Defender only deployment support
Feature Request
Why
Twistlock is designed to support defending multiple clusters from a single console, but the BB charts are not set up to support that well.
Currently, BB users who want to do this have to manually deploy defenders using modified ds charts downloaded from the target console (via API request similar to how the defender init script works). This assumes the namespace and other requisite resources (e.g., img pull secrets) are present. This is handled by the big bang charts, but if you use those then you have a console deployed that you do not need (you can disable the virtual service, however). Additionally, Big Bang upgrades will not automatically upgrade your defender deployments with the latest images. You have to instead modify the image in the defender ds.
Proposed Solution
Add a chart value to switch to defender only mode that:
- disables all resources associated with the console (deployment, vs, etc)
- disables all init actions requiring the console; defender deployment should still be optional and defaulted to enabled
- for the defender init: if the defender ds already exists, the image is patched to the version in the Big Bang charts. Otherwise, nothing is done (users must take care of the initial deployment
- incorporate standalone script to query the twistlock console api to obtain charts (I already have this)