Skip to content

Commit 6c8a341

Browse files
wallrj-cyberarkwallrj-cyberark
committed
Add MachineHub output mode and a cyberark client
Signed-off-by: Richard Wall <richard.wall@cyberark.com>
1 parent 58f1c9c commit 6c8a341

6 files changed

Lines changed: 202 additions & 63 deletions

File tree

‎pkg/agent/config.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,7 @@ const (
334334
VenafiCloudKeypair OutputMode = "Venafi Cloud Key Pair Service Account"
335335
VenafiCloudVenafiConnection OutputMode = "Venafi Cloud VenafiConnection"
336336
LocalFile OutputMode = "Local File"
337+
MachineHub OutputMode = "MachineHub"
337338
)
338339

339340
// The command-line flags and the config file are combined into this struct by
@@ -420,6 +421,9 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
420421
case !flags.VenafiCloudMode && flags.CredentialsPath != "":
421422
mode = JetstackSecureOAuth
422423
reason = "--credentials-file was specified without --venafi-cloud"
424+
case flags.MachineHubMode:
425+
mode = MachineHub
426+
reason = "--machine-hub was specified"
423427
case flags.OutputPath != "":
424428
mode = LocalFile
425429
reason = "--output-path was specified"
@@ -430,6 +434,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
430434
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
431435
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
432436
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.\n" +
437+
" - Use --machine-hub if you want to use the " + string(MachineHub) + " mode.\n" +
433438
" - Use --output-path for " + string(LocalFile) + " mode.")
434439
}
435440

@@ -755,6 +760,12 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
755760
}
756761
case LocalFile:
757762
outputClient = client.NewFileClient(cfg.OutputPath)
763+
case MachineHub:
764+
var err error
765+
outputClient, err = client.NewCyberArk()
766+
if err != nil {
767+
errs = multierror.Append(errs, err)
768+
}
758769
default:
759770
panic(fmt.Errorf("programmer mistake: output mode not implemented: %s", cfg.OutputMode))
760771
}

‎pkg/agent/config_test.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
199199
- Use --venafi-connection for the Venafi Cloud VenafiConnection mode.
200200
- Use --credentials-file alone if you want to use the Jetstack Secure OAuth mode.
201201
- Use --api-token if you want to use the Jetstack Secure API Token mode.
202+
- Use --machine-hub if you want to use the MachineHub mode.
202203
- Use --output-path for Local File mode.`))
203204
assert.Nil(t, cl)
204205
})
@@ -616,6 +617,38 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
616617
require.NoError(t, err)
617618
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
618619
})
620+
t.Run("--machine-hub selects MachineHub mode", func(t *testing.T) {
621+
t.Setenv("POD_NAMESPACE", "venafi")
622+
t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
623+
t.Setenv("ARK_PLATFORM_DOMAIN", "cyberark.cloud")
624+
t.Setenv("ARK_SUBDOMAIN", "tlspk")
625+
t.Setenv("ARK_USERNAME", "first_last@cyberark.cloud.123456")
626+
t.Setenv("ARK_SECRET", "test-secret")
627+
got, cl, err := ValidateAndCombineConfig(discardLogs(),
628+
withConfig(""),
629+
withCmdLineFlags("--period", "1m", "--machine-hub"))
630+
require.NoError(t, err)
631+
assert.Equal(t, MachineHub, got.OutputMode)
632+
assert.IsType(t, &client.CyberArkClient{}, cl)
633+
})
634+
t.Run("--machine-hub without required environment variables", func(t *testing.T) {
635+
t.Setenv("POD_NAMESPACE", "venafi")
636+
t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))
637+
t.Setenv("ARK_PLATFORM_DOMAIN", "")
638+
t.Setenv("ARK_SUBDOMAIN", "")
639+
t.Setenv("ARK_USERNAME", "")
640+
t.Setenv("ARK_SECRET", "")
641+
got, cl, err := ValidateAndCombineConfig(discardLogs(),
642+
withConfig(""),
643+
withCmdLineFlags("--period", "1m", "--machine-hub"))
644+
assert.Equal(t, CombinedConfig{}, got)
645+
assert.Nil(t, cl)
646+
assert.EqualError(t, err, testutil.Undent(`
647+
validating creds: failed loading config using the MachineHub mode: 1 error occurred:
648+
* missing environment variables: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET
649+
650+
`))
651+
})
619652
t.Run("--output-file selects local file mode", func(t *testing.T) {
620653
t.Setenv("POD_NAMESPACE", "venafi")
621654
t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig))

‎pkg/client/client_cyberark.go‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,48 @@
11
package client
22

33
import (
4+
"context"
5+
6+
"github.com/jetstack/preflight/api"
7+
"github.com/jetstack/preflight/pkg/internal/cyberark"
48
"github.com/jetstack/preflight/pkg/internal/cyberark/dataupload"
59
)
610

7-
type CyberArkClient = dataupload.CyberArkClient
11+
type CyberArkClient struct {
12+
configLoader cyberark.ClientConfigLoader
13+
}
14+
15+
var _ Client = &CyberArkClient{}
16+
17+
func NewCyberArk() (*CyberArkClient, error) {
18+
configLoader := cyberark.LoadClientConfigFromEnvironment
19+
_, err := configLoader()
20+
if err != nil {
21+
return nil, err
22+
}
23+
return &CyberArkClient{
24+
configLoader: configLoader,
25+
}, nil
26+
}
27+
28+
// An API token is obtained by authenticating with the ARK_USERNAME and ARK_SECRET from the environment.
29+
// ARK_SUBDOMAIN should be your tenant subdomain.
30+
// ARK_PLATFORM_DOMAIN should be either integration-cyberark.cloud or cyberark.cloud
31+
func (o *CyberArkClient) PostDataReadingsWithOptions(ctx context.Context, readings []*api.DataReading, options Options) error {
32+
cfg, err := o.configLoader()
33+
if err != nil {
34+
return err
35+
}
36+
datauploadClient, err := cyberark.NewDatauploadClient(ctx, cfg)
37+
if err != nil {
38+
return err
39+
}
840

9-
var NewCyberArkClient = dataupload.NewCyberArkClient
41+
err = datauploadClient.PostDataReadingsWithOptions(ctx, api.DataReadingsPost{}, dataupload.Options{
42+
ClusterName: "bb068932-c80d-460d-88df-34bc7f3f3297",
43+
})
44+
if err != nil {
45+
return err
46+
}
47+
return nil
48+
}

‎pkg/client/client_cyberark_test.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
package client
2+
3+
import (
4+
"os"
5+
"testing"
6+
7+
"github.com/stretchr/testify/require"
8+
"k8s.io/klog/v2"
9+
"k8s.io/klog/v2/ktesting"
10+
11+
"github.com/jetstack/preflight/api"
12+
13+
_ "k8s.io/klog/v2/ktesting/init"
14+
)
15+
16+
// TestCyberArkClient_PostDataReadingsWithOptions_RealAPI demonstrates that the
17+
// dataupload code works with the real inventory API.
18+
//
19+
// To enable verbose request logging:
20+
//
21+
// go test ./pkg/internal/cyberark/dataupload/... \
22+
// -v -count 1 -run TestPostDataReadingsWithOptionsWithRealAPI -args -testing.v 6
23+
func TestCyberArkClient_PostDataReadingsWithOptions_RealAPI(t *testing.T) {
24+
platformDomain := os.Getenv("ARK_PLATFORM_DOMAIN")
25+
subdomain := os.Getenv("ARK_SUBDOMAIN")
26+
username := os.Getenv("ARK_USERNAME")
27+
secret := os.Getenv("ARK_SECRET")
28+
29+
if platformDomain == "" || subdomain == "" || username == "" || secret == "" {
30+
t.Skip("Skipping because one of the following environment variables is unset or empty: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
31+
return
32+
}
33+
34+
logger := ktesting.NewLogger(t, ktesting.DefaultConfig)
35+
ctx := klog.NewContext(t.Context(), logger)
36+
37+
c, err := NewCyberArk()
38+
require.NoError(t, err)
39+
var readings []*api.DataReading
40+
err = c.PostDataReadingsWithOptions(ctx, readings, Options{})
41+
require.NoError(t, err)
42+
}

‎pkg/internal/cyberark/client.go‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
package cyberark
2+
3+
import (
4+
"context"
5+
"errors"
6+
"fmt"
7+
"os"
8+
9+
"github.com/jetstack/preflight/pkg/internal/cyberark/dataupload"
10+
"github.com/jetstack/preflight/pkg/internal/cyberark/identity"
11+
"github.com/jetstack/preflight/pkg/internal/cyberark/servicediscovery"
12+
)
13+
14+
type ClientConfig struct {
15+
platformDomain string
16+
subdomain string
17+
username string
18+
secret string
19+
}
20+
21+
type ClientConfigLoader func() (ClientConfig, error)
22+
23+
func LoadClientConfigFromEnvironment() (ClientConfig, error) {
24+
platformDomain := os.Getenv("ARK_PLATFORM_DOMAIN")
25+
subdomain := os.Getenv("ARK_SUBDOMAIN")
26+
username := os.Getenv("ARK_USERNAME")
27+
secret := os.Getenv("ARK_SECRET")
28+
29+
if platformDomain == "" || subdomain == "" || username == "" || secret == "" {
30+
return ClientConfig{}, errors.New(
31+
"missing environment variables: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
32+
}
33+
34+
return ClientConfig{
35+
platformDomain: platformDomain,
36+
subdomain: subdomain,
37+
username: username,
38+
secret: secret,
39+
}, nil
40+
41+
}
42+
43+
func NewDatauploadClient(ctx context.Context, cfg ClientConfig) (*dataupload.CyberArkClient, error) {
44+
const (
45+
discoveryContextServiceName = "inventory"
46+
separator = "."
47+
)
48+
49+
serviceURL := fmt.Sprintf("https://%s%s%s.%s", cfg.subdomain, separator, discoveryContextServiceName, cfg.platformDomain)
50+
51+
var (
52+
identityClient *identity.Client
53+
err error
54+
)
55+
if cfg.platformDomain == "cyberark.cloud" {
56+
identityClient, err = identity.New(ctx, cfg.subdomain)
57+
} else {
58+
discoveryClient := servicediscovery.New(servicediscovery.WithIntegrationEndpoint())
59+
identityClient, err = identity.NewWithDiscoveryClient(ctx, discoveryClient, cfg.subdomain)
60+
}
61+
if err != nil {
62+
return nil, err
63+
}
64+
65+
err = identityClient.LoginUsernamePassword(ctx, cfg.username, []byte(cfg.secret))
66+
if err != nil {
67+
return nil, err
68+
}
69+
70+
cyberArkClient, err := dataupload.NewCyberArkClient(nil, serviceURL, identityClient.AuthenticateRequest)
71+
if err != nil {
72+
return nil, err
73+
}
74+
return cyberArkClient, nil
75+
}

‎pkg/internal/cyberark/dataupload/dataupload_test.go‎

Lines changed: 0 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,13 @@ import (
55
"encoding/pem"
66
"fmt"
77
"net/http"
8-
"os"
98
"testing"
109
"time"
1110

1211
"github.com/stretchr/testify/require"
13-
"k8s.io/klog/v2"
14-
"k8s.io/klog/v2/ktesting"
1512

1613
"github.com/jetstack/preflight/api"
1714
"github.com/jetstack/preflight/pkg/internal/cyberark/dataupload"
18-
"github.com/jetstack/preflight/pkg/internal/cyberark/identity"
19-
"github.com/jetstack/preflight/pkg/internal/cyberark/servicediscovery"
20-
21-
_ "k8s.io/klog/v2/ktesting/init"
2215
)
2316

2417
func TestCyberArkClient_PostDataReadingsWithOptions(t *testing.T) {
@@ -123,57 +116,3 @@ func TestCyberArkClient_PostDataReadingsWithOptions(t *testing.T) {
123116
})
124117
}
125118
}
126-
127-
// TestPostDataReadingsWithOptionsWithRealAPI demonstrates that the dataupload code works with the real inventory API.
128-
// An API token is obtained by authenticating with the ARK_USERNAME and ARK_SECRET from the environment.
129-
// ARK_SUBDOMAIN should be your tenant subdomain.
130-
// ARK_PLATFORM_DOMAIN should be either integration-cyberark.cloud or cyberark.cloud
131-
//
132-
// To enable verbose request logging:
133-
//
134-
// go test ./pkg/internal/cyberark/dataupload/... \
135-
// -v -count 1 -run TestPostDataReadingsWithOptionsWithRealAPI -args -testing.v 6
136-
func TestPostDataReadingsWithOptionsWithRealAPI(t *testing.T) {
137-
platformDomain := os.Getenv("ARK_PLATFORM_DOMAIN")
138-
subdomain := os.Getenv("ARK_SUBDOMAIN")
139-
username := os.Getenv("ARK_USERNAME")
140-
secret := os.Getenv("ARK_SECRET")
141-
142-
if platformDomain == "" || subdomain == "" || username == "" || secret == "" {
143-
t.Skip("Skipping because one of the following environment variables is unset or empty: ARK_PLATFORM_DOMAIN, ARK_SUBDOMAIN, ARK_USERNAME, ARK_SECRET")
144-
return
145-
}
146-
147-
logger := ktesting.NewLogger(t, ktesting.DefaultConfig)
148-
ctx := klog.NewContext(t.Context(), logger)
149-
150-
const (
151-
discoveryContextServiceName = "inventory"
152-
separator = "."
153-
)
154-
155-
serviceURL := fmt.Sprintf("https://%s%s%s.%s", subdomain, separator, discoveryContextServiceName, platformDomain)
156-
157-
var (
158-
identityClient *identity.Client
159-
err error
160-
)
161-
if platformDomain == "cyberark.cloud" {
162-
identityClient, err = identity.New(ctx, subdomain)
163-
} else {
164-
discoveryClient := servicediscovery.New(servicediscovery.WithIntegrationEndpoint())
165-
identityClient, err = identity.NewWithDiscoveryClient(ctx, discoveryClient, subdomain)
166-
}
167-
require.NoError(t, err)
168-
169-
err = identityClient.LoginUsernamePassword(ctx, username, []byte(secret))
170-
require.NoError(t, err)
171-
172-
cyberArkClient, err := dataupload.NewCyberArkClient(nil, serviceURL, identityClient.AuthenticateRequest)
173-
require.NoError(t, err)
174-
175-
err = cyberArkClient.PostDataReadingsWithOptions(ctx, api.DataReadingsPost{}, dataupload.Options{
176-
ClusterName: "bb068932-c80d-460d-88df-34bc7f3f3297",
177-
})
178-
require.NoError(t, err)
179-
}

0 commit comments

Comments
 (0)