feat(cluster-scanner): Introduce support to external secrets accessKeySecret

charts/cluster-scanner/Chart.yaml

@@ -4,7 +4,7 @@ description: Sysdig Cluster Scanner
 
 type: application
 
-version: 0.4.0
+version: 0.4.1
 
 appVersion: "0.1.0"
 home: https://www.sysdig.com/

charts/cluster-scanner/templates/_helpers.tpl

@@ -261,3 +261,12 @@ Return local registry secrets in the correct format: <namespace_name>/<secret_na
     {{- end -}}
     '{{- join "," $list -}}'
 {{- end -}}
+
+{{- define "cluster-scanner.accessKeySecret" -}}
+    {{/*
+    Note: the last default function call is to avoid some weirdness when either
+    argument is nil. If .Values.global.sysdig.accessKeySecret was undefined, the
+    returned empty string does not evaluate to empty on Helm Version:"v3.8.0"
+    */}}
+    {{- .Values.global.sysdig.accessKeySecret | default "" -}}
+{{- end -}}

charts/cluster-scanner/templates/deployment.yaml

@@ -240,8 +240,13 @@ spec:
           - name: SYSDIG_ACCESS_KEY
             valueFrom:
               secretKeyRef:
+                {{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
                 name: {{ include "cluster-scanner.fullname" . }}
                 key: sysdig_access_key
+                {{- else }}
+                name: {{ ( include "cluster-scanner.accessKeySecret" . ) }}
+                key: access-key
+                {{- end }}
           - name: NATS_JS_SERVER_PASSWORD
             valueFrom:
               secretKeyRef:
@@ -314,8 +319,13 @@ spec:
           - name: SYSDIG_ACCESS_KEY
             valueFrom:
               secretKeyRef:
+                {{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
                 name: {{ include "cluster-scanner.fullname" . }}
                 key: sysdig_access_key
+                {{- else }}
+                name: {{ ( include "cluster-scanner.accessKeySecret" . ) }}
+                key: access-key
+                {{- end }}
           - name: SYSDIG_API_URL
             valueFrom:
               configMapKeyRef:

charts/cluster-scanner/templates/secret.yaml

@@ -1,3 +1,18 @@
+{{- if (include "cluster-scanner.accessKeySecret" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "cluster-scanner.fullname" . }}
+  namespace: {{ include "cluster-scanner.namespace" . }}
+  labels:
+    {{- include "cluster-scanner.labels" . | nindent 4 }}
+type: Opaque
+data:
+  js_server_password: {{ .Values.runtimeStatusIntegrator.natsJS.password | default (randAlphaNum 32) | b64enc | quote }}
+{{- if and (eq .Values.imageSbomExtractor.cache.type "distributed") ((.Values.imageSbomExtractor.cache.redis).password) }}
+  cache_redis_password: {{ .Values.imageSbomExtractor.cache.redis.password | b64enc | quote }}
+{{- end }}
+{{- else }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -12,6 +27,7 @@ data:
 {{- if and (eq .Values.imageSbomExtractor.cache.type "distributed") ((.Values.imageSbomExtractor.cache.redis).password) }}
   cache_redis_password: {{ .Values.imageSbomExtractor.cache.redis.password | b64enc | quote }}
 {{- end }}
+{{- end }}
 {{- if eq (include "sysdig.custom_ca.useValues"  (dict "global" .Values.global.ssl "component" .Values.ssl)) "true" }}
 ---
 apiVersion: v1

charts/cluster-scanner/tests/secret_test.yaml

@@ -60,3 +60,34 @@ tests:
     asserts:
       - isNull:
           path: data.cache_redis_password
+
+---
+suite: deployment
+templates:
+  - ../templates/deployment.yaml
+values:
+  - ../values.yaml
+release:
+  name: test-release
+  namespace: test-ns
+tests:
+  - it: "External secret env is set"
+    set:
+      global.sysdig.accessKeySecret: "secret"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[31]
+          value:
+            name: SYSDIG_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                key: access-key
+                name: secret
+      - equal:
+          path: spec.template.spec.containers[1].env[5]
+          value:
+            name: SYSDIG_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                key: access-key
+                name: secret