From 4e3fc010ce6d25d78fcf691e156a8b2e39ab037e Mon Sep 17 00:00:00 2001 From: rzisholz Date: Wed, 9 Sep 2026 15:30:18 +0300 Subject: [PATCH 1/2] Correct the sendSecretValues chart comment The chart's comment said "the actual values of Secrets are not sent by default" while the value below it was `true`. Tracing it: the sentence was accurate when written, when the default was `false`. The default was later flipped to `true`, and whoever did it removed the adjacent "will default to true in a future release" line but missed this one. So it is comment rot, not a disagreement about intent -- corrected the comment rather than changing the default. README and values.schema.json are generated from values.yaml, so they follow. --- deploy/charts/disco-agent/README.md | 4 +++- deploy/charts/disco-agent/values.schema.json | 2 +- deploy/charts/disco-agent/values.yaml | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/deploy/charts/disco-agent/README.md b/deploy/charts/disco-agent/README.md index 3d4dce59..4404a398 100644 --- a/deploy/charts/disco-agent/README.md +++ b/deploy/charts/disco-agent/README.md @@ -419,7 +419,9 @@ This description will be associated with the data that the agent uploads to the > true > ``` -Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service. +Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, and Secret values are sent by default too. +Set this to false to send metadata only. +When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service. #### **config.cyberark.serviceId** ~ `string` > Default value: > ```yaml diff --git a/deploy/charts/disco-agent/values.schema.json b/deploy/charts/disco-agent/values.schema.json index 1087a483..a5d3c48b 100644 --- a/deploy/charts/disco-agent/values.schema.json +++ b/deploy/charts/disco-agent/values.schema.json @@ -200,7 +200,7 @@ }, "helm-values.config.sendSecretValues": { "default": true, - "description": "Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.", + "description": "Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, and Secret values are sent by default too.\nSet this to false to send metadata only.\nWhen enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.", "type": "boolean" }, "helm-values.extraArgs": { diff --git a/deploy/charts/disco-agent/values.yaml b/deploy/charts/disco-agent/values.yaml index 805d6c83..e9df3484 100644 --- a/deploy/charts/disco-agent/values.yaml +++ b/deploy/charts/disco-agent/values.yaml @@ -200,7 +200,8 @@ config: clusterDescription: "" # Enable sending of Secret values to CyberArk in addition to metadata. - # Metadata is always sent, but the actual values of Secrets are not sent by default. + # Metadata is always sent, and Secret values are sent by default too. + # Set this to false to send metadata only. # When enabled, Secret data is encrypted using envelope encryption using # a key managed by CyberArk, fetched from the Discovery and Context service. sendSecretValues: true From f368c94915bf00e24f49ba8c9203025c4c1adc36 Mon Sep 17 00:00:00 2001 From: rzisholz Date: Thu, 10 Sep 2026 11:38:59 +0300 Subject: [PATCH 2/2] Address review: template fallback and datagatherer doc also had the rot wallrj-cyberark flagged two more instances of the same class of bug this PR fixes. deployment.yaml's ARK_SEND_SECRET_VALUES rendered `| default "false"`, disagreeing with the `true` default this PR documents whenever the value is unset; dropped the `default "false"` so the template says what the docs say. Verified via `helm template`: unset now renders "true" (matches values.yaml's default), explicit `false` still renders "false". docs/datagatherers/k8s-dynamic.md said Secret data is never transmitted and linked a file that moved (`pkg/datagatherer/k8s/fieldfilter.go` -> `pkg/datagatherer/k8sdynamic/fieldfilter.go`). Corrected both: describes the redact-by-default / encrypt-when-enabled behavior and points at the chart's sendSecretValues doc. --- deploy/charts/disco-agent/templates/deployment.yaml | 2 +- docs/datagatherers/k8s-dynamic.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy/charts/disco-agent/templates/deployment.yaml b/deploy/charts/disco-agent/templates/deployment.yaml index 63e09ba0..0d3e1d17 100644 --- a/deploy/charts/disco-agent/templates/deployment.yaml +++ b/deploy/charts/disco-agent/templates/deployment.yaml @@ -86,7 +86,7 @@ spec: key: ARK_SECRET optional: true - name: ARK_SEND_SECRET_VALUES - value: {{ .Values.config.sendSecretValues | default "false" | quote }} + value: {{ .Values.config.sendSecretValues | quote }} {{- with .Values.http_proxy }} - name: HTTP_PROXY value: {{ . }} diff --git a/docs/datagatherers/k8s-dynamic.md b/docs/datagatherers/k8s-dynamic.md index da8767a8..cd8b8f59 100644 --- a/docs/datagatherers/k8s-dynamic.md +++ b/docs/datagatherers/k8s-dynamic.md @@ -77,7 +77,7 @@ Secrets can be gathered using the following config: resource: secrets ``` -Before Secrets are sent to the Preflight backend, they are redacted so no secret data is transmitted. See [`fieldfilter.go`](./../../pkg/datagatherer/k8s/fieldfilter.go) to see the details of which fields are filtered and which ones are redacted. +By default, Secret `data` is redacted before being sent to the backend, keeping only non-sensitive fields (`tls.crt`, `ca.crt`, `conjur-map`). If `sendSecretValues` is enabled, the full `data` is kept and encrypted before being sent instead. See [`fieldfilter.go`](./../../pkg/datagatherer/k8sdynamic/fieldfilter.go) for the field list, and `sendSecretValues` in the [disco-agent chart](./../../deploy/charts/disco-agent/README.md) for the encryption behaviour. > **All resource other than Kubernetes Secrets are sent in full, so make sure that you don't store secret information on arbitrary resources.**