Initial commit

2026-08-20 23:16:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,134 @@
+# Nessus Vulnerability Scanner Deployment
+# Optimized for low resource usage in constrained environments
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nessus
+  namespace: nessus
+  labels:
+    app: nessus
+    app.kubernetes.io/name: nessus
+    app.kubernetes.io/component: security-scanner
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate  # Only one instance can mount the PVC at a time
+  selector:
+    matchLabels:
+      app: nessus
+  template:
+    metadata:
+      labels:
+        app: nessus
+      annotations:
+        # Reloader auto-restart when secrets change
+        secret.reloader.stakater.com/reload: "nessus-admin-credentials"
+    spec:
+      containers:
+        - name: nessus
+          image: docker.io/tenable/nessus:10.8.3-ubuntu
+          imagePullPolicy: IfNotPresent
+          
+          # Low resource configuration for constrained environments
+          resources:
+            requests:
+              memory: "1Gi"
+              cpu: "50m"
+            limits:
+              memory: "2Gi"
+          
+          ports:
+            - name: https
+              containerPort: 8834
+              protocol: TCP
+          
+          # Environment variables for Nessus configuration
+          env:
+            # Admin credentials from Vault (via ESO)
+            - name: USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: nessus-admin-credentials
+                  key: NESSUS_USERNAME
+            - name: PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nessus-admin-credentials
+                  key: NESSUS_PASSWORD
+            
+            # Auto-update settings (plugins only to save bandwidth/time)
+            - name: AUTO_UPDATE
+              value: "plugins"
+          
+          # Volume mounts for persistent data
+          volumeMounts:
+            - name: nessus-data
+              mountPath: /opt/nessus/var/nessus
+          
+          # Startup probe - give Nessus time to initialize
+          startupProbe:
+            httpGet:
+              path: /
+              port: 8834
+              scheme: HTTPS
+            initialDelaySeconds: 60
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 60  # 15 minutes total startup time
+          
+          # Liveness probe
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 8834
+              scheme: HTTPS
+            initialDelaySeconds: 300
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 5
+          
+          # Readiness probe
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8834
+              scheme: HTTPS
+            initialDelaySeconds: 120
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 5
+          
+          # Security context
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: false  # Nessus requires root
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_ADMIN  # Required for network scanning
+                - NET_RAW    # Required for raw socket scanning
+      
+      volumes:
+        - name: nessus-data
+          persistentVolumeClaim:
+            claimName: nessus-data
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nessus
+  namespace: nessus
+  labels:
+    app: nessus
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 8834
+      targetPort: 8834
+      protocol: TCP
+  selector:
+    app: nessus