Open source components of Jetstack Secure
Jetstack Secure manages your machine identities across Cloud Native Kubernetes and OpenShift environments and builds a detailed view of the enterprise security posture.
This repo contains the open source in-cluster agent of Jetstack Secure, that sends data to the Jetstack Secure SaaS.
Wondering about Preflight? Preflight was the name for the project that was the foundation for the Jetstack Secure platform. It was a tool to perform configuration checks on a Kubernetes cluster using OPA's REGO policy. We decided to incorporate that functionality as part of the Jetstack Secure SaaS service, making this component a basic agent. You can find the old Preflight Check functionality in the git history ( tagged as
preflight-local-check
and you also check this documentation.
Please review the documentation for the agent before getting started.
The released container images are cryptographically signed by
cosign
, with
SLSA provenance and a
CycloneDX SBOM attached. For instructions on how to
verify those signatures and attachments, refer to
this guide.
To build and run a version from master:
go run main.go agent --agent-config-file ./path/to/agent/config/file.yaml -p 0h1m0s
You can find the example agent file here.
You might also want to run a local echo server to monitor requests the agent sends:
go run main.go echo
The Jetstack-Secure agent exposes its metrics through a Prometheus server, on port 8081.
The Prometheus server is disabled by default but can be enabled by passing the --enable-metrics
flag to the agent binary.
The release process is semi-automated. It starts with the following manual steps:
venafi-kubernetes-agent
Helm chart.
(the jetstack-secure
Helm chart uses a different version scheme and is updated and released separately):
version
value in Chart.yaml.
DO NOT use a v
prefix.
The v
prefix breaks Helm OCI operations.appVersion
value in Chart.yaml.
Use a v
prefix, to match the Docker image tag.image.tag
value in values.yaml.
Use a v
prefix.v
prefix: vX.Y.Z
.This will trigger the following automated processes:
Two Docker images are built and pushed to a public quay.io
registry, by the release-master workflow:
quay.io/jetstack/preflight
: is pulled directly by tier 1 Jetstack Secure users, who do not have access to the Jetstack Enterprise Registry.quay.io/jetstack/venafi-agent
: is mirrored to a public Venafi OCI registry for Venafi TLS Protect for Kubernetes users.The Docker images are mirrored by private Venafi CI pipelines, to:
The venafi-kubernetes-agent chart is released manually, as follows:
export VERSION=0.1.43
helm package deploy/charts/venafi-kubernetes-agent --version "${VERSION}"
helm push venafi-kubernetes-agent-${VERSION}.tgz oci://eu.gcr.io/jetstack-secure-enterprise/charts
ℹ️ To test the Helm chart before releasing it, use a pre-release suffix. E.g.
export VERSION=0.1.43-alpha.0
.
The chart will be mirrored to:
registry.venafi.cloud/charts/venafi-kubernetes-agent
(Public)private-registry.venafi.cloud/charts/venafi-kubernetes-agent
(Private, US)private-registry.venafi.eu/charts/venafi-kubernetes-agent
(Private, EU)The jetstack-agent chart has a different version number to the agent.
This is because the first version of this chart was given version 0.1.0
,
while the app version at the time was 0.1.38
.
And this allows the chart to be updated and released more frequently than the Docker image if necessary.
This chart is for Jetstack Secure.
version
value in Chart.yaml.
DO NOT use a v
prefix.
The v
prefix breaks Helm OCI operations.appVersion
value in Chart.yaml.
Use a v
prefix, to match the Docker image tag.image.tag
value in values.yaml.
Use a v
prefix, to match the Docker image tag.chart-vX.Y.Z
.
This unique tag format is recognized by the private CI pipeline that builds and publishes the chart.The chart will be published to the Jetstack Enterprise Registry by a private CI pipeline managed by Venafi.