Skip to content

Commit b984b9b

Browse files
levan-mlevan-m
committed
Agent sidecar injection support via Admission Controller
1 parent 35d86a8 commit b984b9b

15 files changed

+344
-19
lines changed

‎.github/workflows/go-test.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@ name: Go Test
22
on:
33
push:
44
paths:
5-
- 'test/**'
5+
- 'test/datadog-operator/**'
66
- 'charts/datadog-operator/**'
77
pull_request:
88
paths:
9-
- 'test/**'
9+
- 'test/datadog-operator/**'
1010
- 'charts/datadog-operator/**'
1111
env:
1212
GO111MODULE: "on"

‎charts/datadog/templates/NOTES.txt

+11
Original file line numberDiff line numberDiff line change
@@ -538,3 +538,14 @@ You are using the datadog.securityAgent.compliance.xccdf.enabled parameter which
538538
This version still supports both but the support of the old name will be dropped in the next major version of our Helm chart.
539539
More information about this change: https://github.com/DataDog/helm-charts/pull/1161
540540
{{- end }}
541+
542+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.enabled }}
543+
{{- if (semverCompare "<7.52.0" .Values.clusterAgent.image.tag) }}
544+
##############################################################################
545+
#### WARNING: Sidecar injection not supported. ####
546+
##############################################################################
547+
548+
The clusterAgent.admissionController.agentSidecarInjection.enabled is only supported
549+
by Cluster Agent 7.52.0 or later. Enabling this flag will not have any effect.
550+
{{- end }}
551+
{{- end }}

‎charts/datadog/templates/_ac-agent-sidecar-env.yaml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{{- define "ac-agent-sidecar-env" -}}
2+
{{- if and .Values.clusterAgent.admissionController.enabled .Values.clusterAgent.admissionController.agentSidecarInjection.enabled }}
3+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_ENABLED
4+
value: "true"
5+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.provider }}
6+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROVIDER
7+
value: {{ .Values.clusterAgent.admissionController.agentSidecarInjection.provider }}
8+
{{- end }}
9+
10+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.containerRegistry }}
11+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_CONTAINER_REGISTRY
12+
value: {{ .Values.clusterAgent.admissionController.agentSidecarInjection.containerRegistry }}
13+
{{- else if .Values.registry }}
14+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_CONTAINER_REGISTRY
15+
value: {{ .Values.registry }}
16+
{{- end }}
17+
18+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.imageName }}
19+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_NAME
20+
value: {{ .Values.clusterAgent.admissionController.agentSidecarInjection.imageName }}
21+
{{- else if .Values.agents.image.name}}
22+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_NAME
23+
value: {{ .Values.agents.image.name }}
24+
{{- end }}
25+
26+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.imageTag }}
27+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_TAG
28+
value: {{ .Values.clusterAgent.admissionController.agentSidecarInjection.imageTag }}
29+
{{- else if .Values.agents.image.tag}}
30+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_TAG
31+
value: {{ .Values.agents.image.tag }}
32+
{{- end }}
33+
34+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.selectors }}
35+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_SELECTORS
36+
value: '{{ toJson .Values.clusterAgent.admissionController.agentSidecarInjection.selectors }}'
37+
{{- end }}
38+
{{- if .Values.clusterAgent.admissionController.agentSidecarInjection.profiles }}
39+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROFILES
40+
value: '{{ toJson .Values.clusterAgent.admissionController.agentSidecarInjection.profiles }}'
41+
{{- end }}
42+
{{- end }}
43+
{{- end }}

‎charts/datadog/templates/cluster-agent-deployment.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,7 @@ spec:
235235
- name: DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_PATCHER_ENABLED
236236
value: "true"
237237
{{- end }}
238+
{{ include "ac-agent-sidecar-env" . | nindent 10 }}
238239
- name: DD_REMOTE_CONFIGURATION_ENABLED
239240
value: {{ include "clusterAgent-remoteConfiguration-enabled" . | quote }}
240241
{{- if .Values.datadog.apm.instrumentation.enabled }}

‎charts/datadog/values.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -1061,6 +1061,56 @@ clusterAgent:
10611061
# clusterAgent.admissionController.port -- Set port of cluster-agent admission controller service
10621062
port: 8000
10631063

1064+
agentSidecarInjection:
1065+
# clusterAgent.admissionController.agentSidecarInjection.enabled -- Enables Datadog Agent sidecar injection.
1066+
1067+
## When enabled, Admission Controller mutating webhook will inject Agent sidecar with minimal configuration in every pods meeting configured criteria.
1068+
## ref: https://docs.datadoghq.com/integrations/eks_fargate
1069+
enabled: false
1070+
1071+
# clusterAgent.admissionController.agentSidecarInjection.provider -- Used by Admission Controller to add infrastructure provider specific configurations to the Agent sidecar.
1072+
1073+
## Currently only "fargate" is supported. To use the feature in other environments (including local testing) omit the config.
1074+
provider: # "fargate" or ""
1075+
1076+
# clusterAgent.admissionController.agentSidecarInjection.clusterAgentEnabled -- Enable communication between Agent sidecars and Cluster Agent.
1077+
clusterAgentEnabled: true
1078+
1079+
# clusterAgent.admissionController.containerRegistry -- Override default registry for sidecar Agent.
1080+
containerRegistry:
1081+
1082+
# clusterAgent.admissionController.imageName -- Override default agents.image.name for Agent sidecar.
1083+
imageName:
1084+
1085+
# clusterAgent.admissionController.imageTag -- Override default agents.image.tag for Agent sidecar.
1086+
imageTag:
1087+
1088+
# clusterAgent.admissionController.agentSidecarInjection.selectors -- Defines pod selector for sidecar injection, only one rule is supported.
1089+
selectors: []
1090+
# - objectSelector:
1091+
# matchLabels:
1092+
# "podlabelKey1": podlabelValue1
1093+
# "podlabelKey2": podlabelValue2
1094+
# namespaceSelector:
1095+
# matchLabels:
1096+
# "nsLabelKey1": nsLabelValue1
1097+
# "nsLabelKey2": nsLabelValue2
1098+
1099+
# clusterAgent.admissionController.agentSidecarInjection.profiles -- Defines sidecar configuration override, only one profile is supported.
1100+
1101+
## This setting allows to override sidecar Agent configuration by adding environment variables and providing resource settings.
1102+
profiles: []
1103+
# - env:
1104+
# - name: DD_ORCHESTRATOR_EXPLORER_ENABLED
1105+
# value: "true"
1106+
# resources:
1107+
# requests:
1108+
# cpu: "1"
1109+
# memory: "512Mi"
1110+
# limits:
1111+
# cpu: "2"
1112+
# memory: "1024Mi"
1113+
10641114
# clusterAgent.confd -- Provide additional cluster check configurations. Each key will become a file in /conf.d.
10651115

10661116
## ref: https://docs.datadoghq.com/agent/autodiscovery/

‎test/datadog/baseline/agent-clusterchecks-deployment_default.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ spec:
3636

3737
name: datadog-clusterchecks
3838
annotations:
39-
checksum/clusteragent_token: 2a2bc6b89e48b04b4499adc7d022f736a18ee78f96da00520796532402bd8550
39+
checksum/clusteragent_token: a27982154deaa89254d681a77c2259d7e679a6d30a8e42c2cc382ab12362901f
4040
checksum/install_info: ba661cfd1e600203476c7247bad81157e5bc70aaa7f91e6cdd6be6a469cd0093
4141
spec:
4242
serviceAccountName: datadog-cluster-checks

‎test/datadog/baseline/cluster-agent-deployment_default.yaml

+3-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ spec:
3636

3737
name: datadog-cluster-agent
3838
annotations:
39-
checksum/clusteragent_token: 64345c6150cd562acd79e6965148d36a188d36b4c5656963c7beb3b62ff5bf7d
39+
checksum/clusteragent_token: 5e73a77242cd46ce2e8572b9d427708ef62cda418c62a4441c872f43c0cfc8d7
4040
checksum/clusteragent-configmap: 7f009f417a71add9ae521f09f0eaf63c29efd5cdd701f5d92714fc3ac1800b6f
4141
checksum/api_key: dbe0d3b411cc72447e81235afeed9e2102588d5088fcbb696a2db9e4e31af712
4242
checksum/application_key: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
@@ -105,6 +105,8 @@ spec:
105105
value: "Ignore"
106106
- name: DD_ADMISSION_CONTROLLER_PORT
107107
value: "8000"
108+
109+
108110
- name: DD_REMOTE_CONFIGURATION_ENABLED
109111
value: "false"
110112
- name: DD_CLUSTER_CHECKS_ENABLED

‎test/datadog/baseline/cluster-agent-deployment_default_advanced_AC_injection.yaml

+14-2
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ spec:
3636

3737
name: datadog-cluster-agent
3838
annotations:
39-
checksum/clusteragent_token: bf8ff7d8f04853084ee401bfe3e4d5e83c6764f82c63c32bbb749a66681cb397
39+
checksum/clusteragent_token: ecd48e62f885ce8d94f5a2c8891c6c0e7cb740834f73e72bf03ac9a1ba518412
4040
checksum/clusteragent-configmap: 7f009f417a71add9ae521f09f0eaf63c29efd5cdd701f5d92714fc3ac1800b6f
4141
checksum/api_key: dbe0d3b411cc72447e81235afeed9e2102588d5088fcbb696a2db9e4e31af712
4242
checksum/application_key: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
@@ -106,7 +106,19 @@ spec:
106106
- name: DD_ADMISSION_CONTROLLER_PORT
107107
value: "8000"
108108

109-
# TODO cluster agent version check
109+
110+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_ENABLED
111+
value: "true"
112+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_CONTAINER_REGISTRY
113+
value: gcr.io/datadoghq
114+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_NAME
115+
value: agent
116+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_TAG
117+
value: 7.53.0
118+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_SELECTORS
119+
value: '[{"namespaceSelector":{"matchLabels":{"agentSidecars":"true"}},"objectSelector":{"matchLabels":{"app":"nginx","runsOn":"nodeless"}}}]'
120+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROFILES
121+
value: '[{"env":[{"name":"DD_ORCHESTRATOR_EXPLORER_ENABLED","value":"false"}],"resources":{"limits":{"cpu":"2","memory":"1024Mi"},"requests":{"cpu":"1","memory":"512Mi"}}}]'
110122
- name: DD_REMOTE_CONFIGURATION_ENABLED
111123
value: "false"
112124
- name: DD_CLUSTER_CHECKS_ENABLED

‎test/datadog/baseline/cluster-agent-deployment_default_minimal_AC_injection.yaml

+10-2
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ spec:
3636

3737
name: datadog-cluster-agent
3838
annotations:
39-
checksum/clusteragent_token: be494ddb6dfc1e236fd2df24cd29923903e1dc4d171f4d74795e26e5fc8b6aa9
39+
checksum/clusteragent_token: e3d005d6dff3e012e59ebf6787cabc97a0ce7a826fb88a985fa9e3ee1c4b897f
4040
checksum/clusteragent-configmap: 7f009f417a71add9ae521f09f0eaf63c29efd5cdd701f5d92714fc3ac1800b6f
4141
checksum/api_key: dbe0d3b411cc72447e81235afeed9e2102588d5088fcbb696a2db9e4e31af712
4242
checksum/application_key: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
@@ -106,7 +106,15 @@ spec:
106106
- name: DD_ADMISSION_CONTROLLER_PORT
107107
value: "8000"
108108

109-
# TODO cluster agent version check
109+
110+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_ENABLED
111+
value: "true"
112+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROVIDER
113+
value: fargate
114+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_NAME
115+
value: agent
116+
- name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_TAG
117+
value: 7.51.0
110118
- name: DD_REMOTE_CONFIGURATION_ENABLED
111119
value: "false"
112120
- name: DD_CLUSTER_CHECKS_ENABLED

‎test/datadog/baseline/daemonset_default.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ spec:
3030

3131
name: datadog
3232
annotations:
33-
checksum/clusteragent_token: 3b6811ea07d2b99a0f0fdba3311c16fe34515f24ea3bbc3395ed7600d8a541bc
33+
checksum/clusteragent_token: a2247471c9f45da90af6ffbca68d5253753fe8fd99568d95d00bb32c0053dd5d
3434
checksum/install_info: ba661cfd1e600203476c7247bad81157e5bc70aaa7f91e6cdd6be6a469cd0093
3535
checksum/autoconf-config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
3636
checksum/confd-config: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

‎test/datadog/baseline/other_default.yaml

+8-6
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ metadata:
9999
app.kubernetes.io/version: "7"
100100
type: Opaque
101101
data:
102-
token: "QzdpVlQxRTRoU2lSNlFteEZqWjl6RFFJRFV4bzlzRU4="
102+
token: "VDV4MWZTb1FvWDREcm5hMlBYaklXT0IxQmRlcm1QQUk="
103103
---
104104
# Source: datadog/templates/cluster-agent-confd-configmap.yaml
105105
apiVersion: v1
@@ -185,9 +185,9 @@ metadata:
185185
app.kubernetes.io/managed-by: Helm
186186
app.kubernetes.io/version: "7"
187187
data:
188-
install_id: "e2a0fac0-1cd5-44d6-bb6c-8878699e1dd4"
188+
install_id: "a55b4d56-a363-4f59-95e1-a39d8eb06cac"
189189
install_type: k8s_manual
190-
install_time: "1709149978"
190+
install_time: "1710523214"
191191
---
192192
# Source: datadog/templates/cluster-agent-rbac.yaml
193193
apiVersion: "rbac.authorization.k8s.io/v1"
@@ -808,7 +808,7 @@ spec:
808808

809809
name: datadog
810810
annotations:
811-
checksum/clusteragent_token: c9184bcaa371fdfaa1d86bc729cc022ee91730c48a87174a10787cdfe8dc5acc
811+
checksum/clusteragent_token: 239e62f7908327b7110d0e12f11a758f7cd65339d87c7cde816ca9f4daaed148
812812
checksum/install_info: ba661cfd1e600203476c7247bad81157e5bc70aaa7f91e6cdd6be6a469cd0093
813813
checksum/autoconf-config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
814814
checksum/confd-config: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
@@ -1290,7 +1290,7 @@ spec:
12901290

12911291
name: datadog-clusterchecks
12921292
annotations:
1293-
checksum/clusteragent_token: de6adc9c0cc883525e7c5915e72c98fe170c0606a36d7a01481988b622d1bcad
1293+
checksum/clusteragent_token: 5680d8ac272dacf1ebf5825280bf07461e17b04341ece6697f156307f5804518
12941294
checksum/install_info: ba661cfd1e600203476c7247bad81157e5bc70aaa7f91e6cdd6be6a469cd0093
12951295
spec:
12961296
serviceAccountName: datadog-cluster-checks
@@ -1471,7 +1471,7 @@ spec:
14711471

14721472
name: datadog-cluster-agent
14731473
annotations:
1474-
checksum/clusteragent_token: 54246db63a3d62937e36712985dc2c26e092adae8cf7460e8bee17e21abdc65c
1474+
checksum/clusteragent_token: bad4e1460b330b929541d47c97ff618001505c56ac50e29459be18fa85053376
14751475
checksum/clusteragent-configmap: 358d304b0a5c7d72ee884b4973628f54e132dd0725ac3d1a119391f8b18f7105
14761476
checksum/install_info: ba661cfd1e600203476c7247bad81157e5bc70aaa7f91e6cdd6be6a469cd0093
14771477
spec:
@@ -1538,6 +1538,8 @@ spec:
15381538
value: "Ignore"
15391539
- name: DD_ADMISSION_CONTROLLER_PORT
15401540
value: "8000"
1541+
1542+
15411543
- name: DD_REMOTE_CONFIGURATION_ENABLED
15421544
value: "false"
15431545
- name: DD_CLUSTER_CHECKS_ENABLED

‎test/datadog/baseline_test.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,9 @@ func Test_baseline_manifests(t *testing.T) {
5656
ReleaseName: "datadog",
5757
ChartPath: "../../charts/datadog",
5858
ShowOnly: []string{"templates/cluster-agent-deployment.yaml"},
59-
Values: []string{"../../charts/datadog/values.yaml" /*,"./manifests/dca_AC_sidecar_fargateMinimal.yaml"*/},
60-
Overrides: map[string]string{},
59+
Values: []string{"../../charts/datadog/values.yaml",
60+
"./manifests/dca_AC_sidecar_fargateMinimal.yaml"},
61+
Overrides: map[string]string{},
6162
},
6263
baselineManifestPath: "./baseline/cluster-agent-deployment_default_minimal_AC_injection.yaml",
6364
assertions: verifyDeployment,
@@ -68,8 +69,9 @@ func Test_baseline_manifests(t *testing.T) {
6869
ReleaseName: "datadog",
6970
ChartPath: "../../charts/datadog",
7071
ShowOnly: []string{"templates/cluster-agent-deployment.yaml"},
71-
Values: []string{"../../charts/datadog/values.yaml" /*,"./manifests/dca_AC_sidecar_advanced.yaml"*/},
72-
Overrides: map[string]string{},
72+
Values: []string{"../../charts/datadog/values.yaml",
73+
"./manifests/dca_AC_sidecar_advanced.yaml"},
74+
Overrides: map[string]string{},
7375
},
7476
baselineManifestPath: "./baseline/cluster-agent-deployment_default_advanced_AC_injection.yaml",
7577
assertions: verifyDeployment,

0 commit comments

Comments
 (0)