terraform-ibm-modules / terraform-ibm-scc-workload-protection-agent

A module that supports deploying the Security and Compliance Center Workload Protection agent
Apache License 2.0
0 stars 1 forks source link

Feat: Add admission controller #189

Open ctolon22 opened 1 month ago

ctolon22 commented 1 month ago

Description

Add support for installing SCC-WP Admission Controller:

It's disabled by default

It requires adding Sysdig API Token when used.

Release required?

Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

For mergers

ctolon22 commented 1 month ago

Left some comments - is there a reason why we would not enable the admission controller by default?

As it requires the API Token, I would like to reduce what customers need to introduce and only use it if they actually want it. When moving to cluster-shield / host-shield later this year, we'll enable it by default as the Token requirement will not be necessary anymore

Fixing now the rest of comments

ocofaigh commented 1 month ago

/run pipeline

ocofaigh commented 1 month ago

@ctolon22 Test failed with this:

│ Error: Missing required argument
│ 
│   with module.scc_wp_agent.helm_release.scc_wp_agent,
│   on ../../main.tf line 36, in resource "helm_release" "scc_wp_agent":
│   36: resource "helm_release" "scc_wp_agent" {
│ 
│ The argument "set.40.value" is required, but no definition was found.
╵}
ocofaigh commented 1 month ago

@ctolon22 we probably also want to update the example that the test runs to actually deploy the admission controller so that we test it in PRs