CHG: Sync Artifacts - 4.0.0-beta1

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 airlock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,75 @@
+# Airlock Microgateway
+
+Airlock Microgateway is a Kubernetes native WAAP (Web Application and API Protection) solution to protect microservices.
+
+## Documentation
+
+Check the official documentation at **[docs.airlock.com](https://docs.airlock.com/microgateway/latest/)** or follow one of these links:
+* [Getting Started](https://docs.airlock.com/microgateway/latest/#data/1660804708742.html)
+* [System Architecture](https://docs.airlock.com/microgateway/latest/#data/1660804709650.html)
+* [Installation](https://docs.airlock.com/microgateway/latest/#data/1660804708637.html)
+
+## What is Airlock Microgateway?
+
+Modern application security is embedded in the development workflow and follows DevSecOps paradigms. The Airlock Microgateway is the perfect fit for these requirements. It is a lightweight alternative to the Airlock Gateway appliance and can be used in Kubernetes environments. Airlock Microgateway enables you to protect your applications and microservices with the tried-and-tested Airlock security features against attacks, while also providing a high degree of scalability.
+
+More information: **[airlock.com/microgateway](https://www.airlock.com/en/microgateway)**
+
+### Features
+* Kubernetes native integration with its Operator, Custom Resource Definitions, hot-reload, automatic sidecar injection.
+* Reverse proxy functionality with request routing rules, TLS termination and remote IP extraction
+* Using native Envoy HTTP filters like Lua scripting, RBAC, ext_authz, JWT authentication
+* Content security filters for protecting against known attacks (OWASP Top 10)
+* Access control to allow only authenticated users to access the protected services
+* API security features like JSON parsing or OpenAPI specification enforcement
+
+For a list of all features, view the **[comparison of the community and premium edition](https://docs.airlock.com/microgateway/latest/#data/1675772882054.html)**.
+
+# Quick start guide
+
+The instructions below provide a quick start guide. Detailed information are provided in the **[manual](https://docs.airlock.com/microgateway/latest/)**.
+
+## Prerequisites
+
+For an easy start in non-production environments, you may deploy the same cert-manager we are using internally for testing.
+
+### Deploy the cert-manager
+```
+kubectl apply -k https://github.com/airlock/microgateway/examples/utilities/cert-manager/
+```
+
+Wait for the cert-manager to be up and running
+```
+kubectl -n cert-manager wait --for=condition=ready --timeout=600s pod -l app.kubernetes.io/instance=cert-manager
+```
+
+## Deploy Airlock Microgateway
+Install the Custom Resource Definitions, the CRD RBAC manifests and the deployment of the Airlock Microgateway Operator.
+```
+kubectl apply -k https://github.com/airlock/microgateway/deploy/crds/
+kubectl apply -k https://github.com/airlock/microgateway/deploy/crd-rbac/
+kubectl apply -k https://github.com/airlock/microgateway/deploy/deployment/
+```
+
+Wait for the airlock-microgateway-operator deployment to be ready
+```
+kubectl -n airlock-microgateway-system wait --for=condition=Available deployments.app/airlock-microgateway-operator-controller-manager --timeout=2m
+```
+
+> The minimum supported Kustomize version is [v4.5.3](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv4.5.3).
+
+
+## How to get help
+
+### Community edition
+For the community edition, check our **[Airlock community forum](https://forum.airlock.com/)** for FAQs or register to post your question.
+
+### Premium edition
+If you have a paid license, please follow the [premium support process](https://techzone.ergon.ch/support-process).
+
+## License
+View the [detailed license terms](https://www.airlock.com/en/airlock-license) for the software contained in this image.
+* Decompiling or reverse engineering is not permitted.
+* Using any of the deny rules or parts of these filter patterns outside of the image is not permitted.
+
+![Airlock Logo](https://www.airlock.com/fileadmin/content/upload/Airlock_Logo_Docker_Hub_Microgateway_Readme.png)

deploy/README.md

@@ -0,0 +1,6 @@
+# Description
+The following folder contain the Kubernetes manifest files needed to deploy the Airlock Microgateway.
+* `crd-rbac`: Contains the Kubernetes ClusterRoles
+* `crds`: Contains the Airlock Microgateway CustomResourceDefinitions
+* `deployment`: Contains the Kubernetes manifest files to deploy and run the Airlock Microgateway Operator
+* `operator-installation`: Contains a kustomization file to easily deploy all the previously mentioned resources files at once  

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-contentsecurity-editor.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-contentsecurity-editor
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - contentsecurities
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-contentsecurity-viewer.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-contentsecurity-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - contentsecurities
+    verbs:
+      - get
+      - list
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-denyrules-editor.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-denyrules-editor
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - denyrules
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-denyrules-viewer.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-denyrules-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - denyrules
+    verbs:
+      - get
+      - list
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-envoycluster-editor.yaml

@@ -0,0 +1,27 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-envoycluster-editor
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyclusters
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyclusters/status
+    verbs:
+      - get

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-envoycluster-viewer.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-envoycluster-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyclusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyclusters/status
+    verbs:
+      - get

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-envoyconfiguration-viewer.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-envoyconfiguration-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyconfigurations
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyconfigurations/status
+    verbs:
+      - get

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-envoyhttpfilter-editor.yaml

@@ -0,0 +1,27 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-envoyhttpfilter-editor
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyhttpfilters
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyhttpfilters/status
+    verbs:
+      - get

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-envoyhttpfilter-viewer.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-envoyhttpfilter-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyhttpfilters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - envoyhttpfilters/status
+    verbs:
+      - get

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-headerrewrites-editor.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-headerrewrites-editor
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - headerrewrites
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-headerrewrites-viewer.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-headerrewrites-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - headerrewrites
+    verbs:
+      - get
+      - list
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-limits-editor.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-limits-editor
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - limits
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch

deploy/crd-rbac/ClusterRole_airlock-microgateway-operator-limits-viewer.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/name: airlock-microgateway-operator
+    app.kubernetes.io/version: 4.0.0-beta1
+  name: airlock-microgateway-operator-limits-viewer
+rules:
+  - apiGroups:
+      - microgateway.airlock.com
+    resources:
+      - limits
+    verbs:
+      - get
+      - list
+      - watch