Skip to content

Commit cd18198

Browse files
wallrj-cyberarkwallrj-cyberark
committed
CyberArk(helm): add CyberArk Disco Agent Helm chart
- Introduced a new Helm chart for deploying the CyberArk Disco Agent. - Added templates for deployment, RBAC, ConfigMap, PodDisruptionBudget, and PodMonitor. - Included default values and configuration options in `values.yaml`. - Added an end-to-end test script and supporting files for validating the chart. - Enabled metrics support with optional Prometheus PodMonitor integration. Signed-off-by: Richard Wall <[email protected]>
1 parent 26d6e59 commit cd18198

File tree

13 files changed

+769
-0
lines changed

13 files changed

+769
-0
lines changed

‎deploy/charts/cyberark-disco-agent/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/charts/cyberark-disco-agent/Chart.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: cyberark-disco-agent
3+
description: |-
4+
The cyberark-disco-agent connects your Kubernetes or Openshift cluster to CyberArk Discovery and Context.
5+
6+
maintainers:
7+
- name: CyberArk
8+
email: [email protected]
9+
url: https://cyberark.com
10+
11+
sources:
12+
- https://github.com/jetstack/jetstack-secure
13+
14+
# These versions are meant to be overridden by `make helm-chart`. No `v` prefix
15+
# for the `version` because Helm doesn't support auto-determining the latest
16+
# version for OCI Helm charts that use a `v` prefix.
17+
version: 0.0.0
18+
appVersion: "v0.0.0"

‎deploy/charts/cyberark-disco-agent/templates/NOTES.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
- Check the application is running:
2+
> kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
3+
4+
- Check the application logs for successful connection to the platform:
5+
> kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}

‎deploy/charts/cyberark-disco-agent/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "cyberark-disco-agent.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "cyberark-disco-agent.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "cyberark-disco-agent.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "cyberark-disco-agent.labels" -}}
37+
helm.sh/chart: {{ include "cyberark-disco-agent.chart" . }}
38+
{{ include "cyberark-disco-agent.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "cyberark-disco-agent.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "cyberark-disco-agent.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "cyberark-disco-agent.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "cyberark-disco-agent.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎deploy/charts/cyberark-disco-agent/templates/configmap.yaml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: {{ include "cyberark-disco-agent.fullname" . }}-config
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
{{- include "cyberark-disco-agent.labels" . | nindent 4 }}
8+
data:
9+
config.yaml: |-
10+
period: {{ .Values.config.period | quote }}
11+
{{- with .Values.config.excludeAnnotationKeysRegex }}
12+
exclude-annotation-keys-regex:
13+
{{- . | toYaml | nindent 6 }}
14+
{{- end }}
15+
{{- with .Values.config.excludeLabelKeysRegex }}
16+
exclude-label-keys-regex:
17+
{{- . | toYaml | nindent 6 }}
18+
{{- end }}
19+
data-gatherers:
20+
- kind: k8s-discovery
21+
name: ark/discovery
22+
- kind: k8s-dynamic
23+
name: ark/secrets
24+
config:
25+
resource-type:
26+
version: v1
27+
resource: secrets
28+
field-selectors:
29+
- type!=kubernetes.io/service-account-token
30+
- type!=kubernetes.io/dockercfg
31+
- type!=kubernetes.io/dockerconfigjson
32+
- type!=kubernetes.io/basic-auth
33+
- type!=kubernetes.io/ssh-auth
34+
- type!=bootstrap.kubernetes.io/token
35+
- type!=helm.sh/release.v1
36+
- kind: k8s-dynamic
37+
name: ark/serviceaccounts
38+
config:
39+
resource-type:
40+
resource: serviceaccounts
41+
version: v1
42+
- kind: k8s-dynamic
43+
name: ark/roles
44+
config:
45+
resource-type:
46+
version: v1
47+
group: rbac.authorization.k8s.io
48+
resource: roles
49+
- kind: k8s-dynamic
50+
name: ark/clusterroles
51+
config:
52+
resource-type:
53+
version: v1
54+
group: rbac.authorization.k8s.io
55+
resource: clusterroles
56+
- kind: k8s-dynamic
57+
name: ark/rolebindings
58+
config:
59+
resource-type:
60+
version: v1
61+
group: rbac.authorization.k8s.io
62+
resource: rolebindings
63+
- kind: k8s-dynamic
64+
name: ark/clusterrolebindings
65+
config:
66+
resource-type:
67+
version: v1
68+
group: rbac.authorization.k8s.io
69+
resource: clusterrolebindings
70+
- kind: k8s-dynamic
71+
name: ark/jobs
72+
config:
73+
resource-type:
74+
version: v1
75+
group: batch
76+
resource: jobs
77+
- kind: k8s-dynamic
78+
name: ark/cronjobs
79+
config:
80+
resource-type:
81+
version: v1
82+
group: batch
83+
resource: cronjobs
84+
- kind: k8s-dynamic
85+
name: ark/deployments
86+
config:
87+
resource-type:
88+
version: v1
89+
group: apps
90+
resource: deployments
91+
- kind: k8s-dynamic
92+
name: ark/statefulsets
93+
config:
94+
resource-type:
95+
version: v1
96+
group: apps
97+
resource: statefulsets
98+
- kind: k8s-dynamic
99+
name: ark/daemonsets
100+
config:
101+
resource-type:
102+
version: v1
103+
group: apps
104+
resource: daemonsets
105+
- kind: k8s-dynamic
106+
name: ark/pods
107+
config:
108+
resource-type:
109+
version: v1
110+
resource: pods

‎deploy/charts/cyberark-disco-agent/templates/deployment.yaml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "cyberark-disco-agent.fullname" . }}
5+
labels:
6+
{{- include "cyberark-disco-agent.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "cyberark-disco-agent.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "cyberark-disco-agent.labels" . | nindent 8 }}
20+
{{- with .Values.podLabels }}
21+
{{- toYaml . | nindent 8 }}
22+
{{- end }}
23+
spec:
24+
{{- with .Values.imagePullSecrets }}
25+
imagePullSecrets:
26+
{{- toYaml . | nindent 8 }}
27+
{{- end }}
28+
serviceAccountName: {{ include "cyberark-disco-agent.serviceAccountName" . }}
29+
{{- with .Values.podSecurityContext }}
30+
securityContext:
31+
{{- toYaml . | nindent 8 }}
32+
{{- end }}
33+
containers:
34+
- name: {{ .Chart.Name }}
35+
{{- with .Values.securityContext }}
36+
securityContext:
37+
{{- toYaml . | nindent 12 }}
38+
{{- end }}
39+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
40+
imagePullPolicy: {{ .Values.image.pullPolicy }}
41+
env:
42+
- name: POD_NAMESPACE
43+
valueFrom:
44+
fieldRef:
45+
fieldPath: metadata.namespace
46+
- name: POD_NAME
47+
valueFrom:
48+
fieldRef:
49+
fieldPath: metadata.name
50+
- name: POD_UID
51+
valueFrom:
52+
fieldRef:
53+
fieldPath: metadata.uid
54+
- name: POD_NODE
55+
valueFrom:
56+
fieldRef:
57+
fieldPath: spec.nodeName
58+
- name: ARK_USERNAME
59+
valueFrom:
60+
secretKeyRef:
61+
name: {{ .Values.authentication.secretName }}
62+
key: ARK_USERNAME
63+
- name: ARK_SECRET
64+
valueFrom:
65+
secretKeyRef:
66+
name: {{ .Values.authentication.secretName }}
67+
key: ARK_SECRET
68+
- name: ARK_SUBDOMAIN
69+
valueFrom:
70+
secretKeyRef:
71+
name: {{ .Values.authentication.secretName }}
72+
key: ARK_SUBDOMAIN
73+
- name: ARK_DISCOVERY_API
74+
valueFrom:
75+
secretKeyRef:
76+
name: {{ .Values.authentication.secretName }}
77+
key: ARK_DISCOVERY_API
78+
{{- with .Values.http_proxy }}
79+
- name: HTTP_PROXY
80+
value: {{ . }}
81+
{{- end }}
82+
{{- with .Values.https_proxy }}
83+
- name: HTTPS_PROXY
84+
value: {{ . }}
85+
{{- end }}
86+
{{- with .Values.no_proxy }}
87+
- name: NO_PROXY
88+
value: {{ . }}
89+
{{- end }}
90+
args:
91+
- "agent"
92+
- "-c"
93+
- "/etc/cyberark-disco-agent/config.yaml"
94+
- --machine-hub
95+
{{- if .Values.metrics.enabled }}
96+
- --enable-metrics
97+
{{- end }}
98+
{{- range .Values.extraArgs }}
99+
- {{ . | quote }}
100+
{{- end }}
101+
{{- with .Values.resources }}
102+
resources:
103+
{{- toYaml . | nindent 12 }}
104+
{{- end }}
105+
volumeMounts:
106+
- name: config
107+
mountPath: "/etc/cyberark-disco-agent"
108+
readOnly: true
109+
{{- with .Values.volumeMounts }}
110+
{{- toYaml . | nindent 12 }}
111+
{{- end }}
112+
volumes:
113+
- name: config
114+
configMap:
115+
name: {{ include "cyberark-disco-agent.fullname" . }}-config
116+
optional: false
117+
{{- with .Values.volumes }}
118+
{{- toYaml . | nindent 8 }}
119+
{{- end }}
120+
{{- with .Values.nodeSelector }}
121+
nodeSelector:
122+
{{- toYaml . | nindent 8 }}
123+
{{- end }}
124+
{{- with .Values.affinity }}
125+
affinity:
126+
{{- toYaml . | nindent 8 }}
127+
{{- end }}
128+
{{- with .Values.tolerations }}
129+
tolerations:
130+
{{- toYaml . | nindent 8 }}
131+
{{- end }}

‎deploy/charts/cyberark-disco-agent/templates/poddisruptionbudget.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if .Values.podDisruptionBudget.enabled }}
2+
apiVersion: policy/v1
3+
kind: PodDisruptionBudget
4+
metadata:
5+
name: {{ include "cyberark-disco-agent.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "cyberark-disco-agent.labels" . | nindent 4 }}
9+
spec:
10+
selector:
11+
matchLabels:
12+
{{- include "cyberark-disco-agent.selectorLabels" . | nindent 6 }}
13+
14+
{{- if not (or (hasKey .Values.podDisruptionBudget "minAvailable") (hasKey .Values.podDisruptionBudget "maxUnavailable")) }}
15+
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
16+
{{- end }}
17+
{{- if hasKey .Values.podDisruptionBudget "minAvailable" }}
18+
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
19+
{{- end }}
20+
{{- if hasKey .Values.podDisruptionBudget "maxUnavailable" }}
21+
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
22+
{{- end }}
23+
{{- end }}

0 commit comments

Comments
 (0)