Skip to content

Commit a8f7fe8

Browse files
wallrj-cyberarkwallrj-cyberark
committed
Add cluster name and description to CyberArk Discovery and Context snapshot
The purpose of the change is to give Discovery and Context service operators a clear way to communicate uploaded secret findings and remediations with a team or contact for the origin cluster, by allowing the platform-team to supply these new configuration values when they deploy the agent: - `config.clusterName` — a human‑readable cluster name, and - `config.clusterDescription` — a short description (contact info, purpose). These new fields are optional. If the clusterName is empty, the `ARK_USERNAME` is used as the cluster-name. The rationale is that each agent deployment will be assigned a unique "service account" which should be given a username derived from the name of the target cluster. Therefore the service account username will be sufficient information for the security team to communicate risks and remediations to the platform team responsible for the cluster. This provides an imperfect, but expedient improvement for Web UI users and support for on‑prem / non‑cloud deployments which can be improved in future if with more backend/ cloud discovery work. It wasn't strictly necessary, but I also tried to sort out the confusion around the `cluster_id` and the `cluster_name`. I've added a new `cluster_name` field to the config file and updated the `venafi-kubernetes-agent` chart to set that config field instead of the overloading the `cluster_id` field which is used for other purposes by the much older Jetstack Secure agent. Summary of changes: - Add ClusterName and ClusterDescription fields to Snapshot struct - Populate these fields from Options in PostDataReadingsWithOptions - Add clusterName and clusterDescription Helm values and docs - Populate cluster_id and cluster_description in the rendered configmap - Update values.schema.json to include descriptions for the new values - Add ClusterDescription field to pkg/agent Config and CombinedConfig - Default MachineHub cluster name from ARK_USERNAME env when not set Signed-off-by: Richard Wall <richard.wall@cyberark.com>
1 parent 0ae6dbd commit a8f7fe8

File tree

19 files changed

+1647
-38
lines changed

19 files changed

+1647
-38
lines changed

‎deploy/charts/disco-agent/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,24 @@ Example: excludeAnnotationKeysRegex: ['^kapp\.k14s\.io/original.*']
277277
> ```yaml
278278
> []
279279
> ```
280+
#### **config.clusterName** ~ `string`
281+
> Default value:
282+
> ```yaml
283+
> ""
284+
> ```
285+
286+
A human readable name for the cluster where the agent is deployed (optional).
287+
288+
This cluster name will be associated with the data that the agent uploads to the Discovery and Context service. If empty (the default), the service account name will be used instead.
289+
#### **config.clusterDescription** ~ `string`
290+
> Default value:
291+
> ```yaml
292+
> ""
293+
> ```
294+
295+
A short description of the cluster where the agent is deployed (optional).
296+
297+
This description will be associated with the data that the agent uploads to the Discovery and Context service. The description may include contact information such as the email address of the cluster administrator, so that any problems and risks identified by the Discovery and Context service can be communicated to the people responsible for the affected secrets.
280298
#### **authentication.secretName** ~ `string`
281299
> Default value:
282300
> ```yaml

‎deploy/charts/disco-agent/templates/configmap.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ metadata:
77
{{- include "disco-agent.labels" . | nindent 4 }}
88
data:
99
config.yaml: |-
10+
cluster_name: {{ .Values.config.clusterName | quote }}
11+
cluster_description: {{ .Values.config.clusterDescription | quote }}
1012
period: {{ .Values.config.period | quote }}
1113
{{- with .Values.config.excludeAnnotationKeysRegex }}
1214
exclude-annotation-keys-regex:

‎deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,224 @@
1+
custom-cluster-description:
2+
1: |
3+
apiVersion: v1
4+
data:
5+
config.yaml: |-
6+
cluster_name: ""
7+
cluster_description: "A cloud hosted Kubernetes cluster hosting production workloads.\n\nteam: team-1\nemail: team-1@example.com\npurpose: Production workloads\n"
8+
period: "12h0m0s"
9+
data-gatherers:
10+
- kind: k8s-discovery
11+
name: ark/discovery
12+
- kind: k8s-dynamic
13+
name: ark/secrets
14+
config:
15+
resource-type:
16+
version: v1
17+
resource: secrets
18+
field-selectors:
19+
- type!=kubernetes.io/dockercfg
20+
- type!=kubernetes.io/dockerconfigjson
21+
- type!=bootstrap.kubernetes.io/token
22+
- type!=helm.sh/release.v1
23+
- kind: k8s-dynamic
24+
name: ark/serviceaccounts
25+
config:
26+
resource-type:
27+
resource: serviceaccounts
28+
version: v1
29+
- kind: k8s-dynamic
30+
name: ark/roles
31+
config:
32+
resource-type:
33+
version: v1
34+
group: rbac.authorization.k8s.io
35+
resource: roles
36+
- kind: k8s-dynamic
37+
name: ark/clusterroles
38+
config:
39+
resource-type:
40+
version: v1
41+
group: rbac.authorization.k8s.io
42+
resource: clusterroles
43+
- kind: k8s-dynamic
44+
name: ark/rolebindings
45+
config:
46+
resource-type:
47+
version: v1
48+
group: rbac.authorization.k8s.io
49+
resource: rolebindings
50+
- kind: k8s-dynamic
51+
name: ark/clusterrolebindings
52+
config:
53+
resource-type:
54+
version: v1
55+
group: rbac.authorization.k8s.io
56+
resource: clusterrolebindings
57+
- kind: k8s-dynamic
58+
name: ark/jobs
59+
config:
60+
resource-type:
61+
version: v1
62+
group: batch
63+
resource: jobs
64+
- kind: k8s-dynamic
65+
name: ark/cronjobs
66+
config:
67+
resource-type:
68+
version: v1
69+
group: batch
70+
resource: cronjobs
71+
- kind: k8s-dynamic
72+
name: ark/deployments
73+
config:
74+
resource-type:
75+
version: v1
76+
group: apps
77+
resource: deployments
78+
- kind: k8s-dynamic
79+
name: ark/statefulsets
80+
config:
81+
resource-type:
82+
version: v1
83+
group: apps
84+
resource: statefulsets
85+
- kind: k8s-dynamic
86+
name: ark/daemonsets
87+
config:
88+
resource-type:
89+
version: v1
90+
group: apps
91+
resource: daemonsets
92+
- kind: k8s-dynamic
93+
name: ark/pods
94+
config:
95+
resource-type:
96+
version: v1
97+
resource: pods
98+
kind: ConfigMap
99+
metadata:
100+
labels:
101+
app.kubernetes.io/instance: test
102+
app.kubernetes.io/managed-by: Helm
103+
app.kubernetes.io/name: disco-agent
104+
app.kubernetes.io/version: v0.0.0
105+
helm.sh/chart: disco-agent-0.0.0
106+
name: test-disco-agent-config
107+
namespace: test-ns
108+
custom-cluster-name:
109+
1: |
110+
apiVersion: v1
111+
data:
112+
config.yaml: |-
113+
cluster_name: "cluster-1 region-1 cloud-1 "
114+
cluster_description: ""
115+
period: "12h0m0s"
116+
data-gatherers:
117+
- kind: k8s-discovery
118+
name: ark/discovery
119+
- kind: k8s-dynamic
120+
name: ark/secrets
121+
config:
122+
resource-type:
123+
version: v1
124+
resource: secrets
125+
field-selectors:
126+
- type!=kubernetes.io/dockercfg
127+
- type!=kubernetes.io/dockerconfigjson
128+
- type!=bootstrap.kubernetes.io/token
129+
- type!=helm.sh/release.v1
130+
- kind: k8s-dynamic
131+
name: ark/serviceaccounts
132+
config:
133+
resource-type:
134+
resource: serviceaccounts
135+
version: v1
136+
- kind: k8s-dynamic
137+
name: ark/roles
138+
config:
139+
resource-type:
140+
version: v1
141+
group: rbac.authorization.k8s.io
142+
resource: roles
143+
- kind: k8s-dynamic
144+
name: ark/clusterroles
145+
config:
146+
resource-type:
147+
version: v1
148+
group: rbac.authorization.k8s.io
149+
resource: clusterroles
150+
- kind: k8s-dynamic
151+
name: ark/rolebindings
152+
config:
153+
resource-type:
154+
version: v1
155+
group: rbac.authorization.k8s.io
156+
resource: rolebindings
157+
- kind: k8s-dynamic
158+
name: ark/clusterrolebindings
159+
config:
160+
resource-type:
161+
version: v1
162+
group: rbac.authorization.k8s.io
163+
resource: clusterrolebindings
164+
- kind: k8s-dynamic
165+
name: ark/jobs
166+
config:
167+
resource-type:
168+
version: v1
169+
group: batch
170+
resource: jobs
171+
- kind: k8s-dynamic
172+
name: ark/cronjobs
173+
config:
174+
resource-type:
175+
version: v1
176+
group: batch
177+
resource: cronjobs
178+
- kind: k8s-dynamic
179+
name: ark/deployments
180+
config:
181+
resource-type:
182+
version: v1
183+
group: apps
184+
resource: deployments
185+
- kind: k8s-dynamic
186+
name: ark/statefulsets
187+
config:
188+
resource-type:
189+
version: v1
190+
group: apps
191+
resource: statefulsets
192+
- kind: k8s-dynamic
193+
name: ark/daemonsets
194+
config:
195+
resource-type:
196+
version: v1
197+
group: apps
198+
resource: daemonsets
199+
- kind: k8s-dynamic
200+
name: ark/pods
201+
config:
202+
resource-type:
203+
version: v1
204+
resource: pods
205+
kind: ConfigMap
206+
metadata:
207+
labels:
208+
app.kubernetes.io/instance: test
209+
app.kubernetes.io/managed-by: Helm
210+
app.kubernetes.io/name: disco-agent
211+
app.kubernetes.io/version: v0.0.0
212+
helm.sh/chart: disco-agent-0.0.0
213+
name: test-disco-agent-config
214+
namespace: test-ns
1215
custom-period:
2216
1: |
3217
apiVersion: v1
4218
data:
5219
config.yaml: |-
220+
cluster_name: ""
221+
cluster_description: ""
6222
period: "1m"
7223
data-gatherers:
8224
- kind: k8s-discovery
@@ -108,6 +324,8 @@ defaults:
108324
apiVersion: v1
109325
data:
110326
config.yaml: |-
327+
cluster_name: ""
328+
cluster_description: ""
111329
period: "12h0m0s"
112330
data-gatherers:
113331
- kind: k8s-discovery

‎deploy/charts/disco-agent/tests/configmap_test.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,20 @@ tests:
1414
config.period: 1m
1515
asserts:
1616
- matchSnapshot: {}
17+
18+
- it: custom-cluster-name
19+
set:
20+
config.clusterName: "cluster-1 region-1 cloud-1 "
21+
asserts:
22+
- matchSnapshot: {}
23+
24+
- it: custom-cluster-description
25+
set:
26+
config.clusterDescription: |
27+
A cloud hosted Kubernetes cluster hosting production workloads.
28+
29+
team: team-1
30+
email: team-1@example.com
31+
purpose: Production workloads
32+
asserts:
33+
- matchSnapshot: {}

‎deploy/charts/disco-agent/values.schema.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,12 @@
104104
"helm-values.config": {
105105
"additionalProperties": false,
106106
"properties": {
107+
"clusterDescription": {
108+
"$ref": "#/$defs/helm-values.config.clusterDescription"
109+
},
110+
"clusterName": {
111+
"$ref": "#/$defs/helm-values.config.clusterName"
112+
},
107113
"excludeAnnotationKeysRegex": {
108114
"$ref": "#/$defs/helm-values.config.excludeAnnotationKeysRegex"
109115
},
@@ -116,6 +122,16 @@
116122
},
117123
"type": "object"
118124
},
125+
"helm-values.config.clusterDescription": {
126+
"default": "",
127+
"description": "A short description of the cluster where the agent is deployed (optional).\n\nThis description will be associated with the data that the agent uploads to the Discovery and Context service. The description may include contact information such as the email address of the cluster administrator, so that any problems and risks identified by the Discovery and Context service can be communicated to the people responsible for the affected secrets.",
128+
"type": "string"
129+
},
130+
"helm-values.config.clusterName": {
131+
"default": "",
132+
"description": "A human readable name for the cluster where the agent is deployed (optional).\n\nThis cluster name will be associated with the data that the agent uploads to the Discovery and Context service. If empty (the default), the service account name will be used instead.",
133+
"type": "string"
134+
},
119135
"helm-values.config.excludeAnnotationKeysRegex": {
120136
"default": [],
121137
"description": "You can configure the agent to exclude some annotations or labels from being pushed . All Kubernetes objects are affected. The objects are still pushed, but the specified annotations and labels are removed before being pushed.\n\nDots is the only character that needs to be escaped in the regex. Use either double quotes with escaped single quotes or unquoted strings for the regex to avoid YAML parsing issues with `\\.`.\n\nExample: excludeAnnotationKeysRegex: ['^kapp\\.k14s\\.io/original.*']",

‎deploy/charts/disco-agent/values.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,22 @@ config:
138138
excludeAnnotationKeysRegex: []
139139
excludeLabelKeysRegex: []
140140

141+
# A human readable name for the cluster where the agent is deployed (optional).
142+
#
143+
# This cluster name will be associated with the data that the agent uploads to
144+
# the Discovery and Context service. If empty (the default), the service
145+
# account name will be used instead.
146+
clusterName: ""
147+
148+
# A short description of the cluster where the agent is deployed (optional).
149+
#
150+
# This description will be associated with the data that the agent uploads to
151+
# the Discovery and Context service. The description may include contact
152+
# information such as the email address of the cluster administrator, so that
153+
# any problems and risks identified by the Discovery and Context service can
154+
# be communicated to the people responsible for the affected secrets.
155+
clusterDescription: ""
156+
141157
authentication:
142158
secretName: agent-credentials
143159

‎deploy/charts/venafi-kubernetes-agent/templates/NOTES.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
{{- if .Values.config.configmap.name }}
2+
You are using a custom configuration in the following ConfigMap: {{ .Values.config.configmap.name | quote }}.
3+
4+
DEPRECATION: The `cluster_id` configuration field is deprecated.
5+
If your configuration contains `cluster_id`, it will continue to work as a
6+
fallback, but please migrate to `cluster_name` to avoid ambiguity.
7+
{{- end }}
8+
19
{{- if .Values.authentication.venafiConnection.enabled }}
210
- Check the VenafiConnection exists: "{{ .Values.authentication.venafiConnection.namespace }}/{{ .Values.authentication.venafiConnection.name }}"
311
> kubectl get VenafiConnection -n {{ .Values.authentication.venafiConnection.namespace }} {{ .Values.authentication.venafiConnection.name }}

‎deploy/charts/venafi-kubernetes-agent/templates/configmap.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ metadata:
99
{{- include "venafi-kubernetes-agent.labels" . | nindent 4 }}
1010
data:
1111
config.yaml: |-
12-
cluster_id: {{ .Values.config.clusterName | quote }}
12+
cluster_name: {{ .Values.config.clusterName | quote }}
1313
cluster_description: {{ .Values.config.clusterDescription | quote }}
1414
server: {{ .Values.config.server | quote }}
1515
period: {{ .Values.config.period | quote }}

0 commit comments

Comments
 (0)