Skip to content

Commit 5e07564

Browse files
psokolinskipsokolinski
committed
add changes proposed by the client
1 parent f158b13 commit 5e07564

6 files changed

Lines changed: 83 additions & 13 deletions

File tree

‎charts/jit-k8s-agent/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,17 @@ The following table lists the configurable parameters of the `jit-k8s-agent` cha
3838
| `cluster.name` | Name of the cluster (required) `(1)` | `""` |
3939
| `jit.clientId` | Jit service client ID (required) `(2)` | `""` |
4040
| `jit.clientSecret` | Jit service client secret (required) `(2)` | `""` |
41+
| `jit.existingSecret` | Name of existing secret with credentials `(2)` | `""` |
4142
| `jit.apiUrl` | Jit service API URL | `https://api.jit.io` |
4243
| `serviceAccount.name` | Name of the service account | `jit-k8s-agent-sa` |
4344
| `resources.requests.cpu` | CPU resource requests | `500m` |
4445
| `resources.requests.memory` | Memory resource requests | `2Gi` |
4546
| `resources.limits.cpu` | CPU resource limits | `1000m` |
4647
| `resources.limits.memory` | Memory resource limits | `4Gi` |
4748
| `kubescape.enabled` | Enable Kubescape security scanning | `true` |
49+
| `nodeSelector` | Node selector for pod scheduling | `{}` |
50+
| `tolerations` | Tolerations for pod scheduling on tainted nodes | `[]` |
4851

4952
`(1)` You can retrieve the cluster name by running `kubectl config get-clusters` or `kubectl config current-context`. The cluster name should be unique across all clusters.
5053

51-
`(2)` Refer to [Jit documentation](https://docs.jit.io/docs/managing-users#generating-api-tokens) for more information on how to get the client ID and secret.
54+
`(2)` Authentication: Provide either `clientId` + `clientSecret` OR `existingSecret`. Refer to [Jit documentation](https://docs.jit.io/docs/managing-users#generating-api-tokens) for more information on how to get the client ID and secret.

‎charts/jit-k8s-agent/templates/_job_helper.tpl‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,16 @@
11
{{- define "jit-job-spec" -}}
2+
{{- $jitCredentialsSecret := .Values.jit.existingSecret | default (printf "%s-jit-credentials" .Chart.Name) -}}
23
spec:
34
serviceAccountName: {{ .Values.serviceAccount.name }}
45
restartPolicy: OnFailure
6+
{{- if .Values.tolerations }}
7+
tolerations:
8+
{{ toYaml .Values.tolerations | indent 4 }}
9+
{{- end }}
10+
{{- if .Values.nodeSelector }}
11+
nodeSelector:
12+
{{ toYaml .Values.nodeSelector | indent 4 }}
13+
{{- end }}
514
containers:
615
- name: jit-k8s-agent
716
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -19,12 +28,12 @@ spec:
1928
- name: JIT_CLIENT_ID
2029
valueFrom:
2130
secretKeyRef:
22-
name: {{ .Chart.Name }}-jit-credentials
31+
name: {{ $jitCredentialsSecret }}
2332
key: JIT_CLIENT_ID
2433
- name: JIT_CLIENT_SECRET
2534
valueFrom:
2635
secretKeyRef:
27-
name: {{ .Chart.Name }}-jit-credentials
36+
name: {{ $jitCredentialsSecret }}
2837
key: JIT_CLIENT_SECRET
2938
- name: JIT_API_URL
3039
value: {{ .Values.jit.apiUrl }}

‎charts/jit-k8s-agent/templates/_validation.tpl‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{{/*
2+
Validate required values and provide clear error messages
3+
*/}}
4+
{{- define "jit-k8s-agent.validateValues" -}}
5+
{{- $errors := list -}}
6+
7+
{{- if not .Values.cluster.name -}}
8+
{{- $errors = append $errors "cluster.name is required and cannot be empty" -}}
9+
{{- end -}}
10+
11+
{{- if .Values.jit -}}
12+
{{- if and .Values.jit.clientId .Values.jit.clientSecret -}}
13+
{{- if .Values.jit.existingSecret -}}
14+
{{- $errors = append $errors "Cannot specify both direct credentials (clientId/clientSecret) and existingSecret. Choose one authentication method." -}}
15+
{{- end -}}
16+
{{- else if .Values.jit.existingSecret -}}
17+
{{- /* Valid: using existingSecret */ -}}
18+
{{- else -}}
19+
{{- $errors = append $errors "Jit authentication requires either: 1) Both 'clientId' and 'clientSecret' for direct authentication, or 2) 'existingSecret' to reference an existing Kubernetes secret" -}}
20+
{{- end -}}
21+
{{- else -}}
22+
{{- $errors = append $errors "Jit configuration is required. Please provide either clientId/clientSecret or existingSecret" -}}
23+
{{- end -}}
24+
25+
{{- if $errors -}}
26+
{{- $errorMsg := printf "Configuration validation failed:\n" -}}
27+
{{- range $errors -}}
28+
{{- $errorMsg = printf "%s • %s\n" $errorMsg . -}}
29+
{{- end -}}
30+
{{- $errorMsg = printf "%s\nExample configurations:\n" $errorMsg -}}
31+
{{- $errorMsg = printf "%s # Option 1: Direct credentials\n" $errorMsg -}}
32+
{{- $errorMsg = printf "%s jit:\n" $errorMsg -}}
33+
{{- $errorMsg = printf "%s clientId: \"your-client-id\"\n" $errorMsg -}}
34+
{{- $errorMsg = printf "%s clientSecret: \"your-client-secret\"\n" $errorMsg -}}
35+
{{- $errorMsg = printf "%s\n # Option 2: Existing secret\n" $errorMsg -}}
36+
{{- $errorMsg = printf "%s jit:\n" $errorMsg -}}
37+
{{- $errorMsg = printf "%s existingSecret: \"jit-credentials\"\n" $errorMsg -}}
38+
{{- fail $errorMsg -}}
39+
{{- end -}}
40+
{{- end -}}

‎charts/jit-k8s-agent/templates/secret.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- include "jit-k8s-agent.validateValues" . -}}
2+
{{- if not .Values.jit.existingSecret }}
13
apiVersion: v1
24
kind: Secret
35
metadata:
@@ -7,5 +9,6 @@ metadata:
79
namespace: {{ .Release.Namespace }}
810
type: Opaque
911
data:
10-
JIT_CLIENT_ID: {{ .Values.jit.clientId | b64enc }}
11-
JIT_CLIENT_SECRET: {{ .Values.jit.clientSecret | b64enc }}
12+
JIT_CLIENT_ID: {{ .Values.jit.clientId | toString | b64enc }}
13+
JIT_CLIENT_SECRET: {{ .Values.jit.clientSecret | toString | b64enc }}
14+
{{- end }}

‎charts/jit-k8s-agent/values.schema.json‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,22 @@
1818
"properties": {
1919
"clientId": {
2020
"type": "string",
21-
"minLength": 1,
22-
"description": "The client ID for Jit. This field is required."
21+
"description": "The client ID for Jit. This field is required when not using an existing secret."
2322
},
2423
"clientSecret": {
2524
"type": "string",
26-
"minLength": 1,
27-
"description": "The client secret for Jit. This field is required."
25+
"description": "The client secret for Jit. This field is required when not using an existing secret."
26+
},
27+
"existingSecret": {
28+
"type": "string",
29+
"description": "The name of an existing secret to use for Jit credentials. If provided, clientId and clientSecret will be ignored."
30+
},
31+
"apiUrl": {
32+
"type": "string",
33+
"description": "The Jit API URL"
2834
}
2935
},
30-
"required": ["clientId", "clientSecret"]
36+
"description": "Jit authentication requires either: 1) Both 'clientId' and 'clientSecret' for direct authentication, or 2) 'existingSecret' to reference an existing Kubernetes secret containing the credentials."
3137
}
3238
}
33-
}
39+
}

‎charts/jit-k8s-agent/values.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,11 @@ cluster:
77
name: "" # Required, set it while installing the chart. Should be unique across all clusters.
88

99
jit:
10-
clientId: "" # Required, set it while installing the chart
11-
clientSecret: "" # Required, set it while installing the chart
10+
# Option 1: Direct credentials (required if existingSecret is not provided)
11+
clientId: "" # Set during installation when using direct credentials
12+
clientSecret: "" # Set during installation when using direct credentials
13+
# Option 2: Reference to existing secret (alternative to clientId/clientSecret)
14+
existingSecret: "" # Name of existing secret containing JIT_CLIENT_ID and JIT_CLIENT_SECRET
1215
apiUrl: https://api.jit.io
1316

1417
kubescape:
@@ -24,3 +27,9 @@ resources:
2427
limits:
2528
cpu: "1000m"
2629
memory: "4Gi"
30+
31+
# Optional: Node selector for pod scheduling
32+
nodeSelector: {}
33+
34+
# Optional: Tolerations for pod scheduling on tainted nodes
35+
tolerations: []

0 commit comments

Comments
 (0)