kubescape_sneeffer_Daemonset_seccomp_profile_and_relevent_CVEs.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubescape-sneeffer-service-account
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-sneeffer-cluster-role
rules:
- apiGroups: ["*"]
  resources: ["pods", "nodes", "deployments", "daemonsets", "statefulsets", "jobs", "cronjobs", "replicasets"]
  verbs: ["get"]
- apiGroups: ["*"]
  resources: ["pods"]
  verbs: ["watch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["create"]
- apiGroups: ["kubescape.io"]
  resources: ["runtimevulndetaileds", "runtimevulnsummaries"]
  verbs: ["create", "get", "update"]  
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-sneeffer-cluster-role-container-profiling
  namespace: security-profiles-operator
rules:
- apiGroups: ["security-profiles-operator.x-k8s.io"]
  resources: ["seccompprofiles"]
  verbs: ["get", "create", "update"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-sneeffer-role-binding
subjects:
- kind: ServiceAccount
  name: kubescape-sneeffer-service-account
  namespace: default
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: kubescape-sneeffer-cluster-role
  apiGroup: ""
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-sneeffer-role-binding-container-profiling
  namespace: security-profiles-operator
subjects:
- kind: ServiceAccount
  name: kubescape-sneeffer-service-account
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: ""
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: kubescape-sneeffer-config
  namespace: default
data:
  SneefferConfigurationFile.txt: |
    innerDataDirPath=./data
    kernelObjPath=./resources/ebpf/kernel_obj.o
    snifferEngineLoaderPath=./resources/ebpf/sniffer
    sbomCreatorPath=./resources/sbom/syft
    vulnCreatorPath=./resources/vuln/grype
    snifferTime=5
    loggerVerbose=INFO
    crdFullDetailedPath=./resources/k8s/crd-vuln-full-detailes.yaml
    crdVulnSummaryPath=./resources/k8s/crd-vuln-summary.yaml
    myNode=minikube
    enableContainerProfilingService=true
    enableRelaventCVEsService=false
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kubescape-sneeffer
  labels: 
      app: kubescape-sneeffer
spec:
  selector:
    matchLabels:
      app: kubescape-sneeffer
  template:
    metadata:
      labels:
        app: kubescape-sneeffer
        alt-name: kubescape-sneeffer
    spec:
      serviceAccountName: kubescape-sneeffer-service-account
      automountServiceAccountToken: true
      volumes:
      - name: configmap-volume
        configMap:
          name: kubescape-sneeffer-config
      - emptyDir: {}
        name: root-falco-fs
      - hostPath:
          path: /boot
          type: ""
        name: boot-fs
      - hostPath:
          path: /lib/modules
          type: ""
        name: lib-modules
      - hostPath:
          path: /usr
          type: ""
        name: usr-fs
      - hostPath:
          path: /etc
          type: ""
        name: etc-fs
      - hostPath:
          path: /dev
          type: ""
        name: dev-fs
      - hostPath:
          path: /var/run/docker.sock
          type: ""
        name: docker-socket
      - hostPath:
          path: /run/containerd/containerd.sock
          type: ""
        name: containerd-socket
      - hostPath:
          path: /run/crio/crio.sock
          type: ""
        name: crio-socket
      - hostPath:
          path: /proc
          type: ""
        name: proc-fs
      - hostPath:
          path: /sys/kernel/debug
          type: ""
        name: debugfs
      
      initContainers:
      - env:
        - name: FALCO_BPF_PROBE
        image: docker.io/falcosecurity/falco-driver-loader:0.32.2
        imagePullPolicy: IfNotPresent
        name: falco-driver-loader
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /root/.falco
          name: root-falco-fs
        - mountPath: /host/proc
          name: proc-fs
          readOnly: true
        - mountPath: /host/boot
          name: boot-fs
          readOnly: true
        - mountPath: /host/lib/modules
          name: lib-modules
        - mountPath: /host/usr
          name: usr-fs
          readOnly: true
        - mountPath: /host/etc
          name: etc-fs
          readOnly: true
      containers:
        - name: kubescape-sneeffer
          image: quay.io/kubescape/sneeffer:v0.0.32
          # command: ["/bin/bash"]
          # args: ["-c", "while true; do sleep 1000;done"]
          imagePullPolicy: Always
          env:
            - name: SNEEFFER_CONF_FILE_PATH
              value: "/etc/sneeffer/configuration/SneefferConfigurationFile.txt" 
            - name: myNode
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          securityContext:
            runAsUser: 0
            capabilities:
              add: 
                - SYS_RESOURCE
                - SYS_ADMIN
          volumeMounts:
            - mountPath: /etc/sneeffer/configuration
              name: configmap-volume
            - mountPath: /root/.falco
              name: root-falco-fs
            - mountPath: /host/proc
              name: proc-fs
            - mountPath: /sys/kernel/debug
              name: debugfs
            - mountPath: /host/var/run/docker.sock
              name: docker-socket
            - mountPath: /host/run/containerd/containerd.sock
              name: containerd-socket
            - mountPath: /host/run/crio/crio.sock
              name: crio-socket