WIP

Signed-off-by: Richard Wall <[email protected]>

Author: wallrj-cyberark

pkg/agent/config_test.go

@@ -621,7 +621,6 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
 	t.Run("--machine-hub selects MachineHub mode", func(t *testing.T) {
 		t.Setenv("POD_NAMESPACE", "venafi")
 		t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
-		t.Setenv("ARK_PLATFORM_DOMAIN", "cyberark.cloud")
 		t.Setenv("ARK_SUBDOMAIN", "tlspk")
 		t.Setenv("ARK_USERNAME", "[email protected]")
 		t.Setenv("ARK_SECRET", "test-secret")
@@ -636,7 +635,6 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
 	t.Run("--machine-hub without required environment variables", func(t *testing.T) {
 		t.Setenv("POD_NAMESPACE", "venafi")
 		t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
-		t.Setenv("ARK_PLATFORM_DOMAIN", "")
 		t.Setenv("ARK_SUBDOMAIN", "")
 		t.Setenv("ARK_USERNAME", "")
 		t.Setenv("ARK_SECRET", "")
@@ -647,7 +645,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
 		assert.Nil(t, cl)
 		assert.EqualError(t, err, testutil.Undent(`
 			validating creds: failed loading config using the MachineHub mode: 1 error occurred:
-				* missing environment variables: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET
+				* missing environment variables: ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET
 
 	   `))
 	})

pkg/client/client_cyberark.go

@@ -2,6 +2,10 @@ package client
 
 import (
 	"context"
+	"net/http"
+	"time"
+
+	"k8s.io/client-go/transport"
 
 	"github.com/jetstack/preflight/api"
 	"github.com/jetstack/preflight/pkg/internal/cyberark"
@@ -10,6 +14,7 @@ import (
 
 type CyberArkClient struct {
 	configLoader cyberark.ClientConfigLoader
+	httpClient   *http.Client
 }
 
 var _ Client = &CyberArkClient{}
@@ -22,18 +27,21 @@ func NewCyberArk() (*CyberArkClient, error) {
 	}
 	return &CyberArkClient{
 		configLoader: configLoader,
+		httpClient: &http.Client{
+			Timeout:   time.Minute,
+			Transport: transport.DebugWrappers(http.DefaultTransport),
+		},
 	}, nil
 }
 
 // An API token is obtained by authenticating with the ARK_USERNAME and ARK_SECRET from the environment.
 // ARK_SUBDOMAIN should be your tenant subdomain.
-// ARK_PLATFORM_DOMAIN should be either integration-cyberark.cloud or cyberark.cloud
 func (o *CyberArkClient) PostDataReadingsWithOptions(ctx context.Context, readings []*api.DataReading, options Options) error {
 	cfg, err := o.configLoader()
 	if err != nil {
 		return err
 	}
-	datauploadClient, err := cyberark.NewDatauploadClient(ctx, cfg)
+	datauploadClient, err := cyberark.NewDatauploadClient(ctx, o.httpClient, cfg)
 	if err != nil {
 		return err
 	}

pkg/client/client_cyberark_test.go

@@ -1,4 +1,4 @@
-package client
+package client_test
 
 import (
 	"os"
@@ -9,36 +9,58 @@ import (
 	"k8s.io/klog/v2/ktesting"
 
 	"github.com/jetstack/preflight/api"
+	"github.com/jetstack/preflight/pkg/client"
+	"github.com/jetstack/preflight/pkg/testutil"
 
 	_ "k8s.io/klog/v2/ktesting/init"
 )
 
-func TestCyberArkClient_PostDataReadingsWithOptions(t *testing.T) {
-	// TestCyberArkClient_PostDataReadingsWithOptions/RealAPI demonstrates that the
-	// dataupload code works with the real inventory API.
-	//
-	// To enable verbose request logging:
-	//
-	//	go test ./pkg/internal/cyberark/dataupload/... \
-	//	  -v -count 1 -run TestPostDataReadingsWithOptionsWithRealAPI -args -testing.v 6
-	t.Run("RealAPI", func(t *testing.T) {
-		platformDomain := os.Getenv("ARK_PLATFORM_DOMAIN")
+func TestCyberArkClient_PostDataReadingsWithOptions_MockAPI(t *testing.T) {
+	t.Setenv("ARK_SUBDOMAIN", "dummy-subdomain")
+	t.Setenv("ARK_USERNAME", "dummy-username")
+	t.Setenv("ARK_SECRET", "dummy-secret")
+	t.Run("success", func(t *testing.T) {
+		logger := ktesting.NewLogger(t, ktesting.DefaultConfig)
+		ctx := klog.NewContext(t.Context(), logger)
+
+		server, serverCert := testutil.FakeCyberArk(t)
+		t.Setenv("ARK_DISCOVERY_API", server.URL)
+		cl, err := client.NewCyberArk()
+		require.NoError(t, err)
+
+		testutil.TrustCA(t, cl, serverCert)
+
+		var readings []*api.DataReading
+		err = cl.PostDataReadingsWithOptions(ctx, readings, client.Options{})
+		require.NoError(t, err)
+	})
+}
+
+// TestCyberArkClient_PostDataReadingsWithOptions_RealAPI demonstrates that the
+// dataupload code works with the real inventory API.
+//
+// To enable verbose request logging:
+//
+//	go test ./pkg/internal/cyberark/dataupload/... \
+//	  -v -count 1 -run TestCyberArkClient_PostDataReadingsWithOptions_RealAPI -args -testing.v 6
+func TestCyberArkClient_PostDataReadingsWithOptions_RealAPI(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
 		subdomain := os.Getenv("ARK_SUBDOMAIN")
 		username := os.Getenv("ARK_USERNAME")
 		secret := os.Getenv("ARK_SECRET")
 
-		if platformDomain == "" || subdomain == "" || username == "" || secret == "" {
-			t.Skip("Skipping because one of the following environment variables is unset or empty: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
+		if subdomain == "" || username == "" || secret == "" {
+			t.Skip("Skipping because one of the following environment variables is unset or empty: ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
 			return
 		}
 
 		logger := ktesting.NewLogger(t, ktesting.DefaultConfig)
 		ctx := klog.NewContext(t.Context(), logger)
 
-		c, err := NewCyberArk()
+		c, err := client.NewCyberArk()
 		require.NoError(t, err)
 		var readings []*api.DataReading
-		err = c.PostDataReadingsWithOptions(ctx, readings, Options{})
+		err = c.PostDataReadingsWithOptions(ctx, readings, client.Options{})
 		require.NoError(t, err)
 	})
 }

pkg/internal/cyberark/client.go

@@ -3,7 +3,7 @@ package cyberark
 import (
 	"context"
 	"errors"
-	"fmt"
+	"net/http"
 	"os"
 
 	"github.com/jetstack/preflight/pkg/internal/cyberark/dataupload"
@@ -12,62 +12,44 @@ import (
 )
 
 type ClientConfig struct {
-	platformDomain string
-	subdomain      string
-	username       string
-	secret         string
+	subdomain string
+	username  string
+	secret    string
 }
 
 type ClientConfigLoader func() (ClientConfig, error)
 
 func LoadClientConfigFromEnvironment() (ClientConfig, error) {
-	platformDomain := os.Getenv("ARK_PLATFORM_DOMAIN")
 	subdomain := os.Getenv("ARK_SUBDOMAIN")
 	username := os.Getenv("ARK_USERNAME")
 	secret := os.Getenv("ARK_SECRET")
 
-	if platformDomain == "" || subdomain == "" || username == "" || secret == "" {
+	if subdomain == "" || username == "" || secret == "" {
 		return ClientConfig{}, errors.New(
-			"missing environment variables: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
+			"missing environment variables: ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
 	}
 
 	return ClientConfig{
-		platformDomain: platformDomain,
-		subdomain:      subdomain,
-		username:       username,
-		secret:         secret,
+		subdomain: subdomain,
+		username:  username,
+		secret:    secret,
 	}, nil
 
 }
 
-func NewDatauploadClient(ctx context.Context, cfg ClientConfig) (*dataupload.CyberArkClient, error) {
-	const (
-		discoveryContextServiceName = "inventory"
-		separator                   = "."
-	)
-
-	serviceURL := fmt.Sprintf("https://%s%s%s.%s", cfg.subdomain, separator, discoveryContextServiceName, cfg.platformDomain)
-
-	var (
-		identityClient *identity.Client
-		err            error
-	)
-	if cfg.platformDomain == "cyberark.cloud" {
-		identityClient, err = identity.New(ctx, cfg.subdomain)
-	} else {
-		discoveryClient := servicediscovery.New(servicediscovery.WithIntegrationEndpoint())
-		identityClient, err = identity.NewWithDiscoveryClient(ctx, discoveryClient, cfg.subdomain)
-	}
+func NewDatauploadClient(ctx context.Context, httpClient *http.Client, cfg ClientConfig) (*dataupload.CyberArkClient, error) {
+	discoveryClient := servicediscovery.New(httpClient)
+	serviceMap, err := discoveryClient.DiscoverIdentityAPIURL(ctx, cfg.subdomain)
 	if err != nil {
 		return nil, err
 	}
 
+	identityClient := identity.New(httpClient, serviceMap.IdentityAPI(), cfg.subdomain)
 	err = identityClient.LoginUsernamePassword(ctx, cfg.username, []byte(cfg.secret))
 	if err != nil {
 		return nil, err
 	}
-
-	cyberArkClient, err := dataupload.NewCyberArkClient(nil, serviceURL, identityClient.AuthenticateRequest)
+	cyberArkClient, err := dataupload.NewCyberArkClient(nil, serviceMap.DiscoveryContextAPI(), identityClient.AuthenticateRequest)
 	if err != nil {
 		return nil, err
 	}

pkg/internal/cyberark/dataupload/dataupload.go

@@ -27,7 +27,7 @@ const (
 	// apiPathSnapshotLinks is the URL path of the snapshot-links endpoint of the inventory API.
 	// This endpoint returns an AWS presigned URL.
 	// TODO(wallrj): Link to CyberArk API documentation when it is published.
-	apiPathSnapshotLinks = "/api/ingestions/kubernetes/snapshot-links"
+	apiPathSnapshotLinks = "/ingestions/kubernetes/snapshot-links"
 )
 
 type CyberArkClient struct {

pkg/internal/cyberark/identity/advance_authentication_test.go

@@ -2,6 +2,7 @@ package identity
 
 import (
 	"fmt"
+	"net/http"
 	"testing"
 
 	"github.com/jetstack/preflight/pkg/internal/cyberark/servicediscovery"
@@ -102,18 +103,8 @@ func Test_IdentityAdvanceAuthentication(t *testing.T) {
 			identityServer := MockIdentityServer()
 			defer identityServer.Close()
 
-			mockDiscoveryServer := servicediscovery.MockDiscoveryServerWithCustomAPIURL(identityServer.Server.URL)
-			defer mockDiscoveryServer.Close()
-
-			discoveryClient := servicediscovery.New(servicediscovery.WithCustomEndpoint(mockDiscoveryServer.Server.URL))
-
-			client, err := NewWithDiscoveryClient(ctx, discoveryClient, servicediscovery.MockDiscoverySubdomain)
-			if err != nil {
-				t.Errorf("failed to create identity client: %s", err)
-				return
-			}
-
-			err = client.doAdvanceAuthentication(ctx, testSpec.username, &testSpec.password, testSpec.advanceBody)
+			client := New(http.DefaultClient, identityServer.Server.URL, servicediscovery.MockDiscoverySubdomain)
+			err := client.doAdvanceAuthentication(ctx, testSpec.username, &testSpec.password, testSpec.advanceBody)
 			if testSpec.expectedError != err {
 				if testSpec.expectedError == nil {
 					t.Errorf("didn't expect an error but got %v", err)

pkg/internal/cyberark/identity/cmd/testidentity/main.go

@@ -7,10 +7,12 @@ import (
 	"os"
 	"os/signal"
 
+	"github.com/jetstack/venafi-connection-lib/http_client"
 	"k8s.io/klog/v2"
 
 	"github.com/jetstack/preflight/pkg/internal/cyberark/identity"
 	"github.com/jetstack/preflight/pkg/internal/cyberark/servicediscovery"
+	"github.com/jetstack/preflight/pkg/version"
 )
 
 // This is a trivial CLI application for testing our identity client end-to-end.
@@ -41,12 +43,13 @@ func run(ctx context.Context) error {
 	if password == "" {
 		return fmt.Errorf("no password provided in %s", passwordEnv)
 	}
-	sdClient := servicediscovery.New(servicediscovery.WithIntegrationEndpoint())
-
-	client, err := identity.NewWithDiscoveryClient(ctx, sdClient, subdomain)
+	httpClient := http_client.NewDefaultClient(version.PreflightVersion, nil)
+	sdClient := servicediscovery.New(httpClient)
+	serviceMap, err := sdClient.DiscoverIdentityAPIURL(ctx, subdomain)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to discover services: %s", err)
 	}
+	client := identity.New(httpClient, serviceMap.IdentityAPI(), subdomain)
 
 	err = client.LoginUsernamePassword(ctx, username, []byte(password))
 	if err != nil {

pkg/internal/cyberark/identity/identity.go

@@ -12,10 +12,8 @@ import (
 	"time"
 
 	"github.com/cenkalti/backoff/v5"
-	"k8s.io/client-go/transport"
 	"k8s.io/klog/v2"
 
-	"github.com/jetstack/preflight/pkg/internal/cyberark/servicediscovery"
 	"github.com/jetstack/preflight/pkg/logs"
 	"github.com/jetstack/preflight/pkg/version"
 )
@@ -179,7 +177,7 @@ type advanceAuthenticationResponseResult struct {
 type Client struct {
 	client *http.Client
 
-	endpoint  string
+	apiBase   string
 	subdomain string
 
 	tokenCached      token
@@ -189,40 +187,17 @@ type Client struct {
 // token is a wrapper type for holding auth tokens we want to cache.
 type token string
 
-// New returns an initialized CyberArk Identity client using a default service discovery client.
-// NB: This function performs service discovery when called, in order to ensure that all Identity
-// clients are created with a valid Identity API URL. This function blocks on the network call to
-// the discovery service.
-func New(ctx context.Context, subdomain string) (*Client, error) {
-	return NewWithDiscoveryClient(ctx, servicediscovery.New(), subdomain)
-}
-
-// NewWithDiscoveryClient returns an initialized CyberArk Identity client using the given service discovery client.
-// NB: This function performs service discovery when called, in order to ensure that all Identity
-// clients are created with a valid Identity API URL. This function blocks on the network call to
-// the discovery service.
-func NewWithDiscoveryClient(ctx context.Context, discoveryClient *servicediscovery.Client, subdomain string) (*Client, error) {
-	if discoveryClient == nil {
-		return nil, fmt.Errorf("must provide a non-nil discovery client to the Identity Client")
-	}
-
-	endpoint, err := discoveryClient.DiscoverIdentityAPIURL(ctx, subdomain)
-	if err != nil {
-		return nil, err
-	}
-
+// New returns an initialized CyberArk Identity client
+func New(httpClient *http.Client, apiBase string, subdomain string) *Client {
 	return &Client{
-		client: &http.Client{
-			Timeout:   10 * time.Second,
-			Transport: transport.NewDebuggingRoundTripper(http.DefaultTransport, transport.DebugByContext),
-		},
+		client: httpClient,
 
-		endpoint:  endpoint,
+		apiBase:   apiBase,
 		subdomain: subdomain,
 
 		tokenCached:      "",
 		tokenCachedMutex: sync.Mutex{},
-	}, nil
+	}
 }
 
 // LoginUsernamePassword performs a blocking call to fetch an auth token from CyberArk Identity using the given username and password.
@@ -282,7 +257,7 @@ func (c *Client) doStartAuthentication(ctx context.Context, username string) (ad
 		return response, fmt.Errorf("failed to marshal JSON for request to StartAuthentication endpoint: %s", err)
 	}
 
-	endpoint, err := url.JoinPath(c.endpoint, "Security", "StartAuthentication")
+	endpoint, err := url.JoinPath(c.apiBase, "Security", "StartAuthentication")
 	if err != nil {
 		return response, fmt.Errorf("failed to create URL for request to CyberArk Identity StartAuthentication: %s", err)
 	}
@@ -391,7 +366,7 @@ func (c *Client) doAdvanceAuthentication(ctx context.Context, username string, p
 		return backoff.Permanent(fmt.Errorf("failed to marshal JSON for request to AdvanceAuthentication endpoint: %s", err))
 	}
 
-	endpoint, err := url.JoinPath(c.endpoint, "Security", "AdvanceAuthentication")
+	endpoint, err := url.JoinPath(c.apiBase, "Security", "AdvanceAuthentication")
 	if err != nil {
 		return backoff.Permanent(fmt.Errorf("failed to create URL for request to CyberArk Identity AdvanceAuthentication: %s", err))
 	}