Added Aqua enforcer Add On

eks-anywhere-common/Addons/Partner/Aqua/aqua-enforcer.yaml

@@ -0,0 +1,54 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: aqua-enforcer
+  namespace: aqua
+spec:
+  chart:
+    spec:
+      chart: enforcer
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: aqua-helm
+        namespace: flux-system
+      version: "2022.4.20"
+  interval: 30s
+  values:
+    global:
+      platform: eks
+      gateway:
+        port: 443
+      imageCredentials:
+        create: true
+        name:
+        repositoryUriPrefix: "registry.aquasec.com"
+        registry: "registry.aquasec.com"
+    serviceAccount:
+      create: true
+    nodeSelector: {}
+    tolerations: []
+    podAnnotations: {}
+    podLabels: {}
+    podSecurityContext: {}
+    affinity: {}
+    extraEnvironmentVars: {}
+  valuesFrom:
+  - kind: Secret
+    name: aqua-secrets-from-ps
+    valuesKey: aqua-geteway-address
+    targetPath: global.gateway.address
+  - kind: Secret
+    name: aqua-secrets-from-ps
+    valuesKey: aqua-enforcer-token
+    targetPath: enforcerToken
+  - kind: Secret
+    name: aqua-secrets-from-ps
+    valuesKey: aqua-image-username
+    targetPath: global.imageCredentials.username
+  - kind: Secret
+    name: aqua-secrets-from-ps
+    valuesKey: aqua-image-password
+    targetPath: global.imageCredentials.password
+

eks-anywhere-common/Addons/Partner/Aqua/aqua-source.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: aqua-helm
+  namespace: flux-system
+spec:
+  interval: 30s
+  url:  https://helm.aquasec.com

eks-anywhere-common/Addons/Partner/Aqua/external-secret.yaml

@@ -0,0 +1,29 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: aqua-secretstore-eksa
+  namespace: aqua
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    name: eksa-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: aqua-secrets-from-ps          # Specify the name for the Kubernetes Secret
+  data:
+    - secretKey: aqua-enforcer-token    # Key in Kubernetes Secret
+      remoteRef:
+        key: /aqua-enforcer/enforcer-token  # Key in AWS Parameter Store
+
+    - secretKey: aqua-image-username
+      remoteRef:
+        key: /aqua-enforcer/username
+
+    - secretKey: aqua-image-password
+      remoteRef:
+        key: /aqua-enforcer/password
+
+    - secretKey: aqua-geteway-address
+      remoteRef:
+        key: /aqua-enforcer/gateway
+

eks-anywhere-common/Addons/Partner/Aqua/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: aqua
+  labels:
+    aws.conformance.vendor: aqua
+    aws.conformance.vendor-solution: aqua-enforcer

eks-anywhere-common/Testers/Aqua/aqua-testJob.yaml

@@ -0,0 +1,35 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: aqua-enforcer-tester
+  namespace: aqua
+spec:
+  template:
+    spec:
+      serviceAccountName: 'aqua-enforcer-sa'
+      containers:
+        - name: test-aqua-enforcer
+          image: 'alpine/k8s:1.26.2'
+          imagePullPolicy: Always
+          command:
+            - /bin/bash
+          args:
+            - '-c'
+            - >-
+              echo "1. Checking readiness probe"
+              aqua_enforcer_pod="";
+              while true;
+              do
+                aqua_enforcer_pod=$(kubectl get pod -n aqua -l app=aqua-enforcer-ds --field-selector=status.phase==Running -o jsonpath="{.items[0].metadata.name}{range .items[0].status.conditions[?(@.type=='Ready')]}");
+                aqua_enforcer_pod_status=$(kubectl get pod $aqua_enforcer_pod -n aqua -o jsonpath="{.status.phase}");
+
+                if [[ $aqua_enforcer_pod_status != "Running" ]]; then
+                  echo "LOG: Pod $aqua_enforcer_pod, $aqua_enforcer_pod_status";
+                  sleep 15;
+                else
+                  echo "LOG: Pod $aqua_enforcer_pod, Running";
+                  exit 0;
+                fi;
+              done;
+      restartPolicy: Never
+  backoffLimit: 1