docs: describe the functional flow of a deployment

.github/.kubescape/exceptions.json

@@ -10,7 +10,7 @@
         "designatorType": "Attributes",
         "attributes": {
           "kind": "ServiceAccount",
-          "name": "klc-controller-manager"
+          "name": "lifecycle-operator"
         }
       }
     ],
@@ -79,6 +79,131 @@
         "controlID": "C-0036"
       }
     ]
+  },
+  {
+    "name": "coreDNS poisoning",
+    "policyType": "postureExceptionPolicy",
+    "actions": [
+      "alertOnly"
+    ],
+    "resources": [
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "ServiceAccount",
+          "name": "metrics-operator"
+        }
+      },
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "ServiceAccount",
+          "name": "lifecycle-operator"
+        }
+      },
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "ServiceAccount",
+          "name": "certificate-operator"
+        }
+      }
+    ],
+    "posturePolicies": [
+        {
+            "controlID": "C-0037"
+        }
+    ]
+  },
+  {
+    "name": "data desctruction",
+    "policyType": "postureExceptionPolicy",
+    "actions": [
+      "alertOnly"
+    ],
+    "resources": [
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "ServiceAccount",
+          "name": "keptn-scheduler"
+        }
+      },
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "ServiceAccount",
+          "name": "lifecycle-operator"
+        }
+      }
+    ],
+    "posturePolicies": [
+        {
+            "controlID": "C-0007"
+        }
+    ]
+  },
+  {
+    "name": "malicious webhooks",
+    "policyType": "postureExceptionPolicy",
+    "actions": [
+      "alertOnly"
+    ],
+    "resources": [
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "MutatingWebhookConfiguration",
+          "name": "lifecycle-mutating-webhook-configuration"
+        }
+      }
+    ],
+    "posturePolicies": [
+        {
+            "controlID": "C-0039"
+        }
+    ]
+  },
+  {
+    "name": "server running 2222",
+    "policyType": "postureExceptionPolicy",
+    "actions": [
+      "alertOnly"
+    ],
+    "resources": [
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "Deployment",
+          "name": "lifecycle-operator"
+        }
+      }
+    ],
+    "posturePolicies": [
+        {
+            "controlID": "C-0042"
+        }
+    ]
+  },
+  {
+    "name": "unsigned images",
+    "policyType": "postureExceptionPolicy",
+    "actions": [
+      "alertOnly"
+    ],
+    "resources": [
+      {
+        "designatorType": "Attributes",
+        "attributes": {
+          "kind": "Deployment"
+        }
+      }
+    ],
+    "posturePolicies": [
+        {
+            "controlID": "C-0237"
+        }
+    ]
   }
 ]
 

.github/actions/deploy-klt-on-cluster/action.yml

@@ -20,21 +20,19 @@ inputs:
     default: "test-cluster"
   helm-install:
     required: false
-    type: boolean
     description: "Install KLT via helm instead of manifest if true"
-    # renovate: datasource=github-releases depName=kubernetes-sigs/kind
-    default: false
+    default: "false"
 runs:
   using: "composite"
   steps:
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v4
       with:
         go-version: ${{ env.GO_VERSION }}
         cache: true
         cache-dependency-path: '**/go.sum'
 
-    - name: Download manifests
+    - name: Download artifacts
       uses: actions/download-artifact@v3
       with:
         path: ~/download/artifacts
@@ -62,26 +60,35 @@ runs:
       shell: bash
       run: |
         echo "Installing KLT using manifests"
-        sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/g' ~/download/artifacts/keptn-lifecycle-operator-manifest-test/release.yaml
-        sed -i 's/ghcr.keptn.sh\/keptn\/functions-runtime:.*/localhost:5000\/keptn\/functions-runtime:${{ inputs.functions_runtime_tag }}/g' ~/download/artifacts/keptn-lifecycle-operator-manifest-test/release.yaml
+        sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/g' ~/download/artifacts/lifecycle-operator-manifest-test/release.yaml
+        sed -i 's/ghcr.keptn.sh\/keptn\/functions-runtime:.*/localhost:5000\/keptn\/functions-runtime:${{ inputs.functions_runtime_tag }}/g' \
+          ~/download/artifacts/lifecycle-operator-manifest-test/release.yaml
         kubectl create namespace keptn-lifecycle-toolkit-system
-        kubectl apply -f ~/download/artifacts/keptn-lifecycle-operator-manifest-test
-
-        sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/g' ~/download/artifacts/klt-cert-manager-manifest-test/release.yaml
-        kubectl apply -f ~/download/artifacts/klt-cert-manager-manifest-test
-        kubectl rollout status deployment klt-cert-manager -n keptn-lifecycle-toolkit-system -w
-
+        kubectl apply -f ~/download/artifacts/lifecycle-operator-manifest-test
+
+        sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/g' ~/download/artifacts/certificate-operator-manifest-test/release.yaml
+        kubectl apply -f ~/download/artifacts/certificate-operator-manifest-test
+        kubectl rollout status deployment certificate-operator -n keptn-lifecycle-toolkit-system -w
+
+        sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/g' ~/download/artifacts/metrics-operator-manifest-test/release.yaml
+        kubectl apply -f ~/download/artifacts/metrics-operator-manifest-test
+        kubectl rollout status deployment metrics-operator -n keptn-lifecycle-toolkit-system -w
+
         sed -i 's/imagePullPolicy: Always/imagePullPolicy: Never/g' ~/download/artifacts/scheduler-manifest-test/release.yaml
         kubectl apply -f ~/download/artifacts/scheduler-manifest-test
-        kubectl rollout status deployment keptn-scheduler -n keptn-lifecycle-toolkit-system -w
-        kubectl rollout status deployment klc-controller-manager -n keptn-lifecycle-toolkit-system -w
+        kubectl rollout status deployment scheduler -n keptn-lifecycle-toolkit-system -w
+        kubectl rollout status deployment lifecycle-operator -n keptn-lifecycle-toolkit-system -w
 
     - name: Install lifecycle-toolkit with helm
       if: ${{ inputs.helm-install == 'true'  }}
       shell: bash
       run: |
         echo "Installing KLT using helm"
         helm version
-        kubectl delete crds --all -n keptn-lifecycle-toolkit-system
-        helm install -n keptn-lifecycle-toolkit-system --create-namespace toolkit ~/download/artifacts/keptn-lifecycle-toolkit.tgz --set deployment.imagePullPolicy=Never --debug --wait --timeout 1m
-        kubectl get crds keptnappversions.lifecycle.keptn.sh -o yaml
+        helm install -n keptn-lifecycle-toolkit-system --create-namespace toolkit ~/download/artifacts/keptn-lifecycle-toolkit.tgz \
+          --set scheduler.scheduler.imagePullPolicy=Never \
+          --set lifecycleOperator.manager.imagePullPolicy=Never \
+          --set metricsOperator.manager.imagePullPolicy=Never \
+          --set lifecycleOperator.manager.env.functionRunnerImage=localhost:5000/keptn/functions-runtime:${{ inputs.functions_runtime_tag }} \
+          --set certificateOperator.manager.imagePullPolicy=Never \
+          --debug --wait --timeout 1m

.github/actions/deploy-prometheus-on-cluster/action.yml

@@ -0,0 +1,24 @@
+name: "Deploy Prometheus on GH cluster"
+description: "Deploys and exposes Prometheus on GH cluster"
+runs:
+  using: "composite"
+  steps:
+    - name: Install and expose Prometheus
+      shell: bash
+      run: |
+        make install-prometheus
+
+        kubectl -n monitoring port-forward svc/prometheus-k8s 9090 &
+        kubectl -n monitoring port-forward svc/node-exporter 9100 &
+
+        # wait for port 9090 to become available
+        while ! nc -vz localhost 9090 > /dev/null 2>&1 ; do
+        echo "Sleeping until port-forward for Prometheus at port 9090 is ready..."
+        sleep 5
+        done
+
+        # wait until node exporter is available
+        while ! nc -vz localhost 9100 > /dev/null 2>&1 ; do
+        echo "Sleeping until port-forward for node exporter at port 9100 is ready..."
+        sleep 5
+        done