Skip to content

Commit 8160f9f

Browse files
wallrj-cyberarkwallrj-cyberark
committed
Add cluster name and description to CyberArk Discovery and Context snapshot
- Add ClusterName and ClusterDescription fields to Snapshot struct - Populate these fields from Options in PostDataReadingsWithOptions - Add clusterName and clusterDescription Helm values and docs - Populate cluster_id and cluster_description in the rendered configmap - Update values.schema.json to include descriptions for the new values - Add ClusterDescription field to pkg/agent Config and CombinedConfig - Default MachineHub cluster ID from ARK_USERNAME env when not set - Clarify comments and add TODO about ClusterID vs ClusterName naming Signed-off-by: Richard Wall <richard.wall@cyberark.com>
1 parent 0ae6dbd commit 8160f9f

File tree

10 files changed

+343
-12
lines changed

10 files changed

+343
-12
lines changed

‎deploy/charts/disco-agent/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,24 @@ Example: excludeAnnotationKeysRegex: ['^kapp\.k14s\.io/original.*']
277277
> ```yaml
278278
> []
279279
> ```
280+
#### **config.clusterName** ~ `string`
281+
> Default value:
282+
> ```yaml
283+
> ""
284+
> ```
285+
286+
A human readable name for the cluster where the agent is deployed (optional).
287+
288+
This cluster name will be associated with the data that the agent uploads to the Discovery and Context service. If empty (the default), the service account name will be used instead.
289+
#### **config.clusterDescription** ~ `string`
290+
> Default value:
291+
> ```yaml
292+
> ""
293+
> ```
294+
295+
A short description of the cluster where the agent is deployed (optional).
296+
297+
This description will be associated with the data that the agent uploads to the Discovery and Context service. The description should include contact information such as the email address of the cluster administrator, so that any problems and risks identified by the Discovery and Context service can be communicated to the people responsible for the affected secrets.
280298
#### **authentication.secretName** ~ `string`
281299
> Default value:
282300
> ```yaml

‎deploy/charts/disco-agent/templates/configmap.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
{{- include "disco-agent.labels" . | nindent 4 }}
88
data:
99
config.yaml: |-
10+
cluster_id: {{ .Values.config.clusterName | quote }}
11+
cluster_description: {{ .Values.config.clusterDescription | quote }}
1012
period: {{ .Values.config.period | quote }}
1113
{{- with .Values.config.excludeAnnotationKeysRegex }}
1214
exclude-annotation-keys-regex:

‎deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,224 @@
1+
custom-cluster-description:
2+
1: |
3+
apiVersion: v1
4+
data:
5+
config.yaml: |-
6+
cluster_id: ""
7+
cluster_description: "A cloud hosted Kubernetes cluster hosting production workloads.\n\nteam: team-1\nemail: team-1@example.com\npurpose: Production workloads\n"
8+
period: "12h0m0s"
9+
data-gatherers:
10+
- kind: k8s-discovery
11+
name: ark/discovery
12+
- kind: k8s-dynamic
13+
name: ark/secrets
14+
config:
15+
resource-type:
16+
version: v1
17+
resource: secrets
18+
field-selectors:
19+
- type!=kubernetes.io/dockercfg
20+
- type!=kubernetes.io/dockerconfigjson
21+
- type!=bootstrap.kubernetes.io/token
22+
- type!=helm.sh/release.v1
23+
- kind: k8s-dynamic
24+
name: ark/serviceaccounts
25+
config:
26+
resource-type:
27+
resource: serviceaccounts
28+
version: v1
29+
- kind: k8s-dynamic
30+
name: ark/roles
31+
config:
32+
resource-type:
33+
version: v1
34+
group: rbac.authorization.k8s.io
35+
resource: roles
36+
- kind: k8s-dynamic
37+
name: ark/clusterroles
38+
config:
39+
resource-type:
40+
version: v1
41+
group: rbac.authorization.k8s.io
42+
resource: clusterroles
43+
- kind: k8s-dynamic
44+
name: ark/rolebindings
45+
config:
46+
resource-type:
47+
version: v1
48+
group: rbac.authorization.k8s.io
49+
resource: rolebindings
50+
- kind: k8s-dynamic
51+
name: ark/clusterrolebindings
52+
config:
53+
resource-type:
54+
version: v1
55+
group: rbac.authorization.k8s.io
56+
resource: clusterrolebindings
57+
- kind: k8s-dynamic
58+
name: ark/jobs
59+
config:
60+
resource-type:
61+
version: v1
62+
group: batch
63+
resource: jobs
64+
- kind: k8s-dynamic
65+
name: ark/cronjobs
66+
config:
67+
resource-type:
68+
version: v1
69+
group: batch
70+
resource: cronjobs
71+
- kind: k8s-dynamic
72+
name: ark/deployments
73+
config:
74+
resource-type:
75+
version: v1
76+
group: apps
77+
resource: deployments
78+
- kind: k8s-dynamic
79+
name: ark/statefulsets
80+
config:
81+
resource-type:
82+
version: v1
83+
group: apps
84+
resource: statefulsets
85+
- kind: k8s-dynamic
86+
name: ark/daemonsets
87+
config:
88+
resource-type:
89+
version: v1
90+
group: apps
91+
resource: daemonsets
92+
- kind: k8s-dynamic
93+
name: ark/pods
94+
config:
95+
resource-type:
96+
version: v1
97+
resource: pods
98+
kind: ConfigMap
99+
metadata:
100+
labels:
101+
app.kubernetes.io/instance: test
102+
app.kubernetes.io/managed-by: Helm
103+
app.kubernetes.io/name: disco-agent
104+
app.kubernetes.io/version: v0.0.0
105+
helm.sh/chart: disco-agent-0.0.0
106+
name: test-disco-agent-config
107+
namespace: test-ns
108+
custom-cluster-name:
109+
1: |
110+
apiVersion: v1
111+
data:
112+
config.yaml: |-
113+
cluster_id: "cluster-1 region-1 cloud-1 "
114+
cluster_description: ""
115+
period: "12h0m0s"
116+
data-gatherers:
117+
- kind: k8s-discovery
118+
name: ark/discovery
119+
- kind: k8s-dynamic
120+
name: ark/secrets
121+
config:
122+
resource-type:
123+
version: v1
124+
resource: secrets
125+
field-selectors:
126+
- type!=kubernetes.io/dockercfg
127+
- type!=kubernetes.io/dockerconfigjson
128+
- type!=bootstrap.kubernetes.io/token
129+
- type!=helm.sh/release.v1
130+
- kind: k8s-dynamic
131+
name: ark/serviceaccounts
132+
config:
133+
resource-type:
134+
resource: serviceaccounts
135+
version: v1
136+
- kind: k8s-dynamic
137+
name: ark/roles
138+
config:
139+
resource-type:
140+
version: v1
141+
group: rbac.authorization.k8s.io
142+
resource: roles
143+
- kind: k8s-dynamic
144+
name: ark/clusterroles
145+
config:
146+
resource-type:
147+
version: v1
148+
group: rbac.authorization.k8s.io
149+
resource: clusterroles
150+
- kind: k8s-dynamic
151+
name: ark/rolebindings
152+
config:
153+
resource-type:
154+
version: v1
155+
group: rbac.authorization.k8s.io
156+
resource: rolebindings
157+
- kind: k8s-dynamic
158+
name: ark/clusterrolebindings
159+
config:
160+
resource-type:
161+
version: v1
162+
group: rbac.authorization.k8s.io
163+
resource: clusterrolebindings
164+
- kind: k8s-dynamic
165+
name: ark/jobs
166+
config:
167+
resource-type:
168+
version: v1
169+
group: batch
170+
resource: jobs
171+
- kind: k8s-dynamic
172+
name: ark/cronjobs
173+
config:
174+
resource-type:
175+
version: v1
176+
group: batch
177+
resource: cronjobs
178+
- kind: k8s-dynamic
179+
name: ark/deployments
180+
config:
181+
resource-type:
182+
version: v1
183+
group: apps
184+
resource: deployments
185+
- kind: k8s-dynamic
186+
name: ark/statefulsets
187+
config:
188+
resource-type:
189+
version: v1
190+
group: apps
191+
resource: statefulsets
192+
- kind: k8s-dynamic
193+
name: ark/daemonsets
194+
config:
195+
resource-type:
196+
version: v1
197+
group: apps
198+
resource: daemonsets
199+
- kind: k8s-dynamic
200+
name: ark/pods
201+
config:
202+
resource-type:
203+
version: v1
204+
resource: pods
205+
kind: ConfigMap
206+
metadata:
207+
labels:
208+
app.kubernetes.io/instance: test
209+
app.kubernetes.io/managed-by: Helm
210+
app.kubernetes.io/name: disco-agent
211+
app.kubernetes.io/version: v0.0.0
212+
helm.sh/chart: disco-agent-0.0.0
213+
name: test-disco-agent-config
214+
namespace: test-ns
1215
custom-period:
2216
1: |
3217
apiVersion: v1
4218
data:
5219
config.yaml: |-
220+
cluster_id: ""
221+
cluster_description: ""
6222
period: "1m"
7223
data-gatherers:
8224
- kind: k8s-discovery
@@ -108,6 +324,8 @@ defaults:
108324
apiVersion: v1
109325
data:
110326
config.yaml: |-
327+
cluster_id: ""
328+
cluster_description: ""
111329
period: "12h0m0s"
112330
data-gatherers:
113331
- kind: k8s-discovery

‎deploy/charts/disco-agent/tests/configmap_test.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,20 @@ tests:
1414
config.period: 1m
1515
asserts:
1616
- matchSnapshot: {}
17+
18+
- it: custom-cluster-name
19+
set:
20+
config.clusterName: "cluster-1 region-1 cloud-1 "
21+
asserts:
22+
- matchSnapshot: {}
23+
24+
- it: custom-cluster-description
25+
set:
26+
config.clusterDescription: |
27+
A cloud hosted Kubernetes cluster hosting production workloads.
28+
29+
team: team-1
30+
email: team-1@example.com
31+
purpose: Production workloads
32+
asserts:
33+
- matchSnapshot: {}

‎deploy/charts/disco-agent/values.schema.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,12 @@
104104
"helm-values.config": {
105105
"additionalProperties": false,
106106
"properties": {
107+
"clusterDescription": {
108+
"$ref": "#/$defs/helm-values.config.clusterDescription"
109+
},
110+
"clusterName": {
111+
"$ref": "#/$defs/helm-values.config.clusterName"
112+
},
107113
"excludeAnnotationKeysRegex": {
108114
"$ref": "#/$defs/helm-values.config.excludeAnnotationKeysRegex"
109115
},
@@ -116,6 +122,16 @@
116122
},
117123
"type": "object"
118124
},
125+
"helm-values.config.clusterDescription": {
126+
"default": "",
127+
"description": "A short description of the cluster where the agent is deployed (optional).\n\nThis description will be associated with the data that the agent uploads to the Discovery and Context service. The description should include contact information such as the email address of the cluster administrator, so that any problems and risks identified by the Discovery and Context service can be communicated to the people responsible for the affected secrets.",
128+
"type": "string"
129+
},
130+
"helm-values.config.clusterName": {
131+
"default": "",
132+
"description": "A human readable name for the cluster where the agent is deployed (optional).\n\nThis cluster name will be associated with the data that the agent uploads to the Discovery and Context service. If empty (the default), the service account name will be used instead.",
133+
"type": "string"
134+
},
119135
"helm-values.config.excludeAnnotationKeysRegex": {
120136
"default": [],
121137
"description": "You can configure the agent to exclude some annotations or labels from being pushed . All Kubernetes objects are affected. The objects are still pushed, but the specified annotations and labels are removed before being pushed.\n\nDots is the only character that needs to be escaped in the regex. Use either double quotes with escaped single quotes or unquoted strings for the regex to avoid YAML parsing issues with `\\.`.\n\nExample: excludeAnnotationKeysRegex: ['^kapp\\.k14s\\.io/original.*']",

‎deploy/charts/disco-agent/values.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,22 @@ config:
138138
excludeAnnotationKeysRegex: []
139139
excludeLabelKeysRegex: []
140140

141+
# A human readable name for the cluster where the agent is deployed (optional).
142+
#
143+
# This cluster name will be associated with the data that the agent uploads to
144+
# the Discovery and Context service. If empty (the default), the service
145+
# account name will be used instead.
146+
clusterName: ""
147+
148+
# A short description of the cluster where the agent is deployed (optional).
149+
#
150+
# This description will be associated with the data that the agent uploads to
151+
# the Discovery and Context service. The description should include contact
152+
# information such as the email address of the cluster administrator, so that
153+
# any problems and risks identified by the Discovery and Context service can
154+
# be communicated to the people responsible for the affected secrets.
155+
clusterDescription: ""
156+
141157
authentication:
142158
secretName: agent-credentials
143159

‎internal/cyberark/dataupload/dataupload.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,10 @@ type Snapshot struct {
5151
AgentVersion string `json:"agent_version"`
5252
// ClusterID is the unique ID of the Kubernetes cluster which this snapshot was taken from.
5353
ClusterID string `json:"cluster_id"`
54+
// ClusterName is the name of the Kubernetes cluster which this snapshot was taken from.
55+
ClusterName string `json:"cluster_name"`
56+
// ClusterDescription is an optional description of the Kubernetes cluster which this snapshot was taken from.
57+
ClusterDescription string `json:"cluster_description,omitempty"`
5458
// K8SVersion is the version of Kubernetes which the cluster is running.
5559
K8SVersion string `json:"k8s_version"`
5660
// Secrets is a list of Secret resources in the cluster. Not all Secret

0 commit comments

Comments
 (0)