Skip to content

Commit f047920

Browse files
committed
temporary: disable sendSecretValues by default
In the long run, this should default to true. For now, while the DisCo backend finishes the backend work, disable it and print a warning when it's enabled Signed-off-by: Ashley Davis <ashley.davis@cyberark.com>
1 parent 961ed0c commit f047920

File tree

4 files changed

+12
-7
lines changed

4 files changed

+12
-7
lines changed

deploy/charts/disco-agent/README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -348,11 +348,10 @@ This description will be associated with the data that the agent uploads to the
348348
#### **config.sendSecretValues** ~ `bool`
349349
> Default value:
350350
> ```yaml
351-
> true
351+
> false
352352
> ```
353353
354-
Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.
355-
Default: true
354+
Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service. This value will default to "true" in a future release when further updates have been made to the Discovery and Context backend.
356355
#### **authentication.secretName** ~ `string`
357356
> Default value:
358357
> ```yaml

deploy/charts/disco-agent/templates/NOTES.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,8 @@ APP VERSION: {{ .Chart.AppVersion }}
77

88
- Check the application logs for successful connection to the platform:
99
> kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
10+
11+
{{ if .Values.config.sendSecretValues }}
12+
WARNING: sendSecretValues is not finalised and is subject to breaking changes in the future.
13+
It should be enabled only for testing and validation.
14+
{{ end }}

deploy/charts/disco-agent/values.schema.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,8 @@
166166
"type": "string"
167167
},
168168
"helm-values.config.sendSecretValues": {
169-
"default": true,
170-
"description": "Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.\nDefault: true",
169+
"default": false,
170+
"description": "Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service. This value will default to \"true\" in a future release when further updates have been made to the Discovery and Context backend.",
171171
"type": "boolean"
172172
},
173173
"helm-values.extraArgs": {

deploy/charts/disco-agent/values.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -200,8 +200,9 @@ config:
200200
# Metadata is always sent, but the actual values of Secrets are not sent by default.
201201
# When enabled, Secret data is encrypted using envelope encryption using
202202
# a key managed by CyberArk, fetched from the Discovery and Context service.
203-
# Default: true
204-
sendSecretValues: true
203+
# This value will default to "true" in a future release when further updates have been
204+
# made to the Discovery and Context backend.
205+
sendSecretValues: false
205206

206207
authentication:
207208
secretName: agent-credentials

0 commit comments

Comments
 (0)