Added a spec for new cloud_defend integration input (elastic#1764)

* Added a spec for new cloud_defend beat.

* Added a spec for new cloud_defend beat.

* added changelog

* readded default env vars to spec

* removed default beat env vars

* Update internal/pkg/agent/application/monitoring/v1_monitor.go

Co-authored-by: Craig MacKenzie <craig.mackenzie@elastic.co>

Co-authored-by: Karl Godard <karlgodard@elastic.co>
Co-authored-by: Craig MacKenzie <craig.mackenzie@elastic.co>

changelog/fragments/1669049916-CHANGELOG.asciidoc.yaml

@@ -0,0 +1,31 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: feature
+
+# Change summary; a 80ish characters long description of the change.
+summary: Adds support for a new executable used to prevent container drift.
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+#description:
+
+# Affected component; a word indicating the component this changeset affects.
+component: cloud-defend
+
+# PR number; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: 1764
+
+# Issue number; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: 1234

internal/pkg/agent/application/monitoring/v1_monitor.go

@@ -54,7 +54,7 @@ const (
 )
 
 var (
-	supportedComponents      = []string{"filebeat", "metricbeat", "apm-server", "auditbeat", "cloudbeat", "endpoint-security", "fleet-server", "heartbeat", "osquerybeat", "packetbeat"}
+	supportedComponents      = []string{"filebeat", "metricbeat", "apm-server", "auditbeat", "cloudbeat", "cloud-defend", "endpoint-security", "fleet-server", "heartbeat", "osquerybeat", "packetbeat"}
 	supportedBeatsComponents = []string{"filebeat", "metricbeat", "apm-server", "fleet-server", "auditbeat", "cloudbeat", "heartbeat", "osquerybeat", "packetbeat"}
 )
 

pkg/component/load_test.go

@@ -59,6 +59,10 @@ func TestLoadSpec_Components(t *testing.T) {
 			Name: "Cloudbeat",
 			Path: "cloudbeat.spec.yml",
 		},
+		{
+			Name: "Cloud Defend",
+			Path: "cloud-defend.spec.yml",
+		},
 		{
 			Name: "Endpoint Security",
 			Path: "endpoint-security.spec.yml",

specs/cloud-defend.spec.yml

@@ -0,0 +1,14 @@
+version: 2
+inputs:
+  - name: cloud_defend
+    description: "Cloud defend for containers"
+    platforms: &platforms
+      - container/amd64
+      - container/arm64
+    outputs: &outputs
+      - elasticsearch
+    command:
+      args: &args
+        - "run"
+        - "--fleet-managed"
+        - "--process-managed"