Skip to content

Commit 626d690

Browse files
wallrj-cyberarkwallrj-cyberark
committed
CyberArk(helm): add CyberArk Disco Agent Helm chart
- Introduced a new Helm chart for deploying the CyberArk Disco Agent. - Added templates for deployment, RBAC, ConfigMap, PodDisruptionBudget, and PodMonitor. - Included default values and configuration options in `values.yaml`. - Added an end-to-end test script and supporting files for validating the chart. - Enabled metrics support with optional Prometheus PodMonitor integration. Signed-off-by: Richard Wall <[email protected]>
1 parent 4d53d77 commit 626d690

File tree

20 files changed

+1544
-2
lines changed

20 files changed

+1544
-2
lines changed

‎cmd/ark/main.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package main
2+
3+
import "github.com/jetstack/preflight/cmd"
4+
5+
func main() {
6+
cmd.Execute()
7+
}

‎deploy/charts/cyberark-disco-agent/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/charts/cyberark-disco-agent/Chart.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: cyberark-disco-agent
3+
description: |-
4+
The cyberark-disco-agent connects your Kubernetes or Openshift cluster to CyberArk Discovery and Context.
5+
6+
maintainers:
7+
- name: CyberArk
8+
email: [email protected]
9+
url: https://cyberark.com
10+
11+
sources:
12+
- https://github.com/jetstack/jetstack-secure
13+
14+
# These versions are meant to be overridden by `make helm-chart`. No `v` prefix
15+
# for the `version` because Helm doesn't support auto-determining the latest
16+
# version for OCI Helm charts that use a `v` prefix.
17+
version: 0.0.0
18+
appVersion: "v0.0.0"

‎deploy/charts/cyberark-disco-agent/README.md‎

Lines changed: 292 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,292 @@
1+
# cyberark-disco-agent
2+
3+
The Cyberark Discovery and Context Agent connects your Kubernetes or OpenShift
4+
cluster to the CyberArk Discovery and Context service.
5+
You will require a CyberArk account to connect your cluster.
6+
7+
## Values
8+
9+
<!-- AUTO-GENERATED -->
10+
11+
#### **replicaCount** ~ `number`
12+
> Default value:
13+
> ```yaml
14+
> 1
15+
> ```
16+
17+
This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
18+
#### **image.repository** ~ `string`
19+
> Default value:
20+
> ```yaml
21+
> ""
22+
> ```
23+
#### **image.pullPolicy** ~ `string`
24+
> Default value:
25+
> ```yaml
26+
> IfNotPresent
27+
> ```
28+
29+
This sets the pull policy for images.
30+
#### **image.tag** ~ `string`
31+
> Default value:
32+
> ```yaml
33+
> ""
34+
> ```
35+
36+
Overrides the image tag whose default is the chart appVersion.
37+
#### **imagePullSecrets** ~ `array`
38+
> Default value:
39+
> ```yaml
40+
> []
41+
> ```
42+
43+
This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
44+
#### **nameOverride** ~ `string`
45+
> Default value:
46+
> ```yaml
47+
> ""
48+
> ```
49+
50+
This is to override the chart name.
51+
#### **fullnameOverride** ~ `string`
52+
> Default value:
53+
> ```yaml
54+
> ""
55+
> ```
56+
#### **serviceAccount.create** ~ `bool`
57+
> Default value:
58+
> ```yaml
59+
> true
60+
> ```
61+
62+
Specifies whether a service account should be created
63+
#### **serviceAccount.automount** ~ `bool`
64+
> Default value:
65+
> ```yaml
66+
> true
67+
> ```
68+
69+
Automatically mount a ServiceAccount's API credentials?
70+
#### **serviceAccount.annotations** ~ `object`
71+
> Default value:
72+
> ```yaml
73+
> {}
74+
> ```
75+
76+
Annotations to add to the service account
77+
#### **serviceAccount.name** ~ `string`
78+
> Default value:
79+
> ```yaml
80+
> ""
81+
> ```
82+
83+
The name of the service account to use.
84+
If not set and create is true, a name is generated using the fullname template
85+
#### **podAnnotations** ~ `object`
86+
> Default value:
87+
> ```yaml
88+
> {}
89+
> ```
90+
91+
This is for setting Kubernetes Annotations to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
92+
#### **podLabels** ~ `object`
93+
> Default value:
94+
> ```yaml
95+
> {}
96+
> ```
97+
98+
This is for setting Kubernetes Labels to a Pod.
99+
For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
100+
#### **podSecurityContext** ~ `object`
101+
> Default value:
102+
> ```yaml
103+
> {}
104+
> ```
105+
#### **securityContext** ~ `object`
106+
> Default value:
107+
> ```yaml
108+
> allowPrivilegeEscalation: false
109+
> capabilities:
110+
> drop:
111+
> - ALL
112+
> readOnlyRootFilesystem: true
113+
> runAsNonRoot: true
114+
> seccompProfile:
115+
> type: RuntimeDefault
116+
> ```
117+
118+
Add Container specific SecurityContext settings to the container. Takes precedence over `podSecurityContext` when set. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container
119+
120+
#### **resources** ~ `object`
121+
> Default value:
122+
> ```yaml
123+
> {}
124+
> ```
125+
#### **volumes** ~ `array`
126+
> Default value:
127+
> ```yaml
128+
> []
129+
> ```
130+
131+
Additional volumes on the output Deployment definition.
132+
#### **volumeMounts** ~ `array`
133+
> Default value:
134+
> ```yaml
135+
> []
136+
> ```
137+
138+
Additional volumeMounts on the output Deployment definition.
139+
#### **nodeSelector** ~ `object`
140+
> Default value:
141+
> ```yaml
142+
> {}
143+
> ```
144+
#### **tolerations** ~ `array`
145+
> Default value:
146+
> ```yaml
147+
> []
148+
> ```
149+
#### **affinity** ~ `object`
150+
> Default value:
151+
> ```yaml
152+
> {}
153+
> ```
154+
#### **http_proxy** ~ `string`
155+
156+
Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
157+
158+
#### **https_proxy** ~ `string`
159+
160+
Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
161+
162+
#### **no_proxy** ~ `string`
163+
164+
Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.
165+
166+
#### **podDisruptionBudget** ~ `object`
167+
> Default value:
168+
> ```yaml
169+
> enabled: false
170+
> ```
171+
172+
Configure a PodDisruptionBudget for the agent's Deployment. If running with multiple replicas, consider setting podDisruptionBudget.enabled to true.
173+
174+
#### **config.period** ~ `string`
175+
> Default value:
176+
> ```yaml
177+
> 1h0m0s
178+
> ```
179+
180+
Push data every hour unless changed.
181+
#### **config.excludeAnnotationKeysRegex** ~ `array`
182+
> Default value:
183+
> ```yaml
184+
> []
185+
> ```
186+
187+
You can configure the agent to exclude some annotations or labels from being pushed . All Kubernetes objects are affected. The objects are still pushed, but the specified annotations and labels are removed before being pushed.
188+
189+
Dots is the only character that needs to be escaped in the regex. Use either double quotes with escaped single quotes or unquoted strings for the regex to avoid YAML parsing issues with `\.`.
190+
191+
Example: excludeAnnotationKeysRegex: ['^kapp\.k14s\.io/original.*']
192+
#### **config.excludeLabelKeysRegex** ~ `array`
193+
> Default value:
194+
> ```yaml
195+
> []
196+
> ```
197+
#### **authentication.secretName** ~ `string`
198+
> Default value:
199+
> ```yaml
200+
> agent-credentials
201+
> ```
202+
#### **extraArgs** ~ `array`
203+
> Default value:
204+
> ```yaml
205+
> []
206+
> ```
207+
208+
```yaml
209+
extraArgs:
210+
- --logging-format=json
211+
- --log-level=6 # To enable HTTP request logging
212+
```
213+
#### **metrics.enabled** ~ `bool`
214+
> Default value:
215+
> ```yaml
216+
> true
217+
> ```
218+
219+
Enable the metrics server.
220+
If false, the metrics server will be disabled and the other metrics fields below will be ignored.
221+
#### **metrics.podmonitor.enabled** ~ `bool`
222+
> Default value:
223+
> ```yaml
224+
> false
225+
> ```
226+
227+
Create a PodMonitor to add the metrics to Prometheus, if you are using Prometheus Operator. See https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor
228+
#### **metrics.podmonitor.namespace** ~ `string`
229+
230+
The namespace that the pod monitor should live in. Defaults to the venafi-kubernetes-agent namespace.
231+
232+
#### **metrics.podmonitor.prometheusInstance** ~ `string`
233+
> Default value:
234+
> ```yaml
235+
> default
236+
> ```
237+
238+
Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.
239+
#### **metrics.podmonitor.interval** ~ `string`
240+
> Default value:
241+
> ```yaml
242+
> 60s
243+
> ```
244+
245+
The interval to scrape metrics.
246+
#### **metrics.podmonitor.scrapeTimeout** ~ `string`
247+
> Default value:
248+
> ```yaml
249+
> 30s
250+
> ```
251+
252+
The timeout before a metrics scrape fails.
253+
#### **metrics.podmonitor.labels** ~ `object`
254+
> Default value:
255+
> ```yaml
256+
> {}
257+
> ```
258+
259+
Additional labels to add to the PodMonitor.
260+
#### **metrics.podmonitor.annotations** ~ `object`
261+
> Default value:
262+
> ```yaml
263+
> {}
264+
> ```
265+
266+
Additional annotations to add to the PodMonitor.
267+
#### **metrics.podmonitor.honorLabels** ~ `bool`
268+
> Default value:
269+
> ```yaml
270+
> false
271+
> ```
272+
273+
Keep labels from scraped data, overriding server-side labels.
274+
#### **metrics.podmonitor.endpointAdditionalProperties** ~ `object`
275+
> Default value:
276+
> ```yaml
277+
> {}
278+
> ```
279+
280+
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
281+
282+
For example:
283+
284+
```yaml
285+
endpointAdditionalProperties:
286+
relabelings:
287+
- action: replace
288+
sourceLabels:
289+
- __meta_kubernetes_pod_node_name
290+
targetLabel: instance
291+
```
292+

‎deploy/charts/cyberark-disco-agent/templates/NOTES.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
- Check the application is running:
2+
> kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
3+
4+
- Check the application logs for successful connection to the platform:
5+
> kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}

0 commit comments

Comments
 (0)