Add account to storage & node-agent

[amirmalka]

PR Type:

Enhancement

---

PR Description:

This PR enhances the security of the Kubescape Operator by loading the account from a secret instead of a config map in the storage and node-agent components. The changes include:

• Addition of a new volume for the secret in both the node-agent daemonset and the storage deployment.
• Mounting the secret volume to the respective pods.
• In the storage deployment, the account ID is now being set from the values file.

---

PR Main Files Walkthrough:

files:

charts/kubescape-operator/templates/node-agent/daemonset.yaml: A new volume for the secret has been added to the node-agent daemonset. This volume is then mounted to the pod at '/etc/credentials'. The secret is named according to the value of 'global.cloudSecret' from the values file.
charts/kubescape-operator/templates/storage/deployment.yaml: The account ID is now being set from the values file in the storage deployment. A new environment variable 'ACCOUNT_ID' has been added for this purpose.

---

User Description:

Overview

Account was loaded from config map instead of secret in the storage and node-agent components.
Not in this PR - new versions of storage & node-agent

Related PRs:

• load account id from secret node-agent#143
• Load account from env var storage#60

[codiumai-pr-agent-free]

PR Analysis

• 🎯 Main theme: Enhancing security by loading account from a secret instead of a config map in the storage and node-agent components.
• 📝 PR summary: This PR introduces changes to the Kubescape Operator to enhance security. It modifies the storage and node-agent components to load the account from a secret instead of a config map. This is achieved by adding a new volume for the secret in both the node-agent daemonset and the storage deployment, and then mounting this volume to the respective pods.
• 📌 Type of PR: Enhancement
• 🧪 Relevant tests added: No
• ⏱️ Estimated effort to review [1-5]: 2, The PR is relatively straightforward with changes to the way the account is loaded in two components. It does not involve complex logic or significant refactoring.
• 🔒 Security concerns: No

PR Feedback

• 💡 General suggestions: The PR is well-structured and the changes are clearly explained. It would be beneficial to include tests to verify the new functionality and ensure that the account is correctly loaded from the secret.

• 🤖 Code feedback:

  • relevant file: charts/kubescape-operator/templates/node-agent/daemonset.yaml
    suggestion: Consider adding a fallback mechanism in case the secret is not available or fails to load. This could be implemented by checking if the secret volume is mounted successfully before proceeding. [medium]
    relevant line: secretName: {{ .Values.global.cloudSecret }}

  • relevant file: charts/kubescape-operator/templates/storage/deployment.yaml
    suggestion: It would be good to handle the case where the 'ACCOUNT_ID' environment variable is not set or is set to an invalid value. This could be done by adding validation checks in the code where this environment variable is used. [important]
    relevant line: - name: ACCOUNT_ID

How to use

To invoke the PR-Agent, add a comment using one of the following commands:
/review [-i]: Request a review of your Pull Request. For an incremental review, which only considers changes since the last review, include the '-i' option.
/describe: Modify the PR title and description based on the contents of the PR.
/improve [--extended]: Suggest improvements to the code in the PR. Extended mode employs several calls, and provides a more thorough feedback.
/ask <QUESTION>: Pose a question about the PR.
/update_changelog: Update the changelog based on the PR's contents.

To edit any configuration parameter from configuration.toml, add --config_path=new_value
For example: /review --pr_reviewer.extra_instructions="focus on the file: ..."
To list the possible configuration parameters, use the /config command.