template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: configuration-anomaly-detection-template
parameters:
- name: IMAGE_TAG
  value: v0.0.0
- name: REGISTRY_IMG
  value: quay.io/app-sre/configuration-anomaly-detection
- name: NAMESPACE_NAME
  value: configuration-anomaly-detection
- name: CAD_EXPERIMENTAL_ENABLED
  value: "FALSE"
- name: LOG_LEVEL
  value: info
- name: TEKTON_RESOURCE_PRUNER_IMAGE
  value: quay.io/openshift-pipeline/openshift-pipelines-pipelines-cli-tkn-rhel8
- name: TEKTON_RESOURCE_PRUNER_SHA
objects:
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: cad-interceptor-deployment
  spec:
    replicas: 2
    selector:
      matchLabels:
        app: cad-interceptor
    template:
      metadata:
        labels:
          app: cad-interceptor
      spec:
        containers:
        - args:
          - interceptor
          command:
          - /bin/bash
          - -c
          env:
          - name: CAD_EXPERIMENTAL_ENABLED
            value: ${CAD_EXPERIMENTAL_ENABLED}
          - name: LOG_LEVEL
            value: ${LOG_LEVEL}
          envFrom:
          - secretRef:
              name: cad-pd-token
          image: ${REGISTRY_IMG}:${IMAGE_TAG}
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          name: cad-interceptor
          ports:
          - containerPort: 8080
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            limits:
              cpu: 100m
              memory: 500Mi
            requests:
              cpu: 10m
              memory: 100Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
            seccompProfile:
              type: RuntimeDefault
        restartPolicy: Always
        serviceAccountName: pipeline
        terminationGracePeriodSeconds: 30
- apiVersion: v1
  kind: Service
  metadata:
    name: cad-interceptor-service
    labels:
      app: configuration-anomaly-detection
  spec:
    ports:
    - name: web
      port: 8080
      protocol: TCP
      targetPort: 8080
    selector:
      app: cad-interceptor
    type: ClusterIP
- apiVersion: triggers.tekton.dev/v1alpha1
  kind: Interceptor
  metadata:
    name: cad-interceptor
  spec:
    clientConfig:
      service:
        name: cad-interceptor-service
        namespace: ${NAMESPACE_NAME}
        port: 8080
- apiVersion: triggers.tekton.dev/v1beta1
  kind: TriggerBinding
  metadata:
    name: cad-check-trigger
  spec:
    params:
    - name: payload
      value: $(body)
- apiVersion: triggers.tekton.dev/v1alpha1
  kind: TriggerTemplate
  metadata:
    annotations:
      triggers.tekton.dev/old-escape-quotes: "true"
    name: cad-check-trigger-template
  spec:
    params:
    - description: The event that triggered the webhook.
      name: payload
    resourcetemplates:
    - apiVersion: tekton.dev/v1beta1
      kind: PipelineRun
      metadata:
        name: cad-check-$(uid)
      spec:
        params:
        - name: payload
          value: $(tt.params.payload)
        pipelineRef:
          name: cad-checks-pipeline
        serviceAccountName: cad-sa
        taskRunSpecs:
        - computeResources:
            limits:
              cpu: 500m
              memory: 256Mi
            requests:
              cpu: 100m
              memory: 64Mi
          pipelineTaskName: perform-cad-checks
        timeout: 30m
- apiVersion: triggers.tekton.dev/v1beta1
  kind: Trigger
  metadata:
    name: cad-pipe-listener
  spec:
    bindings:
    - ref: cad-check-trigger
    interceptors:
    - ref:
        kind: NamespacedInterceptor
        name: cad-interceptor
    template:
      ref: cad-check-trigger-template
- apiVersion: triggers.tekton.dev/v1alpha1
  kind: EventListener
  metadata:
    annotations:
      triggers.tekton.dev/old-escape-quotes: "true"
    name: cad-event-listener
  spec:
    resources:
      kubernetesResource:
        spec:
          template:
            spec:
              containers:
              - env:
                - name: TLS_CERT
                  valueFrom:
                    secretKeyRef:
                      key: tls.crt
                      name: cad-event-listener-tls-secret
                - name: TLS_KEY
                  valueFrom:
                    secretKeyRef:
                      key: tls.key
                      name: cad-event-listener-tls-secret
                resources:
                  limits:
                    cpu: 500m
                    memory: 256Mi
                  requests:
                    cpu: 100m
                    memory: 64Mi
    triggers:
    - triggerRef: cad-pipe-listener
- apiVersion: tekton.dev/v1beta1
  kind: Pipeline
  metadata:
    name: cad-checks-pipeline
  spec:
    params:
    - description: Json string of the event data
      name: payload
      type: string
    tasks:
    - name: perform-cad-checks
      params:
      - name: payload
        value: $(params.payload)
      - name: pipeline-name
        value: $(context.pipelineRun.name)
      taskRef:
        name: cad-checks
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pipelinerun-counts
  spec:
    hard:
      count/pipelineruns.tekton.dev: "1000"
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: cad-sa
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: cad-pipelinerun-role
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    - secrets
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - tekton.dev
    resources:
    - pipelineruns
    verbs:
    - create
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: cad-pipelinerun-rolebinding
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: cad-pipelinerun-role
  subjects:
  - kind: ServiceAccount
    name: cad-sa
- apiVersion: v1
  kind: Secret
  metadata:
    name: cad-backplane-secret
  stringData:
    BACKPLANE_INITIAL_ARN: CHANGEME
    BACKPLANE_URL: CHANGEME
  type: Opaque
- apiVersion: v1
  kind: Secret
  metadata:
    name: cad-ocm-client-secret
  stringData:
    CAD_OCM_CLIENT_ID: CHANGEME
    CAD_OCM_CLIENT_SECRET: CHANGEME
    CAD_OCM_URL: https://api.stage.openshift.com
  type: Opaque
- apiVersion: tekton.dev/v1beta1
  kind: Task
  metadata:
    name: cad-checks
  spec:
    params:
    - description: Json string of the event data
      name: payload
      type: string
    - description: The pipelinerun name
      name: pipeline-name
      type: string
    steps:
    - args:
      - |-
        # save the payload to a file
        folder=$(mktemp -d)
        file=${folder}/payload.json
        cat << EOF > $file
        $(params.payload)
        EOF
        # run the cadctl command
        PIPELINE_NAME=$(params.pipeline-name) cadctl investigate --payload-path $file
      command:
      - /bin/bash
      - -c
      env:
      - name: CAD_PROMETHEUS_PUSHGATEWAY
        value: aggregation-pushgateway:9091
      - name: CAD_EXPERIMENTAL_ENABLED
        value: ${CAD_EXPERIMENTAL_ENABLED}
      - name: LOG_LEVEL
        value: ${LOG_LEVEL}
      - name: CAD_HCM_AI_TOKEN
        valueFrom:
          secretKeyRef:
            key: token
            name: srep-ai-sa-token
      envFrom:
      - secretRef:
          name: cad-ocm-client-secret
      - secretRef:
          name: cad-pd-token
      - secretRef:
          name: cad-backplane-secret
      image: ${REGISTRY_IMG}:${IMAGE_TAG}
      name: check-infrastructure
      resources:
        limits:
          cpu: 100m
          memory: 256Mi
        requests:
          cpu: 10m
          memory: 64Mi
- apiVersion: batch/v1
  kind: CronJob
  metadata:
    labels:
      tektonconfig.operator.tekton.dev/pruner: "true"
    name: tekton-resource-pruner
  spec:
    concurrencyPolicy: Forbid
    failedJobsHistoryLimit: 1
    jobTemplate:
      spec:
        backoffLimit: 3
        template:
          spec:
            containers:
            - args:
              - tkn pipelinerun delete --keep=100 -f
              command:
              - /bin/sh
              - -c
              image: ${TEKTON_RESOURCE_PRUNER_IMAGE}@${TEKTON_RESOURCE_PRUNER_SHA}
              imagePullPolicy: IfNotPresent
              name: tekton-resource-pruner
              resources:
                limits:
                  cpu: 500m
                  memory: 256Mi
                requests:
                  cpu: 100m
                  memory: 64Mi
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: FallbackToLogsOnError
            dnsPolicy: ClusterFirst
            restartPolicy: Never
            schedulerName: default-scheduler
            serviceAccount: cad-tekton-pruner
            serviceAccountName: cad-tekton-pruner
            terminationGracePeriodSeconds: 30
        ttlSecondsAfterFinished: 3600
    schedule: 0 * * * *
    successfulJobsHistoryLimit: 3
    suspend: false
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: cad-tekton-pruner
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: cad-tekton-pruner-role
  rules:
  - apiGroups:
    - ""
    resources:
    - pods
    verbs:
    - delete
    - get
    - watch
    - list
  - apiGroups:
    - tekton.dev
    resources:
    - pipelineruns
    - taskruns
    verbs:
    - delete
    - list
    - get
    - watch
  - apiGroups:
    - batch
    resources:
    - jobs
    verbs:
    - create
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: cad-tekton-pruner-role-binding
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: cad-tekton-pruner-role
  subjects:
  - kind: ServiceAccount
    name: cad-tekton-pruner