Skip to content

feat: include the option so deployment secret can be created by external source - #48

Merged
ranberant merged 1 commit into
PaloAltoNetworks:masterfrom
chunfer:master
May 3, 2026
Merged

feat: include the option so deployment secret can be created by external source#48
ranberant merged 1 commit into
PaloAltoNetworks:masterfrom
chunfer:master

Conversation

@chunfer

@chunfer chunfer commented May 1, 2026

Copy link
Copy Markdown
Contributor

Description

This change, allows the secret deployment-secret to be created by external source, for example External Secrets Operator.

Motivation and Context

External Secrets Operator is a CNCF supported solution which is widely used by customers, but the current deployment don't support the creation of the secret related to the distribution Id by an external source, as is required by the external secrets operator and other tools of secrets management.

How Has This Been Tested?

This has been tested by using the following:

  • Google Secrets Manager: The storage where the distribution Id and the docker pull secret is located. The secret hold the following format:
{
    "DISTRIBUTION_ID": "bbcd....",
    "DOCKER_PULL_SECRET": "eyJhd..."
}
  • Cluster: RKE cluster
  • External Secrets Operator: This tool was installed in the cluster and the following resources were created:
    • Namespace: cortex-xdr
    • Secret:
apiVersion: v1
kind: Secret
metadata:
  name: gcp-sa-secret
  namespace: cortex-xdr
type: Opaque
stringData:
  secret-access-credentials: |-
    {
      "type": "service_account",
      "project_id": "external-secrets-operator",
      "private_key_id": "",
      "private_key": "-----BEGIN PRIVATE KEY-----\nA key\n-----END PRIVATE KEY-----\n",
      "client_email": "test-service-account@external-secrets-operator.iam.gserviceaccount.com",
      "client_id": "client ID",
      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
      "token_uri": "https://oauth2.googleapis.com/token",
      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/test-service-account%40external-secrets-operator.iam.gserviceaccount.com"
    }
  • SecretStore:
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: demo-store
  namespace: cortex-xdr
spec:
  provider:
    gcpsm:
      auth:
        secretRef:
          secretAccessKeySecretRef:
            name: gcp-sa-secret
            key: secret-access-credentials
      projectID: my-project
  • ExternalSecrets: Deployment Secret & Docker Pull Secret
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: distribution-id
  namespace: cortex-xdr
spec:
  refreshInterval: 1h0m0s
  secretStoreRef:
    name: demo-store
    kind: SecretStore
  target:
    name: distribution-id
    creationPolicy: Owner
  data:
  - secretKey: distribution-id
    remoteRef:
      key: cortex-xdr
      property: DISTRIBUTION_ID
      conversionStrategy: Default
      decodingStrategy: None
      metadataPolicy: None
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: docker-pull-secret
  namespace: cortex-xdr
spec:
  refreshInterval: 1h0m0s
  secretStoreRef:
    name: demo-store
    kind: SecretStore
  target:
    name: docker-pull-secret
    creationPolicy: Owner
    template:
      type: kubernetes.io/dockerconfigjson
  data:
  - secretKey: .dockerconfigjson
    remoteRef:
      key: cortex-xdr
      property: DOCKER_PULL_SECRET
      conversionStrategy: Default
      decodingStrategy: Base64
      metadataPolicy: None

Once the resources were created. I've executed the following command:

helm upgrade --install cortex-xdr cortex-xdr-1.8.0.tgz \
--set namespace.name=cortex-xdr \
--set namespace.create=false \
--set daemonset.image.repository=us-central1-docker.pkg.dev/xdr-us-1234567890123/agent-docker/cortex-agent \
--set daemonset.image.tag=9.2.0.86 \
--set dockerPullSecret.create=false \
--set dockerPullSecret.name=docker-pull-secret \
--set deploymentSecret.create=false \
--set deploymentSecret.name=distribution-id \
--set agent.clusterName=testing

I've also tested using the command that delivers Cortex Cloud which give satisfactory results also.

Screenshots (if appropriate)

  • Helm installation succeded
image
  • Connectivity test working
image
  • View from the web interface
image

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist

  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes if appropriate.
  • All new and existing tests passed.

@ranberant
ranberant merged commit ce0fd06 into PaloAltoNetworks:master May 3, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ranberant ranberant ranberant approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@chunfer @ranberant