quick-start.yaml

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.10.0
  creationTimestamp: null
  name: changedefenseexecutions.app.ops.cloud.alipay.com
spec:
  group: app.ops.cloud.alipay.com
  names:
    kind: ChangeDefenseExecution
    listKind: ChangeDefenseExecutionList
    plural: changedefenseexecutions
    singular: changedefenseexecution
  scope: Namespaced
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          description: ChangeDefenseExecution is the Schema for the changedefenseexecutions
            API
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: ChangeDefenseExecutionSpec defines the desired state of ChangeDefenseExecution
              properties:
                defenseStrategy:
                  description: DefenseStrategy indicates the defense strategy on targeted
                    resource changes
                  properties:
                    workload:
                      description: Workload indicates the defense strategy on targeted
                        workload changes
                      properties:
                        steps:
                          description: Steps define the order of phases to execute defense
                            in batches(e.g. 20%, 40%, 60%, 80%, 100%)
                          items:
                            properties:
                              checkAfterComplete:
                                format: int32
                                type: integer
                              partition:
                                anyOf:
                                  - type: integer
                                  - type: string
                                x-kubernetes-int-or-string: true
                            required:
                              - partition
                            type: object
                          type: array
                      required:
                        - steps
                      type: object
                  type: object
                id:
                  description: ID is the defense execution unique identifier in altershield
                  type: string
                riskPolicy:
                  description: RiskPolicy indicates what to do on risks discovered by
                    defense strategy
                  type: object
                target:
                  description: Target indicates the resource that needs change defense
                  properties:
                    objectRef:
                      description: ObjectRef references the targeted kubernetes object
                      properties:
                        apiVersion:
                          description: API Version of the referent
                          type: string
                        kind:
                          description: Kind of the referent
                          type: string
                        name:
                          description: Name of the referent
                          type: string
                      required:
                        - apiVersion
                        - kind
                        - name
                      type: object
                    type:
                      description: Type of change resource target
                      type: string
                  required:
                    - objectRef
                    - type
                  type: object
              required:
                - defenseStrategy
                - target
              type: object
            status:
              description: ChangeDefenseExecutionStatus defines the observed state of
                ChangeDefenseExecution
              properties:
                defenseStatus:
                  description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
                  of cluster Important: Run "make" to regenerate code after modifying
                  this file DefenseStatus records the status information of execution'
                  properties:
                    currentBatch:
                      description: CurrentBatch is the latest batch number that change
                        defense is executing on, starts from 1
                      type: integer
                    lastTransitionTime:
                      format: date-time
                      type: string
                    nodeID:
                      type: string
                    phase:
                      description: Phase describes the life-cycle of defense execution
                        in this batch
                      type: string
                    targetStatus:
                      description: TargetStatus is observed status of change defense
                        target
                      properties:
                        podBatches:
                          description: PodsBatches records the pods checked at each
                            batch
                          items:
                            properties:
                              pods:
                                description: Pods records the pods checked in single
                                  batch
                                items:
                                  properties:
                                    ip:
                                      type: string
                                    name:
                                      type: string
                                    uid:
                                      type: string
                                  required:
                                    - ip
                                    - name
                                    - uid
                                  type: object
                                type: array
                            required:
                              - pods
                            type: object
                          type: array
                      type: object
                    verdict:
                      type: string
                  required:
                    - currentBatch
                    - phase
                    - verdict
                  type: object
              required:
                - defenseStatus
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.10.0
  creationTimestamp: null
  name: changedefenses.app.ops.cloud.alipay.com
spec:
  group: app.ops.cloud.alipay.com
  names:
    kind: ChangeDefense
    listKind: ChangeDefenseList
    plural: changedefenses
    singular: changedefense
  scope: Namespaced
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          description: ChangeDefense is the Schema for the changedefenses API
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: ChangeDefenseSpec defines the desired state of ChangeDefense
              properties:
                defenseStrategy:
                  description: DefenseStrategy indicates the defense strategy on targeted
                    resource changes
                  properties:
                    workload:
                      description: Workload indicates the defense strategy on targeted
                        workload changes
                      properties:
                        steps:
                          description: Steps define the order of phases to execute defense
                            in batches(e.g. 20%, 40%, 60%, 80%, 100%)
                          items:
                            properties:
                              checkAfterComplete:
                                format: int32
                                type: integer
                              partition:
                                anyOf:
                                  - type: integer
                                  - type: string
                                x-kubernetes-int-or-string: true
                            required:
                              - partition
                            type: object
                          type: array
                      required:
                        - steps
                      type: object
                  type: object
                riskPolicy:
                  description: RiskPolicy indicates what to do on risks discovered by
                    defense strategy
                  type: object
                target:
                  description: Target indicates the resource that needs change defense
                  properties:
                    objectRef:
                      description: ObjectRef references the targeted kubernetes object
                      properties:
                        apiVersion:
                          description: API Version of the referent
                          type: string
                        kind:
                          description: Kind of the referent
                          type: string
                        name:
                          description: Name of the referent
                          type: string
                      required:
                        - apiVersion
                        - kind
                        - name
                      type: object
                    type:
                      description: Type of change resource target
                      type: string
                  required:
                    - objectRef
                    - type
                  type: object
              required:
                - defenseStrategy
                - target
              type: object
            status:
              description: ChangeDefenseStatus defines the observed state of ChangeDefense
              properties:
                currentExecutionID:
                  description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
                  of cluster Important: Run "make" to regenerate code after modifying
                  this file'
                  type: string
                phase:
                  type: string
                verdict:
                  type: string
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: altershield
  namespace: altershield

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: altershield-role
rules:
  - apiGroups:
      - "app.ops.cloud.alipay.com"
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - ""
    resources:
      - pods
      - namespaces
      - nodes
      - nodes/status
      - services
      - endpoints
      - serviceaccounts
    verbs:
      - create
      - get
      - list
      - watch
      - patch
      - update
  - apiGroups:
      - ""
    resources:
      - pods/finalizers
    verbs:
      - update
  - apiGroups:
      - ""
    resources:
      - pods/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - apps
    resources:
      - deployments
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - apps
    resources:
      - deployments/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - apps
    resources:
      - replicasets
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - apps
    resources:
      - replicasets/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - apps
    resources:
      - statefulsets
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - apps
    resources:
      - statefulsets/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
      - update
  - apiGroups:
      - "admissionregistration.k8s.io"
    resources:
      - "*"
    verbs:
      - "*"
  - apiGroups:
      - "coordination.k8s.io"
    resources:
      - leases
    verbs:
      - create
      - get
      - list
      - update
      - watch
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: altershield
roleRef:
  name: altershield-role
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: altershield
    namespace: altershield

---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: altershield-mutating-webhook
webhooks:
  - name: apps-v1.mutating.altershield
    admissionReviewVersions: ["v1beta1", "v1"]
    clientConfig:
      service:
        name: altershield-svc
        namespace: altershield
        path: "/mutate"
        port: 443
      caBundle: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRQ2s1amxyK28yQWlUQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdGgKYkhSbGNuTm9hV1ZzWkRBZUZ3MHlNekV5TURVd05qRTNNVFJhRncwek16RXlNREl3TmpFM01UUmFNQll4RkRBUwpCZ05WQkFNTUMyRnNkR1Z5YzJocFpXeGtNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUE0SG9oWjV0Z2hlYWxHV1NBQ1pvcGVkVW4ycm5jSHN5aERpZEt0dGd4UHFRUlc5Z3JQbU1uc1hMaGtwWWwKOGEyZU9acjA4OHlVS0orODdXT0xSVVAyQzhackY1Vmx3V1hJNk9MWUhSK05lR2ZoYnNiMVBHOGZnc3ZJaVRUWQorcm40RXpPUS8wbWFXTU00S2ZwYVpnM1VJOW1DR0tEUng3ZWkzWjNVZGNKK3lxS3Ewd0hBak5hNXdUcXkzWVBiCjZTeUs5WWY4cklkTk5BUXNXUjRZMVRXOWVJTHgzaVZqN3Q2N0lQUmEzSk5HcVpJYlpQVEJFZFAvVFRYNmFPaVgKOWlsSkZmcjFzRFB2OWV2R0VGNzFyNXBId2sySVZVVDNSS2xJWkc2TTZXeGhNWWJsa21OaXU3SlVQeTc4QkFKSApwWW1HMDNUaGQzaS9nZ2xRR2c4R3F5Nm9jUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVhxeFc2CkJVYnJTYnlsMjFXV0tGRGIrZDAzdHpLblc1aERSdjlNc2lXOEFlZVFiaVIzU2NmTUkzVG5WLzgyYk9wVWQ0ZnIKM2FldjN2Q0V2ZXFSeE43SFhKVXROQ1VCWHJDbUJuMjkrUlVSU1Uxd1FnNnQ5cVB6RDd6V29naDBzQTIrTE1PUgpuNWNsUVRndi9SY0JpVm1ZeTl4VzJnZ1B3cUxRNzBzbVErdmZQSlZzbk8zTXZIdHhuNE15aE1WN0h0RGF5UkJoCktpU1RIMG0reU8yNFdyZWxORDM0OW5lcDV6b1Azc2N2TWJwRzJMWnRuenJZaEx5NlJRdDlmSVNWWkhNdWpnMGoKN0hOczJhK0VhTXFINzRMMFBzeVNZcHk1K2t4djdYSmREWWtzaFlMdUtZbDdqR2hZbTg1KzE4Y28xVmVRbkZkQgplSEVUcHhUdlhjczJpSjdECi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
    failurePolicy: Fail
    rules:
      - operations: ["UPDATE"]
        apiGroups: ["apps"]
        apiVersions: ["v1"]
        resources: ["deployments","statefulsets"]

---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: altershield-validation-webhook
webhooks:
  - name: core-v1.validating.altershield
    clientConfig:
      service:
        name: altershield-svc
        namespace: altershield
        path: "/validate"
        port: 443
      caBundle: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRQ2s1amxyK28yQWlUQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdGgKYkhSbGNuTm9hV1ZzWkRBZUZ3MHlNekV5TURVd05qRTNNVFJhRncwek16RXlNREl3TmpFM01UUmFNQll4RkRBUwpCZ05WQkFNTUMyRnNkR1Z5YzJocFpXeGtNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUE0SG9oWjV0Z2hlYWxHV1NBQ1pvcGVkVW4ycm5jSHN5aERpZEt0dGd4UHFRUlc5Z3JQbU1uc1hMaGtwWWwKOGEyZU9acjA4OHlVS0orODdXT0xSVVAyQzhackY1Vmx3V1hJNk9MWUhSK05lR2ZoYnNiMVBHOGZnc3ZJaVRUWQorcm40RXpPUS8wbWFXTU00S2ZwYVpnM1VJOW1DR0tEUng3ZWkzWjNVZGNKK3lxS3Ewd0hBak5hNXdUcXkzWVBiCjZTeUs5WWY4cklkTk5BUXNXUjRZMVRXOWVJTHgzaVZqN3Q2N0lQUmEzSk5HcVpJYlpQVEJFZFAvVFRYNmFPaVgKOWlsSkZmcjFzRFB2OWV2R0VGNzFyNXBId2sySVZVVDNSS2xJWkc2TTZXeGhNWWJsa21OaXU3SlVQeTc4QkFKSApwWW1HMDNUaGQzaS9nZ2xRR2c4R3F5Nm9jUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVhxeFc2CkJVYnJTYnlsMjFXV0tGRGIrZDAzdHpLblc1aERSdjlNc2lXOEFlZVFiaVIzU2NmTUkzVG5WLzgyYk9wVWQ0ZnIKM2FldjN2Q0V2ZXFSeE43SFhKVXROQ1VCWHJDbUJuMjkrUlVSU1Uxd1FnNnQ5cVB6RDd6V29naDBzQTIrTE1PUgpuNWNsUVRndi9SY0JpVm1ZeTl4VzJnZ1B3cUxRNzBzbVErdmZQSlZzbk8zTXZIdHhuNE15aE1WN0h0RGF5UkJoCktpU1RIMG0reU8yNFdyZWxORDM0OW5lcDV6b1Azc2N2TWJwRzJMWnRuenJZaEx5NlJRdDlmSVNWWkhNdWpnMGoKN0hOczJhK0VhTXFINzRMMFBzeVNZcHk1K2t4djdYSmREWWtzaFlMdUtZbDdqR2hZbTg1KzE4Y28xVmVRbkZkQgplSEVUcHhUdlhjczJpSjdECi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
    failurePolicy: Fail
    rules:
      - apiGroups: [ "" ]
        apiVersions: [ "v1" ]
        operations: [ "DELETE" ]
        resources: [ "pods" ]

---
apiVersion: v1
data:
  prometheus-metrics-config.yaml: |
    externalRules:
    - metricsQuery: sum(<<.Series>>{condition="true",<<.LabelMatchers>>})
      name:
        as: ready_pods_count
      resources:
        overrides:
          namespace:
            resource: namespace
      seriesQuery: '{__name__="kube_pod_status_ready"}'
    - metricsQuery: avg(sum(irate(<<.Series>>{container!="POD",container!="",<<.LabelMatchers>>}[3m])) by (pod))
      name:
        as: cpu_util
      resources:
        template: <<.Resource>>
      seriesQuery: '{__name__="container_cpu_usage_seconds_total"}'
    - metricsQuery: avg(sum(<<.Series>>{container!="POD",container!="",<<.LabelMatchers>>}) by (pod))
      name:
        as: mem_util
      resources:
        template: <<.Resource>>
      seriesQuery: '{__name__="container_memory_working_set_bytes"}'
    resourceRules:
      cpu:
        containerLabel: container
        containerQuery: |-
          sum by (<<.GroupBy>>) (
            irate(container_cpu_usage_seconds_total{container!="",container!="POD",<<.LabelMatchers>>}[3m])
          )
        readyPodsOnlyContainerQuery: |-
          sum by (<<.GroupBy>>) (
              (kube_pod_status_ready{condition="true"} == 1)
            * on (namespace, pod) group_left ()
              sum by (namespace, pod) (
                irate(container_cpu_usage_seconds_total{container!="",container!="POD",<<.LabelMatchers>>}[3m])
              )
          )
        resources:
          overrides:
            namespace:
              resource: namespace
            pod:
              resource: pod
      memory:
        containerLabel: container
        containerQuery: |-
          sum by (<<.GroupBy>>) (
            container_memory_working_set_bytes{container!="",container!="POD",<<.LabelMatchers>>}
          )
        readyPodsOnlyContainerQuery: |-
          sum by (<<.GroupBy>>) (
              (kube_pod_status_ready{condition="true"} == 1)
            * on (namespace, pod) group_left ()
              sum by (namespace, pod) (
                container_memory_working_set_bytes{container!="",container!="POD",<<.LabelMatchers>>}
              )
          )
        resources:
          overrides:
            namespace:
              resource: namespace
            pod:
              resource: pod
      window: 3m
    rules:
    - metricsQuery: sum by (<<.GroupBy>>) (irate(<<.Series>>{container!="POD",container!="",<<.LabelMatchers>>}[3m]))
      name:
        as: cpu_util
      resources:
        template: <<.Resource>>
      seriesQuery: '{__name__="container_cpu_usage_seconds_total"}'
    workloadPodNamePatterns:
    - group: apps
      kind: ReplicaSet
      pattern: ^%s-[a-z0-9]+$
    - group: apps
      kind: Deployment
      pattern: ^%s-[a-z0-9]+-[a-z0-9]+$
    - group: apps
      kind: StatefulSet
      pattern: ^%s-[0-9]+$
kind: ConfigMap
metadata:
  name: altershield-config
  namespace: altershield

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    control-plane: altershield-operator
  name: altershield-operator
  namespace: altershield
spec:
  replicas: 3
  selector:
    matchLabels:
      control-plane: altershield-operator
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        control-plane: altershield-operator
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: control-plane
                      operator: In
                      values:
                        - altershield-operator
                topologyKey: kubernetes.io/hostname
              weight: 100
      containers:
        - args:
            - --health-probe-bind-address=:8088
            - --leader-elect=true
            - --metrics-bind-address=:8089
            - --altershield-address=altershield-svc:8080
            - --metric-provider=prometheus
            - --prometheus-address=http://prometheus-svc:9090
            - --prometheus-auth-incluster=false
            - --prometheus-auth-config=
            - --prometheus-metrics-config=/etc/altershield/prometheus-metrics-config.yaml
            - --prometheus-metrics-relist-interval=40s
          command:
            - /manager
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
          image: altershield/altershield-operator:latest
          imagePullPolicy: Always
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8088
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 1
          name: altershield-operator
          ports:
            - containerPort: 1443
              hostPort: 1443
              name: webhook-port
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: 8088
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /etc/altershield
              name: config
              readOnly: true
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      serviceAccount: altershield
      serviceAccountName: altershield
      terminationGracePeriodSeconds: 30
      volumes:
        - configMap:
            defaultMode: 420
            name: altershield-config
          name: config

---
apiVersion: v1
kind: Service
metadata:
  name: altershield-svc
  namespace: altershield
spec:
  ports:
    - name: webhook-port
      port: 443
      protocol: TCP
      targetPort: webhook-port
    - name: callback-port
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    control-plane: altershield-operator
  sessionAffinity: None
  type: ClusterIP