Skip to content

Commit 35d754b

Browse files
wallrj-cyberarkwallrj-cyberark
committed
Revert some of the MachineHub changes from #653
Signed-off-by: Richard Wall <[email protected]>
1 parent c4bad68 commit 35d754b

File tree

3 files changed

+20
-133
lines changed

3 files changed

+20
-133
lines changed

‎pkg/agent/config.go

Lines changed: 12 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package agent
22

33
import (
4-
"errors"
54
"fmt"
65
"io"
76
"net/url"
@@ -62,9 +61,6 @@ type Config struct {
6261
ExcludeAnnotationKeysRegex []string `yaml:"exclude-annotation-keys-regex"`
6362
// Skips label keys that match the given set of regular expressions.
6463
ExcludeLabelKeysRegex []string `yaml:"exclude-label-keys-regex"`
65-
66-
// MachineHub holds config specific to MachineHub mode.
67-
MachineHub MachineHubConfig `yaml:"machineHub"`
6864
}
6965

7066
type Endpoint struct {
@@ -92,33 +88,6 @@ type VenafiCloudConfig struct {
9288
UploadPath string `yaml:"upload_path,omitempty"`
9389
}
9490

95-
// MachineHubConfig holds configuration values specific to the CyberArk Machine Hub integration
96-
type MachineHubConfig struct {
97-
// Subdomain is the subdomain indicating where data should be pushed. Used
98-
// for querying the Service Discovery Service to discover the Identity API
99-
// URL.
100-
Subdomain string `yaml:"subdomain"`
101-
102-
// CredentialsSecretName is the name of a Kubernetes Secret in the same
103-
// namespace as the agent, which will be watched for a username and password
104-
// to send to CyberArk Identity for authentication.
105-
CredentialsSecretName string `yaml:"credentialsSecretName"`
106-
}
107-
108-
func (mhc MachineHubConfig) Validate() error {
109-
var errs []error
110-
111-
if mhc.Subdomain == "" {
112-
errs = append(errs, fmt.Errorf("subdomain must not be empty in MachineHub mode"))
113-
}
114-
115-
if mhc.CredentialsSecretName == "" {
116-
errs = append(errs, fmt.Errorf("credentialsSecretName must not be empty in MachineHub mode"))
117-
}
118-
119-
return errors.Join(errs...)
120-
}
121-
12291
type AgentCmdFlags struct {
12392
// ConfigFilePath (--config-file, -c) is the path to the agent configuration
12493
// YAML file.
@@ -364,10 +333,6 @@ const (
364333
JetstackSecureAPIToken TLSPKMode = "Jetstack Secure API Token"
365334
VenafiCloudKeypair TLSPKMode = "Venafi Cloud Key Pair Service Account"
366335
VenafiCloudVenafiConnection TLSPKMode = "Venafi Cloud VenafiConnection"
367-
368-
// It is possible to push to both MachineHub and TLSPK. With this mode, the
369-
// agent will only push to MachineHub and not to TLSPK.
370-
Off TLSPKMode = "MachineHub only"
371336
)
372337

373338
// The command-line flags and the config file are combined into this struct by
@@ -408,11 +373,6 @@ type CombinedConfig struct {
408373
// Only used for testing purposes.
409374
OutputPath string
410375
InputPath string
411-
412-
// MachineHub-related settings.
413-
MachineHubMode bool
414-
MachineHubSubdomain string
415-
MachineHubCredentialsSecretName string
416376
}
417377

418378
// ValidateAndCombineConfig combines and validates the input configuration with
@@ -427,19 +387,6 @@ type CombinedConfig struct {
427387
func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags) (CombinedConfig, client.Client, error) {
428388
res := CombinedConfig{}
429389

430-
if flags.MachineHubMode {
431-
if err := cfg.MachineHub.Validate(); err != nil {
432-
return CombinedConfig{}, nil, fmt.Errorf("invalid MachineHub config provided: %w", err)
433-
}
434-
435-
res.MachineHubMode = true
436-
res.MachineHubSubdomain = cfg.MachineHub.Subdomain
437-
res.MachineHubCredentialsSecretName = cfg.MachineHub.CredentialsSecretName
438-
439-
keysAndValues := []any{"credentialsSecretName", res.MachineHubCredentialsSecretName}
440-
log.V(logs.Info).Info("Will push to CyberArk MachineHub using a username and password loaded from a Kubernetes Secret", keysAndValues...)
441-
}
442-
443390
{
444391
var (
445392
mode TLSPKMode
@@ -473,31 +420,23 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
473420
mode = JetstackSecureOAuth
474421
reason = "--credentials-file was specified without --venafi-cloud"
475422
default:
476-
if !flags.MachineHubMode {
477-
return CombinedConfig{}, nil, fmt.Errorf("no TLSPK mode specified and MachineHub mode is disabled. You must either enable the MachineHub mode (using --machine-hub), or enable one of the TLSPK modes.\n" +
478-
"To enable one of the TLSPK modes, you can:\n" +
479-
" - Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the " + string(VenafiCloudKeypair) + " mode.\n" +
480-
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
481-
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
482-
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.\n" +
483-
"Note that it is possible to use one of the TLSPK modes along with the MachineHub mode (--machine-hub).")
484-
}
485-
486-
mode = Off
423+
return CombinedConfig{}, nil, fmt.Errorf("no TLSPK mode specified. " +
424+
"To enable one of the TLSPK modes, you can:\n" +
425+
" - Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the " + string(VenafiCloudKeypair) + " mode.\n" +
426+
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
427+
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
428+
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.")
487429
}
488430

489431
keysAndValues = append(keysAndValues, "mode", mode, "reason", reason)
490-
if mode != Off {
491-
log.V(logs.Debug).Info("Configured to push to Venafi", keysAndValues...)
492-
}
493-
432+
log.V(logs.Debug).Info("Configured to push to Venafi", keysAndValues...)
494433
res.TLSPKMode = mode
495434
}
496435

497436
var errs error
498437

499438
// Validation and defaulting of `server` and the deprecated `endpoint.path`.
500-
if res.TLSPKMode != Off {
439+
{
501440
// Only relevant if using TLSPK backends
502441
hasEndpointField := cfg.Endpoint.Host != "" && cfg.Endpoint.Path != ""
503442
hasServerField := cfg.Server != ""
@@ -583,7 +522,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
583522
}
584523

585524
// Validation of `cluster_id` and `organization_id`.
586-
if res.TLSPKMode != Off {
525+
{
587526
var clusterID string
588527
var organizationID string // Only used by the old jetstack-secure mode.
589528
switch res.TLSPKMode { // nolint:exhaustive
@@ -605,8 +544,10 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
605544
res.OrganizationID = organizationID
606545
res.ClusterID = clusterID
607546
res.ClusterDescription = cfg.ClusterDescription
547+
}
608548

609-
// Validation of `data-gatherers`.
549+
// Validation of `data-gatherers`.
550+
{
610551
if dgErr := ValidateDataGatherers(cfg.DataGatherers); dgErr != nil {
611552
errs = multierror.Append(errs, dgErr)
612553
}
@@ -807,8 +748,6 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
807748
if err != nil {
808749
errs = multierror.Append(errs, err)
809750
}
810-
case Off:
811-
// No client needed in this mode.
812751
default:
813752
panic(fmt.Errorf("programmer mistake: auth mode not implemented: %s", cfg.TLSPKMode))
814753
}

‎pkg/agent/config_test.go

Lines changed: 2 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -194,13 +194,11 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
194194
withoutCmdLineFlags(),
195195
)
196196
assert.EqualError(t, err, testutil.Undent(`
197-
no TLSPK mode specified and MachineHub mode is disabled. You must either enable the MachineHub mode (using --machine-hub), or enable one of the TLSPK modes.
198-
To enable one of the TLSPK modes, you can:
197+
no TLSPK mode specified. To enable one of the TLSPK modes, you can:
199198
- Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the Venafi Cloud Key Pair Service Account mode.
200199
- Use --venafi-connection for the Venafi Cloud VenafiConnection mode.
201200
- Use --credentials-file alone if you want to use the Jetstack Secure OAuth mode.
202-
- Use --api-token if you want to use the Jetstack Secure API Token mode.
203-
Note that it is possible to use one of the TLSPK modes along with the MachineHub mode (--machine-hub).`))
201+
- Use --api-token if you want to use the Jetstack Secure API Token mode.`))
204202
assert.Nil(t, cl)
205203
})
206204

@@ -617,42 +615,6 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
617615
require.NoError(t, err)
618616
assert.Equal(t, VenafiCloudVenafiConnection, got.TLSPKMode)
619617
})
620-
621-
t.Run("machinehub only: username and password", func(t *testing.T) {
622-
t.Setenv("POD_NAMESPACE", "venafi")
623-
t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
624-
got, _, err := ValidateAndCombineConfig(discardLogs(),
625-
withConfig(testutil.Undent(`
626-
machineHub:
627-
subdomain: foo
628-
credentialsSecretName: secret-1
629-
period: 1h
630-
`)),
631-
withCmdLineFlags("--machine-hub"))
632-
require.NoError(t, err)
633-
assert.Equal(t, Off, got.TLSPKMode)
634-
assert.Equal(t, true, got.MachineHubMode)
635-
})
636-
637-
t.Run("machinehub + venafi-cloud-keypair-auth should work simultaneously", func(t *testing.T) {
638-
t.Setenv("POD_NAMESPACE", "venafi")
639-
t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
640-
privKeyPath := withFile(t, fakePrivKeyPEM)
641-
got, _, err := ValidateAndCombineConfig(discardLogs(),
642-
withConfig(testutil.Undent(`
643-
machineHub:
644-
subdomain: foo
645-
credentialsSecretName: secret-1
646-
period: 1h
647-
venafi-cloud:
648-
upload_path: /v1/tlspk/upload/clusterdata
649-
cluster_id: foo
650-
`)),
651-
withCmdLineFlags("--machine-hub", "--venafi-cloud", "--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", privKeyPath))
652-
require.NoError(t, err)
653-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
654-
assert.Equal(t, true, got.MachineHubMode)
655-
})
656618
}
657619

658620
func Test_ValidateAndCombineConfig_VenafiCloudKeyPair(t *testing.T) {

‎pkg/agent/run.go

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -337,28 +337,14 @@ func gatherAndOutputData(ctx context.Context, eventf Eventf, config CombinedConf
337337
log.Info("Warning: PushingErr: retrying", "in", t, "reason", err)
338338
})
339339

340-
if config.MachineHubMode {
341-
post := func() (any, error) {
342-
log.Info("machine hub mode not yet implemented")
343-
return struct{}{}, nil
344-
}
345-
346-
group.Go(func() error {
347-
_, err := backoff.Retry(ctx, post, backoff.WithBackOff(backOff), backoff.WithNotify(notificationFunc), backoff.WithMaxElapsedTime(config.BackoffMaxTime))
348-
return err
349-
})
340+
post := func() (any, error) {
341+
return struct{}{}, postData(klog.NewContext(ctx, log), config, preflightClient, readings)
350342
}
351343

352-
if config.TLSPKMode != Off {
353-
post := func() (any, error) {
354-
return struct{}{}, postData(klog.NewContext(ctx, log), config, preflightClient, readings)
355-
}
356-
357-
group.Go(func() error {
358-
_, err := backoff.Retry(ctx, post, backoff.WithBackOff(backOff), backoff.WithNotify(notificationFunc), backoff.WithMaxElapsedTime(config.BackoffMaxTime))
359-
return err
360-
})
361-
}
344+
group.Go(func() error {
345+
_, err := backoff.Retry(ctx, post, backoff.WithBackOff(backOff), backoff.WithNotify(notificationFunc), backoff.WithMaxElapsedTime(config.BackoffMaxTime))
346+
return err
347+
})
362348

363349
groupErr := group.Wait()
364350
if groupErr != nil {

0 commit comments

Comments
 (0)