openvas-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: openvas
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openvas
  template:
    metadata:
      name: openvas
      labels:
        app: openvas
    spec:
      volumes:
      - name: redis-socket
        emptyDir: {}
      - name: nasl-plugins
        emptyDir: {}
      - name: notus-data
        emptyDir: {}
      - name: openvas-config
        emptyDir: {}
      - name: scan-config 
        emptyDir: {}
      - name: ospd-config
        emptyDir: {}
      - name: cacerts
        emptyDir: {}
      - name: ospd-logs
        emptyDir: {}
      initContainers:
      - name: scan-config
        image: greenbone/data-objects
        imagePullPolicy: Always
        env:
          - name: POLICY_ROOT
            value: "find /var/lib/gvm/data-objects/gvmd/*/*configs -type d"
        volumeMounts:
          - name: scan-config
            mountPath: /mnt
        command: ['sh', '-c']
        args: ['install -D -v -m 777 $($POLICY_ROOT | sort -r | head -n 1)/* -t /mnt']
      - name: nasl
        image: greenbone/vulnerability-tests
        imagePullPolicy: Always
        volumeMounts:
          - name: nasl-plugins
            mountPath: /mnt/nasl
        command: ['sh', '-c']
        args: ['cp -rv /var/lib/openvas/22.04/vt-data/nasl/* /mnt/nasl/']
      - name: notus-advisories
        image: greenbone/notus-data
        imagePullPolicy: Always
        volumeMounts:
          - name: notus-data
            mountPath: /mnt/notus
        command: ['cp', '-rv', '/var/lib/notus/advisories', '/mnt/notus/']
      - name: notus-products
        image: greenbone/notus-data
        imagePullPolicy: Always
        volumeMounts:
          - name: notus-data
            mountPath: /mnt/notus
        command: ['cp', '-rv', '/var/lib/notus/products', '/mnt/notus/']
      - name: mqtt-broker-openvas-fix
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        volumeMounts:
          - name: openvas-config
            mountPath: /mnt/ovc
        command: ['sh', '-c']
        args: ["sed 's/mqtt-broker/localhost/' /etc/openvas/openvas.conf > /mnt/ovc/openvas.conf; cp /etc/openvas/openvas_log.conf /mnt/ovc/"]
      - name: ospd-tcp-configuration
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        volumeMounts:
          - name: ospd-config
            mountPath: /mnt/ovc
        command: ['sh', '-c']
        args: ["sed 's/unix_socket =.*/bind_address = 0.0.0.0\\nport = 4242/' /etc/gvm/ospd-openvas.conf > /mnt/ovc/ospd-openvas.conf"]
      - name: ospd-disable-notus-hashsum-verification #since can mount local volumes which may be altered we have to disable hashsum verification for notus  
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        volumeMounts:
          - name: ospd-config
            mountPath: /mnt/ovc
        command: ['sh', '-c']
        args: ["printf \"disable_notus_hashsum_verification = True\n\" >> /mnt/ovc/ospd-openvas.conf"]
      - name: create-self-signed-certificates
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        volumeMounts:
          - name: cacerts
            mountPath: /mnt/vlg
        command: ['sh', '-c']
        args: ["mkdir -p /mnt/vlg/CA && mkdir -p /mnt/vlg/private/CA && openssl req -x509 -newkey rsa:4096 -keyout /mnt/vlg/private/CA/serverkey.pem -out /mnt/vlg/CA/cacert.pem -nodes -subj '/CN=localhost' -addext 'subjectAltName = DNS:localhost' -days 365 && cp /mnt/vlg/CA/cacert.pem /mnt/vlg/CA/servercert.pem && chown -R ospd-openvas:ospd-openvas /mnt/vlg/"]
      - name: create-dummy-openvas-log
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        volumeMounts:
          - name: ospd-logs
            mountPath: /mnt/ovc
        command: ['sh', '-c']
        args: ["touch /mnt/ovc/openvas.log && chown ospd-openvas:ospd-openvas /mnt/ovc/openvas.log"]
      containers:
      - name: broker
        image: greenbone/mqtt-broker
        imagePullPolicy: Always
      - name: redis
        image: greenbone/redis-server
        imagePullPolicy: Always
        volumeMounts:
        - name: redis-socket
          mountPath: /run/redis
      # although the main purpose is to display openvas logs 
      # we make it as ospd so that there is a container running
      # to play around
      - name: openvas
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        command: [ "tail", "-f", "/var/log/gvm/openvas.log" ]
        volumeMounts:
        - name: scan-config
          mountPath: /usr/local/src/policies
        - name: redis-socket
          mountPath: /run/redis
        - name: nasl-plugins
          mountPath: /var/lib/openvas/plugins
        - name: notus-data
          mountPath: /var/lib/notus
        - name: openvas-config
          mountPath: /etc/openvas
        - name: ospd-config
          mountPath: /etc/gvm/
        - name: cacerts
          mountPath: /var/lib/gvm
        - name: ospd-logs
          mountPath: /var/log/gvm
        securityContext:
          capabilities:
            add:
              - NET_ADMIN
              - NET_RAW
      - name: ospd
        image: greenbone/ospd-openvas:unstable
        imagePullPolicy: Always
        resources:
          limits:
            cpu: "8"
          requests:
            cpu: "0.9"
        ports:
          - containerPort: 4242
        volumeMounts:
        - name: scan-config
          mountPath: /usr/local/src/policies
        - name: redis-socket
          mountPath: /run/redis
        - name: nasl-plugins
          mountPath: /var/lib/openvas/plugins
        - name: notus-data
          mountPath: /var/lib/notus
        - name: openvas-config
          mountPath: /etc/openvas
        - name: ospd-config
          mountPath: /etc/gvm/
        - name: cacerts
          mountPath: /var/lib/gvm
        - name: ospd-logs
          mountPath: /var/log/gvm
        securityContext:
          capabilities:
            add:
              - NET_ADMIN
              - NET_RAW
      - name: notus
        image: greenbone/notus-scanner:unstable
        imagePullPolicy: Always
        volumeMounts:
        - name: notus-data
          mountPath: /var/lib/notus
        command: ["notus-scanner", "-f", "--disable-hashsum-verification=True"]
---
apiVersion: v1
kind: Service
metadata:
  name: ospd-tcp
spec:
  selector:
    app: openvas
  ports:
    - protocol: TCP
      port: 4242
      targetPort: 4242