init

config/crd/bases/nuclei.homelab.mortenolsen.pro_nucleiscans.yaml

@@ -0,0 +1,306 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.19.0
+  name: nucleiscans.nuclei.homelab.mortenolsen.pro
+spec:
+  group: nuclei.homelab.mortenolsen.pro
+  names:
+    kind: NucleiScan
+    listKind: NucleiScanList
+    plural: nucleiscans
+    shortNames:
+    - ns
+    - nscan
+    singular: nucleiscan
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.phase
+      name: Phase
+      type: string
+    - jsonPath: .status.summary.totalFindings
+      name: Findings
+      type: integer
+    - jsonPath: .spec.sourceRef.kind
+      name: Source
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: NucleiScan is the Schema for the nucleiscans API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: NucleiScanSpec defines the desired state of NucleiScan
+            properties:
+              schedule:
+                description: |-
+                  Schedule for periodic rescanning in cron format
+                  If empty, scan runs once
+                type: string
+              severity:
+                description: Severity filters scan results by severity level
+                enum:
+                - info
+                - low
+                - medium
+                - high
+                - critical
+                items:
+                  type: string
+                type: array
+              sourceRef:
+                description: SourceRef references the Ingress or VirtualService being
+                  scanned
+                properties:
+                  apiVersion:
+                    description: APIVersion of the source resource
+                    type: string
+                  kind:
+                    description: Kind of the source resource - Ingress or VirtualService
+                    enum:
+                    - Ingress
+                    - VirtualService
+                    type: string
+                  name:
+                    description: Name of the source resource
+                    type: string
+                  namespace:
+                    description: Namespace of the source resource
+                    type: string
+                  uid:
+                    description: UID of the source resource for owner reference
+                    type: string
+                required:
+                - apiVersion
+                - kind
+                - name
+                - namespace
+                - uid
+                type: object
+              suspend:
+                description: Suspend prevents scheduled scans from running
+                type: boolean
+              targets:
+                description: Targets is the list of URLs to scan, extracted from the
+                  source resource
+                items:
+                  type: string
+                minItems: 1
+                type: array
+              templates:
+                description: |-
+                  Templates specifies which Nuclei templates to use
+                  If empty, uses default templates
+                items:
+                  type: string
+                type: array
+            required:
+            - sourceRef
+            - targets
+            type: object
+          status:
+            description: NucleiScanStatus defines the observed state of NucleiScan
+            properties:
+              completionTime:
+                description: CompletionTime is when the last scan completed
+                format: date-time
+                type: string
+              conditions:
+                description: Conditions represent the latest available observations
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              findings:
+                description: |-
+                  Findings contains the array of scan results from Nuclei JSONL output
+                  Each element is a parsed JSON object from Nuclei output
+                items:
+                  description: Finding represents a single Nuclei scan finding
+                  properties:
+                    description:
+                      description: Description provides details about the finding
+                      type: string
+                    extractedResults:
+                      description: ExtractedResults contains any data extracted by
+                        the template
+                      items:
+                        type: string
+                      type: array
+                    host:
+                      description: Host that was scanned
+                      type: string
+                    matchedAt:
+                      description: MatchedAt is the specific URL or endpoint where
+                        the issue was found
+                      type: string
+                    metadata:
+                      description: Metadata contains additional template metadata
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    reference:
+                      description: Reference contains URLs to additional information
+                        about the finding
+                      items:
+                        type: string
+                      type: array
+                    severity:
+                      description: Severity of the finding
+                      type: string
+                    tags:
+                      description: Tags associated with the finding
+                      items:
+                        type: string
+                      type: array
+                    templateId:
+                      description: TemplateID is the Nuclei template identifier
+                      type: string
+                    templateName:
+                      description: TemplateName is the human-readable template name
+                      type: string
+                    timestamp:
+                      description: Timestamp when the finding was discovered
+                      format: date-time
+                      type: string
+                    type:
+                      description: Type of the finding - http, dns, ssl, etc.
+                      type: string
+                  required:
+                  - host
+                  - severity
+                  - templateId
+                  - timestamp
+                  type: object
+                type: array
+              lastError:
+                description: LastError contains the error message if the scan failed
+                type: string
+              lastScanTime:
+                description: LastScanTime is when the last scan was initiated
+                format: date-time
+                type: string
+              nextScheduledTime:
+                description: NextScheduledTime is when the next scheduled scan will
+                  run
+                format: date-time
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation observed by the
+                  controller
+                format: int64
+                type: integer
+              phase:
+                description: Phase represents the current scan phase
+                enum:
+                - Pending
+                - Running
+                - Completed
+                - Failed
+                type: string
+              summary:
+                description: Summary provides aggregated scan statistics
+                properties:
+                  durationSeconds:
+                    description: DurationSeconds is the duration of the scan in seconds
+                    format: int64
+                    type: integer
+                  findingsBySeverity:
+                    additionalProperties:
+                      type: integer
+                    description: FindingsBySeverity breaks down findings by severity
+                      level
+                    type: object
+                  targetsScanned:
+                    description: TargetsScanned is the number of targets that were
+                      scanned
+                    type: integer
+                  totalFindings:
+                    description: TotalFindings is the total number of findings
+                    type: integer
+                required:
+                - targetsScanned
+                - totalFindings
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

config/crd/kustomization.yaml

@@ -0,0 +1,16 @@
+# This kustomization.yaml is not intended to be run by itself,
+# since it depends on service name and namespace that are out of this kustomize package.
+# It should be run by config/default
+resources:
+- bases/nuclei.homelab.mortenolsen.pro_nucleiscans.yaml
+# +kubebuilder:scaffold:crdkustomizeresource
+
+patches:
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
+# patches here are for enabling the conversion webhook for each CRD
+# +kubebuilder:scaffold:crdkustomizewebhookpatch
+
+# [WEBHOOK] To enable webhook, uncomment the following section
+# the following config is for teaching kustomize how to do kustomization for CRDs.
+#configurations:
+#- kustomizeconfig.yaml

config/crd/kustomizeconfig.yaml

@@ -0,0 +1,19 @@
+# This file is for teaching kustomize how to substitute name and namespace reference in CRD
+nameReference:
+- kind: Service
+  version: v1
+  fieldSpecs:
+  - kind: CustomResourceDefinition
+    version: v1
+    group: apiextensions.k8s.io
+    path: spec/conversion/webhook/clientConfig/service/name
+
+namespace:
+- kind: CustomResourceDefinition
+  version: v1
+  group: apiextensions.k8s.io
+  path: spec/conversion/webhook/clientConfig/service/namespace
+  create: false
+
+varReference:
+- path: metadata/annotations

config/default/cert_metrics_manager_patch.yaml

@@ -0,0 +1,30 @@
+# This patch adds the args, volumes, and ports to allow the manager to use the metrics-server certs.
+
+# Add the volumeMount for the metrics-server certs
+- op: add
+  path: /spec/template/spec/containers/0/volumeMounts/-
+  value:
+    mountPath: /tmp/k8s-metrics-server/metrics-certs
+    name: metrics-certs
+    readOnly: true
+
+# Add the --metrics-cert-path argument for the metrics server
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: --metrics-cert-path=/tmp/k8s-metrics-server/metrics-certs
+
+# Add the metrics-server certs volume configuration
+- op: add
+  path: /spec/template/spec/volumes/-
+  value:
+    name: metrics-certs
+    secret:
+      secretName: metrics-server-cert
+      optional: false
+      items:
+        - key: ca.crt
+          path: ca.crt
+        - key: tls.crt
+          path: tls.crt
+        - key: tls.key
+          path: tls.key

config/default/kustomization.yaml

@@ -0,0 +1,234 @@
+# Adds namespace to all resources.
+namespace: nuclei-operator-system
+
+# Value of this field is prepended to the
+# names of all resources, e.g. a deployment named
+# "wordpress" becomes "alices-wordpress".
+# Note that it should also match with the prefix (text before '-') of the namespace
+# field above.
+namePrefix: nuclei-operator-
+
+# Labels to add to all resources and selectors.
+#labels:
+#- includeSelectors: true
+#  pairs:
+#    someName: someValue
+
+resources:
+- ../crd
+- ../rbac
+- ../manager
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+#- ../webhook
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
+#- ../certmanager
+# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
+#- ../prometheus
+# [METRICS] Expose the controller manager metrics service.
+- metrics_service.yaml
+# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy.
+# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics.
+# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will
+# be able to communicate with the Webhook Server.
+#- ../network-policy
+
+# Uncomment the patches line if you enable Metrics
+patches:
+# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
+# More info: https://book.kubebuilder.io/reference/metrics
+- path: manager_metrics_patch.yaml
+  target:
+    kind: Deployment
+
+# Uncomment the patches line if you enable Metrics and CertManager
+# [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line.
+# This patch will protect the metrics with certManager self-signed certs.
+#- path: cert_metrics_manager_patch.yaml
+#  target:
+#    kind: Deployment
+
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+#- path: manager_webhook_patch.yaml
+#  target:
+#    kind: Deployment
+
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
+# Uncomment the following replacements to add the cert-manager CA injection annotations
+#replacements:
+# - source: # Uncomment the following block to enable certificates for metrics
+#     kind: Service
+#     version: v1
+#     name: controller-manager-metrics-service
+#     fieldPath: metadata.name
+#   targets:
+#     - select:
+#         kind: Certificate
+#         group: cert-manager.io
+#         version: v1
+#         name: metrics-certs
+#       fieldPaths:
+#         - spec.dnsNames.0
+#         - spec.dnsNames.1
+#       options:
+#         delimiter: '.'
+#         index: 0
+#         create: true
+#     - select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
+#         kind: ServiceMonitor
+#         group: monitoring.coreos.com
+#         version: v1
+#         name: controller-manager-metrics-monitor
+#       fieldPaths:
+#         - spec.endpoints.0.tlsConfig.serverName
+#       options:
+#         delimiter: '.'
+#         index: 0
+#         create: true
+
+# - source:
+#     kind: Service
+#     version: v1
+#     name: controller-manager-metrics-service
+#     fieldPath: metadata.namespace
+#   targets:
+#     - select:
+#         kind: Certificate
+#         group: cert-manager.io
+#         version: v1
+#         name: metrics-certs
+#       fieldPaths:
+#         - spec.dnsNames.0
+#         - spec.dnsNames.1
+#       options:
+#         delimiter: '.'
+#         index: 1
+#         create: true
+#     - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
+#         kind: ServiceMonitor
+#         group: monitoring.coreos.com
+#         version: v1
+#         name: controller-manager-metrics-monitor
+#       fieldPaths:
+#         - spec.endpoints.0.tlsConfig.serverName
+#       options:
+#         delimiter: '.'
+#         index: 1
+#         create: true
+
+# - source: # Uncomment the following block if you have any webhook
+#     kind: Service
+#     version: v1
+#     name: webhook-service
+#     fieldPath: .metadata.name # Name of the service
+#   targets:
+#     - select:
+#         kind: Certificate
+#         group: cert-manager.io
+#         version: v1
+#         name: serving-cert
+#       fieldPaths:
+#         - .spec.dnsNames.0
+#         - .spec.dnsNames.1
+#       options:
+#         delimiter: '.'
+#         index: 0
+#         create: true
+# - source:
+#     kind: Service
+#     version: v1
+#     name: webhook-service
+#     fieldPath: .metadata.namespace # Namespace of the service
+#   targets:
+#     - select:
+#         kind: Certificate
+#         group: cert-manager.io
+#         version: v1
+#         name: serving-cert
+#       fieldPaths:
+#         - .spec.dnsNames.0
+#         - .spec.dnsNames.1
+#       options:
+#         delimiter: '.'
+#         index: 1
+#         create: true
+
+# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation)
+#     kind: Certificate
+#     group: cert-manager.io
+#     version: v1
+#     name: serving-cert # This name should match the one in certificate.yaml
+#     fieldPath: .metadata.namespace # Namespace of the certificate CR
+#   targets:
+#     - select:
+#         kind: ValidatingWebhookConfiguration
+#       fieldPaths:
+#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
+#       options:
+#         delimiter: '/'
+#         index: 0
+#         create: true
+# - source:
+#     kind: Certificate
+#     group: cert-manager.io
+#     version: v1
+#     name: serving-cert
+#     fieldPath: .metadata.name
+#   targets:
+#     - select:
+#         kind: ValidatingWebhookConfiguration
+#       fieldPaths:
+#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
+#       options:
+#         delimiter: '/'
+#         index: 1
+#         create: true
+
+# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting )
+#     kind: Certificate
+#     group: cert-manager.io
+#     version: v1
+#     name: serving-cert
+#     fieldPath: .metadata.namespace # Namespace of the certificate CR
+#   targets:
+#     - select:
+#         kind: MutatingWebhookConfiguration
+#       fieldPaths:
+#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
+#       options:
+#         delimiter: '/'
+#         index: 0
+#         create: true
+# - source:
+#     kind: Certificate
+#     group: cert-manager.io
+#     version: v1
+#     name: serving-cert
+#     fieldPath: .metadata.name
+#   targets:
+#     - select:
+#         kind: MutatingWebhookConfiguration
+#       fieldPaths:
+#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
+#       options:
+#         delimiter: '/'
+#         index: 1
+#         create: true
+
+# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
+#     kind: Certificate
+#     group: cert-manager.io
+#     version: v1
+#     name: serving-cert
+#     fieldPath: .metadata.namespace # Namespace of the certificate CR
+#   targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
+# +kubebuilder:scaffold:crdkustomizecainjectionns
+# - source:
+#     kind: Certificate
+#     group: cert-manager.io
+#     version: v1
+#     name: serving-cert
+#     fieldPath: .metadata.name
+#   targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
+# +kubebuilder:scaffold:crdkustomizecainjectionname

config/default/manager_metrics_patch.yaml

@@ -0,0 +1,4 @@
+# This patch adds the args to allow exposing the metrics endpoint using HTTPS
+- op: add
+  path: /spec/template/spec/containers/0/args/0
+  value: --metrics-bind-address=:8443

config/default/metrics_service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: controller-manager-metrics-service
+  namespace: system
+spec:
+  ports:
+  - name: https
+    port: 8443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    control-plane: controller-manager
+    app.kubernetes.io/name: nuclei-operator

config/manager/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- manager.yaml

config/manager/manager.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+      app.kubernetes.io/name: nuclei-operator
+  replicas: 1
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
+      labels:
+        control-plane: controller-manager
+        app.kubernetes.io/name: nuclei-operator
+    spec:
+      # TODO(user): Uncomment the following code to configure the nodeAffinity expression
+      # according to the platforms which are supported by your solution.
+      # It is considered best practice to support multiple architectures. You can
+      # build your manager image using the makefile target docker-buildx.
+      # affinity:
+      #   nodeAffinity:
+      #     requiredDuringSchedulingIgnoredDuringExecution:
+      #       nodeSelectorTerms:
+      #         - matchExpressions:
+      #           - key: kubernetes.io/arch
+      #             operator: In
+      #             values:
+      #               - amd64
+      #               - arm64
+      #               - ppc64le
+      #               - s390x
+      #           - key: kubernetes.io/os
+      #             operator: In
+      #             values:
+      #               - linux
+      securityContext:
+        # Projects are configured by default to adhere to the "restricted" Pod Security Standards.
+        # This ensures that deployments meet the highest security requirements for Kubernetes.
+        # For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - command:
+        - /manager
+        args:
+          - --leader-elect
+          - --health-probe-bind-address=:8081
+        image: controller:latest
+        name: manager
+        ports: []
+        env:
+          - name: NUCLEI_BINARY_PATH
+            value: "/usr/local/bin/nuclei"
+          - name: NUCLEI_TEMPLATES_PATH
+            value: "/nuclei-templates"
+          - name: NUCLEI_TIMEOUT
+            value: "30m"
+        securityContext:
+          readOnlyRootFilesystem: false  # Nuclei needs to write temporary files
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 65532
+          capabilities:
+            drop:
+            - "ALL"
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        # Resource limits appropriate for running Nuclei scans
+        resources:
+          limits:
+            cpu: "2"
+            memory: "2Gi"
+          requests:
+            cpu: "500m"
+            memory: "512Mi"
+        volumeMounts:
+          - name: nuclei-templates
+            mountPath: /nuclei-templates
+            readOnly: true
+          - name: nuclei-cache
+            mountPath: /home/nonroot/.nuclei
+      volumes:
+        - name: nuclei-templates
+          emptyDir: {}
+        - name: nuclei-cache
+          emptyDir: {}
+      serviceAccountName: controller-manager
+      terminationGracePeriodSeconds: 10

config/network-policy/allow-metrics-traffic.yaml

@@ -0,0 +1,27 @@
+# This NetworkPolicy allows ingress traffic
+# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those
+# namespaces are able to gather data from the metrics endpoint.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: allow-metrics-traffic
+  namespace: system
+spec:
+  podSelector:
+    matchLabels:
+      control-plane: controller-manager
+      app.kubernetes.io/name: nuclei-operator
+  policyTypes:
+    - Ingress
+  ingress:
+    # This allows ingress traffic from any namespace with the label metrics: enabled
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            metrics: enabled  # Only from namespaces with this label
+      ports:
+        - port: 8443
+          protocol: TCP

config/network-policy/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- allow-metrics-traffic.yaml

config/production/kustomization.yaml

@@ -0,0 +1,34 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Reference the default configuration
+resources:
+  - ../default
+
+# Namespace for production deployment
+namespace: nuclei-operator-system
+
+# Common labels for all resources
+commonLabels:
+  environment: production
+
+# Production-specific patches
+patches:
+  - path: manager_patch.yaml
+    target:
+      kind: Deployment
+      name: controller-manager
+
+# Image configuration for production
+images:
+  - name: controller
+    newName: ghcr.io/mortenolsen/nuclei-operator
+    newTag: latest
+
+# ConfigMap generator for production settings
+configMapGenerator:
+  - name: nuclei-config
+    literals:
+      - NUCLEI_TIMEOUT=60m
+      - NUCLEI_RATE_LIMIT=150
+      - NUCLEI_BULK_SIZE=25

config/production/manager_patch.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+spec:
+  # Production replica count for high availability
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: manager
+          # Higher resource limits for production workloads
+          resources:
+            limits:
+              cpu: "4"
+              memory: "4Gi"
+            requests:
+              cpu: "1"
+              memory: "1Gi"
+          env:
+            # Production environment variables
+            - name: NUCLEI_BINARY_PATH
+              value: "/usr/local/bin/nuclei"
+            - name: NUCLEI_TEMPLATES_PATH
+              value: "/nuclei-templates"
+            - name: NUCLEI_TIMEOUT
+              value: "60m"
+            - name: NUCLEI_RATE_LIMIT
+              value: "150"
+            - name: NUCLEI_BULK_SIZE
+              value: "25"
+            - name: NUCLEI_CONCURRENCY
+              value: "25"
+            # Enable metrics
+            - name: ENABLE_METRICS
+              value: "true"
+          # Production volume mounts with persistent templates
+          volumeMounts:
+            - name: nuclei-templates
+              mountPath: /nuclei-templates
+              readOnly: true
+            - name: nuclei-cache
+              mountPath: /home/nonroot/.nuclei
+      # Production volumes - consider using PVC for templates in production
+      volumes:
+        - name: nuclei-templates
+          emptyDir: {}
+        - name: nuclei-cache
+          emptyDir: {}
+      # Pod anti-affinity for high availability
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    control-plane: controller-manager
+                topologyKey: kubernetes.io/hostname
+      # Topology spread for better distribution
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              control-plane: controller-manager

config/prometheus/kustomization.yaml

@@ -0,0 +1,11 @@
+resources:
+- monitor.yaml
+
+# [PROMETHEUS-WITH-CERTS] The following patch configures the ServiceMonitor in ../prometheus
+# to securely reference certificates created and managed by cert-manager.
+# Additionally, ensure that you uncomment the [METRICS WITH CERTMANAGER] patch under config/default/kustomization.yaml
+# to mount the "metrics-server-cert" secret in the Manager Deployment.
+#patches:
+#  - path: monitor_tls_patch.yaml
+#    target:
+#      kind: ServiceMonitor

config/prometheus/monitor.yaml

@@ -0,0 +1,27 @@
+# Prometheus Monitor Service (Metrics)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    control-plane: controller-manager
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: controller-manager-metrics-monitor
+  namespace: system
+spec:
+  endpoints:
+    - path: /metrics
+      port: https # Ensure this is the name of the port that exposes HTTPS metrics
+      scheme: https
+      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tlsConfig:
+        # TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
+        # certificate verification, exposing the system to potential man-in-the-middle attacks.
+        # For production environments, it is recommended to use cert-manager for automatic TLS certificate management.
+        # To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml,
+        # which securely references the certificate from the 'metrics-server-cert' secret.
+        insecureSkipVerify: true
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+      app.kubernetes.io/name: nuclei-operator

config/prometheus/monitor_tls_patch.yaml

@@ -0,0 +1,19 @@
+# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
+# using certificates managed by cert-manager
+- op: replace
+  path: /spec/endpoints/0/tlsConfig
+  value:
+    # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
+    serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
+    insecureSkipVerify: false
+    ca:
+      secret:
+        name: metrics-server-cert
+        key: ca.crt
+    cert:
+      secret:
+        name: metrics-server-cert
+        key: tls.crt
+    keySecret:
+      name: metrics-server-cert
+      key: tls.key

config/rbac/kustomization.yaml

@@ -0,0 +1,28 @@
+resources:
+# All RBAC will be applied under this service account in
+# the deployment namespace. You may comment out this resource
+# if your manager will use a service account that exists at
+# runtime. Be sure to update RoleBinding and ClusterRoleBinding
+# subjects if changing service account names.
+- service_account.yaml
+- role.yaml
+- role_binding.yaml
+- leader_election_role.yaml
+- leader_election_role_binding.yaml
+# The following RBAC configurations are used to protect
+# the metrics endpoint with authn/authz. These configurations
+# ensure that only authorized users and service accounts
+# can access the metrics endpoint. Comment the following
+# permissions if you want to disable this protection.
+# More info: https://book.kubebuilder.io/reference/metrics.html
+- metrics_auth_role.yaml
+- metrics_auth_role_binding.yaml
+- metrics_reader_role.yaml
+# For each CRD, "Admin", "Editor" and "Viewer" roles are scaffolded by
+# default, aiding admins in cluster management. Those roles are
+# not used by the nuclei-operator itself. You can comment the following lines
+# if you do not want those helpers be installed with your Project.
+- nucleiscan_admin_role.yaml
+- nucleiscan_editor_role.yaml
+- nucleiscan_viewer_role.yaml
+

config/rbac/leader_election_role.yaml

@@ -0,0 +1,40 @@
+# permissions to do leader election.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: leader-election-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch

config/rbac/leader_election_role_binding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: leader-election-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system

config/rbac/metrics_auth_role.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-auth-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create

config/rbac/metrics_auth_role_binding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-auth-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: metrics-auth-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system

config/rbac/metrics_reader_role.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-reader
+rules:
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get

config/rbac/nucleiscan_admin_role.yaml

@@ -0,0 +1,27 @@
+# This rule is not used by the project nuclei-operator itself.
+# It is provided to allow the cluster admin to help manage permissions for users.
+#
+# Grants full permissions ('*') over nuclei.homelab.mortenolsen.pro.
+# This role is intended for users authorized to modify roles and bindings within the cluster,
+# enabling them to delegate specific permissions to other users or groups as needed.
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: nucleiscan-admin-role
+rules:
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans
+  verbs:
+  - '*'
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans/status
+  verbs:
+  - get

config/rbac/nucleiscan_editor_role.yaml

@@ -0,0 +1,33 @@
+# This rule is not used by the project nuclei-operator itself.
+# It is provided to allow the cluster admin to help manage permissions for users.
+#
+# Grants permissions to create, update, and delete resources within the nuclei.homelab.mortenolsen.pro.
+# This role is intended for users who need to manage these resources
+# but should not control RBAC or manage permissions for others.
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: nucleiscan-editor-role
+rules:
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans/status
+  verbs:
+  - get

config/rbac/nucleiscan_viewer_role.yaml

@@ -0,0 +1,29 @@
+# This rule is not used by the project nuclei-operator itself.
+# It is provided to allow the cluster admin to help manage permissions for users.
+#
+# Grants read-only access to nuclei.homelab.mortenolsen.pro resources.
+# This role is intended for users who need visibility into these resources
+# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing.
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: nucleiscan-viewer-role
+rules:
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans/status
+  verbs:
+  - get

config/rbac/role.yaml

@@ -0,0 +1,67 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - networking.istio.io
+  resources:
+  - virtualservices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.istio.io
+  resources:
+  - virtualservices/status
+  verbs:
+  - get
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - get
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - nuclei.homelab.mortenolsen.pro
+  resources:
+  - nucleiscans/status
+  verbs:
+  - get
+  - patch
+  - update

config/rbac/role_binding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: manager-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system

config/rbac/service_account.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: controller-manager
+  namespace: system

config/samples/example-ingress.yaml

@@ -0,0 +1,75 @@
+# Example Ingress resource that would trigger NucleiScan creation
+# When this Ingress is created, the nuclei-operator will automatically
+# create a corresponding NucleiScan resource to scan the exposed endpoints.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: example-app-ingress
+  namespace: default
+  labels:
+    app.kubernetes.io/name: example-app
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    # Optional: Add annotations to customize scan behavior
+    # nuclei.homelab.mortenolsen.pro/scan-enabled: "true"
+    # nuclei.homelab.mortenolsen.pro/severity: "high,critical"
+    kubernetes.io/ingress.class: nginx
+spec:
+  # TLS configuration - endpoints will be scanned with HTTPS
+  tls:
+    - hosts:
+        - example.example.com
+        - api.example.com
+      secretName: example-tls-secret
+  rules:
+    # Main application endpoint
+    - host: example.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: example-app
+                port:
+                  number: 80
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: example-api
+                port:
+                  number: 8080
+    # API endpoint
+    - host: api.example.com
+      http:
+        paths:
+          - path: /v1
+            pathType: Prefix
+            backend:
+              service:
+                name: api-service
+                port:
+                  number: 8080
+---
+# Example Ingress without TLS (HTTP only)
+# This will be scanned with HTTP scheme
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: internal-app-ingress
+  namespace: default
+  labels:
+    app.kubernetes.io/name: internal-app
+spec:
+  rules:
+    - host: internal.example.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: internal-app
+                port:
+                  number: 80

config/samples/kustomization.yaml

@@ -0,0 +1,5 @@
+## Append samples of your project ##
+resources:
+- nuclei_v1alpha1_nucleiscan.yaml
+- example-ingress.yaml
+# +kubebuilder:scaffold:manifestskustomizesamples

config/samples/nuclei_v1alpha1_nucleiscan.yaml

@@ -0,0 +1,94 @@
+# Example NucleiScan resource
+# This demonstrates a complete NucleiScan configuration
+apiVersion: nuclei.homelab.mortenolsen.pro/v1alpha1
+kind: NucleiScan
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: nucleiscan-sample
+  namespace: default
+spec:
+  # Reference to the source resource that triggered this scan
+  # This is typically set automatically by the Ingress/VirtualService controllers
+  sourceRef:
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    name: example-ingress
+    namespace: default
+    uid: "placeholder-uid"
+  
+  # Target URLs to scan
+  # These are extracted from the source Ingress/VirtualService
+  targets:
+    - https://example.com
+    - https://example.com/api
+    - https://example.com/admin
+  
+  # Severity levels to include in the scan
+  # Options: info, low, medium, high, critical
+  severity:
+    - medium
+    - high
+    - critical
+  
+  # Optional: Specific Nuclei templates to use
+  # If not specified, all templates matching the severity will be used
+  templates:
+    - cves/
+    - vulnerabilities/
+    - exposures/
+  
+  # Optional: Schedule for periodic rescanning (cron format)
+  # Examples:
+  #   "0 2 * * *"     - Daily at 2 AM
+  #   "0 */6 * * *"   - Every 6 hours
+  #   "@every 24h"    - Every 24 hours (simplified format)
+  schedule: "@every 24h"
+  
+  # Optional: Suspend scheduled scans
+  # Set to true to pause scheduled scans without deleting the resource
+  suspend: false
+---
+# Example NucleiScan for a specific security audit
+apiVersion: nuclei.homelab.mortenolsen.pro/v1alpha1
+kind: NucleiScan
+metadata:
+  labels:
+    app.kubernetes.io/name: nuclei-operator
+    app.kubernetes.io/managed-by: kustomize
+    security-audit: "true"
+  name: security-audit-scan
+  namespace: default
+spec:
+  sourceRef:
+    apiVersion: networking.k8s.io/v1
+    kind: Ingress
+    name: production-ingress
+    namespace: production
+    uid: "audit-placeholder-uid"
+  
+  targets:
+    - https://api.example.com
+    - https://www.example.com
+  
+  # Full severity scan for security audit
+  severity:
+    - info
+    - low
+    - medium
+    - high
+    - critical
+  
+  # Comprehensive template coverage
+  templates:
+    - cves/
+    - vulnerabilities/
+    - exposures/
+    - misconfiguration/
+    - default-logins/
+  
+  # Weekly security audit
+  schedule: "0 3 * * 0"
+  
+  suspend: false