Deprecate service/discovery API and implement the new one by mladen-rusev-cyberark · Pull Request #706 · jetstack/jetstack-secure

mladen-rusev-cyberark · 2025-09-03T07:16:39Z

We were made aware in an email thread that the v2/service/discovery API will be deprecated in the end of 2025. A new API will be provided by Q3 2025. It is detailed in this document under /api/tenant-discovery/public. It will take a subdomain name as a query parameter &bySubdomain= and return a response in the following format:

{
  "region": "string",
  "dr_region": "string",
  "subdomain": "string",
  "platform_id": "string",
  "identity_id": "string",
  "default_url": "string",
  "tenant_flags": {
    "is_crdr_supported": true,
    "is_crdr_active": true
  },
  "services": [
    {
      "service_name": "string",
      "region": "string",
      "endpoints": [
        {
          "is_active": true,
          "type": "main",
          "ui": "string",
          "api": "string"
        }
      ]
    }
  ]
}

In this MR:

Replace all usage of the old API with the new one
Create structs to parse the new JSON structure into
Filter for the services we need (identity_administration and discoverycontext) and return their URLs
Changes to the MockDiscoveryServer to accommodate the changes

@wallrj-cyberark invited me to the test tenant https://tlskp-test.integration-cyberark.cloud/ which allowed me to run the TestCyberArkClient_PutSnapshot_RealAPI test

$ go test ./pkg/internal/cyberark -v -count 1 -run TestCyberArkClient_PutSnapshot_RealAPI -args -testing.v 6
=== RUN   TestCyberArkClient_PutSnapshot_RealAPI
    round_trippers.go:632: I0903 11:56:10.355088] Response verb="GET" url="https://platform-discovery.integration-cyberark.cloud/api/public/tenant-discovery?bySubdomain=tlskp-test" status="200 OK" milliseconds=466
    round_trippers.go:632: I0903 11:56:10.963827] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/StartAuthentication" status="200 OK" milliseconds=608
    identity.go:303: I0903 11:56:10.964094] made successful request to StartAuthentication source="Identity.doStartAuthentication" summary="NewPackage"
    round_trippers.go:632: I0903 11:56:11.318450] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/AdvanceAuthentication" status="200 OK" milliseconds=354
    round_trippers.go:632: I0903 11:56:22.200393] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/StartAuthentication" status="200 OK" milliseconds=872
    identity.go:303: I0903 11:56:22.200528] made successful request to StartAuthentication source="Identity.doStartAuthentication" summary="NewPackage"
    round_trippers.go:632: I0903 11:56:22.643333] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/AdvanceAuthentication" status="200 OK" milliseconds=442
    round_trippers.go:632: I0903 11:56:32.841489] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/StartAuthentication" status="200 OK" milliseconds=197
    identity.go:303: I0903 11:56:32.841773] made successful request to StartAuthentication source="Identity.doStartAuthentication" summary="NewPackage"
    round_trippers.go:632: I0903 11:56:33.077864] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/AdvanceAuthentication" status="200 OK" milliseconds=235
    round_trippers.go:632: I0903 11:56:43.278994] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/StartAuthentication" status="200 OK" milliseconds=192
    identity.go:303: I0903 11:56:43.279196] made successful request to StartAuthentication source="Identity.doStartAuthentication" summary="NewPackage"
    round_trippers.go:632: I0903 11:56:43.413130] Response verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/AdvanceAuthentication" status="200 OK" milliseconds=133

… update readme and envrc.template

mladen-rusev-cyberark · 2025-09-03T09:08:42Z

pkg/internal/cyberark/servicediscovery/discovery.go

+		switch svc.ServiceName {
+		case IdentityServiceName:
+			for _, ep := range svc.Endpoints {
+				if ep.Type == "main" && ep.IsActive && ep.API != "" {


I was not sure if I should check the Type and IsActive but I've added them. I don't understand the difference between Type main and crdr.

I'm not sure either. Let's merge as-is and adapt it if we learn more from the API team.

mladen-rusev-cyberark · 2025-09-03T09:09:10Z

pkg/internal/cyberark/servicediscovery/discovery.go

+		return nil, fmt.Errorf("didn't find %s in service discovery response, "+
+			"which may indicate a suspended tenant; unable to detect CyberArk Identity API URL", IdentityServiceName)
 	}
+	//TODO: Should add a check for discoveryContextAPI too?


We check for identityAPI but not for discoveryContextAPI. Was this intentional?

I thought about adding it, but didn't know what actionable message to return if it's not found.
Thanks for adding the TODO, lets address that in a future PR.

…bugte to json

wallrj-cyberark

Thanks @mladen-rusev-cyberark

Looks great.

wallrj-cyberark · 2025-09-03T15:38:07Z

pkg/internal/cyberark/servicediscovery/discovery.go

+		return nil, fmt.Errorf("didn't find %s in service discovery response, "+
+			"which may indicate a suspended tenant; unable to detect CyberArk Identity API URL", IdentityServiceName)
 	}
+	//TODO: Should add a check for discoveryContextAPI too?


I thought about adding it, but didn't know what actionable message to return if it's not found.
Thanks for adding the TODO, lets address that in a future PR.

wallrj-cyberark · 2025-09-03T15:43:26Z

pkg/internal/cyberark/servicediscovery/discovery.go

+		switch svc.ServiceName {
+		case IdentityServiceName:
+			for _, ep := range svc.Endpoints {
+				if ep.Type == "main" && ep.IsActive && ep.API != "" {


I'm not sure either. Let's merge as-is and adapt it if we learn more from the API team.

wallrj-cyberark · 2025-09-03T15:46:00Z

pkg/internal/cyberark/identity/cmd/testidentity/main.go

I tested this and it worked well:

$ go run pkg/internal/cyberark/identity/cmd/testidentity/main.go -subdomain $ARK_SUBDOMAIN -username $ARK_USERNAME I0903 16:45:13.361918 1414535 round_trippers.go:632] "Response" verb="GET" url="https://platform-discovery.integration-cyberark.cloud/api/public/tenant-discovery?bySubdomain=tlskp-test" status="200 OK" milliseconds=354 I0903 16:45:13.905341 1414535 round_trippers.go:632] "Response" verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/StartAuthentication" status="200 OK" milliseconds=536 I0903 16:45:13.906041 1414535 identity.go:303] "made successful request to StartAuthentication" source="Identity.doStartAuthentication" summary="NewPackage" I0903 16:45:14.772488 1414535 round_trippers.go:632] "Response" verb="POST" url="https://anb5751.id.integration-cyberark.cloud/Security/AdvanceAuthentication" status="200 OK" milliseconds=866 I0903 16:45:14.773137 1414535 identity.go:419] "successfully completed AdvanceAuthentication request to CyberArk Identity; login complete" username="<REDACTED>"

wallrj-cyberark · 2025-09-03T16:49:52Z

@mladen-rusev-cyberark I'll merge this because I want to use it in my helm branch. Hope you don't mind.

mladen-rusev-cyberark self-assigned this Sep 3, 2025

Deprecate old service-discovery API and impl new one

787f14e

mladen-rusev-cyberark force-pushed the VC-43587 branch from 33c8701 to 787f14e Compare September 3, 2025 08:13

Mladen Rusev added 2 commits September 3, 2025 11:36

update the api

6134f1a

update the type of tenant_flags to accommodate actual boolean values;…

ebcf00b

… update readme and envrc.template

mladen-rusev-cyberark commented Sep 3, 2025

View reviewed changes

edit tlspk to tlskp (typo was made during test tenant creation)

b8dba8c

wallrj-cyberark self-requested a review September 3, 2025 09:59

Mladen Rusev added 3 commits September 3, 2025 13:06

adding tenant ID which is missing from API spec but present in response

e97b2e7

cleanup the success_json template; add missing ServiceSubdomains atri…

429790e

…bugte to json

change the API url

f532eb8

wallrj-cyberark approved these changes Sep 3, 2025

View reviewed changes

wallrj-cyberark merged commit cd6bb05 into master Sep 3, 2025
2 checks passed

wallrj-cyberark deleted the VC-43587 branch September 3, 2025 16:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate service/discovery API and implement the new one#706

Deprecate service/discovery API and implement the new one#706
wallrj-cyberark merged 7 commits intomasterfrom
VC-43587

mladen-rusev-cyberark commented Sep 3, 2025 •

edited

Loading

Uh oh!

mladen-rusev-cyberark Sep 3, 2025

Uh oh!

wallrj-cyberark Sep 3, 2025

Uh oh!

mladen-rusev-cyberark Sep 3, 2025

Uh oh!

wallrj-cyberark Sep 3, 2025

Uh oh!

wallrj-cyberark left a comment

Uh oh!

wallrj-cyberark Sep 3, 2025

Uh oh!

wallrj-cyberark Sep 3, 2025

Uh oh!

wallrj-cyberark Sep 3, 2025

Uh oh!

wallrj-cyberark commented Sep 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mladen-rusev-cyberark commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mladen-rusev-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

mladen-rusev-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark left a comment

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark commented Sep 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mladen-rusev-cyberark commented Sep 3, 2025 •

edited

Loading