Skip to content

Commit b612f3f

Browse files
author
Atanas Chuchev
committed
Merge remote-tracking branch 'origin/master' into feature/ark-configmaps-discovery
2 parents dd680c7 + 9df05b3 commit b612f3f

27 files changed

Lines changed: 1072 additions & 177 deletions

‎CONTRIBUTING.md‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
# Contributing to Discovery Agent
2+
3+
Thank you for your interest in contributing! This document provides guidelines and instructions for contributing.
4+
5+
Note that this repository holds two separate components:
6+
7+
- disco-agent: For CyberArk DisCo
8+
- venafi-kubernetes-agent: For TLSPK / Certificate Manager SaaS
9+
10+
## Table of Contents
11+
12+
- [Getting Started](#getting-started)
13+
- [Development Environment](#development-environment)
14+
- [Making Changes](#making-changes)
15+
- [Testing](#testing)
16+
- [Submitting a Pull Request](#submitting-a-pull-request)
17+
- [Code Review Process](#code-review-process)
18+
- [Additional Resources](#additional-resources)
19+
20+
### Prerequisites
21+
22+
Before you begin, ensure you have the following installed:
23+
24+
- [Go](https://golang.org/doc/install) (version specified in `go.mod`)
25+
- [Make](https://www.gnu.org/software/make/)
26+
- [Git](https://git-scm.com/)
27+
- [Docker](https://docs.docker.com/get-docker/) (for building container images)
28+
29+
To check which Go version will be used:
30+
31+
```bash
32+
make which-go
33+
```
34+
35+
It's also possible to use a vendored version of Go, via `make vendor-go`.
36+
37+
### Repository Tooling
38+
39+
Most of the setup logic for provisioning tooling and for handling builds and testing
40+
is defined in Makefile logic.
41+
42+
Specifically, `the make/_shared` directory contains shared Makefile logic derived from
43+
the cert-manager [makefile-modules](https://github.com/cert-manager/makefile-modules/) project.
44+
45+
### Setting Up Your Development Environment
46+
47+
1. **Fork the repository** on GitHub
48+
49+
2. **Clone your fork:**
50+
51+
```bash
52+
git clone git@github.com:YOUR-USERNAME/jetstack-secure.git
53+
cd jetstack-secure
54+
```
55+
56+
3. **Add the upstream remote:**
57+
58+
```bash
59+
git remote add upstream git@github.com:jetstack/jetstack-secure.git
60+
```
61+
62+
4. **Run initial verification:**
63+
64+
```bash
65+
make verify
66+
```
67+
68+
This ensures your environment is set up correctly.
69+
70+
## Development Environment
71+
72+
### Local Execution
73+
74+
To build and run the agent locally:
75+
76+
```bash
77+
go run main.go agent --agent-config-file ./path/to/agent/config/file.yaml -p 0h1m0s
78+
```
79+
80+
Example configuration files are available:
81+
- [agent.yaml](./agent.yaml)
82+
- [examples/one-shot-secret.yaml](./examples/one-shot-secret.yaml)
83+
- [examples/cert-manager-agent.yaml](./examples/cert-manager-agent.yaml)
84+
85+
You can also run a local echo server to monitor agent requests:
86+
87+
```bash
88+
go run main.go echo
89+
```
90+
91+
### Useful Make Targets
92+
93+
- `make help` - Show all available make targets
94+
- `make verify` - Run all verification checks (linting, formatting, etc.)
95+
- `make test-unit` - Run unit tests
96+
- `make test-helm` - Run Helm chart tests
97+
- `make generate` - Generate code, documentation, and other artifacts
98+
- `make oci-build-preflight` - Build container image
99+
- `make clean` - Clean all temporary files
100+
101+
## Making Changes
102+
103+
### Creating a Branch
104+
105+
Always create a new branch for your changes:
106+
107+
```bash
108+
git checkout -b feature/your-feature-name
109+
```
110+
111+
Use descriptive branch names:
112+
- `feature/` for new features
113+
- `fix/` for bug fixes
114+
- `docs/` for documentation changes
115+
- `refactor/` for refactoring
116+
117+
### Code Style
118+
119+
This project follows standard Go conventions:
120+
121+
- Run `make verify-golangci-lint` to check your code
122+
- Run `make fix-golangci-lint` to automatically fix some issues
123+
- Ensure all code is formatted with `gofmt`
124+
- Follow the [Effective Go](https://golang.org/doc/effective_go) guidelines
125+
- Most of the conventions are enforced by linters, and violations will prevent code being merged
126+
127+
### Committing Changes
128+
129+
1. **Stage your changes:**
130+
131+
```bash
132+
git add .
133+
```
134+
135+
2. **Run verification before committing:**
136+
137+
```bash
138+
make verify
139+
```
140+
141+
3. **Commit with a descriptive message:**
142+
143+
```bash
144+
git commit -m "Brief description of your changes"
145+
```
146+
147+
Write clear commit messages:
148+
- Use the imperative mood ("Add feature" not "Added feature")
149+
- Keep the first line under 72 characters
150+
- Add additional context in the body if needed
151+
152+
## Testing
153+
154+
### Running Tests Locally
155+
156+
Before submitting a PR, ensure all tests pass:
157+
158+
```bash
159+
# Run unit tests
160+
make test-unit
161+
162+
# Run Helm tests
163+
make test-helm
164+
165+
# Run all verification checks
166+
make verify
167+
```
168+
169+
### End-to-End Tests
170+
171+
E2E tests run automatically in CI when you add specific labels to your PR:
172+
173+
- Add the `test-e2e` label to trigger GKE-based E2E tests
174+
- Add the `keep-e2e-cluster` label if you need to keep the cluster for debugging (remember to delete it manually afterward to avoid costs)
175+
176+
The E2E test script is located at [hack/e2e/test.sh](./hack/e2e/test.sh).
177+
178+
### Writing Tests
179+
180+
- Add unit tests for all new functionality
181+
- Place tests in `*_test.go` files alongside the code they test
182+
- Use the [testify](https://github.com/stretchr/testify) library for assertions
183+
- Aim for meaningful test coverage, not just high percentages
184+
185+
## Submitting a Pull Request
186+
187+
1. **Push your branch to your fork:**
188+
189+
```bash
190+
git push origin feature/your-feature-name
191+
```
192+
193+
2. **Create a Pull Request** on GitHub from your fork to the `master` branch of `jetstack/jetstack-secure`
194+
195+
3. **Fill out the PR description** with:
196+
- Clear description of the changes
197+
- Related issue numbers (if applicable)
198+
- Testing instructions
199+
- Any breaking changes or special considerations
200+
201+
4. **Ensure CI passes:**
202+
- All tests must pass
203+
- Code must pass verification / linting checks
204+
- No merge conflicts
205+
206+
## Code Review Process
207+
208+
### For All Contributors
209+
210+
- PRs require approval before merging
211+
- Keep PRs focused and reasonably sized
212+
- Update your branch if `master` has moved forward:
213+
214+
```bash
215+
git fetch upstream
216+
git rebase upstream/master
217+
git push --force-with-lease origin feature/your-feature-name
218+
```
219+
220+
### For CyberArk Contributors
221+
222+
**Contributors from inside CyberArk should reach out to the cert-manager team for reviews for PRs which are passing CI.**
223+
224+
The cert-manager team maintains this project and will provide code reviews and guidance for merging changes.
225+
226+
## Additional Resources
227+
228+
- [Project Documentation](https://docs.cyberark.com/mis-saas/vaas/k8s-components/c-tlspk-agent-overview/)
229+
- [Issue Tracker](https://github.com/jetstack/jetstack-secure/issues)
230+
- [Release Process](./RELEASE.md)
231+
- [cert-manager Community](https://cert-manager.io/docs/contributing/)
232+
233+
## Getting Help
234+
235+
If you need help or have questions:
236+
237+
1. Check existing [issues](https://github.com/jetstack/jetstack-secure/issues) and [documentation](https://docs.cyberark.com/mis-saas/vaas/k8s-components/c-tlspk-agent-overview/)
238+
2. Open a new issue with the `question` label
239+
3. For CyberArk contributors, reach out to the cert-manager team
240+
241+
## License
242+
243+
By contributing, you agree that your contributions will be licensed under the license in the LICENSE file in the root directory of this repository.

‎LICENSES‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ github.com/hashicorp/errwrap,MPL-2.0
7373
github.com/hashicorp/go-multierror,MPL-2.0
7474
github.com/josharian/intern,MIT
7575
github.com/json-iterator/go,MIT
76+
github.com/lestrrat-go/blackmagic,MIT
77+
github.com/lestrrat-go/httpcc,MIT
78+
github.com/lestrrat-go/httprc/v3,MIT
79+
github.com/lestrrat-go/jwx/v3,MIT
80+
github.com/lestrrat-go/option/v2,MIT
7681
github.com/mailru/easyjson,MIT
7782
github.com/mattn/go-colorable,MIT
7883
github.com/mattn/go-isatty,MIT

‎api/datareading.go‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ func (o *DataReading) UnmarshalJSON(data []byte) error {
6464
target any
6565
assign func(any)
6666
}{
67+
{&OIDCDiscoveryData{}, func(v any) { o.Data = v.(*OIDCDiscoveryData) }},
6768
{&DiscoveryData{}, func(v any) { o.Data = v.(*DiscoveryData) }},
6869
{&DynamicData{}, func(v any) { o.Data = v.(*DynamicData) }},
6970
}
@@ -130,14 +131,14 @@ func (v *GatheredResource) UnmarshalJSON(data []byte) error {
130131
return nil
131132
}
132133

133-
// DynamicData is the DataReading.Data returned by the k8s.DataGathererDynamic
134+
// DynamicData is the DataReading.Data returned by the k8sdynamic.DataGathererDynamic
134135
// gatherer
135136
type DynamicData struct {
136137
// Items is a list of GatheredResource
137138
Items []*GatheredResource `json:"items"`
138139
}
139140

140-
// DiscoveryData is the DataReading.Data returned by the k8s.ConfigDiscovery
141+
// DiscoveryData is the DataReading.Data returned by the k8sdiscovery.DataGathererDiscovery
141142
// gatherer
142143
type DiscoveryData struct {
143144
// ClusterID is the unique ID of the Kubernetes cluster which this snapshot was taken from.
@@ -149,3 +150,18 @@ type DiscoveryData struct {
149150
// See https://godoc.org/k8s.io/apimachinery/pkg/version#Info
150151
ServerVersion *version.Info `json:"server_version"`
151152
}
153+
154+
// OIDCDiscoveryData is the DataReading.Data returned by the oidc.OIDCDiscovery
155+
// gatherer
156+
type OIDCDiscoveryData struct {
157+
// OIDCConfig contains OIDC configuration data from the API server's
158+
// `/.well-known/openid-configuration` endpoint
159+
OIDCConfig map[string]any `json:"openid_configuration,omitempty"`
160+
// OIDCConfigError contains any error encountered while fetching the OIDC configuration
161+
OIDCConfigError string `json:"openid_configuration_error,omitempty"`
162+
163+
// JWKS contains JWKS data from the API server's `/openid/v1/jwks` endpoint
164+
JWKS map[string]any `json:"jwks,omitempty"`
165+
// JWKSError contains any error encountered while fetching the JWKS
166+
JWKSError string `json:"jwks_error,omitempty"`
167+
}

‎api/datareading_test.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,20 @@ func TestDataReading_UnmarshalJSON(t *testing.T) {
7575
}`,
7676
wantDataType: &DynamicData{},
7777
},
78+
{
79+
name: "OIDCDiscoveryData type",
80+
input: `{
81+
"cluster_id": "11111111-2222-3333-4444-555555555555",
82+
"data-gatherer": "oidc",
83+
"timestamp": "2024-06-01T12:00:00Z",
84+
"data": {
85+
"openid_configuration": {"issuer": "https://example.com"},
86+
"jwks": {"keys": []}
87+
},
88+
"schema_version": "v1"
89+
}`,
90+
wantDataType: &OIDCDiscoveryData{},
91+
},
7892
{
7993
name: "Invalid JSON",
8094
input: `not a json`,

‎cmd/agent_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ func TestOutputModes(t *testing.T) {
3333

3434
t.Run("machinehub", func(t *testing.T) {
3535
arktesting.SkipIfNoEnv(t)
36+
37+
t.Log("This test runs against a live service and has been known to flake. If you see timeout issues it's possible that the test is flaking and it could be unrelated to your changes.")
38+
3639
runSubprocess(t, repoRoot, []string{
3740
"--agent-config-file", filepath.Join(repoRoot, "examples/machinehub/config.yaml"),
3841
"--input-path", filepath.Join(repoRoot, "examples/machinehub/input.json"),

‎deploy/charts/disco-agent/templates/configmap.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ data:
1919
{{- . | toYaml | nindent 6 }}
2020
{{- end }}
2121
data-gatherers:
22+
- kind: oidc
23+
name: ark/oidc
2224
- kind: k8s-discovery
2325
name: ark/discovery
2426
- kind: k8s-dynamic

‎deploy/charts/disco-agent/templates/rbac.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,4 +95,18 @@ subjects:
9595
- kind: ServiceAccount
9696
name: {{ include "disco-agent.serviceAccountName" . }}
9797
namespace: {{ .Release.Namespace }}
98-
98+
---
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: ClusterRoleBinding
101+
metadata:
102+
name: {{ include "disco-agent.fullname" . }}-oidc-discovery
103+
labels:
104+
{{- include "disco-agent.labels" . | nindent 4 }}
105+
roleRef:
106+
kind: ClusterRole
107+
name: system:service-account-issuer-discovery
108+
apiGroup: rbac.authorization.k8s.io
109+
subjects:
110+
- kind: ServiceAccount
111+
name: {{ include "disco-agent.serviceAccountName" . }}
112+
namespace: {{ .Release.Namespace }}

‎deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ custom-cluster-description:
77
cluster_description: "A cloud hosted Kubernetes cluster hosting production workloads.\n\nteam: team-1\nemail: team-1@example.com\npurpose: Production workloads\n"
88
period: "12h0m0s"
99
data-gatherers:
10+
- kind: oidc
11+
name: ark/oidc
1012
- kind: k8s-discovery
1113
name: ark/discovery
1214
- kind: k8s-dynamic
@@ -122,6 +124,8 @@ custom-cluster-name:
122124
cluster_description: ""
123125
period: "12h0m0s"
124126
data-gatherers:
127+
- kind: oidc
128+
name: ark/oidc
125129
- kind: k8s-discovery
126130
name: ark/discovery
127131
- kind: k8s-dynamic
@@ -237,6 +241,8 @@ custom-period:
237241
cluster_description: ""
238242
period: "1m"
239243
data-gatherers:
244+
- kind: oidc
245+
name: ark/oidc
240246
- kind: k8s-discovery
241247
name: ark/discovery
242248
- kind: k8s-dynamic
@@ -352,6 +358,8 @@ defaults:
352358
cluster_description: ""
353359
period: "12h0m0s"
354360
data-gatherers:
361+
- kind: oidc
362+
name: ark/oidc
355363
- kind: k8s-discovery
356364
name: ark/discovery
357365
- kind: k8s-dynamic

0 commit comments

Comments
 (0)