agentVersion: {{ .agentConfig.tag }}
 {{- /* Openshift does not allow seccomp - So we don't add seccomp in openshift case */ -}}
 {{- /* From k8s 1.19 and up we use the seccomp in securityContext so no need for it here, in case of template we don't know the version so we fall back to annotation */ -}}
 {{- if and (not (contains "openshift" (include "get.platform" .))) (semverCompare "<1.19-0" .Capabilities.KubeVersion.Version ) }}
@@ -154,7 +159,10 @@ imagePullSecrets:
       fieldPath: spec.nodeName
 - name: PLATFORM
   value: {{ include "get.platform" . }}
-
+{{- if eq (include "get.autoUpgrade" .) "true" }}
+- name: AUTO_UPGRADE_ENABLED
+  value: "true"
+{{- end -}}
 {{- template "user.defined.env" . -}}
 
 {{- if .Values.proxy }}
@@ -163,6 +171,8 @@ imagePullSecrets:
 - name: NO_PROXY
   value: "kubernetes.default.svc"
 {{- end -}}
+
+{{- template "user.defined.env" . -}}
 {{- end -}}
 
 {{- /* Environment variables needed for fluentbit-based side-cars */ -}}
@@ -203,8 +213,8 @@ imagePullSecrets:
     Header                      Node-Name   ${NODE_NAME}
     Header                      Agent-Version   {{ .agentVersion }}
     Compress                    gzip
-    http_User                   {{ .credentials.user }}
-    http_Passwd                 {{ .credentials.secret }}
+    http_User                   ${USERNAME}
+    http_Passwd                 ${SECRET}
     Port                        443        
     tls                         On
     tls.verify                  On
@@ -430,6 +440,19 @@ eks
 {{- end -}}
 {{- end -}}
 
+
+{{/*
+if registry is not quay do not enable auto upgrade
+ */}}
+{{- define "get.autoUpgrade" -}}
+{{-     if ne .Values.imageRegistry.url "quay.io" -}}
+{{-         printf "false" -}}
+{{-     else -}}
+{{-         printf (.Values.autoUpgrade | toString) -}}
+{{-     end -}}
+{{- end -}}
+
+
 {{/*
   use to know if we run from template (which mean wo have no connection to the cluster and cannot check Capabilities/nodes etc.)
   if there is no namespace probably we are running template

checkpoint/cloudguard/templates/admission/enforcer/deployment.yaml

@@ -1,12 +1,12 @@
 {{- $config := fromYaml (include "admission.enforcer.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 {{ if $config.featureConfig.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 spec:
@@ -61,11 +61,6 @@ spec:
         {{- end }}
         ports:
         - containerPort: 8080
-        startupProbe:
-          tcpSocket:
-            port: 8080
-          failureThreshold: 2
-          periodSeconds: 5
       volumes:
       - name: secret-volume
         secret:

checkpoint/cloudguard/templates/admission/policy/deployment.yaml

@@ -1,12 +1,12 @@
 {{- $config := fromYaml (include "admission.policy.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 {{- if $config.featureConfig.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 spec:

checkpoint/cloudguard/templates/flowlogs/daemon/daemonset.yaml

@@ -1,12 +1,12 @@
 {{- $config := fromYaml (include "flowlogs.daemon.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 {{- if $config.featureConfig.enabled -}}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 spec:

checkpoint/cloudguard/templates/imagescan/daemon/daemonset.yaml

@@ -1,12 +1,12 @@
 {{- $config := fromYaml (include "imagescan.daemon.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 {{- if $config.featureConfig.enabled -}}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 spec:

checkpoint/cloudguard/templates/imagescan/engine/deployment.yaml

@@ -1,12 +1,12 @@
 {{- $config := fromYaml (include "imagescan.engine.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 {{- if $config.featureConfig.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 spec:

checkpoint/cloudguard/templates/imagescan/engine_list_common/_role.yaml

@@ -10,7 +10,7 @@ metadata:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 rules:
 - apiGroups: [ "" ]
-  resources: [ "pods", "secrets" ]
+  resources: [ "pods", "secrets", "configmaps" ]
   verbs: [ "list", "get"]
 {{- if $config.Values.rbac.pspEnabled }}
 - apiGroups: [ "policy" ]

checkpoint/cloudguard/templates/imagescan/list/deployment.yaml

@@ -1,12 +1,12 @@
 {{- $config := fromYaml (include "imagescan.list.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 {{- if $config.featureConfig.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
     imagescan-agent-type: list

checkpoint/cloudguard/templates/inventory/agent/deployment.yaml

@@ -1,11 +1,11 @@
 {{- $config := fromYaml (include "inventory.agent.config" .) -}}
+{{- /* Make ".Files" of the chart accessible and properly formatted when accessed via $config' */ -}}
+{{- $_ := set $config "Files" .Files -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "agent.resource.name" $config }}
   namespace: {{ .Release.Namespace }}
-  annotations:
-    agentVersion: {{ $config.agentConfig.tag }}
   labels:
 {{ include "common.labels.with.chart" $config | indent 4 }}
 spec: