Skip to content

feat(shield): convert alf config to secret #2303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Sep 26, 2025
Merged

feat(shield): convert alf config to secret #2303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
fd1c28b
feat(shield): convert alf config to secret
aroberts87 Jul 1, 2025
25f1ef1
Merge branch 'main' into aroberts/feat/shield-chart-forwarder-secret
aroberts87 Aug 25, 2025
e241cfa
(shield): Implement the possibility to provide an already existing se…
gi-erre Sep 19, 2025
412b05d
(shield): Refactor existing secret variable name
gi-erre Sep 25, 2025
f5fd96c
Merge branch 'main' into aroberts/feat/shield-chart-forwarder-secret
aroberts87 Sep 25, 2025
d955f49
fix: add the new readme entry
aroberts87 Sep 25, 2025
74abe42
fix(shield): update schema and tests for alf changes
aroberts87 Sep 26, 2025
4ac0d71
Merge branch 'main' into aroberts/feat/shield-chart-forwarder-secret
aroberts87 Sep 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/shield/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,5 @@ maintainers:
- name: mavimo
email: [email protected]
type: application
version: 1.19.3
version: 1.19.4
appVersion: "1.0.0"
1 change: 1 addition & 0 deletions charts/shield/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ The following table lists the configurable parameters of the `shield` chart and
| features.investigations.event_forwarder.enabled | | <code>false</code> |
| features.investigations.event_forwarder.integrations | | <code>[]</code> |
| features.investigations.event_forwarder.transmit_message_types | | <code>[]</code> |
| features.investigations.event_forwarder.existing_secret | If existing_secret is set to anything different than an empty string the local forwarder secret generation is skipped and the existing secret name is used to mount the secret volume instead of the one defined in the secrets template | <code>""</code> |
| features.respond.rapid_response.enabled | | <code>false</code> |
| features.respond.rapid_response.password | | <code></code> |
| features.respond.rapid_response.password_existing_secret | The name of the existing Rapid Response password secret | <code></code> |
Expand Down
5 changes: 5 additions & 0 deletions charts/shield/templates/host/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,3 +288,8 @@ true
true
{{- end }}
{{- end }}

{{/* Return the name of the local forwarder secret */}}
{{- define "host.local_forwarder_secret_name" }}
{{- include "host.fullname" . | trunc 46 | trimSuffix "-" | printf "%s-local-forwarder" }}
{{- end }}
5 changes: 0 additions & 5 deletions charts/shield/templates/host/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,6 @@ data:
{{- include "host.host_shield_config" . | nindent 4 }}
dragent.yaml: |
{{- include "host.configmap" . | nindent 4 }}
{{- if .Values.features.investigations.event_forwarder.enabled }}
local_forwarder_config.yaml: |
integrations:
{{- toYaml .Values.features.investigations.event_forwarder.integrations | nindent 6 }}
{{- end }}
{{- if (include "host.prometheus_enabled" .Values.features) }}
prometheus.yaml: |
{{- with .Values.features }}
Expand Down
9 changes: 6 additions & 3 deletions charts/shield/templates/host/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,8 +332,11 @@ spec:
{{- end }}
{{- if .Values.features.investigations.event_forwarder.enabled }}
- name: local-forwarder-config
configMap:
name: {{ include "host.fullname" . }}
optional: true
secret:
{{- if eq .Values.features.investigations.event_forwarder.existing_secret "" }}
secretName: {{ include "host.local_forwarder_secret_name" . }}
{{- else }}
secretName: {{ .Values.features.investigations.event_forwarder.existing_secret }}
{{- end }}
{{- end }}
{{- include "host.volumes" . | nindent 8 }}
14 changes: 14 additions & 0 deletions charts/shield/templates/host/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,17 @@ type: Opaque
data:
password: {{ (include "host.rapid_response_password" .) | b64enc | quote }}
{{- end }}

{{- if and .Values.features.investigations.event_forwarder.enabled (eq .Values.features.investigations.event_forwarder.existing_secret "") }}
---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: {{ include "host.local_forwarder_secret_name" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "host.labels" . | nindent 4 }}
data:
local_forwarder_config.yaml: {{ pick .Values.features.investigations.event_forwarder "integrations" | toYaml | b64enc | quote }}
{{- end }}
26 changes: 26 additions & 0 deletions charts/shield/tests/host/configmap-host-shield-config_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,3 +473,29 @@ tests:
in_use:
enabled: false
integration_enabled: false

- it: Ensure Local Forwarder
set:
features:
investigations:
event_forwarder:
enabled: true
integrations:
- channels:
- SECURE_EVENTS_POLICIES
- ACTIVITY_AUDIT
configuration:
output: stdout
type: LOCAL
transmit_message_types:
- POLICY_EVENTS
- SECURE_AUDIT
asserts:
- matchRegex:
path: data['dragent.yaml']
pattern: |
local_forwarder:
enabled: true
transmit_message_types:
- POLICY_EVENTS
- SECURE_AUDIT
61 changes: 0 additions & 61 deletions charts/shield/tests/host/configmap-local-forwarder_test.yaml
View file
Open in desktop

This file was deleted.

41 changes: 41 additions & 0 deletions charts/shield/tests/host/daemonset_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -847,3 +847,44 @@ tests:
value:
- company.public
- company.internal

- it: No Local Forwarder items if not enabled
asserts:
- notExists:
path: spec.template.spec.volumes[?(@.name == "local-forwarder-config")]
template: host/daemonset.yaml
- notExists:
path: spec.template.spec.containers[0].volumeMounts[?(@.name == "local-forwarder-config")]
template: host/daemonset.yaml

- it: Local Forwarder Configured as needed
set:
features:
investigations:
event_forwarder:
enabled: true
transmit_message_types:
- POLICY_EVENTS
- SECURE_AUDIT
integrations:
- channels:
- SECURE_EVENTS_POLICIES
- ACTIVITY_AUDIT
configuration:
output: stdout
type: LOCAL
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: local-forwarder-config
secret:
secretName: release-name-shield-host-local-forwarder
template: host/daemonset.yaml
- contains:
path: spec.template.spec.containers[0].volumeMounts
content:
name: local-forwarder-config
mountPath: /opt/draios/etc/local_forwarder_config.yaml
subPath: local_forwarder_config.yaml
template: host/daemonset.yaml
36 changes: 36 additions & 0 deletions charts/shield/tests/host/secrets_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,3 +117,39 @@ tests:
name: existing-secret
key: custom-key
template: templates/host/daemonset.yaml

- it: Test Local Forwarder secret is not created when disabled
asserts:
- containsDocument:
kind: Secret
apiVersion: v1
name: release-name-shield-host-local-forwarder
namespace: shield-namespace
not: true
template: host/secrets.yaml

- it: Test Local Forwarder secret is created when enabled
set:
features:
investigations:
event_forwarder:
enabled: true
integrations:
- channels:
- SECURE_EVENTS_POLICIES
- ACTIVITY_AUDIT
configuration:
output: stdout
type: LOCAL
asserts:
- containsDocument:
kind: Secret
apiVersion: v1
name: release-name-shield-host-local-forwarder
namespace: shield-namespace
- exists:
path: data["local_forwarder_config.yaml"]
- matchRegex:
path: data["local_forwarder_config.yaml"]
pattern: aW50ZWdyYXRpb25zOgotIGNoYW5uZWxzOgogIC0gU0VDVVJFX0VWRU5UU19QT0xJQ0lFUwogIC0gQUNUSVZJVFlfQVVESVQKICBjb25maWd1cmF0aW9uOgogICAgb3V0cHV0OiBzdGRvdXQKICB0eXBlOiBMT0NBTA==
template: host/secrets.yaml
4 changes: 4 additions & 0 deletions charts/shield/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1035,6 +1035,10 @@
]
},
"uniqueItems": true
},
"existing_secret": {
"type": "string",
"description": "name of an existing secret containing local forwarder configuration data"
}
}
}
Expand Down
5 changes: 5 additions & 0 deletions charts/shield/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,11 @@ features:
enabled: false
integrations: []
transmit_message_types: []
# If existing_secret is set to anything different than an empty string
# the local forwarder secret generation is skipped and the existing secret
# name is used to mount the secret volume instead of the one defined in
# the secrets template
existing_secret: ""
respond:
rapid_response:
enabled: false
Expand Down
Loading