Skip to content

Commit 398313d

Browse files
doronm2doronm2
authored
Merge pull request #816 from YaaraSirkis/dev/csi_information
add CSI information to discovery-agent
2 parents 1edaed3 + 277d447 commit 398313d

7 files changed

Lines changed: 292 additions & 0 deletions

File tree

‎deploy/charts/disco-agent/templates/configmap.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,3 +145,17 @@ data:
145145
group: external-secrets.io
146146
version: v1
147147
resource: clustersecretstores
148+
- kind: k8s-dynamic
149+
name: ark/secretproviderclasses
150+
config:
151+
resource-type:
152+
group: secrets-store.csi.x-k8s.io
153+
version: v1
154+
resource: secretproviderclasses
155+
- kind: k8s-dynamic
156+
name: ark/secretproviderclasspodstatuses
157+
config:
158+
resource-type:
159+
group: secrets-store.csi.x-k8s.io
160+
version: v1
161+
resource: secretproviderclasspodstatuses

‎deploy/charts/disco-agent/templates/rbac.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,3 +140,31 @@ subjects:
140140
- kind: ServiceAccount
141141
name: {{ include "disco-agent.serviceAccountName" . }}
142142
namespace: {{ .Release.Namespace }}
143+
---
144+
apiVersion: rbac.authorization.k8s.io/v1
145+
kind: ClusterRole
146+
metadata:
147+
name: {{ include "disco-agent.fullname" . }}-csi-reader
148+
labels:
149+
{{- include "disco-agent.labels" . | nindent 4 }}
150+
rules:
151+
- apiGroups: ["secrets-store.csi.x-k8s.io"]
152+
resources:
153+
- secretproviderclasses
154+
- secretproviderclasspodstatuses
155+
verbs: ["get", "list", "watch"]
156+
---
157+
apiVersion: rbac.authorization.k8s.io/v1
158+
kind: ClusterRoleBinding
159+
metadata:
160+
name: {{ include "disco-agent.fullname" . }}-csi-reader
161+
labels:
162+
{{- include "disco-agent.labels" . | nindent 4 }}
163+
roleRef:
164+
kind: ClusterRole
165+
name: {{ include "disco-agent.fullname" . }}-csi-reader
166+
apiGroup: rbac.authorization.k8s.io
167+
subjects:
168+
- kind: ServiceAccount
169+
name: {{ include "disco-agent.serviceAccountName" . }}
170+
namespace: {{ .Release.Namespace }}

‎deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,20 @@ custom-cluster-description:
133133
group: external-secrets.io
134134
version: v1
135135
resource: clustersecretstores
136+
- kind: k8s-dynamic
137+
name: ark/secretproviderclasses
138+
config:
139+
resource-type:
140+
group: secrets-store.csi.x-k8s.io
141+
version: v1
142+
resource: secretproviderclasses
143+
- kind: k8s-dynamic
144+
name: ark/secretproviderclasspodstatuses
145+
config:
146+
resource-type:
147+
group: secrets-store.csi.x-k8s.io
148+
version: v1
149+
resource: secretproviderclasspodstatuses
136150
kind: ConfigMap
137151
metadata:
138152
labels:
@@ -278,6 +292,20 @@ custom-cluster-name:
278292
group: external-secrets.io
279293
version: v1
280294
resource: clustersecretstores
295+
- kind: k8s-dynamic
296+
name: ark/secretproviderclasses
297+
config:
298+
resource-type:
299+
group: secrets-store.csi.x-k8s.io
300+
version: v1
301+
resource: secretproviderclasses
302+
- kind: k8s-dynamic
303+
name: ark/secretproviderclasspodstatuses
304+
config:
305+
resource-type:
306+
group: secrets-store.csi.x-k8s.io
307+
version: v1
308+
resource: secretproviderclasspodstatuses
281309
kind: ConfigMap
282310
metadata:
283311
labels:
@@ -423,6 +451,20 @@ custom-period:
423451
group: external-secrets.io
424452
version: v1
425453
resource: clustersecretstores
454+
- kind: k8s-dynamic
455+
name: ark/secretproviderclasses
456+
config:
457+
resource-type:
458+
group: secrets-store.csi.x-k8s.io
459+
version: v1
460+
resource: secretproviderclasses
461+
- kind: k8s-dynamic
462+
name: ark/secretproviderclasspodstatuses
463+
config:
464+
resource-type:
465+
group: secrets-store.csi.x-k8s.io
466+
version: v1
467+
resource: secretproviderclasspodstatuses
426468
kind: ConfigMap
427469
metadata:
428470
labels:
@@ -568,6 +610,20 @@ defaults:
568610
group: external-secrets.io
569611
version: v1
570612
resource: clustersecretstores
613+
- kind: k8s-dynamic
614+
name: ark/secretproviderclasses
615+
config:
616+
resource-type:
617+
group: secrets-store.csi.x-k8s.io
618+
version: v1
619+
resource: secretproviderclasses
620+
- kind: k8s-dynamic
621+
name: ark/secretproviderclasspodstatuses
622+
config:
623+
resource-type:
624+
group: secrets-store.csi.x-k8s.io
625+
version: v1
626+
resource: secretproviderclasspodstatuses
571627
kind: ConfigMap
572628
metadata:
573629
labels:

‎internal/cyberark/dataupload/dataupload.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,10 @@ type Snapshot struct {
8888
ClusterExternalSecrets []runtime.Object `json:"clusterexternalsecrets"`
8989
// ClusterSecretStores is a list of ClusterSecretStore resources in the cluster.
9090
ClusterSecretStores []runtime.Object `json:"clustersecretstores"`
91+
// SecretProviderClasses is a list of SecretProviderClass resources in the cluster.
92+
SecretProviderClasses []runtime.Object `json:"secretproviderclasses"`
93+
// SecretProviderClassPodStatuses is a list of SecretProviderClassPodStatus resources in the cluster.
94+
SecretProviderClassPodStatuses []runtime.Object `json:"secretproviderclasspodstatuses"`
9195
// Roles is a list of Role resources in the cluster.
9296
Roles []runtime.Object `json:"roles"`
9397
// ClusterRoles is a list of ClusterRole resources in the cluster.

‎pkg/client/client_cyberark.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,12 @@ var defaultExtractorFunctions = map[string]func(*api.DataReading, *dataupload.Sn
244244
"ark/esoclustersecretstores": func(r *api.DataReading, s *dataupload.Snapshot) error {
245245
return extractResourceListFromReading(r, &s.ClusterSecretStores)
246246
},
247+
"ark/secretproviderclasses": func(r *api.DataReading, s *dataupload.Snapshot) error {
248+
return extractResourceListFromReading(r, &s.SecretProviderClasses)
249+
},
250+
"ark/secretproviderclasspodstatuses": func(r *api.DataReading, s *dataupload.Snapshot) error {
251+
return extractResourceListFromReading(r, &s.SecretProviderClassPodStatuses)
252+
},
247253
}
248254

249255
// convertDataReadings processes a list of DataReadings using the provided

‎pkg/client/client_cyberark_convertdatareadings_test.go‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -815,6 +815,188 @@ func TestConvertDataReadings_ClusterSecretStores(t *testing.T) {
815815
assert.Equal(t, "aws-cluster-secret-store", css2.GetName())
816816
}
817817

818+
// TestConvertDataReadings_SecretProviderClasses tests that secretproviderclasses are correctly converted.
819+
func TestConvertDataReadings_SecretProviderClasses(t *testing.T) {
820+
extractorFunctions := map[string]func(*api.DataReading, *dataupload.Snapshot) error{
821+
"ark/discovery": extractClusterIDAndServerVersionFromReading,
822+
"ark/secretproviderclasses": func(reading *api.DataReading, snapshot *dataupload.Snapshot) error {
823+
return extractResourceListFromReading(reading, &snapshot.SecretProviderClasses)
824+
},
825+
}
826+
827+
readings := []*api.DataReading{
828+
{
829+
DataGatherer: "ark/discovery",
830+
Data: &api.DiscoveryData{
831+
ClusterID: "test-cluster-id",
832+
ServerVersion: &version.Info{
833+
GitVersion: "v1.21.0",
834+
},
835+
},
836+
},
837+
{
838+
DataGatherer: "ark/secretproviderclasses",
839+
Data: &api.DynamicData{
840+
Items: []*api.GatheredResource{
841+
{
842+
Resource: &unstructured.Unstructured{
843+
Object: map[string]any{
844+
"apiVersion": "secrets-store.csi.x-k8s.io/v1",
845+
"kind": "SecretProviderClass",
846+
"metadata": map[string]any{
847+
"name": "conjur-spc",
848+
"namespace": "default",
849+
},
850+
"spec": map[string]any{
851+
"provider": "conjur",
852+
},
853+
},
854+
},
855+
},
856+
{
857+
Resource: &unstructured.Unstructured{
858+
Object: map[string]any{
859+
"apiVersion": "secrets-store.csi.x-k8s.io/v1",
860+
"kind": "SecretProviderClass",
861+
"metadata": map[string]any{
862+
"name": "vault-spc",
863+
"namespace": "default",
864+
},
865+
"spec": map[string]any{
866+
"provider": "vault",
867+
},
868+
},
869+
},
870+
},
871+
// Deleted secretproviderclass should be ignored
872+
{
873+
DeletedAt: api.Time{Time: time.Now()},
874+
Resource: &unstructured.Unstructured{
875+
Object: map[string]any{
876+
"apiVersion": "secrets-store.csi.x-k8s.io/v1",
877+
"kind": "SecretProviderClass",
878+
"metadata": map[string]any{
879+
"name": "deleted-spc",
880+
"namespace": "default",
881+
},
882+
},
883+
},
884+
},
885+
},
886+
},
887+
},
888+
}
889+
890+
var snapshot dataupload.Snapshot
891+
err := convertDataReadings(extractorFunctions, readings, &snapshot)
892+
require.NoError(t, err)
893+
894+
assert.Equal(t, "test-cluster-id", snapshot.ClusterID)
895+
require.Len(t, snapshot.SecretProviderClasses, 2, "should have 2 secretproviderclasses (deleted one should be excluded)")
896+
897+
spc1, ok := snapshot.SecretProviderClasses[0].(*unstructured.Unstructured)
898+
require.True(t, ok, "secretproviderclass should be unstructured")
899+
assert.Equal(t, "SecretProviderClass", spc1.GetKind())
900+
assert.Equal(t, "conjur-spc", spc1.GetName())
901+
902+
spc2, ok := snapshot.SecretProviderClasses[1].(*unstructured.Unstructured)
903+
require.True(t, ok, "secretproviderclass should be unstructured")
904+
assert.Equal(t, "SecretProviderClass", spc2.GetKind())
905+
assert.Equal(t, "vault-spc", spc2.GetName())
906+
}
907+
908+
// TestConvertDataReadings_SecretProviderClassPodStatuses tests that secretproviderclasspodstatuses are correctly converted.
909+
func TestConvertDataReadings_SecretProviderClassPodStatuses(t *testing.T) {
910+
extractorFunctions := map[string]func(*api.DataReading, *dataupload.Snapshot) error{
911+
"ark/discovery": extractClusterIDAndServerVersionFromReading,
912+
"ark/secretproviderclasspodstatuses": func(reading *api.DataReading, snapshot *dataupload.Snapshot) error {
913+
return extractResourceListFromReading(reading, &snapshot.SecretProviderClassPodStatuses)
914+
},
915+
}
916+
917+
readings := []*api.DataReading{
918+
{
919+
DataGatherer: "ark/discovery",
920+
Data: &api.DiscoveryData{
921+
ClusterID: "test-cluster-id",
922+
ServerVersion: &version.Info{
923+
GitVersion: "v1.21.0",
924+
},
925+
},
926+
},
927+
{
928+
DataGatherer: "ark/secretproviderclasspodstatuses",
929+
Data: &api.DynamicData{
930+
Items: []*api.GatheredResource{
931+
{
932+
Resource: &unstructured.Unstructured{
933+
Object: map[string]any{
934+
"apiVersion": "secrets-store.csi.x-k8s.io/v1",
935+
"kind": "SecretProviderClassPodStatus",
936+
"metadata": map[string]any{
937+
"name": "my-pod-conjur-spc",
938+
"namespace": "default",
939+
},
940+
"status": map[string]any{
941+
"mounted": true,
942+
"podName": "my-pod",
943+
},
944+
},
945+
},
946+
},
947+
{
948+
Resource: &unstructured.Unstructured{
949+
Object: map[string]any{
950+
"apiVersion": "secrets-store.csi.x-k8s.io/v1",
951+
"kind": "SecretProviderClassPodStatus",
952+
"metadata": map[string]any{
953+
"name": "other-pod-conjur-spc",
954+
"namespace": "default",
955+
},
956+
"status": map[string]any{
957+
"mounted": false,
958+
"podName": "other-pod",
959+
},
960+
},
961+
},
962+
},
963+
// Deleted secretproviderclasspodstatus should be ignored
964+
{
965+
DeletedAt: api.Time{Time: time.Now()},
966+
Resource: &unstructured.Unstructured{
967+
Object: map[string]any{
968+
"apiVersion": "secrets-store.csi.x-k8s.io/v1",
969+
"kind": "SecretProviderClassPodStatus",
970+
"metadata": map[string]any{
971+
"name": "deleted-pod-spc",
972+
"namespace": "default",
973+
},
974+
},
975+
},
976+
},
977+
},
978+
},
979+
},
980+
}
981+
982+
var snapshot dataupload.Snapshot
983+
err := convertDataReadings(extractorFunctions, readings, &snapshot)
984+
require.NoError(t, err)
985+
986+
assert.Equal(t, "test-cluster-id", snapshot.ClusterID)
987+
require.Len(t, snapshot.SecretProviderClassPodStatuses, 2, "should have 2 secretproviderclasspodstatuses (deleted one should be excluded)")
988+
989+
spcps1, ok := snapshot.SecretProviderClassPodStatuses[0].(*unstructured.Unstructured)
990+
require.True(t, ok, "secretproviderclasspodstatus should be unstructured")
991+
assert.Equal(t, "SecretProviderClassPodStatus", spcps1.GetKind())
992+
assert.Equal(t, "my-pod-conjur-spc", spcps1.GetName())
993+
994+
spcps2, ok := snapshot.SecretProviderClassPodStatuses[1].(*unstructured.Unstructured)
995+
require.True(t, ok, "secretproviderclasspodstatus should be unstructured")
996+
assert.Equal(t, "SecretProviderClassPodStatus", spcps2.GetKind())
997+
assert.Equal(t, "other-pod-conjur-spc", spcps2.GetName())
998+
}
999+
8181000
// TestConvertDataReadings_ServiceAccounts tests that serviceaccounts are correctly converted.
8191001
func TestConvertDataReadings_ServiceAccounts(t *testing.T) {
8201002
extractorFunctions := map[string]func(*api.DataReading, *dataupload.Snapshot) error{

‎pkg/client/client_cyberark_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,8 @@ var defaultDynamicDatagathererNames = []string{
9191
"ark/esosecretstores",
9292
"ark/esoclusterexternalsecrets",
9393
"ark/esoclustersecretstores",
94+
"ark/secretproviderclasses",
95+
"ark/secretproviderclasspodstatuses",
9496
"ark/roles",
9597
"ark/clusterroles",
9698
"ark/rolebindings",

0 commit comments

Comments
 (0)