title	secreCodeBox Operator
category	core
type	Operator
state	released
appVersion
usecase	secureCodeBox Operator is the core component.

What is secureCodeBox Operator?

The secureCodeBox operator is running on Kubernetes and is the core component of the complete secureCodeBox stack, responsible for managing all scans and resources.

Homepage: https://www.securecodebox.io/docs/getting-started/installation

Deployment

The operator chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)
helm upgrade --install operator oci://ghcr.io/securecodebox/helm/operator

Requirements

Kubernetes: >=v1.11.0-0

Deployment

The secureCodeBox Operator can be deployed via helm:

# Create a new namespace for the secureCodeBox Operator
kubectl create namespace securecodebox-system
# Install the Operator & CRDs
helm install securecodebox-operator oci://ghcr.io/securecodebox/helm/operator

Values

Key	Type	Default	Description
allowIstioSidecarInjectionInJobs	bool	false	Sets the value of the istio sidecar annotation ("sidecar.istio.io/inject") for jobs started by the operator (scans, parser and hooks). defaults to false to prevent jobs hanging indefinitely due to the sidecar never terminating. If you aren't using istio this setting/annotation has no effect.
clusterDomain	string	"cluster.local"	The cluster domain to use when building the in-cluster Garage endpoint (<release>-garage.<namespace>.svc.<clusterDomain>). Override this if your cluster uses a custom domain instead of the Kubernetes default cluster.local.
customCACertificate	object	{"certificate":"public.crt","existingCertificate":null}	Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurker, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s)
customCACertificate.certificate	string	"public.crt"	key in the configmap holding the certificate(s)
customCACertificate.existingCertificate	string	nil	name of the configMap holding the ca certificate(s), needs to be the same across all namespaces
extraVolumeMounts	list	[]	Additional volume mounts to be mounted to the operator deployment
extraVolumes	list	[]	Additional volumes to be mounted to the operator deployment
garage	object	{"auth":{"accessKey":"","adminToken":"","existingSecret":"","rpcSecret":"","secretKey":""},"defaultBucket":"securecodebox","enabled":true,"image":{"pullPolicy":"IfNotPresent","repository":"docker.io/dxflrs/garage","tag":"v2.3.0"},"persistence":{"size":"10Gi","storageClass":""},"podSecurityContext":{"fsGroup":1000,"runAsGroup":1000,"runAsUser":1000},"resources":{"limits":{"cpu":"500m","ephemeral-storage":"1Gi","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}}}	Garage configuration for direct deployment (S3-compatible quickstart storage backend). This replaces the previous minio configuration section; if your values file still sets minio.enabled: false, it will still be honored and disable Garage as well.
garage.auth	object	{"accessKey":"","adminToken":"","existingSecret":"","rpcSecret":"","secretKey":""}	Authentication configuration
garage.auth.accessKey	string	""	Default access key (leave empty to generate a secure random one)
garage.auth.adminToken	string	""	Garage admin API token (leave empty to generate a secure random one). Not used for anything outside the pod on a single-node deployment.
garage.auth.existingSecret	string	""	Name of existing secret containing garage credentials (if set, auth.accessKey, auth.secretKey, auth.rpcSecret and auth.adminToken are ignored)
garage.auth.rpcSecret	string	""	Garage inter-node RPC secret, must be exactly 64 hex characters (leave empty to generate a secure random one). Not used for anything outside the pod on a single-node deployment.
garage.auth.secretKey	string	""	Default secret key (leave empty to generate a secure random one)
garage.defaultBucket	string	"securecodebox"	Default bucket to create on startup
garage.enabled	bool	true	Enable this to use Garage as storage backend instead of a cloud bucket provider like AWS S3, Google Cloud Storage, DigitalOcean Spaces etc.
garage.image	object	{"pullPolicy":"IfNotPresent","repository":"docker.io/dxflrs/garage","tag":"v2.3.0"}	Garage image configuration
garage.persistence	object	{"size":"10Gi","storageClass":""}	Persistence configuration
garage.persistence.size	string	"10Gi"	Size of the persistent volume
garage.persistence.storageClass	string	""	Storage class for garage data persistence
garage.podSecurityContext	object	{"fsGroup":1000,"runAsGroup":1000,"runAsUser":1000}	Pod security context for garage
garage.resources	object	{"limits":{"cpu":"500m","ephemeral-storage":"1Gi","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}	Resource limits and requests for garage
garage.securityContext	object	{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}}	Container security context for garage
image.pullPolicy	string	"IfNotPresent"	Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
image.repository	string	"docker.io/securecodebox/operator"	The operator image repository
image.tag	string	defaults to the charts version	Parser image tag
imagePullSecrets	list	[]	Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/)
lurker.image.pullPolicy	string	"IfNotPresent"	Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
lurker.image.repository	string	"docker.io/securecodebox/lurker"	The operator image repository
lurker.image.tag	string	defaults to the charts version	Parser image tag
metrics	object	{"serviceMonitor":{"enabled":false}}	Configuration for the metrics the operator exports
metrics.serviceMonitor.enabled	bool	false	Creates a prometheus operator ServiceMonitor rule to automatically scrape the operators metrics: https://github.com/prometheus-operator/prometheus-operator
nodeSelector	object	{}
podSecurityContext	object	{}	Sets the securityContext on the operators pod level. See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
presignedUrlExpirationTimes	object	{"hooks":"1h","parsers":"1h","scanners":"12h"}	Duration how long presigned urls are valid
probes	object	{"liveness":{"httpGet":{"path":"/healthz","port":"healthchecks"},"initialDelaySeconds":15,"periodSeconds":20},"readiness":{"httpGet":{"path":"/readyz","port":"healthchecks"},"initialDelaySeconds":5,"periodSeconds":10}}	Health and liveness probe configuration for the controller manager
probes.liveness	object	{"httpGet":{"path":"/healthz","port":"healthchecks"},"initialDelaySeconds":15,"periodSeconds":20}	Liveness probe configuration
probes.readiness	object	{"httpGet":{"path":"/readyz","port":"healthchecks"},"initialDelaySeconds":5,"periodSeconds":10}	Readiness probe configuration
resources	object	{"limits":{"cpu":"250m","memory":"100Mi"},"requests":{"cpu":"100m","memory":"50Mi"}}	CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
s3.authType	string	"access-secret-key"	Authentication method. Supports access-secret-key (used by most s3 endpoints) and `aws-iam`` (Used by AWS EKS IAM Role to Kubernetes Service Account Binding (IRSA) and EKS Pod Identity Authentication. Support for AWS IRSA is considered experimental in the secureCodeBox)
s3.awsStsEndpoint	string	"https://sts.amazonaws.com"	STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-iam". Usually not required, even in IRSA or Pod Identity setups as the region gets injected by AWS into the pod.
s3.bucket	string	"my-bucket"
s3.enabled	bool	false
s3.endpoint	string	"fra1.digitaloceanspaces.com"
s3.keySecret	string	"my-secret"
s3.port	string	nil
s3.secretAttributeNames.accesskey	string	"accesskey"
s3.secretAttributeNames.secretkey	string	"secretkey"
s3.tls.enabled	bool	true
s3.urlTemplate	string	scan-{{ .Scan.UID }}/{{ .Filename }}	Go Template that generates the path used to store raw result file and findings.json file in the s3 bucket. Can be used to store the files in a subfolder of the s3 bucket
securityContext	object	{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}	Sets the securityContext on the operators container level. See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
securityContext.allowPrivilegeEscalation	bool	false	Ensure that users privileges cannot be escalated
securityContext.capabilities.drop[0]	string	"ALL"	This drops all linux privileges from the operator container. They are not required
securityContext.privileged	bool	false	Ensures that the operator container is not run in privileged mode
securityContext.readOnlyRootFilesystem	bool	true	Prevents write access to the containers file system
securityContext.runAsNonRoot	bool	true	Enforces that the Operator image is run as a non root user
securityContext.seccompProfile.type	string	"RuntimeDefault"	one of RuntimeDefault, Unconfined, Localhost To disable seccompProfile, set to Unconfined. See: https://kubernetes.io/docs/tutorials/security/seccomp/
serviceAccount.annotations	object	{}	Annotations of the serviceAccount the operator uses to talk to the k8s api
serviceAccount.labels	object	{}	Labels of the serviceAccount the operator uses to talk to the k8s api
serviceAccount.name	string	"securecodebox-operator"	Name of the serviceAccount the operator uses to talk to the k8s api

License

Code of secureCodeBox is licensed under the Apache License 2.0.