Jetstack Secure manages your machine identities across Cloud Native Kubernetes and OpenShift environments and builds a detailed view of the enterprise security posture.

This repo contains the open source in-cluster agent of Jetstack Secure, that sends data to the Jetstack Secure SaaS.

Wondering about Preflight? Preflight was the name for the project that was the foundation for the Jetstack Secure platform. It was a tool to perform configuration checks on a Kubernetes cluster using OPA's REGO policy. We decided to incorporate that functionality as part of the Jetstack Secure SaaS service, making this component a basic agent. You can find the old Preflight Check functionality in the git history ( tagged as preflight-local-check and you also check this documentation.

Please review the documentation for the agent before getting started.

The released container images are cryptographically signed by cosign, with SLSA provenance and a CycloneDX SBOM attached. For instructions on how to verify those signatures and attachments, refer to this guide.

To build and run a version from master:

go run main.go agent --agent-config-file ./path/to/agent/config/file.yaml -p 0h1m0s

You can find the example agent file here.

You might also want to run a local echo server to monitor requests the agent sends:

go run main.go echo

The Jetstack-Secure agent exposes its metrics through a Prometheus server, on port 8081. The Prometheus server is disabled by default but can be enabled by passing the --enable-metrics flag to the agent binary.

If you deploy the agent with Helm, using the venafi-kubernetes-agent Helm chart, the metrics server will be enabled by default, on port 8081. If you use the Prometheus Operator, you can use --set metrics.podmonitor.enabled=true to deploy a PodMonitor resource, which will add the venafi-kubernetes-agent metrics to your Prometheus server.

The following metrics are collected:

• Go collector: via the default registry in Prometheus client_golang.
• Process collector: via the default registry in Prometheus client_golang.
• Agent metrics:
• data_readings_upload_size: Data readings upload size (in bytes) sent by the jscp in-cluster agent.

The Docker images are:

The Helm charts are:

The release process is semi-automated.

1. Create a tag for the new release:

   export VERSION=v1.1.0
   git tag --annotate --message="Release ${VERSION}" "${VERSION}"
   git push origin "${VERSION}"

2. A GitHub action will see the new tag and do the following:
   • Build and publish the container image at quay.io/jetstack/venafi-agent,
   • Build and publish the Helm chart at oci:https://quay.io/jetstack/charts/venafi-kubernetes-agent,
   • Create a draft GitHub release,
   • Upload the Helm chart tarball to the GitHub release.
3. Navigate to the GitHub Releases page and select the draft release to edit.
   1. Click on “Generate release notes” to automatically compile the changelog.
   2. Review and refine the generated notes to ensure they’re clear and useful for end users.
   3. Remove any irrelevant entries, such as “update deps,” “update CI,” “update docs,” or similar internal changes that do not impact user functionality.
4. Publish the release.
5. Inform the #venctl channel that a new version of Venafi Kubernetes Agent has been released. Make sure to share any breaking change that may affect venctl connect or venctl generate.
6. Inform Michael McLoughlin of the new release so he can update the documentation at https://docs.venafi.cloud/.

v1.1.0 (Git tag in the jetstack-secure repo)
 └── oci:https://quay.io/jetstack/charts/venafi-kubernetes-agent --version 1.1.0 (GitHub Actions in the jetstack-secure repo)
    ├── oci:https://us.gcr.io/jetstack-secure-enterprise/charts/venafi-kubernetes-agent (Enterprise Builds's GitHub Actions)
    └── oci:https://eu.gcr.io/jetstack-secure-enterprise/charts/venafi-kubernetes-agent (Enterprise Builds's GitHub Actions)
        ├── oci:https://registry.venafi.cloud/charts/venafi-kubernetes-agent --version 1.1.0 (Harbor Replication)
        └── oci:https://private-registry.venafi.cloud/charts/venafi-kubernetes-agent --version 1.1.0 (Harbor Replication)
        └── oci:https://private-registry.venafi.eu/charts/venafi-kubernetes-agent --version 1.1.0 (Harbor Replication)

v1.1.0 (Git tag in the jetstack-secure repo)
 └── quay.io/jetstack/venafi-agent:v1.1.0 (GitHub Actions in the jetstack-secure repo)
     ├── us.gcr.io/jetstack-secure-enterprise/venafi-agent:v1.1.0 (Enterprise Builds's GitHub Actions)
     └── eu.gcr.io/jetstack-secure-enterprise/venafi-agent:v1.1.0 (Enterprise Builds's GitHub Actions)
         ├── registry.venafi.cloud/venafi-agent/venafi-agent:v1.1.0 (Harbor Replication)
         ├── private-registry.venafi.cloud/venafi-agent/venafi-agent:v1.1.0 (Harbor Replication)
         └── private-registry.venafi.eu/venafi-agent/venafi-agent:v1.1.0 (Harbor Replication)

NOTE(mael): TBD

This step is performed by Peter Fiddes and Adrian Lai separately from the main release process.

The jetstack-secure chart is for Jetstack Secure. It is composed of two OCI Helm charts:

• oci:https://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent
• oci:https://us.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent

The process is as follows:

1. Create a branch.
2. Increment version numbers.
   1. Increment the version value in Chart.yaml. DO NOT use a v prefix. The v prefix breaks Helm OCI operations.
   2. Increment the appVersion value in Chart.yaml. Use a v prefix, to match the Docker image tag.
   3. Increment the image.tag value in values.yaml. Use a v prefix, to match the Docker image tag.
   4. Update the Helm unit test snapshots:

      helm unittest ./deploy/charts/jetstack-agent --update-snapshot

3. Create a pull request and wait for it to be approved.
4. Merge the branch
5. Manually trigger the Helm Chart workflow: release_js-agent_chart.yaml.