Skip to content

Commit fd80105

Browse files
SgtCoDFishSgtCoDFish
authored
Merge pull request #780 from jetstack/EldarShalev-feature/ESO_Patch
Add support for ESO resources in disco-agent
2 parents 6810e77 + 3cb1c78 commit fd80105

13 files changed

Lines changed: 729 additions & 0 deletions

File tree

‎deploy/charts/disco-agent/templates/configmap.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,3 +117,31 @@ data:
117117
version: v1
118118
label-selectors:
119119
- conjur.org/name=conjur-connect-configmap
120+
- kind: k8s-dynamic
121+
name: ark/esoexternalsecrets
122+
config:
123+
resource-type:
124+
group: external-secrets.io
125+
version: v1
126+
resource: externalsecrets
127+
- kind: k8s-dynamic
128+
name: ark/esosecretstores
129+
config:
130+
resource-type:
131+
group: external-secrets.io
132+
version: v1
133+
resource: secretstores
134+
- kind: k8s-dynamic
135+
name: ark/esoclusterexternalsecrets
136+
config:
137+
resource-type:
138+
group: external-secrets.io
139+
version: v1
140+
resource: clusterexternalsecrets
141+
- kind: k8s-dynamic
142+
name: ark/esoclustersecretstores
143+
config:
144+
resource-type:
145+
group: external-secrets.io
146+
version: v1
147+
resource: clustersecretstores

‎deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,34 @@ custom-cluster-description:
105105
version: v1
106106
label-selectors:
107107
- conjur.org/name=conjur-connect-configmap
108+
- kind: k8s-dynamic
109+
name: ark/esoexternalsecrets
110+
config:
111+
resource-type:
112+
group: external-secrets.io
113+
version: v1
114+
resource: externalsecrets
115+
- kind: k8s-dynamic
116+
name: ark/esosecretstores
117+
config:
118+
resource-type:
119+
group: external-secrets.io
120+
version: v1
121+
resource: secretstores
122+
- kind: k8s-dynamic
123+
name: ark/esoclusterexternalsecrets
124+
config:
125+
resource-type:
126+
group: external-secrets.io
127+
version: v1
128+
resource: clusterexternalsecrets
129+
- kind: k8s-dynamic
130+
name: ark/esoclustersecretstores
131+
config:
132+
resource-type:
133+
group: external-secrets.io
134+
version: v1
135+
resource: clustersecretstores
108136
kind: ConfigMap
109137
metadata:
110138
labels:
@@ -222,6 +250,34 @@ custom-cluster-name:
222250
version: v1
223251
label-selectors:
224252
- conjur.org/name=conjur-connect-configmap
253+
- kind: k8s-dynamic
254+
name: ark/esoexternalsecrets
255+
config:
256+
resource-type:
257+
group: external-secrets.io
258+
version: v1
259+
resource: externalsecrets
260+
- kind: k8s-dynamic
261+
name: ark/esosecretstores
262+
config:
263+
resource-type:
264+
group: external-secrets.io
265+
version: v1
266+
resource: secretstores
267+
- kind: k8s-dynamic
268+
name: ark/esoclusterexternalsecrets
269+
config:
270+
resource-type:
271+
group: external-secrets.io
272+
version: v1
273+
resource: clusterexternalsecrets
274+
- kind: k8s-dynamic
275+
name: ark/esoclustersecretstores
276+
config:
277+
resource-type:
278+
group: external-secrets.io
279+
version: v1
280+
resource: clustersecretstores
225281
kind: ConfigMap
226282
metadata:
227283
labels:
@@ -339,6 +395,34 @@ custom-period:
339395
version: v1
340396
label-selectors:
341397
- conjur.org/name=conjur-connect-configmap
398+
- kind: k8s-dynamic
399+
name: ark/esoexternalsecrets
400+
config:
401+
resource-type:
402+
group: external-secrets.io
403+
version: v1
404+
resource: externalsecrets
405+
- kind: k8s-dynamic
406+
name: ark/esosecretstores
407+
config:
408+
resource-type:
409+
group: external-secrets.io
410+
version: v1
411+
resource: secretstores
412+
- kind: k8s-dynamic
413+
name: ark/esoclusterexternalsecrets
414+
config:
415+
resource-type:
416+
group: external-secrets.io
417+
version: v1
418+
resource: clusterexternalsecrets
419+
- kind: k8s-dynamic
420+
name: ark/esoclustersecretstores
421+
config:
422+
resource-type:
423+
group: external-secrets.io
424+
version: v1
425+
resource: clustersecretstores
342426
kind: ConfigMap
343427
metadata:
344428
labels:
@@ -456,6 +540,34 @@ defaults:
456540
version: v1
457541
label-selectors:
458542
- conjur.org/name=conjur-connect-configmap
543+
- kind: k8s-dynamic
544+
name: ark/esoexternalsecrets
545+
config:
546+
resource-type:
547+
group: external-secrets.io
548+
version: v1
549+
resource: externalsecrets
550+
- kind: k8s-dynamic
551+
name: ark/esosecretstores
552+
config:
553+
resource-type:
554+
group: external-secrets.io
555+
version: v1
556+
resource: secretstores
557+
- kind: k8s-dynamic
558+
name: ark/esoclusterexternalsecrets
559+
config:
560+
resource-type:
561+
group: external-secrets.io
562+
version: v1
563+
resource: clusterexternalsecrets
564+
- kind: k8s-dynamic
565+
name: ark/esoclustersecretstores
566+
config:
567+
resource-type:
568+
group: external-secrets.io
569+
version: v1
570+
resource: clustersecretstores
459571
kind: ConfigMap
460572
metadata:
461573
labels:

‎examples/machinehub.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,3 +139,39 @@ data-gatherers:
139139
version: v1
140140
label-selectors:
141141
- conjur.org/name=conjur-connect-configmap
142+
143+
# Gather External Secrets Operator ExternalSecret resources
144+
- name: ark/esoexternalsecrets
145+
kind: k8s-dynamic
146+
config:
147+
resource-type:
148+
group: external-secrets.io
149+
version: v1
150+
resource: externalsecrets
151+
152+
# Gather External Secrets Operator SecretStore resources
153+
- name: ark/esosecretstores
154+
kind: k8s-dynamic
155+
config:
156+
resource-type:
157+
group: external-secrets.io
158+
version: v1
159+
resource: secretstores
160+
161+
# Gather External Secrets Operator ClusterExternalSecret resources
162+
- name: ark/esoclusterexternalsecrets
163+
kind: k8s-dynamic
164+
config:
165+
resource-type:
166+
group: external-secrets.io
167+
version: v1
168+
resource: clusterexternalsecrets
169+
170+
# Gather External Secrets Operator ClusterSecretStore resources
171+
- name: ark/esoclustersecretstores
172+
kind: k8s-dynamic
173+
config:
174+
resource-type:
175+
group: external-secrets.io
176+
version: v1
177+
resource: clustersecretstores

‎examples/machinehub/input.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,5 +159,29 @@
159159
"data": {
160160
"items": []
161161
}
162+
},
163+
{
164+
"data-gatherer": "ark/esoexternalsecrets",
165+
"data": {
166+
"items": []
167+
}
168+
},
169+
{
170+
"data-gatherer": "ark/esosecretstores",
171+
"data": {
172+
"items": []
173+
}
174+
},
175+
{
176+
"data-gatherer": "ark/esoclusterexternalsecrets",
177+
"data": {
178+
"items": []
179+
}
180+
},
181+
{
182+
"data-gatherer": "ark/esoclustersecretstores",
183+
"data": {
184+
"items": []
185+
}
162186
}
163187
]

‎hack/ark/cluster-external-secret.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Sample ClusterExternalSecret for e2e testing
2+
# This is a minimal ClusterExternalSecret CR that will be discovered by the agent.
3+
# This is a cluster-scoped resource that can create ExternalSecrets in multiple namespaces.
4+
apiVersion: external-secrets.io/v1
5+
kind: ClusterExternalSecret
6+
metadata:
7+
name: e2e-test-cluster-external-secret
8+
labels:
9+
app.kubernetes.io/name: e2e-test
10+
app.kubernetes.io/component: cluster-external-secret
11+
spec:
12+
externalSecretSpec:
13+
refreshInterval: 1h
14+
secretStoreRef:
15+
name: e2e-test-cluster-secret-store
16+
kind: ClusterSecretStore
17+
target:
18+
name: e2e-test-synced-secret
19+
creationPolicy: Owner
20+
data:
21+
- secretKey: example-key
22+
remoteRef:
23+
key: dummy/path/to/secret
24+
property: password
25+
namespaceSelector:
26+
matchLabels:
27+
environment: test

‎hack/ark/cluster-secret-store.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Sample ClusterSecretStore for e2e testing
2+
# This is a minimal ClusterSecretStore CR that will be discovered by the agent.
3+
# This is a cluster-scoped resource that can be referenced by ExternalSecrets in any namespace.
4+
apiVersion: external-secrets.io/v1
5+
kind: ClusterSecretStore
6+
metadata:
7+
name: e2e-test-cluster-secret-store
8+
labels:
9+
app.kubernetes.io/name: e2e-test
10+
app.kubernetes.io/component: cluster-secret-store
11+
spec:
12+
provider:
13+
# Fake provider configuration - this won't actually work but allows the CR to be created
14+
fake:
15+
data:
16+
- key: dummy/path/to/secret
17+
value: dummy-value
18+
version: "1"

‎hack/ark/external-secret.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Sample ExternalSecret for e2e testing
2+
# This is a minimal ExternalSecret CR that will be discovered by the agent.
3+
# Note: This requires the External Secrets Operator CRDs to be installed,
4+
# but does not require a working secrets backend.
5+
apiVersion: external-secrets.io/v1
6+
kind: ExternalSecret
7+
metadata:
8+
name: e2e-test-external-secret
9+
namespace: default
10+
labels:
11+
app.kubernetes.io/name: e2e-test
12+
app.kubernetes.io/component: external-secret
13+
spec:
14+
refreshInterval: 1h
15+
secretStoreRef:
16+
name: e2e-test-secret-store
17+
kind: SecretStore
18+
target:
19+
name: e2e-test-synced-secret
20+
creationPolicy: Owner
21+
data:
22+
- secretKey: example-key
23+
remoteRef:
24+
key: dummy/path/to/secret
25+
property: password

‎hack/ark/secret-store.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Sample SecretStore for e2e testing
2+
# This is a minimal SecretStore CR that will be discovered by the agent.
3+
# Note: This requires the External Secrets Operator CRDs to be installed,
4+
# but does not require a working secrets backend.
5+
apiVersion: external-secrets.io/v1
6+
kind: SecretStore
7+
metadata:
8+
name: e2e-test-secret-store
9+
namespace: default
10+
labels:
11+
app.kubernetes.io/name: e2e-test
12+
app.kubernetes.io/component: secret-store
13+
spec:
14+
provider:
15+
# Fake provider configuration - this won't actually work but allows the CR to be created
16+
fake:
17+
data:
18+
- key: dummy/path/to/secret
19+
value: dummy-value
20+
version: "1"

‎hack/ark/test-e2e.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,25 @@ kubectl create secret generic e2e-sample-secret-$(date '+%s') \
8080
# in the ark/configmaps data gatherer (conjur.org/name=conjur-connect-configmap).
8181
kubectl apply -f "${root_dir}/hack/ark/conjur-connect-configmap.yaml"
8282

83+
# Install External Secrets Operator CRDs and controller
84+
#
85+
# This is required for the agent to discover ExternalSecret and SecretStore resources.
86+
echo "Installing External Secrets Operator..."
87+
helm repo add external-secrets https://charts.external-secrets.io
88+
helm repo update
89+
helm upgrade --install external-secrets \
90+
external-secrets/external-secrets \
91+
--namespace external-secrets-system \
92+
--create-namespace \
93+
--wait \
94+
--set installCRDs=true
95+
96+
# Create sample External Secrets Operator resources that will be discovered by the agent
97+
kubectl apply -f "${root_dir}/hack/ark/secret-store.yaml"
98+
kubectl apply -f "${root_dir}/hack/ark/external-secret.yaml"
99+
kubectl apply -f "${root_dir}/hack/ark/cluster-secret-store.yaml"
100+
kubectl apply -f "${root_dir}/hack/ark/cluster-external-secret.yaml"
101+
83102
# We use a non-existent tag and omit the `--version` flag, to work around a Helm
84103
# v4 bug. See: https://github.com/helm/helm/issues/31600
85104
helm upgrade agent "oci://${ARK_CHART}:NON_EXISTENT_TAG@${ARK_CHART_DIGEST}" \

‎internal/cyberark/dataupload/dataupload.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,14 @@ type Snapshot struct {
8080
ServiceAccounts []runtime.Object `json:"serviceaccounts"`
8181
// ConfigMaps is a list of ConfigMap resources in the cluster.
8282
ConfigMaps []runtime.Object `json:"configmaps"`
83+
// ExternalSecrets is a list of ExternalSecret resources in the cluster.
84+
ExternalSecrets []runtime.Object `json:"externalsecrets"`
85+
// SecretStores is a list of SecretStore resources in the cluster.
86+
SecretStores []runtime.Object `json:"secretstores"`
87+
// ClusterExternalSecrets is a list of ClusterExternalSecret resources in the cluster.
88+
ClusterExternalSecrets []runtime.Object `json:"clusterexternalsecrets"`
89+
// ClusterSecretStores is a list of ClusterSecretStore resources in the cluster.
90+
ClusterSecretStores []runtime.Object `json:"clustersecretstores"`
8391
// Roles is a list of Role resources in the cluster.
8492
Roles []runtime.Object `json:"roles"`
8593
// ClusterRoles is a list of ClusterRole resources in the cluster.

0 commit comments

Comments
 (0)