These are Helm charts for installation and maintenance of Aqua Container Security Platform Console, Database, Gateway, Scanner, and Enforcer components.

• Aqua Security Helm Charts
  • Contents
  • Chart Details
  • Prerequisites
    • Container Registry Credentials
    • PostgreSQL database
    • High-Volume Scanner Installation
    • Helm Customizations / Troubleshooting
    • Non-public cloud provider deployments
  • Installing the Charts
    • Server (console)
    • Enforcer
    • Scanner
  • Configurable Variables
    • Console
    • Enforcer
    • Scanner
  • Support

This repository includes two charts that may be deployed separately:

• Server - deploys the Console, Gateway, and Database components, and optionally the Scanner component
• Enforcer - deploys the Enforcer daemonset
• Scanner - deploys the aqua scanner cli deployment

The Aqua server (Console and Gateway) components are available in our private repository, which requires authentication. By default, the charts create a secret based on the values.yaml.

First, create a new namespace named "aqua":

kubectl create namespace aqua

Next, (Optional) create the secret:

kubectl create secret docker-registry csp-registry-secret  --docker-server="registry.aquasec.com" --namespace aqua --docker-username="[email protected]" --docker-password="Truckin" --docker-email="[email protected]"

Aqua Security recommends implementing a highly-available PostgreSQL database. By default, the console chart will install a PostgreSQL database and attach it to persistent storage for POC usage and testing. For production use, one may override this default behavior and specify an existing PostgreSQL database by setting the following variables in values.yaml:

db:
  external:
    enabled: true
    name: example-aquasec
    host: aquasec-db
    port: 5432
    user: aquasec-db-username
    password: verysecret

Aqua CSP has the ability to deploy a scanning pod that is external to the Aqua Server. This dedicated scanning pod allows the Server to run unprivileged, and provides a high-throughput scanning queue anywhere you choose. To install the Scanner-CLI alongside the Server components, set the following variables in values.yaml:

scanner:
  enabled: true
scanner.replicas: "Set quantity"

This section not all-inclusive. It includes information regarding common issues Aqua has encountered during deployments

Error: UPGRADE/INSTALL FAILED, configmaps is forbidden.

Error: UPGRADE FAILED: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"

Solution: Create a service account for Tiller to utilize.

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
helm init --service-account tiller --upgrade

Error: No persistent volumes available for this claim and no storage class is set.

Solution: Most managed Kubernetes deployments do NOT include all possible storage provider variations at setup time. Refer to the official Kubernetes guidance https://kubernetes.io/docs/concepts/storage/storage-classes for your platform. Three primary examples are shown below.

• Amazon EKS

  kind: StorageClass
  apiVersion: storage.k8s.io/v1
  metadata:
    name: aqua-console-db-data
  provisioner: kubernetes.io/aws-ebs
  parameters:
    type: gp2
  reclaimPolicy: Retain
  mountOptions:
    - debug
  volumeBindingMode: Immediate

• Azure AKS

  kind: StorageClass
  apiVersion: storage.k8s.io/v1
  metadata:
    name: slow
  provisioner: kubernetes.io/azure-disk
  parameters:
    storageaccounttype: Standard_LRS
    kind: Shared

• Google GKE

  kind: StorageClass
  apiVersion: storage.k8s.io/v1
  metadata:
    name: slow
  provisioner: kubernetes.io/gce-pd
  parameters:
    type: pd-standard
  replication-type: none

Error: When executing kubectl get events -n aqua you might encounter one of the following errors: no persistent volumes available for this claim and no storage class is set or PersistentVolumeClaim is not bound.

Solution: If you encounter this error, you need to create a persistent volume prior to chart installation with a generic or existing storage class, specifying db.persistence.storageClass within the values.yaml. A sample file using aqua-storage is included in the repo.

kubectl apply -f pv-example.yaml

• Creating an ingress to access the Aqua Server
• IBM Cloud Private includes a bundled ingress controller. A sample ingress yaml file is included in the repo.

kubectl apply -f ingress-example.yaml

• Alternative Ingress Configuration
• The services charts are set to create `ClusterIP' ingress types. You may tune these as appropriate for your environment.

Clone the GitHub repository with the charts

git clone https://github.com/aquasecurity/aqua-helm.git
cd aqua-helm/

Optional Update the Helm charts values.yaml file with your environment's custom values. This eliminates the need to pass the parameters to the helm command. Then run one of the commands below to install the relevant services.

helm upgrade --install --namespace aqua csp ./server --set imageCredentials.username=<>,imageCredentials.password=<>,imageCredentials.email=<>

helm upgrade --install --namespace aqua csp-enforcer ./enforcer --set imageCredentials.username=<>,imageCredentials.password=<>,imageCredentials.email=<>,enforcerToken=<aquasec-token>

helm upgrade --install --namespace aqua scanner ./scanner --set imageCredentials.username=<>,imageCredentials.password=<>,imageCredentials.email=<>

The following table lists the configurable parameters of the Console and Enforcer charts with their default values.

If you encounter any problems or would like to give us feedback on deployments, we encourage you to raise issues here on GitHub please contact us at https://github.com/aquasecurity.