feat/scorecard certifier

charts/guac/Chart.yaml

@@ -9,7 +9,7 @@ maintainers:
     email: guac-info@kusari.dev
 
 type: application
-version: 0.6.2
+version: 0.7.0
 appVersion: "v0.14.0"
 
 dependencies:

charts/guac/templates/scorecard-certifier-deployment.yaml

@@ -0,0 +1,90 @@
+# Copyright Kusari, Inc. and GUAC contributors
+# Licensed under the MIT license. See LICENSE file in the project root for details.
+{{ if .Values.guac.scorecardCertifier.enabled }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.guac.scorecardCertifier.name }}
+{{- if .Values.guac.scorecardCertifier.annotations }}
+  annotations:
+{{ toYaml .Values.guac.scorecardCertifier.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "guac.labels" . | nindent 4 }}
+    app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }}
+    app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }}
+spec:
+  replicas:  {{ .Values.guac.scorecardCertifier.replicas }}
+  selector:
+    matchLabels:
+      {{- include "guac.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }}
+      app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }}
+  template:
+    metadata:
+      labels:
+        {{- include "guac.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }}
+        app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }}
+    spec:
+      serviceAccountName: {{ .Values.guac.scorecardCertifier.name }}
+      containers:
+      - name: {{ .Values.guac.scorecardCertifier.name }}
+        {{- if .Values.guac.guacImage.digest }}
+        image: "{{ .Values.guac.guacImage.repository }}@{{ .Values.guac.guacImage.digest }}"
+        {{- else }}
+        image: "{{ .Values.guac.guacImage.repository }}:{{ .Values.guac.guacImage.tag | default .Chart.AppVersion}}"
+        {{- end }}
+        imagePullPolicy: "{{ .Values.guac.guacImage.pullPolicy }}"
+        command:
+{{ toYaml .Values.guac.scorecardCertifier.image.command | indent 10 }}
+        workingDir: {{ .Values.guac.guacImage.workingDir }}
+{{- if .Values.guac.scorecardCertifier.ports }}
+        ports:
+{{ toYaml .Values.guac.scorecardCertifier.image.ports | indent 10 }}
+{{- end }}
+{{- if .Values.guac.scorecardCertifier.resources }}
+        resources: {{- toYaml .Values.guac.scorecardCertifier.resources | nindent 10 }}
+{{- end }}
+
+        volumeMounts:
+          - name: guac-config
+            mountPath: {{ .Values.guac.guacImage.workingDir }}
+            readOnly: true
+
+{{- if or .Values.guac.common.env .Values.guac.scorecardCertifier.env }}
+        env:
+{{- if .Values.guac.common.env }}
+{{ toYaml .Values.guac.common.env | indent 10 }}
+{{- end }}
+{{- if .Values.guac.scorecardCertifier.env }}
+{{ toYaml .Values.guac.scorecardCertifier.env | indent 10 }}
+{{- end }}
+{{- end }}
+
+{{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+{{- end }}
+      volumes:
+        - name: guac-config
+          configMap:
+            name: guac-cm
+{{- if .Values.guac.scorecardCertifier.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.guac.scorecardCertifier.nodeSelector | indent 8 }}
+{{- end }}
+
+{{- if or .Values.guac.common.tolerations .Values.guac.scorecardCertifier.tolerations }}
+      tolerations:
+{{- if .Values.guac.common.tolerations }}
+{{ toYaml .Values.guac.common.tolerations | indent 8 }}
+{{- end }}
+{{- if .Values.guac.scorecardCertifier.tolerations }}
+{{ toYaml .Values.guac.scorecardCertifier.tolerations | indent 8 }}
+{{- end }}
+{{- end }}
+
+
+{{- end }}

charts/guac/templates/scorecard-certifier-sa.yaml

@@ -0,0 +1,19 @@
+# Copyright Kusari, Inc. and GUAC contributors
+# Licensed under the MIT license. See LICENSE file in the project root for details.
+{{ if .Values.guac.scorecardCertifier.enabled }}
+{{ if .Values.guac.scorecardCertifier.serviceAccount.create }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.guac.scorecardCertifier.name }}
+{{- if .Values.guac.scorecardCertifier.annotations }}
+  annotations:
+{{ toYaml .Values.guac.scorecardCertifier.serviceAccount.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "guac.labels" . | nindent 4 }}
+    app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }}
+    app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }}
+{{- end }}
+{{- end }}

charts/guac/tests/scorecard-certifier_deployment_test.yaml

@@ -0,0 +1,92 @@
+# Copyright Kusari, Inc. and GUAC contributors
+# Licensed under the MIT license. See LICENSE file in the project root for details.
+suite: Scorecard Certifier Deployment tests
+templates:
+  - scorecard-certifier-deployment.yaml
+
+tests:
+  - it: deployment should render
+    values:
+      - ./values_digest_and_tag.yaml
+    asserts:
+      - isKind:
+          of: Deployment
+      - hasDocuments:
+          count: 1
+
+  - it: should run the scorecardCertifier image
+    values:
+      - ./values_digest_and_tag.yaml
+    asserts:
+      - equal:
+          path:  spec.template.spec.containers[0].name
+          value: scorecard-certifier 
+      - equal:
+          path:  spec.template.spec.containers[0].image
+          value:  ghcr.io/guacsec/guac@sha256:167e823f36e268f66b12a79d4c4b39df23c2f87847817c161b6c6ddbc9ee5c4e
+
+  - it: should run the scorecardCertifier sub command
+    values:
+      - ./values_digest_and_tag.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].command[0]
+          value: "sh"
+      - equal:
+          path: spec.template.spec.containers[0].command[1]
+          value: "-c"
+      - equal:
+          path: spec.template.spec.containers[0].command[2]
+          value: "/opt/guac/guaccollect scorecard"
+
+  - it: should respect spec level parameters
+    values:
+      - ./values_digest_and_tag.yaml
+    asserts:
+      - equal:
+          path:  spec.replicas
+          value:  1
+      - equal:
+          path:  spec.selector.matchLabels["app.kubernetes.io/name"]
+          value: scorecard-certifier 
+      - equal:
+          path:  spec.template.metadata.labels["app.kubernetes.io/name"]
+          value: scorecard-certifier 
+
+  - it: should use tag if only tag is specified
+    values:
+      - ./values_tag_no_digest.yaml
+    asserts:
+      - equal:
+          path:  spec.template.spec.containers[0].image
+          value:  ghcr.io/guacsec/guac:latest
+
+  - it: should include tolerations
+    values:
+      - ./values_combine.yaml
+    asserts:
+      - equal:
+          path:  spec.template.spec.tolerations[0].key
+          value: "kusari.cloud/common"
+      - equal:
+          path:  spec.template.spec.tolerations[0].value
+          value: common
+      - equal:
+          path:  spec.template.spec.tolerations[0].effect
+          value: NoSchedule
+      - equal:
+          path:  spec.template.spec.tolerations[0].operator
+          value: Equal
+
+      - equal:
+          path:  spec.template.spec.tolerations[1].key
+          value: "kusari.cloud/own"
+      - equal:
+          path:  spec.template.spec.tolerations[1].value
+          value: own
+      - equal:
+          path:  spec.template.spec.tolerations[1].effect
+          value: NoSchedule
+      - equal:
+          path:  spec.template.spec.tolerations[1].operator
+          value: Equal

charts/guac/tests/serviceaccount_all_test.yaml

@@ -9,6 +9,7 @@ templates:
   - ingestor-sa.yaml
   - oci-collector-sa.yaml
   - osv-certifier-sa.yaml
+  - scorecard-certifier-sa.yaml
 
 tests:
   - it: should not create service account

charts/guac/tests/values_combine.yaml

@@ -71,3 +71,11 @@ guac:
         key: kusari.cloud/own
         operator: Equal
         value: own
+
+  scorecardCertifier:
+    enabled: true
+    tolerations:        
+      - effect: NoSchedule
+        key: kusari.cloud/own
+        operator: Equal
+        value: own

charts/guac/tests/values_digest_and_tag.yaml

@@ -6,7 +6,8 @@ imagePullSecrets:
 guac:
   guacImage:
     repository: ghcr.io/guacsec/guac
-    tag: "latest"
+    tag: "v0.1.1"
+    # digest corresponds to guac v0.1.1
     digest: "sha256:167e823f36e268f66b12a79d4c4b39df23c2f87847817c161b6c6ddbc9ee5c4e"
     workingDir: /guac
 
@@ -31,3 +32,7 @@ guac:
 
   ingestor:
     name: ingestor
+
+  scorecardCertifier:
+    enabled: true
+    name: scorecard-certifier

charts/guac/tests/values_serviceaccount_all.yaml

@@ -37,3 +37,8 @@ guac:
   visualizer:
     serviceAccount:
       create: true
+
+  scorecardCertifier:
+    enabled: true
+    serviceAccount:
+      create: true

charts/guac/tests/values_tag_no_digest.yaml

@@ -31,3 +31,7 @@ guac:
 
   graphqlServer:
     name: graphql-server
+
+  scorecardCertifier:
+    enabled: true
+    name: scorecard-certifier

charts/guac/values.yaml

@@ -66,6 +66,17 @@ imagePullSecrets:
 ## @param guac.cdCertifier.serviceAccount.create - whether to create cdCertifier service account
 ## @param guac.cdCertifier.serviceAccount.annotations - CD Certifier service account annotations
 ## @param guac.cdCertifier.resources - [map] resource requests or limits of the cd Certifier deployment
+## @param guac.scorecardCertifier.enabled String Whether to deploy Scorecard Certifier
+## @param guac.scorecardCertifier.name String Name of the Scorecard Certifier component.
+## @param guac.scorecardCertifier.annotations.reloader.stakater.com/auto [string] Boolean for deploying [stakater/Reloader] (https://github.com/stakater/Reloader)
+## @param guac.scorecardCertifier.replicas Number of replicas for Scorecard Certifier deployment
+## @param guac.scorecardCertifier.image.command Command for the Scorecard Certifier image.  It is not recommended to override this.
+## @param guac.scorecardCertifier.env Environment variables for Scorecard Certifier. Note: GITHUB_AUTH_TOKEN is required and should be provided via secretKeyRef.
+## @param guac.scorecardCertifier.nodeSelector - sets the node selector for where to run the deployment
+## @param guac.scorecardCertifier.tolerations
+## @param guac.scorecardCertifier.serviceAccount.create - whether to create scorecardCertifier service account
+## @param guac.scorecardCertifier.serviceAccount.annotations - Scorecard Certifier service account annotations
+## @param guac.scorecardCertifier.resources - [map] resource requests or limits of the Scorecard Certifier deployment
 ## @param guac.ingestor.enabled String Whether to deploy Ingestor
 ## @param guac.ingestor.name String Name of the ingestor component.
 ## @param guac.ingestor.annotations.reloader.stakater.com/auto [string] Boolean for deploying [stakater/Reloader] (https://github.com/stakater/Reloader)
@@ -272,6 +283,34 @@ guac:
     #     cpu: "0.25"
     #     memory: "0.5G"
 
+  scorecardCertifier:
+    enabled: false
+    name: scorecard-certifier
+    annotations:
+      reloader.stakater.com/auto: "true"
+    replicas: 1
+    image:
+      command: ['sh', '-c', '/opt/guac/guaccollect scorecard']
+    # GITHUB_AUTH_TOKEN is required for scorecard certifier to fetch scorecards from GitHub
+    # Users should create a Kubernetes secret with their GitHub token and reference it here
+    # Example:
+    # kubectl create secret generic github-token --from-literal=token=<your-github-token>
+    env:
+      - name: GITHUB_AUTH_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: github-token
+            key: token
+    nodeSelector: {}
+    tolerations: []
+    serviceAccount:
+      create: true
+      annotations: {}
+    resources: {}
+    #   requests:
+    #     cpu: "0.25"
+    #     memory: "0.5G"
+
   ingestor:
     enabled: true
     name: ingestor