Add deploy files

README.md

@@ -1,2 +1,23 @@
 # trivy-extractor
-Enriches trivy metric data
+
+Enriches trivy metric data with a namespace team mapping. This allows a Security team to easily identify what vulnerabilities belong to what team.
+
+# Configuration
+
+Simply add a new configmap to the k8s namespace and update the `trivyExtractor.namespacesTeamConfigMapName` value in the `values.yaml` file.
+
+
+Example config map:
+
+```
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: namespaces
+data: 
+  namespaces.csv: |
+    TEAM 1,app-1
+    TEAM 2,app-2
+    TEAM 3,app-3
+```
+

deploy/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: k8s-trivy-extractor
+description: A Helm chart to deploy the Trivy Extractor for Kubernetes
+type: application
+version: 0.1.0

deploy/templates/cm.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: namespaces
+data: 
+  namespaces.csv: |
+    team-1,app-1
+    team-2,app-2

deploy/templates/deployments.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trivy-extractor-deployment
+  labels:
+    app: trivy-extractor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: trivy-extractor
+  template:
+    metadata:
+      labels:
+        app: trivy-extractor
+    spec:
+      containers:
+      - name: trivy-extractor
+        image:  ghcr.io/{{ .Values.trivyExtractor.repository }}/trivy-extractor/trivy-extractor:{{ .Values.trivyExtractor.tag }}
+        imagePullPolicy: Always
+        command: ["/usr/bin/trivy-extractor"]
+        ports:
+        - containerPort: 2112
+        volumeMounts:
+        - name: namespaces
+          mountPath: "/data"
+          readOnly: true
+        resources:
+            requests:
+              memory: "128Mi"
+              cpu: "250m"
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+      imagePullSecrets:
+      - name: {{ .Values.trivyExtractor.imagePullSecrets }}
+      volumes:
+      - name: namespaces
+        configMap:
+          name: {{ .Values.trivyExtractor.namespacesTeamConfigMapName }}
+

deploy/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trivy-extractor
+  labels:
+    app: trivy-extractor
+spec:
+  selector:
+    app: trivy-extractor
+  ports:
+    - name: web
+      protocol: TCP
+      port: 2112
+      targetPort: 2112

deploy/templates/serviceMonitor.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: trivy-extractor
+spec:
+  selector:
+    matchLabels:
+      app: trivy-extractor
+  endpoints:
+    - interval: 15s
+      port: web
+      scrapeTimeout: 14s
+  namespaceSelector:
+    matchNames:
+      - trivy-operator

deploy/values.yaml

@@ -0,0 +1,5 @@
+trivyExtractor:
+  tag: v1.0.0
+  repository: metal-toolbox
+  namespacesTeamConfigMapName: namespaces
+  imagePullSecret: trivy-operator-image-pull-secret