Skip to content

Commit 7e4fc8a

Browse files
ozgenozgen
authored
Merge pull request #10 from ozgen/add/scan-configs-volume-for-k8s
add: scan-config volumes to the gvmd-lite deploy
2 parents b5ca773 + ca6cddd commit 7e4fc8a

10 files changed

Lines changed: 457 additions & 64 deletions

‎README.md‎

Lines changed: 37 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,26 @@ Helm chart that deploys a lightweight Greenbone stack on Kubernetes:
1414
## Prerequisites
1515

1616
### Required
17+
1718
- **Helm** (v3.x)
18-
- Verify: `helm version`
19+
- Verify: `helm version`
1920
- **helm-unittest** plugin (for unit tests)
20-
- Install: `helm plugin install https://github.com/helm-unittest/helm-unittest`
21-
- Verify: `helm plugin list | grep unittest`
21+
- Install: `helm plugin install https://github.com/helm-unittest/helm-unittest`
22+
- Verify: `helm plugin list | grep unittest`
2223

2324
### Recommended
25+
2426
- **kubeconform** (validates rendered manifests against Kubernetes schemas)
25-
- macOS (Homebrew): `brew install kubeconform`
26-
- Linux: install from GitHub releases (see CI workflow)
27-
- Verify: `kubeconform -v`
27+
- macOS (Homebrew): `brew install kubeconform`
28+
- Linux: install from GitHub releases (see CI workflow)
29+
- Verify: `kubeconform -v`
2830
- **yamlfmt** (formats / checks YAML style)
29-
- Install (Go): `go install github.com/google/yamlfmt/cmd/yamlfmt@latest`
30-
- Ensure it’s on PATH: `export PATH="$PATH:$HOME/go/bin"`
31-
- Verify: `yamlfmt -version` (or `yamlfmt --version`)
31+
- Install (Go): `go install github.com/google/yamlfmt/cmd/yamlfmt@latest`
32+
- Ensure it’s on PATH: `export PATH="$PATH:$HOME/go/bin"`
33+
- Verify: `yamlfmt -version` (or `yamlfmt --version`)
3234

33-
> Note: Helm templates under `charts/**/templates/` are **not valid YAML** until rendered, so formatting is applied only to `Chart.yaml`, `values*.yaml`, and `tests/**/*.yaml`.
35+
> Note: Helm templates under `charts/**/templates/` are **not valid YAML** until rendered, so formatting is applied only
36+
> to `Chart.yaml`, `values*.yaml`, and `tests/**/*.yaml`.
3437
3538
---
3639

@@ -41,35 +44,42 @@ This repository uses a Makefile to keep common actions consistent locally and in
4144
> Chart location: `charts/gvm-lite-stack`
4245
4346
### Format (non-template YAML only)
47+
4448
- Format files in-place:
45-
- `make fmt`
49+
- `make fmt`
4650
- Check formatting (CI-style; fails if formatting would change):
47-
- `make fmt-check`
51+
- `make fmt-check`
4852

4953
### Lint
54+
5055
- Run Helm lint:
51-
- `make lint`
56+
- `make lint`
5257

5358
### Unit tests
59+
5460
- Run Helm unit tests:
55-
- `make test`
61+
- `make test`
5662

5763
### Render manifests
64+
5865
- Render the chart to a local file:
59-
- `make render`
60-
- Output: `/tmp/gvm-lite-stack.rendered.yaml`
66+
- `make render`
67+
- Output: `/tmp/gvm-lite-stack.rendered.yaml`
6168

6269
### Schema validation (rendered output)
70+
6371
- Validate rendered manifests with kubeconform:
64-
- `make validate`
72+
- `make validate`
6573

6674
### Coverage gate (Helm template coverage)
75+
6776
- Ensure every template has at least one unit test referencing it:
68-
- `make coverage`
77+
- `make coverage`
6978

7079
### Full local check (recommended before pushing)
80+
7181
- Run everything CI expects:
72-
- `make check`
82+
- `make check`
7383

7484
---
7585

@@ -304,14 +314,14 @@ gvmdLite:
304314

305315
The chart creates the following PVCs by default:
306316

307-
| Component | Purpose | Size |
308-
|-----------------------|---------------------------| ---- |
309-
| PostgreSQL | Database storage | 8Gi |
310-
| Feed – plugins | NVT feed data | 5Gi |
311-
| Feed – notus | Notus feed data | 2Gi |
312-
| Feed – report-formats | Report format feed data | 1Gi |
313-
| Feed – logs | Feed sync logs | 1Gi |
314-
| gvmr-lite – work | Report rendering work dir | 1Gi |
317+
| Component | Purpose | Size |
318+
|------------------|------------------------------------------|------|
319+
| PostgreSQL | Database storage | 8Gi |
320+
| Feed – plugins | NVT feed data | 5Gi |
321+
| Feed – notus | Notus feed data | 2Gi |
322+
| Feed – gvm | Report format and scan configs feed data | 1Gi |
323+
| Feed – logs | Feed sync logs | 1Gi |
324+
| gvmr-lite – work | Report rendering work dir | 1Gi |
315325

316326
PVC sizes can be adjusted in `values.yaml` as needed.
317327

‎charts/gvm-lite-stack/templates/feed-deploy.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,14 @@ spec:
3434
# Logs
3535
mkdir -p /var/log/feedsync
3636
chmod 0775 /var/log/feedsync
37-
# Report Formats
37+
# gvm
3838
mkdir -p /var/lib/gvm
3939
chmod 0775 /var/lib/gvm
4040
volumeMounts:
4141
- { name: plugins, mountPath: /var/lib/openvas/plugins }
4242
- { name: notus, mountPath: /var/lib/notus }
4343
- { name: logs, mountPath: /var/log/feedsync }
44-
- { name: report-formats, mountPath: /var/lib/gvm }
44+
- { name: gvm, mountPath: /var/lib/gvm }
4545

4646
containers:
4747
- name: feed
@@ -62,7 +62,7 @@ spec:
6262
- { name: plugins, mountPath: /var/lib/openvas/plugins }
6363
- { name: notus, mountPath: /var/lib/notus }
6464
- { name: logs, mountPath: /var/log/feedsync }
65-
- { name: report-formats, mountPath: /var/lib/gvm}
65+
- { name: gvm, mountPath: /var/lib/gvm}
6666
readinessProbe:
6767
exec:
6868
command: [ "sh","-c","test -f /var/lib/openvas/plugins/.feedsync_ready" ]
@@ -82,5 +82,5 @@ spec:
8282
persistentVolumeClaim: { claimName: {{ .Values.feed.pvc.notus.name }} }
8383
- name: logs
8484
persistentVolumeClaim: { claimName: {{ .Values.feed.pvc.logs.name }} }
85-
- name: report-formats
86-
persistentVolumeClaim: { claimName: {{ .Values.feed.pvc.reportFormats.name }} }
85+
- name: gvm
86+
persistentVolumeClaim: { claimName: {{ .Values.feed.pvc.gvm.name }} }

‎charts/gvm-lite-stack/templates/gvmd-lite-deploy.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ spec:
1515
labels:
1616
app: gvmd-lite
1717
spec:
18+
securityContext:
19+
fsGroup: 999
20+
fsGroupChangePolicy: "OnRootMismatch"
1821
containers:
1922
- name: api
2023
image: "{{ .Values.gvmdLite.image.repository }}:{{ .Values.gvmdLite.image.tag }}"
@@ -63,6 +66,8 @@ spec:
6366
value: {{ .Values.gvmdLite.env.FEED_VT_METADATA_PATH | quote }}
6467
- name: FEED_SCAN_CONFIG_DIR
6568
value: {{ .Values.gvmdLite.env.FEED_SCAN_CONFIG_DIR | quote }}
69+
- name: FEED_XML_SCAN_CONFIG_DIR
70+
value: {{ .Values.gvmdLite.env.FEED_XML_SCAN_CONFIG_DIR | quote }}
6671
- name: LOG_LEVEL
6772
value: {{ .Values.gvmdLite.env.LOG_LEVEL | quote }}
6873
- name: RUNNING_ENV
@@ -201,11 +206,17 @@ spec:
201206
- name: exports
202207
mountPath: {{ .Values.gvmdLite.exports.dir }}
203208
{{- end }}
209+
# report formats from feed PVC (read-only)
210+
- name: scan-configs
211+
mountPath: /var/lib/gvm
204212

205213
volumes:
206214
- name: plugins
207215
persistentVolumeClaim:
208216
claimName: {{ default .Values.feed.pvc.plugins.name .Values.gvmdLite.pvcPluginsName }}
217+
- name: scan-configs
218+
persistentVolumeClaim:
219+
claimName: {{ .Values.feed.pvc.gvm.name }}
209220

210221
{{- if .Values.gvmrLite.enabled }}
211222
- name: exports

‎charts/gvm-lite-stack/templates/gvmr-lite-deploy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ spec:
9595
volumes:
9696
- name: report-formats
9797
persistentVolumeClaim:
98-
claimName: {{ .Values.feed.pvc.reportFormats.name }}
98+
claimName: {{ .Values.feed.pvc.gvm.name }}
9999

100100
- name: work
101101
{{- if .Values.gvmrLite.pvc.work.enabled }}

‎charts/gvm-lite-stack/templates/pvcs.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,13 @@ spec:
3434
apiVersion: v1
3535
kind: PersistentVolumeClaim
3636
metadata:
37-
name: {{ .Values.feed.pvc.reportFormats.name }}
37+
name: {{ .Values.feed.pvc.gvm.name }}
3838
namespace: {{ .Release.Namespace }}
3939
spec:
4040
accessModes: [ "ReadWriteOnce" ]
4141
resources:
4242
requests:
43-
storage: {{ .Values.feed.pvc.reportFormats.size }}
43+
storage: {{ .Values.feed.pvc.gvm.size }}
4444
---
4545
{{- if and .Values.gvmrLite.enabled .Values.gvmrLite.pvc.work.enabled }}
4646
apiVersion: v1

‎charts/gvm-lite-stack/tests/feed-deploy_test.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ tests:
6565
- contains:
6666
path: spec.template.spec.containers[0].volumeMounts
6767
content:
68-
name: report-formats
68+
name: gvm
6969
mountPath: /var/lib/gvm
7070
- it: defines PVC-backed volumes with claimNames
7171
asserts:
@@ -90,6 +90,6 @@ tests:
9090
- contains:
9191
path: spec.template.spec.volumes
9292
content:
93-
name: report-formats
93+
name: gvm
9494
persistentVolumeClaim:
95-
claimName: gvm-report-formats-pvc
95+
claimName: gvm-gvm-pvc

0 commit comments

Comments
 (0)