From 90111a122f6e22f5b840b1098b2947c53641f49d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Furkan=20T=C3=BCrkal?= Date: Sun, 7 Apr 2024 01:04:10 +0300 Subject: [PATCH] add neuvector-prometheus-exporter (#2453) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Furkan Türkal Co-authored-by: Batuahn --- .../neuvector-prometheus-exporter/README.md | 53 ++++++++++ .../config/main.tf | 19 ++++ .../config/template.apko.yaml | 15 +++ images/neuvector-prometheus-exporter/main.tf | 39 ++++++++ .../metadata.yaml | 14 +++ .../tests/main.tf | 97 +++++++++++++++++++ main.tf | 5 + 7 files changed, 242 insertions(+) create mode 100644 images/neuvector-prometheus-exporter/README.md create mode 100644 images/neuvector-prometheus-exporter/config/main.tf create mode 100644 images/neuvector-prometheus-exporter/config/template.apko.yaml create mode 100644 images/neuvector-prometheus-exporter/main.tf create mode 100644 images/neuvector-prometheus-exporter/metadata.yaml create mode 100644 images/neuvector-prometheus-exporter/tests/main.tf diff --git a/images/neuvector-prometheus-exporter/README.md b/images/neuvector-prometheus-exporter/README.md new file mode 100644 index 0000000000..f86eb73bfc --- /dev/null +++ b/images/neuvector-prometheus-exporter/README.md @@ -0,0 +1,53 @@ + +# neuvector-prometheus-exporter +| | | +| - | - | +| **OCI Reference** | `cgr.dev/chainguard/neuvector-prometheus-exporter` | + + +* [View Image in Chainguard Academy](https://edu.chainguard.dev/chainguard/chainguard-images/reference/neuvector-prometheus-exporter/overview/) +* [View Image Catalog](https://console.enforce.dev/images/catalog) for a full list of available tags. +* [Contact Chainguard](https://www.chainguard.dev/chainguard-images) for enterprise support, SLAs, and access to older tags.* + +--- + + + +Prometheus exporter and Grafana template for NeuVector container security platform. + + + +## Download this Image +The image is available on `cgr.dev`: + +``` +docker pull cgr.dev/chainguard/neuvector-prometheus-exporter:latest +``` + + + +## Usage + +Add the NeuVector Helm repository to your repositories list: + +```shell +helm repo add neuvector https://neuvector.github.io/neuvector-helm/ +helm repo update +``` + +Next, install the NeuVector Prometheus Exporter with the following command: + +```sh +helm install neuvector-prometheus-exporter neuvector/monitor \ + --namespace neuvector \ + --create-namespace \ + --set exporter.apiSvc=neuvector-svc-controller:10443 \ + --set exporter.image.repository=cgr.dev/chainguard/neuvector-prometheus-exporter \ + --set exporter.image.tag= +``` + +Jump to the official [Helm Chart](https://github.com/neuvector/neuvector-helm/blob/master/charts/monitor/README.md) for more detailed usage. + +P.S: The Exporter will not work without the NeuVector Core Service. Install the [neuvector/core](https://github.com/neuvector/neuvector-helm/tree/master/charts/core) first. + + diff --git a/images/neuvector-prometheus-exporter/config/main.tf b/images/neuvector-prometheus-exporter/config/main.tf new file mode 100644 index 0000000000..ada624af1d --- /dev/null +++ b/images/neuvector-prometheus-exporter/config/main.tf @@ -0,0 +1,19 @@ +terraform { + required_providers { + apko = { source = "chainguard-dev/apko" } + } +} + +variable "extra_packages" { + description = "The additional packages to install" + default = ["neuvector-prometheus-exporter"] +} + +data "apko_config" "this" { + config_contents = file("${path.module}/template.apko.yaml") + extra_packages = var.extra_packages +} + +output "config" { + value = jsonencode(data.apko_config.this.config) +} diff --git a/images/neuvector-prometheus-exporter/config/template.apko.yaml b/images/neuvector-prometheus-exporter/config/template.apko.yaml new file mode 100644 index 0000000000..7f928818fd --- /dev/null +++ b/images/neuvector-prometheus-exporter/config/template.apko.yaml @@ -0,0 +1,15 @@ +contents: + packages: + +accounts: + groups: + - groupname: nonroot + gid: 65532 + users: + - username: nonroot + uid: 65532 + gid: 65532 + run-as: 65532 + +entrypoint: + command: python3 /usr/bin/nv_exporter.py diff --git a/images/neuvector-prometheus-exporter/main.tf b/images/neuvector-prometheus-exporter/main.tf new file mode 100644 index 0000000000..38db5806fa --- /dev/null +++ b/images/neuvector-prometheus-exporter/main.tf @@ -0,0 +1,39 @@ +terraform { + required_providers { + oci = { source = "chainguard-dev/oci" } + } +} + +variable "target_repository" { + description = "The docker repo into which the image and attestations should be published." +} + +module "config" { source = "./config" } + +module "neuvector-prometheus-exporter" { + source = "../../tflib/publisher" + name = basename(path.module) + target_repository = var.target_repository + config = module.config.config + + build-dev = true + +} + +module "test" { + source = "./tests" + digest = module.neuvector-prometheus-exporter.image_ref +} + +resource "oci_tag" "latest" { + depends_on = [module.test] + digest_ref = module.neuvector-prometheus-exporter.image_ref + tag = "latest" +} + +resource "oci_tag" "latest-dev" { + depends_on = [module.test] + digest_ref = module.neuvector-prometheus-exporter.dev_ref + tag = "latest-dev" +} + diff --git a/images/neuvector-prometheus-exporter/metadata.yaml b/images/neuvector-prometheus-exporter/metadata.yaml new file mode 100644 index 0000000000..1ed2f865e9 --- /dev/null +++ b/images/neuvector-prometheus-exporter/metadata.yaml @@ -0,0 +1,14 @@ +name: neuvector-prometheus-exporter +image: cgr.dev/chainguard/neuvector-prometheus-exporter +logo: https://storage.googleapis.com/chainguard-academy/logos/neuvector-prometheus-exporter.svg +endoflife: "" +console_summary: "" +short_description: Prometheus exporter and Grafana template for NeuVector container security platform. +compatibility_notes: "" +readme_file: README.md +upstream_url: https://github.com/neuvector/prometheus-exporter +keywords: + - application + - prometheus + - grafana + - neuvector diff --git a/images/neuvector-prometheus-exporter/tests/main.tf b/images/neuvector-prometheus-exporter/tests/main.tf new file mode 100644 index 0000000000..2e9340ad30 --- /dev/null +++ b/images/neuvector-prometheus-exporter/tests/main.tf @@ -0,0 +1,97 @@ +terraform { + required_providers { + oci = { source = "chainguard-dev/oci" } + imagetest = { source = "chainguard-dev/imagetest" } + } +} + +variable "digest" { + description = "The image digest to run tests over." +} + +data "oci_string" "ref" { input = var.digest } + +data "imagetest_inventory" "this" {} + +resource "random_pet" "suffix" {} + +module "helm-neuvector" { + source = "../../../tflib/imagetest/helm" + + name = "neuvector-core-${random_pet.suffix.id}" + namespace = "neuvector" + repo = "https://neuvector.github.io/neuvector-helm" + chart = "core" +} + +module "helm" { + source = "../../../tflib/imagetest/helm" + + name = "neuvector-prometheus-exporter-${random_pet.suffix.id}" + namespace = "neuvector" + repo = "https://neuvector.github.io/neuvector-helm" + chart = "monitor" + + values = { + exporter = { + apiSvc = "neuvector-svc-controller:10443" + } + } +} + +resource "imagetest_harness_k3s" "this" { + name = "neuvector-prometheus-exporter" + inventory = data.imagetest_inventory.this +} + +resource "imagetest_feature" "basic" { + harness = imagetest_harness_k3s.this + name = "Basic" + description = "Basic functionality of neuvector-prometheus-exporter." + + steps = [ + { + name = "Helm install neuvector dependency" + cmd = module.helm-neuvector.install_cmd + }, + { + name = "Helm install" + cmd = module.helm.install_cmd + }, + + { + name = "Set image" + cmd = <