Skip to content

Commit dff52aa

Browse files
inteoninteon
committed
add VenafiConnection support for NGTS
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
1 parent 9bf7abd commit dff52aa

11 files changed

Lines changed: 143 additions & 35 deletions

File tree

‎deploy/charts/venafi-kubernetes-agent/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,10 @@ Configure VenafiConnection authentication
390390
> false
391391
> ```
392392
393-
When set to true, the Discovery Agent will authenticate to CyberArk Certificate Manager using the configuration in a VenafiConnection resource. Use `venafiConnection.enabled=true` for [secretless authentication](https://docs.cyberark.com/mis-saas/vaas/k8s-components/t-install-tlspk-agent/). When set to true, the `authentication.secret` values will be ignored and the. Secret with `authentication.secretName` will _not_ be mounted into the
393+
When set to true, the Discovery Agent will authenticate to its upload backend using the configuration in a VenafiConnection resource. The backend is determined by the VenafiConnection's spec: use `spec.vcp` for. CyberArk Certificate Manager (CMSaaS), or `spec.ngts` (with `tsgID` or
394+
`url`, and a `jwt` source) for NGTS / Palo Alto Networks. `spec.tpp` and
395+
`spec.vcp.apiKey` are rejected by the agent.
396+
Use `venafiConnection.enabled=true` for [secretless authentication](https://docs.cyberark.com/mis-saas/vaas/k8s-components/t-install-tlspk-agent/). When set to true, the `authentication.secret` values will be ignored and the. Secret with `authentication.secretName` will _not_ be mounted into the
394397
Discovery Agent Pod.
395398
#### **authentication.venafiConnection.name** ~ `string`
396399
> Default value:

‎deploy/charts/venafi-kubernetes-agent/crd_bases/jetstack.io_venaficonnections.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.20.1
7+
controller-gen.kubebuilder.io/version: v0.21.0
88
name: venaficonnections.jetstack.io
99
spec:
1010
group: jetstack.io

‎deploy/charts/venafi-kubernetes-agent/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@ spec:
8181
- {{ .Values.config.clientId | quote }}
8282
- "--private-key-path"
8383
- "/etc/venafi/agent/key/{{ .Values.authentication.secretKey }}"
84-
{{- end }}
8584
- --venafi-cloud
85+
{{- end }}
8686
{{- if .Values.metrics.enabled }}
8787
- --enable-metrics
8888
{{- end }}

‎deploy/charts/venafi-kubernetes-agent/tests/deployment_test.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,3 +133,71 @@ tests:
133133
- lengthEqual :
134134
path: spec.template.spec.containers[0].env
135135
count: 4
136+
137+
# VenafiConnection mode (used for both VCP and NGTS backends) wires the
138+
# connection name/namespace through as flags and skips mounting the keypair
139+
# Secret. The Secret-based --client-id / --private-key-path flags must not be
140+
# present in this mode.
141+
- it: VenafiConnection mode passes the connection flags and omits the credentials Secret
142+
set:
143+
authentication.venafiConnection.enabled: true
144+
authentication.venafiConnection.name: my-venconn
145+
authentication.venafiConnection.namespace: my-ns
146+
template: deployment.yaml
147+
asserts:
148+
- isKind:
149+
of: Deployment
150+
- contains:
151+
path: spec.template.spec.containers[0].args
152+
content: --venafi-connection
153+
- contains:
154+
path: spec.template.spec.containers[0].args
155+
content: my-venconn
156+
- contains:
157+
path: spec.template.spec.containers[0].args
158+
content: --venafi-connection-namespace
159+
- contains:
160+
path: spec.template.spec.containers[0].args
161+
content: my-ns
162+
- notContains:
163+
path: spec.template.spec.containers[0].args
164+
content: --client-id
165+
- notContains:
166+
path: spec.template.spec.containers[0].args
167+
content: --private-key-path
168+
- notContains:
169+
path: spec.template.spec.containers[0].args
170+
content: --venafi-cloud
171+
- notContains:
172+
path: spec.template.spec.containers[0].volumeMounts
173+
content:
174+
name: credentials
175+
mountPath: /etc/venafi/agent/key
176+
readOnly: true
177+
- notContains:
178+
path: spec.template.spec.volumes
179+
content:
180+
name: credentials
181+
secret:
182+
secretName: agent-credentials
183+
optional: false
184+
185+
# Keypair mode (the default, used when authentication.venafiConnection.enabled
186+
# is false) still renders --venafi-cloud since the agent's mode-resolution
187+
# treats keypair as a Venafi Cloud backend.
188+
- it: Keypair mode still passes --venafi-cloud
189+
set:
190+
config.clientId: "00000000-0000-0000-0000-000000000000"
191+
template: deployment.yaml
192+
asserts:
193+
- isKind:
194+
of: Deployment
195+
- contains:
196+
path: spec.template.spec.containers[0].args
197+
content: --venafi-cloud
198+
- contains:
199+
path: spec.template.spec.containers[0].args
200+
content: --client-id
201+
- contains:
202+
path: spec.template.spec.containers[0].args
203+
content: --private-key-path

‎deploy/charts/venafi-kubernetes-agent/values.schema.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@
137137
},
138138
"helm-values.authentication.venafiConnection.enabled": {
139139
"default": false,
140-
"description": "When set to true, the Discovery Agent will authenticate to CyberArk Certificate Manager using the configuration in a VenafiConnection resource. Use `venafiConnection.enabled=true` for [secretless authentication](https://docs.cyberark.com/mis-saas/vaas/k8s-components/t-install-tlspk-agent/). When set to true, the `authentication.secret` values will be ignored and the. Secret with `authentication.secretName` will _not_ be mounted into the\nDiscovery Agent Pod.",
140+
"description": "When set to true, the Discovery Agent will authenticate to its upload backend using the configuration in a VenafiConnection resource. The backend is determined by the VenafiConnection's spec: use `spec.vcp` for. CyberArk Certificate Manager (CMSaaS), or `spec.ngts` (with `tsgID` or\n`url`, and a `jwt` source) for NGTS / Palo Alto Networks. `spec.tpp` and\n`spec.vcp.apiKey` are rejected by the agent.\nUse `venafiConnection.enabled=true` for [secretless authentication](https://docs.cyberark.com/mis-saas/vaas/k8s-components/t-install-tlspk-agent/). When set to true, the `authentication.secret` values will be ignored and the. Secret with `authentication.secretName` will _not_ be mounted into the\nDiscovery Agent Pod.",
141141
"type": "boolean"
142142
},
143143
"helm-values.authentication.venafiConnection.name": {

‎deploy/charts/venafi-kubernetes-agent/values.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -238,8 +238,12 @@ authentication:
238238
# +docs:section=Venafi Connection
239239
# Configure VenafiConnection authentication
240240
venafiConnection:
241-
# When set to true, the Discovery Agent will authenticate to CyberArk Certificate Manager
242-
# using the configuration in a VenafiConnection resource.
241+
# When set to true, the Discovery Agent will authenticate to its upload
242+
# backend using the configuration in a VenafiConnection resource. The
243+
# backend is determined by the VenafiConnection's spec: use `spec.vcp` for
244+
# CyberArk Certificate Manager (CMSaaS), or `spec.ngts` (with `tsgID` or
245+
# `url`, and a `jwt` source) for NGTS / Palo Alto Networks. `spec.tpp` and
246+
# `spec.vcp.apiKey` are rejected by the agent.
243247
# Use `venafiConnection.enabled=true` for [secretless authentication](https://docs.cyberark.com/mis-saas/vaas/k8s-components/t-install-tlspk-agent/).
244248
# When set to true, the `authentication.secret` values will be ignored and the
245249
# Secret with `authentication.secretName` will _not_ be mounted into the

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ require (
99
github.com/fatih/color v1.19.0
1010
github.com/google/uuid v1.6.0
1111
github.com/hashicorp/go-multierror v1.1.1
12-
github.com/jetstack/venafi-connection-lib v0.6.0
12+
github.com/jetstack/venafi-connection-lib v0.6.1-0.20260528121802-f90d3d05ddd5
1313
github.com/lestrrat-go/jwx/v3 v3.1.1
1414
github.com/microcosm-cc/bluemonday v1.0.27
1515
github.com/pmylund/go-cache v2.1.0+incompatible
@@ -63,7 +63,7 @@ require (
6363
go.opentelemetry.io/otel v1.41.0 // indirect
6464
go.opentelemetry.io/otel/trace v1.41.0 // indirect
6565
go.uber.org/multierr v1.11.0 // indirect
66-
go.uber.org/zap v1.27.1 // indirect
66+
go.uber.org/zap v1.28.0 // indirect
6767
go.yaml.in/yaml/v2 v2.4.3 // indirect
6868
go.yaml.in/yaml/v3 v3.0.4 // indirect
6969
golang.org/x/crypto v0.50.0 // indirect
@@ -74,8 +74,8 @@ require (
7474
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
7575
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
7676
gopkg.in/ini.v1 v1.67.1 // indirect
77-
k8s.io/apiextensions-apiserver v0.36.0 // indirect
78-
k8s.io/apiserver v0.36.0 // indirect
77+
k8s.io/apiextensions-apiserver v0.36.1 // indirect
78+
k8s.io/apiserver v0.36.1 // indirect
7979
sigs.k8s.io/randfill v1.0.0 // indirect
8080
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
8181
)
@@ -112,6 +112,6 @@ require (
112112
gopkg.in/yaml.v3 v3.0.1
113113
k8s.io/klog/v2 v2.140.0
114114
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
115-
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
115+
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 // indirect
116116
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
117117
)

‎go.sum‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,8 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
107107
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
108108
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
109109
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
110-
github.com/jetstack/venafi-connection-lib v0.6.0 h1:ZVR06xfJdWTKfIjVK3v4oPgc68TZNd9cYZmsi+9prFg=
111-
github.com/jetstack/venafi-connection-lib v0.6.0/go.mod h1:XEjTVju/2ROnUEDQAyAm0Rj7Mk7HJF0/bwmS67KbwQA=
110+
github.com/jetstack/venafi-connection-lib v0.6.1-0.20260528121802-f90d3d05ddd5 h1:bF8CfskHNjfxm5dcIhMKBSa+hWvSR0rQEzFxXcj3dBw=
111+
github.com/jetstack/venafi-connection-lib v0.6.1-0.20260528121802-f90d3d05ddd5/go.mod h1:KPndhwwPHPkBqv7cocVTtEDPHV/CBrwapLqzUnwbCUs=
112112
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
113113
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
114114
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@@ -238,8 +238,8 @@ go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
238238
go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
239239
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
240240
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
241-
go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
242-
go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
241+
go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
242+
go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
243243
go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
244244
go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
245245
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
@@ -293,12 +293,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
293293
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
294294
k8s.io/api v0.36.1 h1:XbL/EMj8K2aJpJtePmqUyQMsM0D4QI2pvl7YKJ20FTY=
295295
k8s.io/api v0.36.1/go.mod h1:KOWo4ey3TINlXjeHVuwB3i+tXXnu+UcwFBHlI/9dvEo=
296-
k8s.io/apiextensions-apiserver v0.36.0 h1:Wt7E8J+VBCbj4FjiBfDTK/neXDDjyJVJc7xfuOHImZ0=
297-
k8s.io/apiextensions-apiserver v0.36.0/go.mod h1:kGDjH0msuiIB3tgsYRV0kS9GqpMYMUsQ3GHv7TApyug=
296+
k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks=
297+
k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8=
298298
k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=
299299
k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=
300-
k8s.io/apiserver v0.36.0 h1:Jg5OFAENUACByUCg15CmhZAYrr5ZyJ+jodyA1mHl3YE=
301-
k8s.io/apiserver v0.36.0/go.mod h1:mHvwdHf+qKEm+1/hYm756SV+oREOKSPnsjagOpx6Vho=
300+
k8s.io/apiserver v0.36.1 h1:iMS5V+rPUertv5P9RaqJgmHHTuh4quWpoxchvMUY+JY=
301+
k8s.io/apiserver v0.36.1/go.mod h1:Cby1PbLWztu0GDOxoO6iFOyyqIsziHNEW+w9zVQ22Kw=
302302
k8s.io/client-go v0.36.1 h1:FN/K8QIT2CEDt+2WB2HnWrUANZ50AP5GII43/SP2JR0=
303303
k8s.io/client-go v0.36.1/go.mod h1:s6rAnCtTGYDQnpNjEhSaISV+2O8jwruZ6m3QOYBFbtU=
304304
k8s.io/component-base v0.36.1 h1:iG6GsELftXqTNG9HG6kiVjatSgAw1sf5pJ6R5a6N0kA=
@@ -307,8 +307,8 @@ k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
307307
k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
308308
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
309309
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
310-
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
311-
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
310+
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 h1:wU4tMEhLGgIbLvXQb1cfN+EcM0wf7zC6CPF+C79jroc=
311+
k8s.io/utils v0.0.0-20260507154919-ff6756f316d2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
312312
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
313313
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
314314
sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=

‎pkg/agent/config_test.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -645,6 +645,19 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
645645
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
646646
})
647647

648+
t.Run("venafi-cloud-workload-identity-auth: --venafi-cloud is tolerated alongside --venafi-connection for backwards compatibility with older rendered charts", func(t *testing.T) {
649+
t.Setenv("POD_NAMESPACE", "venafi")
650+
t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
651+
got, _, err := ValidateAndCombineConfig(discardLogs(),
652+
withConfig(testutil.Undent(`
653+
period: 1h
654+
cluster_name: cluster-1
655+
`)),
656+
withCmdLineFlags("--venafi-connection", "venafi-components", "--venafi-cloud"))
657+
require.NoError(t, err)
658+
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
659+
})
660+
648661
const arkUsername = "cluster-1-region-1-cloud-1@cyberark.cloud.123456"
649662

650663
t.Run("--machine-hub selects MachineHub mode", func(t *testing.T) {

‎pkg/client/client_oauth.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,8 +159,8 @@ func (c *OAuthClient) post(ctx context.Context, path string, body io.Reader) (*h
159159
return nil, err
160160
}
161161

162+
req.Header.Set("Accept", "application/json")
162163
req.Header.Set("Content-Type", "application/json")
163-
164164
version.SetUserAgent(req)
165165

166166
if len(token.bearer) > 0 {

0 commit comments

Comments
 (0)