feat(cluster-scanner): Introduce support to external secrets accessKeySecret

charts/cluster-scanner/Chart.yaml

@@ -4,7 +4,7 @@ description: Sysdig Cluster Scanner
 
 type: application
 
-version: 0.5.5
+version: 0.5.6
 
 appVersion: "0.1.0"
 home: https://www.sysdig.com/

charts/cluster-scanner/README.md

@@ -25,7 +25,7 @@ $ pre-commit run -a
 $ helm repo add sysdig https://charts.sysdig.com
 $ helm repo update
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-      --create-namespace -n sysdig --version=0.5.5  \
+      --create-namespace -n sysdig --version=0.5.6  \
       --set global.clusterConfig.name=CLUSTER_NAME \
       --set global.sysdig.region=SYSDIG_REGION \
       --set global.sysdig.accessKey=YOUR-KEY-HERE
@@ -55,7 +55,7 @@ To install the chart with the release name `cluster-scanner`, run:
 
 ```console
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-       --create-namespace -n sysdig --version=0.5.5 \
+       --create-namespace -n sysdig --version=0.5.6 \
        --set global.clusterConfig.name=CLUSTER_NAME \
        --set global.sysdig.region=SYSDIG_REGION \
        --set global.sysdig.accessKey=YOUR-KEY-HERE
@@ -161,7 +161,7 @@ Specify each parameter using the **`--set key=value[,key=value]`** argument to `
 
 ```console
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-    --create-namespace -n sysdig --version=0.5.5 \
+    --create-namespace -n sysdig --version=0.5.6 \
     --set global.sysdig.region="us1"
 ```
 
@@ -170,7 +170,7 @@ installing the chart. For example:
 
 ```console
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-    --create-namespace -n sysdig --version=0.5.5 \
+    --create-namespace -n sysdig --version=0.5.6 \
     --values values.yaml
 ```
 

charts/cluster-scanner/templates/_helpers.tpl

@@ -261,3 +261,12 @@ Return local registry secrets in the correct format: <namespace_name>/<secret_na
     {{- end -}}
     '{{- join "," $list -}}'
 {{- end -}}
+
+{{- define "cluster-scanner.accessKeySecret" -}}
+    {{/*
+    Note: the last default function call is to avoid some weirdness when either
+    argument is nil. If .Values.global.sysdig.accessKeySecret was undefined, the
+    returned empty string does not evaluate to empty on Helm Version:"v3.8.0"
+    */}}
+    {{- .Values.global.sysdig.accessKeySecret | default "" -}}
+{{- end -}}

charts/cluster-scanner/templates/deployment.yaml

@@ -258,8 +258,13 @@ spec:
           - name: SYSDIG_ACCESS_KEY
             valueFrom:
               secretKeyRef:
+                {{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
                 name: {{ include "cluster-scanner.fullname" . }}
                 key: sysdig_access_key
+                {{- else }}
+                name: {{ ( include "cluster-scanner.accessKeySecret" . ) }}
+                key: access-key
+                {{- end }}
           - name: NATS_JS_SERVER_PASSWORD
             valueFrom:
               secretKeyRef:
@@ -354,8 +359,13 @@ spec:
           - name: SYSDIG_ACCESS_KEY
             valueFrom:
               secretKeyRef:
+                {{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
                 name: {{ include "cluster-scanner.fullname" . }}
                 key: sysdig_access_key
+                {{- else }}
+                name: {{ ( include "cluster-scanner.accessKeySecret" . ) }}
+                key: access-key
+                {{- end }}
           - name: SYSDIG_API_URL
             valueFrom:
               configMapKeyRef:

charts/cluster-scanner/templates/secret.yaml

@@ -7,7 +7,9 @@ metadata:
     {{- include "cluster-scanner.labels" . | nindent 4 }}
 type: Opaque
 data:
+{{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
   sysdig_access_key: {{ required "please provide a sysdig access key" .Values.global.sysdig.accessKey | b64enc | quote }}
+{{- end }}
   js_server_password: {{ .Values.runtimeStatusIntegrator.natsJS.password | default (randAlphaNum 32) | b64enc | quote }}
 {{- if and (eq .Values.imageSbomExtractor.cache.type "distributed") ((.Values.imageSbomExtractor.cache.redis).password) }}
   cache_redis_password: {{ .Values.imageSbomExtractor.cache.redis.password | b64enc | quote }}

charts/cluster-scanner/tests/existing-secret_test.yaml

@@ -0,0 +1,38 @@
+---
+suite: existing-secret
+templates:
+  - ../templates/deployment.yaml
+  - ../templates/clusterrole.yaml
+  - ../templates/clusterrolebinding.yaml
+  - ../templates/role.yaml
+  - ../templates/rolebinding.yaml
+  - ../templates/configmap.yaml
+  - ../templates/secret.yaml
+values:
+  - ../values.yaml
+release:
+  name: test-release
+  namespace: test-ns
+tests:
+  - it: "External secret env is set"
+    templates:
+      - ../templates/deployment.yaml
+    set:
+      global.sysdig.accessKeySecret: "secret"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[35]
+          value:
+            name: SYSDIG_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                key: access-key
+                name: secret
+      - equal:
+          path: spec.template.spec.containers[1].env[8]
+          value:
+            name: SYSDIG_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                key: access-key
+                name: secret