Merge pull request #233 from adishaull/feature/SLK-69785

SLK-69062 Update certified operator with the new KE deployment requir…
aquasecurity · Jul 26, 2023 · 9ff7356 · 9ff7356
2 parents 5f70d4e + 8df8b4b
commit 9ff7356
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 5 deletions.
diff --git a/controllers/aquasecurity/aquastarboard/aquaStarboardHelper.go b/controllers/aquasecurity/aquastarboard/aquaStarboardHelper.go
@@ -74,6 +74,17 @@ func (enf *AquaStarboardHelper) CreateStarboardClusterRole(name string, namespac
 				"get", "list", "watch",
 			},
 		},
+		{
+			APIGroups: []string{
+				"apps.openshift.io",
+			},
+			Resources: []string{
+				"deploymentconfigs",
+			},
+			Verbs: []string{
+				"get", "list", "watch",
+			},
+		},
 		{
 			APIGroups: []string{
 				"batch",
@@ -131,7 +142,7 @@ func (enf *AquaStarboardHelper) CreateStarboardClusterRole(name string, namespac
 		},
 		{
 			APIGroups: []string{
-				"networking.k8s.io",
+				"networking.k8s.io", "extensions",
 			},
 			Resources: []string{
 				"networkpolicies", "ingresses",
@@ -573,6 +584,10 @@ func (ebf *AquaStarboardHelper) getStarboardEnvVars(cr *aquasecurityv1alpha1.Aqu
 			Name:  "OPERATOR_HEALTH_PROBE_BIND_ADDRESS",
 			Value: consts.OperatorHealthProbeBindAddress,
 		},
+		{
+			Name:  "OPERATOR_CONFIG_AUDIT_SCANNER_SCAN_ONLY_CURRENT_REVISIONS",
+			Value: "true",
+		},
 	}
 	operatorLogDevMode := corev1.EnvVar{
 		Name:  "OPERATOR_LOG_DEV_MODE",

diff --git a/controllers/operator/aquakubeenforcer/aquaKubeEnforcerHelper.go b/controllers/operator/aquakubeenforcer/aquaKubeEnforcerHelper.go
@@ -80,6 +80,17 @@ func (enf *AquaKubeEnforcerHelper) CreateKubeEnforcerClusterRole(name string, na
 				"get", "list", "watch",
 			},
 		},
+		{
+			APIGroups: []string{
+				"apps.openshift.io",
+			},
+			Resources: []string{
+				"deploymentconfigs",
+			},
+			Verbs: []string{
+				"get", "list", "watch",
+			},
+		},
 		{
 			APIGroups: []string{
 				"*",
@@ -365,6 +376,7 @@ func (enf *AquaKubeEnforcerHelper) CreateValidatingWebhook(cr, namespace, name,
 				Resources: []string{
 					"pods",
 					"deployments",
+					"deploymentconfigs",
 					"replicasets",
 					"replicationcontrollers",
 					"statefulsets",

diff --git a/docs/DeployOpenShiftOperator.md b/docs/DeployOpenShiftOperator.md
@@ -688,7 +688,7 @@ spec:
     gateway_address: 'aqua-gateway:8443'                      # Required: provide <<AQUA GW IP OR DNS: AQUA GW PORT>>
     cluster_name: Default-cluster-name                        # Required: provide your cluster name
     imagePullSecret: aqua-registry                            # Required: provide the imagePullSecret name
-    kubebench_image: 'docker.io/aquasec/kube-bench:v0.6.12'   # Optional: KubeBench image name can be replace with custom registry
+    kubebench_image: 'docker.io/aquasec/kube-bench:v0.6.17'   # Optional: KubeBench image name can be replace with custom registry
   deploy:
     service: ClusterIP
     image:

diff --git a/pkg/consts/consts.go b/pkg/consts/consts.go
@@ -85,7 +85,7 @@ const (
 	LatestVersion = "2022.4"
 
 	// StarboardVersion Latest starboard version
-	StarboardVersion = "0.15.10"
+	StarboardVersion = "0.15.13"
 
 	// CyberCenterAddress Aqua Cybercenter Address
 	CyberCenterAddress = "https://cybercenter5.aquasec.com"
@@ -164,7 +164,7 @@ const (
 
 	EnforcerConfigMapName = "aqua-csp-enforcer"
 
-	KubeBenchImageName = "docker.io/aquasec/kube-bench:v0.6.12"
+	KubeBenchImageName = "docker.io/aquasec/kube-bench:v0.6.17"
 
 	LightningEnforcerResources = `resources:
         limits:

diff --git a/test/consts/testing_consts.go b/test/consts/testing_consts.go
@@ -42,5 +42,5 @@ const (
 	ScannerToken               = ""
 	GatewayAddress             = "aqua-gateway:8443"
 	ClusterName                = "Default-cluster-name"
-	KubeBenchName              = "docker.io/aquasec/kube-bench:v0.6.12"
+	KubeBenchName              = "docker.io/aquasec/kube-bench:v0.6.17"
 )