Skip to content

Commit 528bc8d

Browse files
datadog-githubops-containers[bot]hush-hush
datadog-githubops-containers[bot]
and
hush-hush
authored
Add support for secret_refresh_interval (#1913) (#1921)
(cherry picked from commit 58ce3eb) Co-authored-by: maxime mouial <[email protected]>
1 parent d0647ea commit 528bc8d

File tree

10 files changed

+113
-4
lines changed

10 files changed

+113
-4
lines changed

‎api/datadoghq/v2alpha1/datadogagent_types.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1546,6 +1546,11 @@ type SecretBackendConfig struct {
15461546
// +optional
15471547
Timeout *int32 `json:"timeout,omitempty"`
15481548

1549+
// The refresh interval for secrets (0 disables refreshing).
1550+
// Default: `0`.
1551+
// +optional
1552+
RefreshInterval *int32 `json:"refreshInterval,omitempty"`
1553+
15491554
// Whether to create a global permission allowing Datadog agents to read all Kubernetes secrets.
15501555
// Default: `false`.
15511556
// +optional

‎api/datadoghq/v2alpha1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/datadoghq/v2alpha1/zz_generated.openapi.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/v1/datadoghq.com_datadogagents.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2791,6 +2791,12 @@ spec:
27912791
Whether to create a global permission allowing Datadog agents to read all Kubernetes secrets.
27922792
Default: `false`.
27932793
type: boolean
2794+
refreshInterval:
2795+
description: |-
2796+
The refresh interval for secrets (0 disables refreshing).
2797+
Default: `0`.
2798+
format: int32
2799+
type: integer
27942800
roles:
27952801
description: |-
27962802
Roles for Datadog to read the specified secrets, replacing `enableGlobalPermissions`.

‎config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2917,6 +2917,11 @@
29172917
"description": "Whether to create a global permission allowing Datadog agents to read all Kubernetes secrets.\nDefault: `false`.",
29182918
"type": "boolean"
29192919
},
2920+
"refreshInterval": {
2921+
"description": "The refresh interval for secrets (0 disables refreshing).\nDefault: `0`.",
2922+
"format": "int32",
2923+
"type": "integer"
2924+
},
29202925
"roles": {
29212926
"description": "Roles for Datadog to read the specified secrets, replacing `enableGlobalPermissions`.\nThey are defined as a list of namespace/secrets.\nEach defined namespace needs to be present in the DatadogAgent controller using `WATCH_NAMESPACE` or `DD_AGENT_WATCH_NAMESPACE`.\nSee also: https://github.com/DataDog/datadog-operator/blob/main/docs/secret_management.md#how-to-deploy-the-agent-components-using-the-secret-backend-feature-with-datadogagent.",
29222927
"items": {

‎docs/configuration.v2alpha1.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,7 @@ spec:
253253
| global.secretBackend.args | List of arguments to pass to the command (space-separated strings). |
254254
| global.secretBackend.command | The secret backend command to use. Datadog provides a pre-defined binary `/readsecret_multiple_providers.sh`. Read more about `/readsecret_multiple_providers.sh` at https://docs.datadoghq.com/agent/configuration/secrets-management/?tab=linux#script-for-reading-from-multiple-secret-providers. |
255255
| global.secretBackend.enableGlobalPermissions | Whether to create a global permission allowing Datadog agents to read all Kubernetes secrets. Default: `false`. |
256+
| global.secretBackend.refreshInterval | The refresh interval for secrets (0 disables refreshing). Default: `0`. |
256257
| global.secretBackend.roles | For Datadog to read the specified secrets, replacing `enableGlobalPermissions`. They are defined as a list of namespace/secrets. Each defined namespace needs to be present in the DatadogAgent controller using `WATCH_NAMESPACE` or `DD_AGENT_WATCH_NAMESPACE`. See also: https://github.com/DataDog/datadog-operator/blob/main/docs/secret_management.md#how-to-deploy-the-agent-components-using-the-secret-backend-feature-with-datadogagent. |
257258
| global.secretBackend.timeout | The command timeout in seconds. Default: `30`. |
258259
| global.site | Is the Datadog intake site Agent data are sent to. Set to 'datadoghq.com' to send data to the US1 site (default). Set to 'datadoghq.eu' to send data to the EU site. Set to 'us3.datadoghq.com' to send data to the US3 site. Set to 'us5.datadoghq.com' to send data to the US5 site. Set to 'ddog-gov.com' to send data to the US1-FED site. Set to 'ap1.datadoghq.com' to send data to the AP1 site. Default: 'datadoghq.com' |

‎internal/controller/datadogagent/global/envvar.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ const (
2626
DDSecretBackendCommand = "DD_SECRET_BACKEND_COMMAND"
2727
DDSecretBackendArguments = "DD_SECRET_BACKEND_ARGUMENTS"
2828
DDSecretBackendTimeout = "DD_SECRET_BACKEND_TIMEOUT"
29+
DDSecretRefreshInterval = "DD_SECRET_REFRESH_INTERVAL"
2930
DDTags = "DD_TAGS"
3031
DockerHost = "DOCKER_HOST"
3132
DDKubernetesResourcesLabelsAsTags = "DD_KUBERNETES_RESOURCES_LABELS_AS_TAGS"

‎internal/controller/datadogagent/global/global.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,14 @@ func applyGlobalSettings(logger logr.Logger, manager feature.PodTemplateManagers
234234
Value: strconv.FormatInt(int64(*config.SecretBackend.Timeout), 10),
235235
})
236236
}
237+
238+
// Set secret backend refresh interval
239+
if config.SecretBackend.RefreshInterval != nil && *config.SecretBackend.RefreshInterval > 0 {
240+
manager.EnvVar().AddEnvVar(&corev1.EnvVar{
241+
Name: DDSecretRefreshInterval,
242+
Value: strconv.FormatInt(int64(*config.SecretBackend.RefreshInterval), 10),
243+
})
244+
}
237245
}
238246

239247
// Update images with Global Registry and UseFIPSAgent configurations

‎internal/controller/datadogagent/global/global_test.go

Lines changed: 71 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ func TestNodeAgentComponenGlobalSettings(t *testing.T) {
367367
ddaName,
368368
ddaNamespace,
369369
testutils.NewDatadogAgentBuilder().
370-
WithGlobalSecretBackendGlobalPerms(secretBackendCommand, secretBackendArgs, secretBackendTimeout).
370+
WithGlobalSecretBackendGlobalPerms(secretBackendCommand, secretBackendArgs, secretBackendTimeout, 0).
371371
WithCredentials("apiKey", "appKey").
372372
BuildWithDefaults(),
373373
),
@@ -425,14 +425,83 @@ func TestNodeAgentComponenGlobalSettings(t *testing.T) {
425425
want: assertAll,
426426
wantDependency: assertSecretBackendGlobalPerms,
427427
},
428+
{
429+
name: "Secret backend - with refresh interval",
430+
singleContainerStrategyEnabled: false,
431+
dda: addNameNamespaceToDDA(
432+
ddaName,
433+
ddaNamespace,
434+
testutils.NewDatadogAgentBuilder().
435+
WithGlobalSecretBackendGlobalPerms(secretBackendCommand, secretBackendArgs, secretBackendTimeout, 3600).
436+
WithCredentials("apiKey", "appKey").
437+
BuildWithDefaults(),
438+
),
439+
wantCoreAgentEnvVars: nil,
440+
wantEnvVars: getExpectedEnvVars([]*corev1.EnvVar{
441+
{
442+
Name: DDSecretBackendCommand,
443+
Value: secretBackendCommand,
444+
},
445+
{
446+
Name: DDSecretBackendArguments,
447+
Value: secretBackendArgs,
448+
},
449+
{
450+
Name: DDSecretBackendTimeout,
451+
Value: "60",
452+
},
453+
{
454+
Name: DDSecretRefreshInterval,
455+
Value: "3600",
456+
},
457+
{
458+
Name: constants.DDAPIKey,
459+
ValueFrom: &corev1.EnvVarSource{
460+
SecretKeyRef: &corev1.SecretKeySelector{
461+
LocalObjectReference: corev1.LocalObjectReference{
462+
Name: "datadog-secret",
463+
},
464+
Key: v2alpha1.DefaultAPIKeyKey,
465+
},
466+
},
467+
},
468+
{
469+
Name: constants.DDAppKey,
470+
ValueFrom: &corev1.EnvVarSource{
471+
SecretKeyRef: &corev1.SecretKeySelector{
472+
LocalObjectReference: corev1.LocalObjectReference{
473+
Name: "datadog-secret",
474+
},
475+
Key: v2alpha1.DefaultAPPKeyKey,
476+
},
477+
},
478+
},
479+
{
480+
Name: DDClusterAgentAuthToken,
481+
ValueFrom: &corev1.EnvVarSource{
482+
SecretKeyRef: &corev1.SecretKeySelector{
483+
LocalObjectReference: corev1.LocalObjectReference{
484+
Name: "datadog-token",
485+
},
486+
Key: common.DefaultTokenKey,
487+
},
488+
},
489+
},
490+
}...),
491+
wantCoreAgentVolumeMounts: getExpectedVolumeMounts(),
492+
wantVolumeMounts: getExpectedVolumeMounts(),
493+
wantVolumes: getExpectedVolumes(),
494+
want: assertAll,
495+
wantDependency: assertSecretBackendGlobalPerms,
496+
},
428497
{
429498
name: "Secret backend - specific secret permissions",
430499
singleContainerStrategyEnabled: false,
431500
dda: addNameNamespaceToDDA(
432501
ddaName,
433502
ddaNamespace,
434503
testutils.NewDatadogAgentBuilder().
435-
WithGlobalSecretBackendSpecificRoles(secretBackendCommand, secretBackendArgs, secretBackendTimeout, secretNamespace, secretNames).
504+
WithGlobalSecretBackendSpecificRoles(secretBackendCommand, secretBackendArgs, secretBackendTimeout, 0, secretNamespace, secretNames).
436505
WithCredentials("apiKey", "appKey").
437506
BuildWithDefaults(),
438507
),

‎pkg/testutils/builder.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -970,21 +970,23 @@ func (builder *DatadogAgentBuilder) WithChecksTagCardinality(cardinality string)
970970

971971
// Global SecretBackend
972972

973-
func (builder *DatadogAgentBuilder) WithGlobalSecretBackendGlobalPerms(command string, args string, timeout int32) *DatadogAgentBuilder {
973+
func (builder *DatadogAgentBuilder) WithGlobalSecretBackendGlobalPerms(command string, args string, timeout int32, refreshInterval int32) *DatadogAgentBuilder {
974974
builder.datadogAgent.Spec.Global.SecretBackend = &v2alpha1.SecretBackendConfig{
975975
Command: apiutils.NewStringPointer(command),
976976
Args: apiutils.NewStringPointer(args),
977977
Timeout: apiutils.NewInt32Pointer(timeout),
978+
RefreshInterval: apiutils.NewInt32Pointer(refreshInterval),
978979
EnableGlobalPermissions: apiutils.NewBoolPointer(true),
979980
}
980981
return builder
981982
}
982983

983-
func (builder *DatadogAgentBuilder) WithGlobalSecretBackendSpecificRoles(command string, args string, timeout int32, secretNs string, secretNames []string) *DatadogAgentBuilder {
984+
func (builder *DatadogAgentBuilder) WithGlobalSecretBackendSpecificRoles(command string, args string, timeout int32, refreshInterval int32, secretNs string, secretNames []string) *DatadogAgentBuilder {
984985
builder.datadogAgent.Spec.Global.SecretBackend = &v2alpha1.SecretBackendConfig{
985986
Command: apiutils.NewStringPointer(command),
986987
Args: apiutils.NewStringPointer(args),
987988
Timeout: apiutils.NewInt32Pointer(timeout),
989+
RefreshInterval: apiutils.NewInt32Pointer(refreshInterval),
988990
EnableGlobalPermissions: apiutils.NewBoolPointer(false),
989991
Roles: []*v2alpha1.SecretBackendRolesConfig{
990992
{

0 commit comments

Comments
 (0)