Skip to content

Commit 89758e9

Browse files
wallrj-cyberarkwallrj-cyberark
committed
CyberArk(helm): add CyberArk Disco Agent Helm chart
- Introduced a new Helm chart for deploying the CyberArk Disco Agent. - Added templates for deployment, RBAC, ConfigMap, PodDisruptionBudget, and PodMonitor. - Included default values and configuration options in `values.yaml`. - Added an end-to-end test script and supporting files for validating the chart. - Enabled metrics support with optional Prometheus PodMonitor integration. Signed-off-by: Richard Wall <[email protected]>
1 parent 26d6e59 commit 89758e9

File tree

17 files changed

+1477
-0
lines changed

17 files changed

+1477
-0
lines changed

‎deploy/charts/cyberark-disco-agent/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/charts/cyberark-disco-agent/Chart.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: cyberark-disco-agent
3+
description: |-
4+
The cyberark-disco-agent connects your Kubernetes or Openshift cluster to CyberArk Discovery and Context.
5+
6+
maintainers:
7+
- name: CyberArk
8+
email: [email protected]
9+
url: https://cyberark.com
10+
11+
sources:
12+
- https://github.com/jetstack/jetstack-secure
13+
14+
# These versions are meant to be overridden by `make helm-chart`. No `v` prefix
15+
# for the `version` because Helm doesn't support auto-determining the latest
16+
# version for OCI Helm charts that use a `v` prefix.
17+
version: 0.0.0
18+
appVersion: "v0.0.0"

‎deploy/charts/cyberark-disco-agent/README.md‎

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
# cyberark-disco-agent
2+
3+
The Cyberark Discovery and Context Agent connects your Kubernetes or OpenShift cluster to the CyberArk Discovery and Context service.
4+
You will require a CyberArk account to connect your cluster.
5+
6+
## Values
7+
8+
<!-- AUTO-GENERATED -->
9+
10+
#### **replicaCount** ~ `number`
11+
> Default value:
12+
> ```yaml
13+
> 1
14+
> ```
15+
16+
This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
17+
#### **image.repository** ~ `string`
18+
> Default value:
19+
> ```yaml
20+
> registry.venafi.cloud/venafi-agent/venafi-agent
21+
> ```
22+
#### **image.pullPolicy** ~ `string`
23+
> Default value:
24+
> ```yaml
25+
> IfNotPresent
26+
> ```
27+
28+
This sets the pull policy for images.
29+
#### **image.tag** ~ `string`
30+
> Default value:
31+
> ```yaml
32+
> ""
33+
> ```
34+
35+
Overrides the image tag whose default is the chart appVersion.
36+
#### **imagePullSecrets** ~ `array`
37+
> Default value:
38+
> ```yaml
39+
> []
40+
> ```
41+
42+
This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
43+
#### **nameOverride** ~ `string`
44+
> Default value:
45+
> ```yaml
46+
> ""
47+
> ```
48+
49+
This is to override the chart name.
50+
#### **fullnameOverride** ~ `string`
51+
> Default value:
52+
> ```yaml
53+
> ""
54+
> ```
55+
#### **serviceAccount.create** ~ `bool`
56+
> Default value:
57+
> ```yaml
58+
> true
59+
> ```
60+
61+
Specifies whether a service account should be created
62+
#### **serviceAccount.automount** ~ `bool`
63+
> Default value:
64+
> ```yaml
65+
> true
66+
> ```
67+
68+
Automatically mount a ServiceAccount's API credentials?
69+
#### **serviceAccount.annotations** ~ `object`
70+
> Default value:
71+
> ```yaml
72+
> {}
73+
> ```
74+
75+
Annotations to add to the service account
76+
#### **serviceAccount.name** ~ `string`
77+
> Default value:
78+
> ```yaml
79+
> ""
80+
> ```
81+
82+
The name of the service account to use.
83+
If not set and create is true, a name is generated using the fullname template
84+
#### **podAnnotations** ~ `object`
85+
> Default value:
86+
> ```yaml
87+
> {}
88+
> ```
89+
90+
This is for setting Kubernetes Annotations to a Pod. For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
91+
#### **podLabels** ~ `object`
92+
> Default value:
93+
> ```yaml
94+
> {}
95+
> ```
96+
97+
This is for setting Kubernetes Labels to a Pod.
98+
For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
99+
#### **podSecurityContext** ~ `object`
100+
> Default value:
101+
> ```yaml
102+
> {}
103+
> ```
104+
#### **securityContext** ~ `object`
105+
> Default value:
106+
> ```yaml
107+
> allowPrivilegeEscalation: false
108+
> capabilities:
109+
> drop:
110+
> - ALL
111+
> readOnlyRootFilesystem: true
112+
> runAsNonRoot: true
113+
> seccompProfile:
114+
> type: RuntimeDefault
115+
> ```
116+
117+
Add Container specific SecurityContext settings to the container. Takes precedence over `podSecurityContext` when set. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container
118+
119+
#### **resources** ~ `object`
120+
> Default value:
121+
> ```yaml
122+
> {}
123+
> ```
124+
#### **volumes** ~ `array`
125+
> Default value:
126+
> ```yaml
127+
> []
128+
> ```
129+
130+
Additional volumes on the output Deployment definition.
131+
#### **volumeMounts** ~ `array`
132+
> Default value:
133+
> ```yaml
134+
> []
135+
> ```
136+
137+
Additional volumeMounts on the output Deployment definition.
138+
#### **nodeSelector** ~ `object`
139+
> Default value:
140+
> ```yaml
141+
> {}
142+
> ```
143+
#### **tolerations** ~ `array`
144+
> Default value:
145+
> ```yaml
146+
> []
147+
> ```
148+
#### **affinity** ~ `object`
149+
> Default value:
150+
> ```yaml
151+
> {}
152+
> ```
153+
#### **http_proxy** ~ `string`
154+
155+
Configures the HTTP_PROXY environment variable where a HTTP proxy is required.
156+
157+
#### **https_proxy** ~ `string`
158+
159+
Configures the HTTPS_PROXY environment variable where a HTTP proxy is required.
160+
161+
#### **no_proxy** ~ `string`
162+
163+
Configures the NO_PROXY environment variable where a HTTP proxy is required, but certain domains should be excluded.
164+
165+
#### **podDisruptionBudget** ~ `object`
166+
> Default value:
167+
> ```yaml
168+
> enabled: false
169+
> ```
170+
171+
Configure a PodDisruptionBudget for the agent's Deployment. If running with multiple replicas, consider setting podDisruptionBudget.enabled to true.
172+
173+
#### **config.period** ~ `string`
174+
> Default value:
175+
> ```yaml
176+
> 1h0m0s
177+
> ```
178+
179+
Push data every hour unless changed.
180+
#### **config.excludeAnnotationKeysRegex** ~ `array`
181+
> Default value:
182+
> ```yaml
183+
> []
184+
> ```
185+
186+
You can configure the agent to exclude some annotations or labels from being pushed . All Kubernetes objects are affected. The objects are still pushed, but the specified annotations and labels are removed before being pushed.
187+
188+
Dots is the only character that needs to be escaped in the regex. Use either double quotes with escaped single quotes or unquoted strings for the regex to avoid YAML parsing issues with `\.`.
189+
190+
Example: excludeAnnotationKeysRegex: ['^kapp\.k14s\.io/original.*']
191+
#### **config.excludeLabelKeysRegex** ~ `array`
192+
> Default value:
193+
> ```yaml
194+
> []
195+
> ```
196+
#### **authentication.secretName** ~ `string`
197+
> Default value:
198+
> ```yaml
199+
> agent-credentials
200+
> ```
201+
#### **extraArgs** ~ `array`
202+
> Default value:
203+
> ```yaml
204+
> []
205+
> ```
206+
207+
```yaml
208+
extraArgs:
209+
- --logging-format=json
210+
- --log-level=6 # To enable HTTP request logging
211+
```
212+
#### **metrics.enabled** ~ `bool`
213+
> Default value:
214+
> ```yaml
215+
> true
216+
> ```
217+
218+
Enable the metrics server.
219+
If false, the metrics server will be disabled and the other metrics fields below will be ignored.
220+
#### **metrics.podmonitor.enabled** ~ `bool`
221+
> Default value:
222+
> ```yaml
223+
> false
224+
> ```
225+
226+
Create a PodMonitor to add the metrics to Prometheus, if you are using Prometheus Operator. See https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PodMonitor
227+
#### **metrics.podmonitor.namespace** ~ `string`
228+
229+
The namespace that the pod monitor should live in. Defaults to the venafi-kubernetes-agent namespace.
230+
231+
#### **metrics.podmonitor.prometheusInstance** ~ `string`
232+
> Default value:
233+
> ```yaml
234+
> default
235+
> ```
236+
237+
Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.
238+
#### **metrics.podmonitor.interval** ~ `string`
239+
> Default value:
240+
> ```yaml
241+
> 60s
242+
> ```
243+
244+
The interval to scrape metrics.
245+
#### **metrics.podmonitor.scrapeTimeout** ~ `string`
246+
> Default value:
247+
> ```yaml
248+
> 30s
249+
> ```
250+
251+
The timeout before a metrics scrape fails.
252+
#### **metrics.podmonitor.labels** ~ `object`
253+
> Default value:
254+
> ```yaml
255+
> {}
256+
> ```
257+
258+
Additional labels to add to the PodMonitor.
259+
#### **metrics.podmonitor.annotations** ~ `object`
260+
> Default value:
261+
> ```yaml
262+
> {}
263+
> ```
264+
265+
Additional annotations to add to the PodMonitor.
266+
#### **metrics.podmonitor.honorLabels** ~ `bool`
267+
> Default value:
268+
> ```yaml
269+
> false
270+
> ```
271+
272+
Keep labels from scraped data, overriding server-side labels.
273+
#### **metrics.podmonitor.endpointAdditionalProperties** ~ `object`
274+
> Default value:
275+
> ```yaml
276+
> {}
277+
> ```
278+
279+
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
280+
281+
For example:
282+
283+
```yaml
284+
endpointAdditionalProperties:
285+
relabelings:
286+
- action: replace
287+
sourceLabels:
288+
- __meta_kubernetes_pod_node_name
289+
targetLabel: instance
290+
```
291+

‎deploy/charts/cyberark-disco-agent/templates/NOTES.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
- Check the application is running:
2+
> kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
3+
4+
- Check the application logs for successful connection to the platform:
5+
> kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}

0 commit comments

Comments
 (0)