Add ConfigMaps discovery and reporting support #754
Conversation
- Add ConfigMaps field to Snapshot struct for data upload - Register ConfigMaps informer in kubernetesNativeResources - Add ark/configmaps extractor function for data processing - Update test coverage to include ConfigMaps - Add ConfigMaps configuration to disco-agent templates - Update example configurations and test snapshots This enhancement allows the agent to discover and report ConfigMap resources alongside existing resources like Pods and Daemonsets.
There was a problem hiding this comment.
Pull request overview
This pull request adds support for discovering and reporting Kubernetes ConfigMap resources to the CyberArk Discovery and Context API. The changes follow the existing pattern used for other Kubernetes resources like Pods and DaemonSets.
Changes:
- Added ConfigMaps field to the Snapshot data structure for data upload
- Registered ConfigMaps informer in the Kubernetes native resources map
- Added ark/configmaps extractor function for processing ConfigMap data
- Updated test coverage, example configurations, and chart templates
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
internal/cyberark/dataupload/dataupload.go |
Added ConfigMaps field to Snapshot struct |
pkg/datagatherer/k8s/dynamic.go |
Registered ConfigMaps informer in kubernetesNativeResources map |
pkg/client/client_cyberark.go |
Added ark/configmaps extractor function to defaultExtractorFunctions map |
pkg/client/client_cyberark_test.go |
Added ark/configmaps to defaultDynamicDatagathererNames test list |
examples/machinehub.yaml |
Added ConfigMaps data gatherer configuration example |
examples/machinehub/input.json |
Added ConfigMaps entry to example input data |
deploy/charts/disco-agent/templates/configmap.yaml |
Added ConfigMaps configuration to helm chart template |
deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap |
Updated test snapshots to include ConfigMaps configuration |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
erge branch 'master' of https://github.com/jetstack/jetstack-secure into feature/add-configmaps-discovery
| continue | ||
| } | ||
|
|
||
| // filter by labels |
There was a problem hiding this comment.
The assumption is that labels will be used more broadly, so they are applied for filtering first, followed by annotations. Please share your thoughts if you have a different perspective.
| // If includeFilters is set, all key-value pairs must match for the resource to be included. | ||
| // An empty string value means "match any value for this key" (key-only matching). | ||
| // If excludeFilters is set, any matching key-value pair will exclude the resource. | ||
| func matchesFilter(resourceMetadata, includeFilters, excludeFilters map[string]string) bool { |
There was a problem hiding this comment.
Regex support is not available, as I thought it was not required. Please share your thoughts if you have a different opinion.
| version: v1 | ||
| resource: configmaps | ||
| include-resources-by-labels: | ||
| conjur.org/name: "conjur-connect-configmap" |
There was a problem hiding this comment.
This label uniquely identifies the ConfigMaps used by the Secrets Manager (aka Conjur) components.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ConfigMaps Discovery & Label & Annotation Filtering
Business Value
These enhancements provide users with greater control and flexibility over Kubernetes resource discovery:
Changes
Feature 1: ConfigMap Discovery
Added ConfigMap resource type to the dynamic data gatherer:
core/v1/configmapsinto the informer-based collection pipelineFeature 2: Label & Annotation Filtering of Resources
Implemented filtering for all resource types in the
k8sdynamicdata gatherer:include-resources-by-labels: Collect only resources matching ALL specified labelsexclude-resources-by-labels: Skip resources with ANY of the specified labelsinclude-resources-by-annotations: Collect only resources matching ALL specified annotationsexclude-resources-by-annotations: Skip resources with ANY of the specified annotationsNote:
""as the valueapp: myappwill not matchApp: myapporapp: MyApp)Filtering applies to Pods, Deployments, Secrets, ConfigMaps, Services, and any other resource type configured for collection. Validation ensures include/exclude filters of the same type are mutually exclusive.
How to test locally
go run . agent --one-shot --machine-hub -v 6 --agent-config-file ./examples/machinehub.yaml