Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .golangci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ linters:
path: api/v1alpha1/groupversion_info\.go
- linters:
- gochecknoglobals
path: api/v1alpha1/exploitiqstack_types\.go
path: api/v1alpha1/exploitintelligencestack_types\.go
- linters:
- gochecknoglobals
path: cmd/main\.go
Expand Down
14 changes: 7 additions & 7 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
# This variable is used to construct full image tags for bundle and catalog images.
#
# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
# openshift.io/exploit-iq-operator-bundle:$VERSION and openshift.io/exploit-iq-operator-catalog:$VERSION.
# openshift.io/exploit-intelligence-operator-bundle:$VERSION and openshift.io/exploit-intelligence-operator-catalog:$VERSION.
IMAGE_TAG_BASE ?= quay.io/redhat-user-workloads/exploit-intelligence-tenant/operator-tech-preview

# BUNDLE_IMG defines the image:tag used for the bundle.
Expand Down Expand Up @@ -106,7 +106,7 @@ test: manifests generate fmt vet setup-envtest ## Run tests.
# The default setup assumes Kind is pre-installed and builds/loads the Manager Docker image locally.
# CertManager is installed by default; skip with:
# - CERT_MANAGER_INSTALL_SKIP=true
KIND_CLUSTER ?= exploit-iq-operator-test-e2e
KIND_CLUSTER ?= exploit-intelligence-operator-test-e2e

.PHONY: setup-test-e2e
setup-test-e2e: ## Set up a Kind cluster for e2e tests if it does not exist
Expand Down Expand Up @@ -178,10 +178,10 @@ PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
docker-buildx: ## Build and push docker image for the manager for cross-platform support
# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
- $(CONTAINER_TOOL) buildx create --name exploit-iq-operator-builder
$(CONTAINER_TOOL) buildx use exploit-iq-operator-builder
- $(CONTAINER_TOOL) buildx create --name exploit-intelligence-operator-builder
$(CONTAINER_TOOL) buildx use exploit-intelligence-operator-builder
- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross .
- $(CONTAINER_TOOL) buildx rm exploit-iq-operator-builder
- $(CONTAINER_TOOL) buildx rm exploit-intelligence-operator-builder
rm Dockerfile.cross

.PHONY: build-installer
Expand All @@ -199,15 +199,15 @@ endif
.PHONY: redeploy
redeploy: manifests generate fmt vet docker-build-push deploy ## Complete redeployment: generate manifests, build image, push, and deploy.
@echo "Restarting controller pod..."
@$(KUBECTL) delete pod -n exploit-iq-operator-system -l control-plane=controller-manager --ignore-not-found=true
@$(KUBECTL) delete pod -n exploit-intelligence-operator-system -l control-plane=controller-manager --ignore-not-found=true
@echo "Redeployment complete!"
@echo " Image: ${IMG}"
@echo " Deployed to cluster: $(shell $(KUBECTL) config current-context)"

.PHONY: redeploy-olm
redeploy-olm: manifests generate fmt vet docker-build-push bundle bundle-build bundle-push catalog-build catalog-push deploy ## Complete OLM redeployment: includes bundle and catalog updates.
@echo "Restarting controller pod..."
@$(KUBECTL) delete pod -n exploit-iq-operator-system -l control-plane=controller-manager --ignore-not-found=true
@$(KUBECTL) delete pod -n exploit-intelligence-operator-system -l control-plane=controller-manager --ignore-not-found=true
@echo "OLM redeployment complete!"
@echo " Operator Image: ${IMG}"
@echo " Bundle Image: $(BUNDLE_IMG)"
Expand Down
52 changes: 26 additions & 26 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# ExploitIQ Operator
# RHTPA Exploit Intelligence Operator

An operator that automates the deployment and lifecycle management of the ExploitIQ Stack on OpenShift and Kubernetes clusters.
An operator that automates the deployment and lifecycle management of the RHTPA exploit intelligence stack on OpenShift and Kubernetes clusters.

## Quick Start

Expand All @@ -9,17 +9,17 @@ For the fastest deployment on OpenShift using OperatorHub:
1. Create a project:

```bash
oc new-project exploit-iq
oc new-project exploit-intelligence
```

2. Install the operator from OperatorHub (web console: **Operators → OperatorHub → ExploitIQ**)
2. Install the operator from OperatorHub (web console: **Operators → OperatorHub → RHTPA exploit intelligence**)

3. Create required Secrets (refer to [Prerequisites](#prerequisites))

4. Deploy the stack:

```bash
oc apply -f config/samples/exploitiq_v1alpha1_exploitiqstack.yaml
oc apply -f config/samples/exploitintelligence_v1alpha1_exploitintelligencestack.yaml
```

For Kubernetes installations or advanced configurations, refer to the sections below.
Expand Down Expand Up @@ -47,7 +47,7 @@ The operator manages the following components:

The operator does not manage sensitive credentials. Create the following Secrets in your application namespace before deploying the stack. All Secret manifests use `stringData` for plain-text values, which the API server automatically encodes.

#### ExploitIQ API Keys
#### RHTPA Exploit Intelligence API Keys

The Cache and WebApp components require API keys for external services.

Expand All @@ -65,7 +65,7 @@ For additional details, refer to the [upstream README](https://github.com/RHEcos
apiVersion: v1
kind: Secret
metadata:
name: exploit-iq-secret
name: exploit-intelligence-secret
type: Opaque
stringData:
ghsa_api_key: "YOUR_KEY"
Expand All @@ -91,7 +91,7 @@ The Engine and WebApp components require credentials to pull images from the Qua

```bash
cat ${HOME}/.docker/config.json | jq '{auths: {"quay.io": .auths["quay.io"]}}' > quay-pull-secret.json
oc create secret generic exploit-iq-pull-secret \
oc create secret generic exploit-intelligence-pull-secret \
--from-file=.dockerconfigjson=quay-pull-secret.json \
--type=kubernetes.io/dockerconfigjson
rm quay-pull-secret.json
Expand Down Expand Up @@ -142,7 +142,7 @@ On OpenShift, if you want to provide your own OAuth client secret and base domai
openshift-domain: "<CLUSTER_BASE_DOMAIN>"
```

On Kubernetes with OIDC sidecar authentication, use `spec.auth.oidc.clientSecretRef` in the `ExploitIQStack` CR instead. Refer to [config/samples/exploitiq_v1alpha1_exploitiqstack_kubernetes_oidc.yaml](config/samples/exploitiq_v1alpha1_exploitiqstack_kubernetes_oidc.yaml) for an example.
On Kubernetes with OIDC sidecar authentication, use `spec.auth.oidc.clientSecretRef` in the `ExploitIntelligenceStack` CR instead. Refer to [config/samples/exploitintelligence_v1alpha1_exploitintelligencestack_kubernetes_oidc.yaml](config/samples/exploitintelligence_v1alpha1_exploitintelligencestack_kubernetes_oidc.yaml) for an example.

## Installing on OpenShift

Expand All @@ -151,7 +151,7 @@ On Kubernetes with OIDC sidecar authentication, use `spec.auth.oidc.clientSecret
1. Build and push your own catalog image (refer to [Building a CatalogSource](docs/managing_bundles_catalogs.md#building-a-catalogsource) for details):

```bash
make catalog-build catalog-push CATALOG_IMG=<your-registry>/exploit-iq-operator-catalog:latest
make catalog-build catalog-push CATALOG_IMG=<your-registry>/exploit-intelligence-operator-catalog:latest
```

2. Create a CatalogSource in the `openshift-marketplace` namespace:
Expand All @@ -161,10 +161,10 @@ On Kubernetes with OIDC sidecar authentication, use `spec.auth.oidc.clientSecret
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
name: exploit-iq-catalog
name: exploit-intelligence-catalog
namespace: openshift-marketplace
spec:
displayName: ExploitIQ
displayName: RHTPA Exploit Intelligence
image: '<your-catalog-image>'
publisher: Red Hat
sourceType: grpc
Expand All @@ -178,53 +178,53 @@ On Kubernetes with OIDC sidecar authentication, use `spec.auth.oidc.clientSecret

```bash
oc -n openshift-marketplace wait --for=condition=Ready pod \
-l olm.catalogSource=exploit-iq-catalog --timeout=300s
-l olm.catalogSource=exploit-intelligence-catalog --timeout=300s
```

4. Install the operator from the web console:
- Navigate to **Operators → OperatorHub**
- Select the **ExploitIQ** source
- Select the **RHTPA exploit intelligence** source
- Select the operator
- Click **Install**

5. Wait for the operator to become ready:

```bash
oc wait --for=condition=ready pod \
-l app.kubernetes.io/name=exploit-iq-operator \
-n exploit-iq-operator-system \
-l app.kubernetes.io/name=exploit-intelligence-operator \
-n exploit-intelligence-operator-system \
--timeout=300s
```

### Creating the Stack Instance

After installing the operator, create an `ExploitIQStack` instance:
After installing the operator, create an `ExploitIntelligenceStack` instance:

1. Create or select your project:

```bash
oc new-project exploit-iq
oc new-project exploit-intelligence
```

2. Create the required Secrets (refer to [Prerequisites](#prerequisites))

3. Create the `ExploitIQStack` instance:
3. Create the `ExploitIntelligenceStack` instance:

```bash
oc apply -f config/samples/exploitiq_v1alpha1_exploitiqstack.yaml
oc apply -f config/samples/exploitintelligence_v1alpha1_exploitintelligencestack.yaml
```

Example minimal CR:

```yaml
apiVersion: exploitiq.openshift.io/v1alpha1
kind: ExploitIQStack
apiVersion: exploitintelligence.openshift.io/v1alpha1
kind: ExploitIntelligenceStack
metadata:
name: example
spec:
engine:
pullSecretRef:
name: exploit-iq-pull-secret
name: exploit-intelligence-pull-secret
webApp:
registryCredentialsSecretRef:
name: image-registry-credentials
Expand All @@ -238,16 +238,16 @@ For Kubernetes installations (without OLM), refer to [docs/installing_kubernetes

## Uninstalling

Delete all `ExploitIQStack` custom resources:
Delete all `ExploitIntelligenceStack` custom resources:

```bash
oc delete exploitiqstack --all -n <namespace>
oc delete exploitintelligencestack --all -n <namespace>
```

Or delete a specific instance:

```bash
oc delete -f config/samples/exploitiq_v1alpha1_exploitiqstack.yaml
oc delete -f config/samples/exploitintelligence_v1alpha1_exploitintelligencestack.yaml
```

For OLM-based installations, uninstall the operator from the web console (**Operators → Installed Operators**) or using the `oc` CLI.
Expand Down
6 changes: 3 additions & 3 deletions api/v1alpha1/conditions.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ package v1alpha1
type ConditionType string

const (
// ConditionTypeDegraded indicates that the ExploitIQStack is operating in a degraded state.
// ConditionTypeDegraded indicates that the ExploitIntelligenceStack is operating in a degraded state.
ConditionTypeDegraded ConditionType = "Degraded"
// ConditionTypeProgressing indicates that the ExploitIQStack is currently being reconciled.
// ConditionTypeProgressing indicates that the ExploitIntelligenceStack is currently being reconciled.
ConditionTypeProgressing ConditionType = "Progressing"
// ConditionTypeReady indicates that the ExploitIQStack is ready and all components are operational.
// ConditionTypeReady indicates that the ExploitIntelligenceStack is ready and all components are operational.
ConditionTypeReady ConditionType = "Ready"

// ConditionTypeCacheReady indicates that the Cache component is ready.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@ package v1alpha1

// GetReferencedSecretNames returns the unique names of all Kubernetes Secrets
// (both operator-managed defaults and user-provided ones) that the
// ExploitIQStack CR depends on. The controller uses this list to index stacks
// ExploitIntelligenceStack CR depends on. The controller uses this list to index stacks
// by referenced Secret so that Secret changes can trigger
// reconciliation of only the affected stacks.
func (r *ExploitIQStack) GetReferencedSecretNames() []string {
func (r *ExploitIntelligenceStack) GetReferencedSecretNames() []string {
secrets := make(map[string]struct{})
// Default Secrets
// TODO: Import from constants?
secrets["exploit-iq-secret"] = struct{}{}
secrets["exploit-intelligence-secret"] = struct{}{}
secrets["oauth-client-secret"] = struct{}{}

// Engine
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// ExploitIQStackSpec defines the desired state of ExploitIQStack.
type ExploitIQStackSpec struct {
// ExploitIntelligenceStackSpec defines the desired state of ExploitIntelligenceStack.
type ExploitIntelligenceStackSpec struct {
// Auth defines the configuration for the authentication component.
// +kubebuilder:validation:Optional
Auth AuthSpec `json:"auth,omitempty"`
Expand Down Expand Up @@ -116,7 +116,7 @@ type DatabaseSpec struct {

// CredentialsSecretRef references an existing Secret with MongoDB credentials.
// If not provided, the operator auto-generates one.
// The Secret must contain keys: admin-user, admin-password, exploit-iq-user, exploit-iq-password.
// The Secret must contain keys: admin-user, admin-password, exploit-intelligence-user, exploit-intelligence-password.
// +kubebuilder:validation:Optional
CredentialsSecretRef *corev1.LocalObjectReference `json:"credentialsSecretRef,omitempty"`

Expand Down Expand Up @@ -380,36 +380,36 @@ type GatewayReference struct {
Namespace string `json:"namespace,omitempty"`
}

// ExploitIQStackStatus defines the observed state of ExploitIQStack.
type ExploitIQStackStatus struct {
// Conditions store the status conditions of the ExploitIQ stack status
// ExploitIntelligenceStackStatus defines the observed state of ExploitIntelligenceStack.
type ExploitIntelligenceStackStatus struct {
// Conditions store the status conditions of the RHTPA exploit intelligence stack status
// +operator-sdk:csv:customresourcedefinitions:type=status
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

// +kubebuilder:object:root=true
// +kubebuilder:subresource:status

// ExploitIQStack is the Schema for the exploitiqstacks API.
// +operator-sdk:csv:customresourcedefinitions:displayName="Exploit IQStack",resources={{Deployment,v1,exploit-iq},{Service,v1,exploit-iq},{ConfigMap,v1,exploit-iq-config},{PersistentVolumeClaim,v1,exploit-iq-data},{ServiceAccount,v1,exploit-iq-engine},{Route,v1,exploit-iq}}
// ExploitIntelligenceStack is the Schema for the exploitiqstacks API.
// +operator-sdk:csv:customresourcedefinitions:displayName="Exploit IntelligenceStack",resources={{Deployment,v1,exploit-intelligence},{Service,v1,exploit-intelligence},{ConfigMap,v1,exploit-intelligence-config},{PersistentVolumeClaim,v1,exploit-intelligence-data},{ServiceAccount,v1,exploit-intelligence-engine},{Route,v1,exploit-intelligence}}
// +kubebuilder:subresource:status
type ExploitIQStack struct {
type ExploitIntelligenceStack struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`

Spec ExploitIQStackSpec `json:"spec,omitempty"`
Status ExploitIQStackStatus `json:"status,omitempty"`
Spec ExploitIntelligenceStackSpec `json:"spec,omitempty"`
Status ExploitIntelligenceStackStatus `json:"status,omitempty"`
}

// +kubebuilder:object:root=true

// ExploitIQStackList contains a list of ExploitIQStack.
type ExploitIQStackList struct {
// ExploitIntelligenceStackList contains a list of ExploitIntelligenceStack.
type ExploitIntelligenceStackList struct {
metav1.TypeMeta `json:",inline"`
metav1.ListMeta `json:"metadata,omitempty"`
Items []ExploitIQStack `json:"items"`
Items []ExploitIntelligenceStack `json:"items"`
}

func init() {
SchemeBuilder.Register(&ExploitIQStack{}, &ExploitIQStackList{})
SchemeBuilder.Register(&ExploitIntelligenceStack{}, &ExploitIntelligenceStackList{})
}
6 changes: 3 additions & 3 deletions api/v1alpha1/groupversion_info.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@ See the License for the specific language governing permissions and
limitations under the License.
*/

// Package v1alpha1 contains API Schema definitions for the exploitiq v1alpha1 API group.
// Package v1alpha1 contains API Schema definitions for the exploitintelligence v1alpha1 API group.
// +kubebuilder:object:generate=true
// +groupName=exploitiq.openshift.io
// +groupName=exploitintelligence.openshift.io
package v1alpha1

import (
Expand All @@ -26,7 +26,7 @@ import (

var (
// GroupVersion is group version used to register these objects.
GroupVersion = schema.GroupVersion{Group: "exploitiq.openshift.io", Version: "v1alpha1"}
GroupVersion = schema.GroupVersion{Group: "exploitintelligence.openshift.io", Version: "v1alpha1"}

// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
Expand Down
Loading