Skip to content

Feature/eso patch #775

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EldarShalev wants to merge 5 commits into
base: master
Choose a base branch
from
+729 −0
Open

Feature/eso patch #775

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6149a02
Test for first commit
Feb 8, 2026
811b7c4
ESO Features
Feb 8, 2026
698b861
include the cluster-scoped resources: clusterexternalsecrets and clus…
Feb 9, 2026
280cbd5
adding clusterexternalsecrets and clustersecretstores support
Feb 9, 2026
ad67d6e
Add more support for clusterexternalsecrets and clustersecretstores
Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions deploy/charts/disco-agent/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,3 +117,31 @@ data:
version: v1
label-selectors:
- conjur.org/name=conjur-connect-configmap
- kind: k8s-dynamic
Copy link
Contributor

@achuchev achuchev Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please include the cluster-scoped resources: clusterexternalsecrets and clustersecretstores.

Copy link
Author

@EldarShalev EldarShalev Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Copy link
Author

@EldarShalev EldarShalev Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or not, I need to add everything i did (for all files) the same for clusterexternalsecrets and clustersecretstores?

Copy link
Author

@EldarShalev EldarShalev Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

now done @achuchev

name: ark/externalsecrets
config:
resource-type:
group: external-secrets.io
version: v1
resource: externalsecrets
- kind: k8s-dynamic
name: ark/secretstores
config:
resource-type:
group: external-secrets.io
version: v1
resource: secretstores
- kind: k8s-dynamic
name: ark/clusterexternalsecrets
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clusterexternalsecrets
- kind: k8s-dynamic
name: ark/clustersecretstores
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clustersecretstores
112 changes: 112 additions & 0 deletions deploy/charts/disco-agent/tests/__snapshot__/configmap_test.yaml.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,34 @@ custom-cluster-description:
version: v1
label-selectors:
- conjur.org/name=conjur-connect-configmap
- kind: k8s-dynamic
name: ark/externalsecrets
config:
resource-type:
group: external-secrets.io
version: v1
resource: externalsecrets
- kind: k8s-dynamic
name: ark/secretstores
config:
resource-type:
group: external-secrets.io
version: v1
resource: secretstores
- kind: k8s-dynamic
name: ark/clusterexternalsecrets
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clusterexternalsecrets
- kind: k8s-dynamic
name: ark/clustersecretstores
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clustersecretstores
kind: ConfigMap
metadata:
labels:
Expand Down Expand Up @@ -222,6 +250,34 @@ custom-cluster-name:
version: v1
label-selectors:
- conjur.org/name=conjur-connect-configmap
- kind: k8s-dynamic
name: ark/externalsecrets
config:
resource-type:
group: external-secrets.io
version: v1
resource: externalsecrets
- kind: k8s-dynamic
name: ark/secretstores
config:
resource-type:
group: external-secrets.io
version: v1
resource: secretstores
- kind: k8s-dynamic
name: ark/clusterexternalsecrets
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clusterexternalsecrets
- kind: k8s-dynamic
name: ark/clustersecretstores
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clustersecretstores
kind: ConfigMap
metadata:
labels:
Expand Down Expand Up @@ -339,6 +395,34 @@ custom-period:
version: v1
label-selectors:
- conjur.org/name=conjur-connect-configmap
- kind: k8s-dynamic
name: ark/externalsecrets
config:
resource-type:
group: external-secrets.io
version: v1
resource: externalsecrets
- kind: k8s-dynamic
name: ark/secretstores
config:
resource-type:
group: external-secrets.io
version: v1
resource: secretstores
- kind: k8s-dynamic
name: ark/clusterexternalsecrets
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clusterexternalsecrets
- kind: k8s-dynamic
name: ark/clustersecretstores
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clustersecretstores
kind: ConfigMap
metadata:
labels:
Expand Down Expand Up @@ -456,6 +540,34 @@ defaults:
version: v1
label-selectors:
- conjur.org/name=conjur-connect-configmap
- kind: k8s-dynamic
name: ark/externalsecrets
config:
resource-type:
group: external-secrets.io
version: v1
resource: externalsecrets
- kind: k8s-dynamic
name: ark/secretstores
config:
resource-type:
group: external-secrets.io
version: v1
resource: secretstores
- kind: k8s-dynamic
name: ark/clusterexternalsecrets
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clusterexternalsecrets
- kind: k8s-dynamic
name: ark/clustersecretstores
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clustersecretstores
kind: ConfigMap
metadata:
labels:
Expand Down
36 changes: 36 additions & 0 deletions examples/machinehub.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,3 +139,39 @@ data-gatherers:
version: v1
label-selectors:
- conjur.org/name=conjur-connect-configmap

# Gather External Secrets Operator ExternalSecret resources
- name: ark/externalsecrets
kind: k8s-dynamic
config:
resource-type:
group: external-secrets.io
version: v1
resource: externalsecrets

# Gather External Secrets Operator SecretStore resources
- name: ark/secretstores
kind: k8s-dynamic
config:
resource-type:
group: external-secrets.io
version: v1
resource: secretstores

# Gather External Secrets Operator ClusterExternalSecret resources
- name: ark/clusterexternalsecrets
kind: k8s-dynamic
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clusterexternalsecrets

# Gather External Secrets Operator ClusterSecretStore resources
- name: ark/clustersecretstores
kind: k8s-dynamic
config:
resource-type:
group: external-secrets.io
version: v1beta1
resource: clustersecretstores
24 changes: 24 additions & 0 deletions examples/machinehub/input.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,5 +159,29 @@
"data": {
"items": []
}
},
{
"data-gatherer": "ark/externalsecrets",
"data": {
"items": []
}
},
{
"data-gatherer": "ark/secretstores",
"data": {
"items": []
}
},
{
"data-gatherer": "ark/clusterexternalsecrets",
"data": {
"items": []
}
},
{
"data-gatherer": "ark/clustersecretstores",
"data": {
"items": []
}
}
]
27 changes: 27 additions & 0 deletions hack/ark/cluster-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Sample ClusterExternalSecret for e2e testing
# This is a minimal ClusterExternalSecret CR that will be discovered by the agent.
# This is a cluster-scoped resource that can create ExternalSecrets in multiple namespaces.
apiVersion: external-secrets.io/v1beta1
kind: ClusterExternalSecret
metadata:
name: e2e-test-cluster-external-secret
labels:
app.kubernetes.io/name: e2e-test
app.kubernetes.io/component: cluster-external-secret
spec:
refreshInterval: 1h
externalSecretSpec:
secretStoreRef:
name: e2e-test-cluster-secret-store
kind: ClusterSecretStore
target:
name: e2e-test-synced-secret
creationPolicy: Owner
data:
- secretKey: example-key
remoteRef:
key: dummy/path/to/secret
property: password
namespaceSelector:
matchLabels:
environment: test
18 changes: 18 additions & 0 deletions hack/ark/cluster-secret-store.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# Sample ClusterSecretStore for e2e testing
# This is a minimal ClusterSecretStore CR that will be discovered by the agent.
# This is a cluster-scoped resource that can be referenced by ExternalSecrets in any namespace.
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
name: e2e-test-cluster-secret-store
labels:
app.kubernetes.io/name: e2e-test
app.kubernetes.io/component: cluster-secret-store
spec:
provider:
# Fake provider configuration - this won't actually work but allows the CR to be created
fake:
data:
- key: dummy/path/to/secret
value: dummy-value
version: "1"
25 changes: 25 additions & 0 deletions hack/ark/external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# Sample ExternalSecret for e2e testing
# This is a minimal ExternalSecret CR that will be discovered by the agent.
# Note: This requires the External Secrets Operator CRDs to be installed,
# but does not require a working secrets backend.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: e2e-test-external-secret
namespace: default
labels:
app.kubernetes.io/name: e2e-test
app.kubernetes.io/component: external-secret
spec:
refreshInterval: 1h
secretStoreRef:
name: e2e-test-secret-store
kind: SecretStore
target:
name: e2e-test-synced-secret
creationPolicy: Owner
data:
- secretKey: example-key
remoteRef:
key: dummy/path/to/secret
property: password
20 changes: 20 additions & 0 deletions hack/ark/secret-store.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
# Sample SecretStore for e2e testing
# This is a minimal SecretStore CR that will be discovered by the agent.
# Note: This requires the External Secrets Operator CRDs to be installed,
# but does not require a working secrets backend.
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
name: e2e-test-secret-store
namespace: default
labels:
app.kubernetes.io/name: e2e-test
app.kubernetes.io/component: secret-store
spec:
provider:
# Fake provider configuration - this won't actually work but allows the CR to be created
fake:
data:
- key: dummy/path/to/secret
value: dummy-value
version: "1"
19 changes: 19 additions & 0 deletions hack/ark/test-e2e.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,25 @@ kubectl create secret generic e2e-sample-secret-$(date '+%s') \
# in the ark/configmaps data gatherer (conjur.org/name=conjur-connect-configmap).
kubectl apply -f "${root_dir}/hack/ark/conjur-connect-configmap.yaml"

# Install External Secrets Operator CRDs and controller
#
# This is required for the agent to discover ExternalSecret and SecretStore resources.
echo "Installing External Secrets Operator..."
helm repo add external-secrets https://charts.external-secrets.io
helm repo update
helm upgrade --install external-secrets \
external-secrets/external-secrets \
--namespace external-secrets-system \
--create-namespace \
--wait \
--set installCRDs=true

# Create sample External Secrets Operator resources that will be discovered by the agent
kubectl apply -f "${root_dir}/hack/ark/secret-store.yaml"
kubectl apply -f "${root_dir}/hack/ark/external-secret.yaml"
kubectl apply -f "${root_dir}/hack/ark/cluster-secret-store.yaml"
kubectl apply -f "${root_dir}/hack/ark/cluster-external-secret.yaml"

# We use a non-existent tag and omit the `--version` flag, to work around a Helm
# v4 bug. See: https://github.com/helm/helm/issues/31600
helm upgrade agent "oci://${ARK_CHART}:NON_EXISTENT_TAG@${ARK_CHART_DIGEST}" \
Expand Down
8 changes: 8 additions & 0 deletions internal/cyberark/dataupload/dataupload.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,14 @@ type Snapshot struct {
ServiceAccounts []runtime.Object `json:"serviceaccounts"`
// ConfigMaps is a list of ConfigMap resources in the cluster.
ConfigMaps []runtime.Object `json:"configmaps"`
// ExternalSecrets is a list of ExternalSecret resources in the cluster.
ExternalSecrets []runtime.Object `json:"externalsecrets"`
// SecretStores is a list of SecretStore resources in the cluster.
SecretStores []runtime.Object `json:"secretstores"`
// ClusterExternalSecrets is a list of ClusterExternalSecret resources in the cluster.
ClusterExternalSecrets []runtime.Object `json:"clusterexternalsecrets"`
// ClusterSecretStores is a list of ClusterSecretStore resources in the cluster.
ClusterSecretStores []runtime.Object `json:"clustersecretstores"`
// Roles is a list of Role resources in the cluster.
Roles []runtime.Object `json:"roles"`
// ClusterRoles is a list of ClusterRole resources in the cluster.
Expand Down
12 changes: 12 additions & 0 deletions pkg/client/client_cyberark.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,18 @@ var defaultExtractorFunctions = map[string]func(*api.DataReading, *dataupload.Sn
"ark/configmaps": func(r *api.DataReading, s *dataupload.Snapshot) error {
return extractResourceListFromReading(r, &s.ConfigMaps)
},
"ark/externalsecrets": func(r *api.DataReading, s *dataupload.Snapshot) error {
Copy link
Contributor

@achuchev achuchev Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"ark/externalsecrets": func(r *api.DataReading, s *dataupload.Snapshot) error {
"ark/esoexternalsecrets": func(r *api.DataReading, s *dataupload.Snapshot) error {

It may be helpful to add a prefix to the names to clarify which project they originate from.

Copy link
Author

@EldarShalev EldarShalev Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure, but I guess you dont mean only here right?
just to understand the scope of the prefix

return extractResourceListFromReading(r, &s.ExternalSecrets)
},
"ark/secretstores": func(r *api.DataReading, s *dataupload.Snapshot) error {
return extractResourceListFromReading(r, &s.SecretStores)
},
"ark/clusterexternalsecrets": func(r *api.DataReading, s *dataupload.Snapshot) error {
return extractResourceListFromReading(r, &s.ClusterExternalSecrets)
},
"ark/clustersecretstores": func(r *api.DataReading, s *dataupload.Snapshot) error {
return extractResourceListFromReading(r, &s.ClusterSecretStores)
},
}

// convertDataReadings processes a list of DataReadings using the provided
Expand Down
Loading