CP-26533: allow config.cyberark.subdomain in agent YAML

deploy/charts/disco-agent/README.md

@@ -14,6 +14,18 @@ export NAMESPACE=cyberark
 kubectl create ns "$NAMESPACE" || true
 ```
 
+### Set your CyberArk tenant subdomain
+
+Always required, but **not a credential**. Set it via `config.cyberark.subdomain`
+on the `helm upgrade` command below, or via `ARK_SUBDOMAIN` in the Secret if
+you're already creating one for the legacy username/password method.
+
+```sh
+export ARK_SUBDOMAIN=      # your CyberArk tenant subdomain, e.g. tlskp-test
+# OPTIONAL: Discovery API URL for non-production environments
+export ARK_DISCOVERY_API=https://platform-discovery.integration-cyberark.cloud/
+```
+
 ### Add credentials to a Secret
 
 The agent supports **two authentication methods**, selected automatically by
@@ -28,16 +40,11 @@ If **both** are set, the Conjur `serviceId` wins (so a migrating install can add
 the service-id before removing its old credentials) and a warning is logged. If
 **neither** is set, the agent fails closed at startup.
 
-The only credential always required in the Kubernetes Secret is the CyberArk
-tenant subdomain (`ARK_SUBDOMAIN`).
+Skip this section entirely for a Conjur-JWT-only install: `config.cyberark.subdomain`
+above already covers the one non-credential value this Secret would otherwise carry.
 
-```sh
-export ARK_SUBDOMAIN=      # your CyberArk tenant subdomain, e.g. tlskp-test
-# OPTIONAL: Discovery API URL for non-production environments
-export ARK_DISCOVERY_API=https://platform-discovery.integration-cyberark.cloud/
-```
-
-Create the Secret:
+Create the Secret (only needed for the legacy username/password method, or if
+you'd rather set the subdomain here than in `config.cyberark.subdomain`):
 
 ```sh
 # Production (no ARK_DISCOVERY_API override needed):
@@ -119,11 +126,13 @@ value for `config.cyberark.serviceId` below.
 
 ```sh
 # $SERVICE_ID is this cluster's own authn-jwt service ID from onboarding above — do not reuse it across clusters.
+# No Secret needed for this Conjur-JWT install — the subdomain isn't a credential.
 helm upgrade agent "oci://${OCI_BASE}/charts/disco-agent" \
      --install \
      --create-namespace \
      --namespace "$NAMESPACE" \
      --set fullnameOverride=disco-agent \
+     --set config.cyberark.subdomain="$ARK_SUBDOMAIN" \
      --set config.cyberark.serviceId="$SERVICE_ID" \
      --set acceptTerms=true
 ```
@@ -422,6 +431,13 @@ This description will be associated with the data that the agent uploads to the
 Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, and Secret values are sent by default too.  
 Set this to false to send metadata only.  
 When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.
+#### **config.cyberark.subdomain** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+CyberArk tenant subdomain. Not a credential. Leave empty to keep sourcing it from the authentication Secret's ARK_SUBDOMAIN key instead.
 #### **config.cyberark.serviceId** ~ `string`
 > Default value:
 > ```yaml

deploy/charts/disco-agent/templates/configmap.yaml

@@ -11,6 +11,7 @@ data:
     cluster_description: {{ .Values.config.clusterDescription | quote }}
     period: {{ .Values.config.period | quote }}
     cyberark:
+      subdomain: {{ .Values.config.cyberark.subdomain | quote }}
       service_id: {{ .Values.config.cyberark.serviceId | quote }}
       account: {{ .Values.config.cyberark.account | quote }}
       jwt_source: {{ .Values.config.cyberark.jwtSource | quote }}

deploy/charts/disco-agent/templates/deployment.yaml

@@ -58,11 +58,13 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
+          # Not a credential; only used when config.cyberark.subdomain is empty.
           - name: ARK_SUBDOMAIN
             valueFrom:
               secretKeyRef:
                 name: {{ .Values.authentication.secretName }}
                 key: ARK_SUBDOMAIN
+                optional: true
           - name: ARK_DISCOVERY_API
             valueFrom:
               secretKeyRef:

deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap

@@ -7,6 +7,7 @@ custom-cluster-description:
         cluster_description: "A cloud hosted Kubernetes cluster hosting production workloads.\n\nteam: team-1\nemail: team-1@example.com\npurpose: Production workloads\n"
         period: "12h0m0s"
         cyberark:
+          subdomain: ""
           service_id: ""
           account: "conjur"
           jwt_source: "file"
@@ -170,6 +171,7 @@ custom-cluster-name:
         cluster_description: ""
         period: "12h0m0s"
         cyberark:
+          subdomain: ""
           service_id: ""
           account: "conjur"
           jwt_source: "file"
@@ -333,6 +335,171 @@ custom-period:
         cluster_description: ""
         period: "1m"
         cyberark:
+          subdomain: ""
+          service_id: ""
+          account: "conjur"
+          jwt_source: "file"
+        data-gatherers:
+        - kind: oidc
+          name: ark/oidc
+        - kind: k8s-discovery
+          name: ark/discovery
+        - kind: k8s-dynamic
+          name: ark/secrets
+          config:
+            resource-type:
+              version: v1
+              resource: secrets
+            field-selectors:
+            - type!=kubernetes.io/dockercfg
+            - type!=kubernetes.io/dockerconfigjson
+            - type!=bootstrap.kubernetes.io/token
+            - type!=helm.sh/release.v1
+        - kind: k8s-dynamic
+          name: ark/serviceaccounts
+          config:
+            resource-type:
+              resource: serviceaccounts
+              version: v1
+        - kind: k8s-dynamic
+          name: ark/roles
+          config:
+            resource-type:
+              version: v1
+              group: rbac.authorization.k8s.io
+              resource: roles
+        - kind: k8s-dynamic
+          name: ark/clusterroles
+          config:
+            resource-type:
+              version: v1
+              group: rbac.authorization.k8s.io
+              resource: clusterroles
+        - kind: k8s-dynamic
+          name: ark/rolebindings
+          config:
+            resource-type:
+              version: v1
+              group: rbac.authorization.k8s.io
+              resource: rolebindings
+        - kind: k8s-dynamic
+          name: ark/clusterrolebindings
+          config:
+            resource-type:
+              version: v1
+              group: rbac.authorization.k8s.io
+              resource: clusterrolebindings
+        - kind: k8s-dynamic
+          name: ark/jobs
+          config:
+            resource-type:
+              version: v1
+              group: batch
+              resource: jobs
+        - kind: k8s-dynamic
+          name: ark/cronjobs
+          config:
+            resource-type:
+              version: v1
+              group: batch
+              resource: cronjobs
+        - kind: k8s-dynamic
+          name: ark/deployments
+          config:
+            resource-type:
+              version: v1
+              group: apps
+              resource: deployments
+        - kind: k8s-dynamic
+          name: ark/statefulsets
+          config:
+            resource-type:
+              version: v1
+              group: apps
+              resource: statefulsets
+        - kind: k8s-dynamic
+          name: ark/daemonsets
+          config:
+            resource-type:
+              version: v1
+              group: apps
+              resource: daemonsets
+        - kind: k8s-dynamic
+          name: ark/pods
+          config:
+            resource-type:
+              version: v1
+              resource: pods
+        - kind: k8s-dynamic
+          name: ark/configmaps
+          config:
+            resource-type:
+              resource: configmaps
+              version: v1
+            label-selectors:
+            - conjur.org/name=conjur-connect-configmap
+        - kind: k8s-dynamic
+          name: ark/esoexternalsecrets
+          config:
+            resource-type:
+              group: external-secrets.io
+              version: v1
+              resource: externalsecrets
+        - kind: k8s-dynamic
+          name: ark/esosecretstores
+          config:
+            resource-type:
+              group: external-secrets.io
+              version: v1
+              resource: secretstores
+        - kind: k8s-dynamic
+          name: ark/esoclusterexternalsecrets
+          config:
+            resource-type:
+              group: external-secrets.io
+              version: v1
+              resource: clusterexternalsecrets
+        - kind: k8s-dynamic
+          name: ark/esoclustersecretstores
+          config:
+            resource-type:
+              group: external-secrets.io
+              version: v1
+              resource: clustersecretstores
+        - kind: k8s-dynamic
+          name: ark/secretproviderclasses
+          config:
+            resource-type:
+              group: secrets-store.csi.x-k8s.io
+              version: v1
+              resource: secretproviderclasses
+        - kind: k8s-dynamic
+          name: ark/secretproviderclasspodstatuses
+          config:
+            resource-type:
+              group: secrets-store.csi.x-k8s.io
+              version: v1
+              resource: secretproviderclasspodstatuses
+    kind: ConfigMap
+    metadata:
+      labels:
+        app.kubernetes.io/instance: test
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: disco-agent
+        app.kubernetes.io/version: v0.0.0
+        helm.sh/chart: disco-agent-0.0.0
+      name: test-disco-agent-config
+      namespace: test-ns
+custom-subdomain:
+  1: |
+    apiVersion: v1
+    data:
+      config.yaml: |-
+        cluster_name: ""
+        cluster_description: ""
+        period: "12h0m0s"
+        cyberark:
+          subdomain: "tlskp-test"
           service_id: ""
           account: "conjur"
           jwt_source: "file"
@@ -496,6 +663,7 @@ defaults:
         cluster_description: ""
         period: "12h0m0s"
         cyberark:
+          subdomain: ""
           service_id: ""
           account: "conjur"
           jwt_source: "file"

deploy/charts/disco-agent/tests/configmap_test.yaml

@@ -31,3 +31,9 @@ tests:
         purpose: Production workloads
     asserts:
       - matchSnapshot: {}
+
+  - it: custom-subdomain
+    set:
+      config.cyberark.subdomain: tlskp-test
+    asserts:
+      - matchSnapshot: {}

deploy/charts/disco-agent/tests/deployment_test.yaml

@@ -0,0 +1,25 @@
+suite: test the deployment's credential env vars
+templates:
+  - deployment.yaml
+release:
+  name: test
+  namespace: test-ns
+set:
+  acceptTerms: true
+tests:
+  - it: ARK_SUBDOMAIN and ARK_DISCOVERY_API secretKeyRefs are optional, so a Conjur-JWT-only install needs no Secret
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name == "ARK_SUBDOMAIN")].valueFrom.secretKeyRef.optional
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name == "ARK_DISCOVERY_API")].valueFrom.secretKeyRef.optional
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name == "ARK_USERNAME")].valueFrom.secretKeyRef.optional
+          value: true
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name == "ARK_SECRET")].valueFrom.secretKeyRef.optional
+          value: true

deploy/charts/disco-agent/values.schema.json

@@ -163,6 +163,9 @@
         },
         "serviceId": {
           "$ref": "#/$defs/helm-values.config.cyberark.serviceId"
+        },
+        "subdomain": {
+          "$ref": "#/$defs/helm-values.config.cyberark.subdomain"
         }
       },
       "type": "object"
@@ -182,6 +185,11 @@
       "description": "The Conjur authn-jwt authenticator service ID configured for this cluster (one authenticator per cluster, not shared across a tenant's clusters — see config.clusterName above, which falls back to this value and depends on it being cluster-unique). Set this to use the Conjur JWT exchange (preferred). Leave empty to use the legacy CyberArk Identity username/password method (ARK_USERNAME/ARK_SECRET in the credentials Secret) for backward compatibility. If both are set, the serviceId (Conjur) wins. NOTE: bare service-id segment (e.g. a UUID chosen at onboarding), NOT the policy path \"conjur/authn-jwt/<serviceId>\" — the agent builds the URL as\n<base>/authn-jwt/<serviceId>/<account>/authenticate.",
       "type": "string"
     },
+    "helm-values.config.cyberark.subdomain": {
+      "default": "",
+      "description": "CyberArk tenant subdomain. Not a credential. Leave empty to keep sourcing it from the authentication Secret's ARK_SUBDOMAIN key instead.",
+      "type": "string"
+    },
     "helm-values.config.excludeAnnotationKeysRegex": {
       "default": [],
       "description": "You can configure the agent to exclude some annotations or labels from being pushed . All Kubernetes objects are affected. The objects are still pushed, but the specified annotations and labels are removed before being pushed.\n\nDots is the only character that needs to be escaped in the regex. Use either double quotes with escaped single quotes or unquoted strings for the regex to avoid YAML parsing issues with `\\.`.\n\nExample: excludeAnnotationKeysRegex: ['^kapp\\.k14s\\.io/original.*']",

deploy/charts/disco-agent/values.yaml

@@ -211,6 +211,10 @@ config:
   # short-lived Conjur access token, then uses that token to authenticate to the
   # Discovery & Context upload API.
   cyberark:
+    # CyberArk tenant subdomain. Not a credential. Leave empty to keep
+    # sourcing it from the authentication Secret's ARK_SUBDOMAIN key instead.
+    subdomain: ""
+
     # The Conjur authn-jwt authenticator service ID configured for this
     # cluster (one authenticator per cluster, not shared across a tenant's
     # clusters — see config.clusterName above, which falls back to this