Skip to content

Commit 67657d6

Browse files
wallrj-cyberarkwallrj-cyberark
committed
CyberArk(helm): add cyberark-disco-agent Helm chart, build scripts, and E2E test
- introduce cyberark-disco-agent Helm chart with templates, docs, schema, and values - add build and release Makefile modules for ark agent and chart publishing - implement E2E test script for agent deployment and verification - update main.go for ark agent entrypoint - integrate chart build and test targets into main Makefiles Signed-off-by: Richard Wall <[email protected]>
1 parent 4d53d77 commit 67657d6

File tree

19 files changed

+1626
-2
lines changed

19 files changed

+1626
-2
lines changed

‎cmd/ark/main.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package main
2+
3+
import "github.com/jetstack/preflight/cmd"
4+
5+
func main() {
6+
cmd.Execute()
7+
}

‎deploy/charts/cyberark-disco-agent/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/charts/cyberark-disco-agent/Chart.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: cyberark-disco-agent
3+
description: |-
4+
The cyberark-disco-agent connects your Kubernetes or Openshift cluster to CyberArk Discovery and Context.
5+
6+
maintainers:
7+
- name: CyberArk
8+
email: [email protected]
9+
url: https://cyberark.com
10+
11+
sources:
12+
- https://github.com/jetstack/jetstack-secure
13+
14+
# These versions are meant to be overridden by `make helm-chart`. No `v` prefix
15+
# for the `version` because Helm doesn't support auto-determining the latest
16+
# version for OCI Helm charts that use a `v` prefix.
17+
version: 0.0.0
18+
appVersion: "v0.0.0"

‎deploy/charts/cyberark-disco-agent/README.md

Lines changed: 335 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,335 @@
1+
# cyberark-disco-agent
2+
3+
The Cyberark Discovery and Context Agent connects your Kubernetes or OpenShift
4+
cluster to the Discovery and Context service of the CyberArk Identity Security Platform.
5+
6+
## Quick Start
7+
8+
Create a namespace for the agent:
9+
10+
```sh
11+
export NAMESPACE=cyberark
12+
kubectl create ns "$NAMESPACE" || true
13+
```
14+
15+
You will require tenant details and credentials for the CyberArk Identity Security Platform.
16+
Put them in the following environment variables:
17+
18+
```sh
19+
export ARK_SUBDOMAIN= # your CyberArk tenant subdomain e.g. tlskp-test
20+
export ARK_USERNAME= # your CyberArk username
21+
export ARK_SECRET= # your CyberArk password
22+
# OPTIONAL: the URL for the CyberArk Discovery API if not using the production environment
23+
export ARK_DISCOVERY_API=https://platform-discovery.integration-cyberark.cloud/
24+
```
25+
26+
Create a Secret containing the tenant details and credentials:
27+
28+
```sh
29+
kubectl create secret generic agent-credentials \
30+
--namespace "$NAMESPACE" \
31+
--from-literal=ARK_USERNAME=$ARK_USERNAME \
32+
--from-literal=ARK_SECRET=$ARK_SECRET \
33+
--from-literal=ARK_SUBDOMAIN=$ARK_SUBDOMAIN \
34+
--from-literal=ARK_DISCOVERY_API=$ARK_DISCOVERY_API
35+
```
36+
37+
Deploy the agent:
38+
39+
```sh
40+
helm upgrade agent "oci://${RELEASE_OCI_CHART}" \
41+
--version "${RELEASE_OCI_CHART_TAG}" \
42+
--install \
43+
--create-namespace \
44+
--namespace "$NAMESPACE" \
45+
--set fullnameOverride=disco-agent
46+
```
47+
48+
49+
## Values
50+
51+
<!-- AUTO-GENERATED -->
52+
53+
#### **replicaCount** ~ `number`
54+
> Default value:
55+
> ```yaml
56+
> 1
57+
> ```
58+
59+
This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
60+
#### **image.repository** ~ `string`
61+
> Default value:
62+
> ```yaml
63+
> ""
64+
> ```
65+
#### **image.pullPolicy** ~ `string`
66+
> Default value:
67+
> ```yaml
68+
> IfNotPresent
69+
> ```
70+
71+
This sets the pull policy for images.
72+
#### **image.tag** ~ `string`
73+
> Default value:
74+
> ```yaml
75+
> ""
76+
> ```
77+
78+
Overrides the image tag whose default is the chart appVersion.
79+
#### **imagePullSecrets** ~ `array`
80+
> Default value:
81+
> ```yaml
82+
> []
83+
> ```
84+
85+
This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
86+
#### **nameOverride** ~ `string`
87+
> Default value:
88+
> ```yaml
89+
> ""
90+
> ```
91+
92+
This is to override the chart name.
93+
#### **fullnameOverride** ~ `string`
94+
> Default value:
95+
> ```yaml
96+
> ""
97+
> ```
98+
#### **serviceAccount.create** ~ `bool`
99+
> Default value:
100+
> ```yaml
101+
> true
102+
> ```
103+
104+
Specifies whether a service account should be created
105+
#### **serviceAccount.automount** ~ `bool`
106+
> Default value:
107+
> ```yaml
108+
> true
109+
> ```
110+
111+
Automatically mount a ServiceAccount's API credentials?
112+
#### **serviceAccount.annotations** ~ `object`
113+
> Default value:
114+
> ```yaml
115+
> {}
116+
> ```
117+
118+
Annotations to add to the service account
119+
#### **serviceAccount.name** ~ `string`
120+
> Default value:
121+
> ```yaml
122+
> ""
123+
> ```
124+
125+
The name of the service account to use.
126+
If not set and create is true, a name is generated using the fullname template
127+
#### **podAnnotations** ~ `object`
128+
> Default value:
129+
> ```yaml
130+
> {}
131+
> ```
132+
133+
This is for setting Kubernetes Annotations to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
134+
#### **podLabels** ~ `object`
135+
> Default value:
136+
> ```yaml
137+
> {}
138+
> ```
139+
140+
This is for setting Kubernetes Labels to a Pod.
141+
For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
142+
#### **podSecurityContext** ~ `object`
143+
> Default value:
144+
> ```yaml
145+
> {}
146+
> ```
147+
#### **securityContext** ~ `object`
148+
> Default value:
149+
> ```yaml
150+
> allowPrivilegeEscalation: false
151+
> capabilities:
152+
> drop:
153+
> - ALL
154+
> readOnlyRootFilesystem: true
155+
> runAsNonRoot: true
156+
> seccompProfile:
157+
> type: RuntimeDefault
158+
> ```
159+
160+
Add Container specific SecurityContext settings to the container. Takes precedence over `podSecurityContext` when set. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container
161+
162+
#### **resources** ~ `object`
163+
> Default value:
164+
> ```yaml
165+
> {}
166+
> ```
167+
#### **volumes** ~ `array`
168+
> Default value:
169+
> ```yaml
170+
> []
171+
> ```
172+
173+
Additional volumes on the output Deployment definition.
174+
#### **volumeMounts** ~ `array`
175+
> Default value:
176+
> ```yaml
177+
> []
178+
> ```
179+
180+
Additional volumeMounts on the output Deployment definition.
181+
#### **nodeSelector** ~ `object`
182+
> Default value:
183+
> ```yaml
184+
> {}
185+
> ```
186+
#### **tolerations** ~ `array`
187+
> Default value:
188+
> ```yaml
189+
> []
190+
> ```
191+
#### **affinity** ~ `object`
192+
> Default value:
193+
> ```yaml
194+
> {}
195+
> ```
196+
#### **http_proxy** ~ `string`
197+
198+
Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
199+
200+
#### **https_proxy** ~ `string`
201+
202+
Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
203+
204+
#### **no_proxy** ~ `string`
205+
206+
Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.
207+
208+
#### **podDisruptionBudget** ~ `object`
209+
> Default value:
210+
> ```yaml
211+
> enabled: false
212+
> ```
213+
214+
Configure a PodDisruptionBudget for the agent's Deployment. If running with multiple replicas, consider setting podDisruptionBudget.enabled to true.
215+
216+
#### **config.period** ~ `string`
217+
> Default value:
218+
> ```yaml
219+
> 1h0m0s
220+
> ```
221+
222+
Push data every hour unless changed.
223+
#### **config.excludeAnnotationKeysRegex** ~ `array`
224+
> Default value:
225+
> ```yaml
226+
> []
227+
> ```
228+
229+
You can configure the agent to exclude some annotations or labels from being pushed . All Kubernetes objects are affected. The objects are still pushed, but the specified annotations and labels are removed before being pushed.
230+
231+
Dots is the only character that needs to be escaped in the regex. Use either double quotes with escaped single quotes or unquoted strings for the regex to avoid YAML parsing issues with `\.`.
232+
233+
Example: excludeAnnotationKeysRegex: ['^kapp\.k14s\.io/original.*']
234+
#### **config.excludeLabelKeysRegex** ~ `array`
235+
> Default value:
236+
> ```yaml
237+
> []
238+
> ```
239+
#### **authentication.secretName** ~ `string`
240+
> Default value:
241+
> ```yaml
242+
> agent-credentials
243+
> ```
244+
#### **extraArgs** ~ `array`
245+
> Default value:
246+
> ```yaml
247+
> []
248+
> ```
249+
250+
```yaml
251+
extraArgs:
252+
- --logging-format=json
253+
- --log-level=6 # To enable HTTP request logging
254+
```
255+
#### **metrics.enabled** ~ `bool`
256+
> Default value:
257+
> ```yaml
258+
> true
259+
> ```
260+
261+
Enable the metrics server.
262+
If false, the metrics server will be disabled and the other metrics fields below will be ignored.
263+
#### **metrics.podmonitor.enabled** ~ `bool`
264+
> Default value:
265+
> ```yaml
266+
> false
267+
> ```
268+
269+
Create a PodMonitor to add the metrics to Prometheus, if you are using Prometheus Operator. See https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor
270+
#### **metrics.podmonitor.namespace** ~ `string`
271+
272+
The namespace that the pod monitor should live in.
273+
Defaults to the cyberark-disco-agent namespace.
274+
275+
#### **metrics.podmonitor.prometheusInstance** ~ `string`
276+
> Default value:
277+
> ```yaml
278+
> default
279+
> ```
280+
281+
Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.
282+
#### **metrics.podmonitor.interval** ~ `string`
283+
> Default value:
284+
> ```yaml
285+
> 60s
286+
> ```
287+
288+
The interval to scrape metrics.
289+
#### **metrics.podmonitor.scrapeTimeout** ~ `string`
290+
> Default value:
291+
> ```yaml
292+
> 30s
293+
> ```
294+
295+
The timeout before a metrics scrape fails.
296+
#### **metrics.podmonitor.labels** ~ `object`
297+
> Default value:
298+
> ```yaml
299+
> {}
300+
> ```
301+
302+
Additional labels to add to the PodMonitor.
303+
#### **metrics.podmonitor.annotations** ~ `object`
304+
> Default value:
305+
> ```yaml
306+
> {}
307+
> ```
308+
309+
Additional annotations to add to the PodMonitor.
310+
#### **metrics.podmonitor.honorLabels** ~ `bool`
311+
> Default value:
312+
> ```yaml
313+
> false
314+
> ```
315+
316+
Keep labels from scraped data, overriding server-side labels.
317+
#### **metrics.podmonitor.endpointAdditionalProperties** ~ `object`
318+
> Default value:
319+
> ```yaml
320+
> {}
321+
> ```
322+
323+
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
324+
325+
For example:
326+
327+
```yaml
328+
endpointAdditionalProperties:
329+
relabelings:
330+
- action: replace
331+
sourceLabels:
332+
- __meta_kubernetes_pod_node_name
333+
targetLabel: instance
334+
```
335+

‎deploy/charts/cyberark-disco-agent/templates/NOTES.txt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
CHART NAME: {{ .Chart.Name }}
2+
CHART VERSION: {{ .Chart.Version }}
3+
APP VERSION: {{ .Chart.AppVersion }}
4+
5+
- Check the application is running:
6+
> kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
7+
8+
- Check the application logs for successful connection to the platform:
9+
> kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}

0 commit comments

Comments
 (0)