Twistlock init script

chart/templates/twistlock/gitrepository.yaml

@@ -14,5 +14,6 @@ spec:
   ref:
     {{- include "validRef" .Values.twistlock.git | nindent 4 }}
   {{ include "gitIgnore" . }}
+    !/chart/scripts/*.sh
   {{- include "gitCreds" . | nindent 2 }}
 {{- end }}

chart/templates/twistlock/values.yaml

@@ -4,15 +4,12 @@
 
 {{- define "bigbang.defaults.twistlock" -}}
 # hostname is deprecated and replaced with domain. But if hostname exists then use it.
-{{- $domainName := default .Values.domain .Values.hostname }}
-hostname: {{ $domainName }}
-domain: {{ $domainName }}
+domain: {{ default .Values.domain .Values.hostname }}
 
 openshift: {{ .Values.openshift }}
 
-prometheus:
-  servicemonitor:
-    enabled: {{ .Values.monitoring.enabled }}
+monitoring:
+  enabled: {{ .Values.monitoring.enabled }}
 
 imagePullSecrets:
 - name: private-registry
@@ -23,6 +20,7 @@ networkPolicies:
     {{- $gateway := default "public" .Values.twistlock.ingress.gateway }}
     {{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
     {{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}
+  controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
   nodeCidr: {{ .Values.networkPolicies.nodeCidr }}
 
 istio:

chart/values.yaml

@@ -639,7 +639,7 @@ twistlock:
   git:
     repo: https://repo1.dso.mil/platform-one/big-bang/apps/security-tools/twistlock.git
     path: "./chart"
-    tag: "0.6.0-bb.0"
+    tag: "0.7.0-bb.0"
 
   # -- Flux reconciliation overrides specifically for the Twistlock Package
   flux: {}

tests/test-values.yaml

@@ -162,6 +162,7 @@ gatekeeper:
           - monitoring/kube-prometheus-stack-cypress-test
           - vault/vault-cypress-test
           - logging/loki-cypress-test
+          - twistlock/twistlock-cypress-test
           # Allow kyverno test vectors for Helm test
           - default/restrict-host-path-mount-.?
           - default/restrict-host-path-write-.?
@@ -257,6 +258,7 @@ gatekeeper:
           - monitoring/kube-prometheus-stack-cypress-test
           - vault/vault-cypress-test
           - logging/loki-cypress-test
+          - twistlock/twistlock-cypress-test
           # Allow kyverno test vectors for Helm test
           - default/restrict-host-path-mount-.?
           - default/restrict-host-path-write-.?
@@ -365,6 +367,7 @@ kyvernopolicies:
               - monitoring
               - vault
               - logging
+              - twistlock
               names:
               - "*-cypress-test*"
         parameters:
@@ -385,6 +388,7 @@ kyvernopolicies:
               - monitoring
               - vault
               - logging
+              - twistlock
               names:
               - "*-cypress-test*"
         parameters:
@@ -420,6 +424,7 @@ kyvernopolicies:
               - monitoring
               - vault
               - logging
+              - twistlock
               names:
               - "*-cypress-test*"
       update-image-pull-policy:
@@ -496,17 +501,17 @@ loki:
   strategy: scalable
   values:
     global:
-      createGlobalConfig: true 
+      createGlobalConfig: true
       existingSecretForConfig: "loki-config"
     loki-simple-scalable:
       write:
         replicas: 1
         persistence:
           size: 2Gi
-        resources: 
+        resources:
           limits:
             cpu: 200m
-            memory: 400Mi 
+            memory: 400Mi
           requests:
             cpu: 200m
             memory: 400Mi
@@ -514,10 +519,10 @@ loki:
         replicas: 1
         persistence:
           size: 2Gi
-        resources: 
+        resources:
           limits:
             cpu: 200m
-            memory: 400Mi 
+            memory: 400Mi
           requests:
             cpu: 200m
             memory: 400Mi