Skip to content

Commit 8dd52d6

Browse files
authored
[CONTINT-5064] Apply the scrubber to pod list in flares (#45064)
### What does this PR do? Applies the orchestrator scrubber to pod lists in agent flares to prevent secret environment variables from being exposed. As a result, some additional changes were made: - The scrubber should not act on env vars that aren't using the `value` field. That indicates the field is populated used `valueFrom`, and should not be scrubbed. - Added a list of known "safe" DD_ env vars to not scrub. This is so that flares do not redact helpful, non-sensitive information. The scrubber only looks for exact matches, to err on the side of caution. - Moved the `redact` package from `pkg/orchestrator/redact` to `pkg/redact` to reflect that the orchestrator check is no longer the only part of the agent using it (though, I could be convinced otherwise) - Gated `archive_k8s.go` behind the `orchestrator` build tag. This is strictly because of artifact size/import problems that are introduced because of the need to decode the kubelet response. ### Motivation Addresses [CONTINT-5064](https://datadoghq.atlassian.net/browse/CONTINT-5064) and [CONS-7961](https://datadoghq.atlassian.net/browse/CONS-7961). Essentially scrubber currently being used on flares is not sufficient to properly scrub environment variables, so we want to also reuse the specialized [pod scrubber](https://github.com/DataDog/datadog-agent/blob/fd53b327b45e068e802401f3f03134c15d271360/pkg/orchestrator/redact/pod.go#L43). ### Describe how you validated your changes Deployed v7.74.1 of the agent to a local kind cluster configured to add the env-var `AWS_SECRET_ACCESS_KEY= randomsecretsgohere` to each agent container. Generating a flare using `agent flare` and examined the output of `k8s/kubelet_pods.yaml`: ```yaml ... containers: - command: - agent - run env: - name: DD_API_KEY valueFrom: secretKeyRef: key: api-key name: datadog-agent - name: DD_REMOTE_CONFIGURATION_ENABLED value: "true" - name: DD_AUTH_TOKEN_FILE_PATH value: /etc/datadog-agent/auth/token - name: AWS_SECRET_ACCESS_KEY value: randomsecretsgohere ... ``` versus an agent built off of this branch: ```yaml ... containers: - command: - agent - run env: - name: DD_API_KEY valueFrom: secretKeyRef: key: api-key name: datadog-agent - name: DD_REMOTE_CONFIGURATION_ENABLED value: "true" - name: DD_AUTH_TOKEN_FILE_PATH value: /etc/datadog-agent/auth/token - name: AWS_SECRET_ACCESS_KEY value: '********' ... ``` ### Additional Notes [CONTINT-5064]: https://datadoghq.atlassian.net/browse/CONTINT-5064?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [CONS-7961]: https://datadoghq.atlassian.net/browse/CONS-7961?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: jon.rosario <jon.rosario@datadoghq.com>
1 parent 492a8d6 commit 8dd52d6

40 files changed

+145
-34
lines changed

.github/CODEOWNERS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -543,6 +543,7 @@
543543
/pkg/proto/datadog/workloadmeta @DataDog/container-platform
544544
/pkg/remoteconfig/ @DataDog/remote-config
545545
/pkg/runtime/ @DataDog/agent-runtimes
546+
/pkg/redact/ @DataDog/kubernetes-experiences
546547
/pkg/system-probe/ @DataDog/ebpf-platform
547548
/pkg/system-probe/api/client/client_windows.go @DataDog/windows-products
548549
/pkg/system-probe/api/server/listener_windows.go @DataDog/windows-products

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/clusterrole.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,12 @@ package k8s
99

1010
import (
1111
model "github.com/DataDog/agent-payload/v5/process"
12+
1213
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1314
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1415
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
16-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
17+
"github.com/DataDog/datadog-agent/pkg/redact"
1718

1819
rbacv1 "k8s.io/api/rbac/v1"
1920
"k8s.io/apimachinery/pkg/types"

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/clusterrolebinding.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@ package k8s
99

1010
import (
1111
model "github.com/DataDog/agent-payload/v5/process"
12+
1213
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1314
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
1415

1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1617
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
17-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
18+
"github.com/DataDog/datadog-agent/pkg/redact"
1819

1920
rbacv1 "k8s.io/api/rbac/v1"
2021
"k8s.io/apimachinery/pkg/types"

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/cr.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,10 @@ import (
1313
"k8s.io/apimachinery/pkg/types"
1414

1515
model "github.com/DataDog/agent-payload/v5/process"
16+
1617
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1718
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
18-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
19+
"github.com/DataDog/datadog-agent/pkg/redact"
1920
)
2021

2122
// CRHandlers implements the Handlers interface for Kubernetes CronJobs.

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/crd.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,10 @@ import (
1212
"k8s.io/apimachinery/pkg/runtime"
1313

1414
model "github.com/DataDog/agent-payload/v5/process"
15+
1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1617
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
17-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
18+
"github.com/DataDog/datadog-agent/pkg/redact"
1819

1920
"k8s.io/apimachinery/pkg/types"
2021
)

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/cronjob_v1.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,12 @@ package k8s
99

1010
import (
1111
model "github.com/DataDog/agent-payload/v5/process"
12+
1213
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1314
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1415
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
16-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
17+
"github.com/DataDog/datadog-agent/pkg/redact"
1718

1819
batchv1 "k8s.io/api/batch/v1"
1920
"k8s.io/apimachinery/pkg/types"

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/cronjob_v1beta1.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@ package k8s
99

1010
import (
1111
model "github.com/DataDog/agent-payload/v5/process"
12+
1213
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1314
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
1415

1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1617
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
17-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
18+
"github.com/DataDog/datadog-agent/pkg/redact"
1819

1920
batchv1beta1 "k8s.io/api/batch/v1beta1"
2021
"k8s.io/apimachinery/pkg/types"

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/daemonset.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@ package k8s
99

1010
import (
1111
model "github.com/DataDog/agent-payload/v5/process"
12+
1213
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1314
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
1415

1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1617
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
17-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
18+
"github.com/DataDog/datadog-agent/pkg/redact"
1819

1920
appsv1 "k8s.io/api/apps/v1"
2021
"k8s.io/apimachinery/pkg/types"

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/deployment.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@ package k8s
99

1010
import (
1111
model "github.com/DataDog/agent-payload/v5/process"
12+
1213
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1314
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
1415

1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1617
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
17-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
18+
"github.com/DataDog/datadog-agent/pkg/redact"
1819

1920
appsv1 "k8s.io/api/apps/v1"
2021
"k8s.io/apimachinery/pkg/types"

pkg/collector/corechecks/cluster/orchestrator/processors/k8s/horizontalpodautoscaler.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,12 @@ import (
1212
"k8s.io/apimachinery/pkg/types"
1313

1414
model "github.com/DataDog/agent-payload/v5/process"
15+
1516
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors"
1617
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/processors/common"
1718
k8sTransformers "github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/transformers/k8s"
1819
"github.com/DataDog/datadog-agent/pkg/collector/corechecks/cluster/orchestrator/util"
19-
"github.com/DataDog/datadog-agent/pkg/orchestrator/redact"
20+
"github.com/DataDog/datadog-agent/pkg/redact"
2021
)
2122

2223
// HorizontalPodAutoscalerHandlers implements the Handlers interface for Kuberenetes HPAs

0 commit comments

Comments
 (0)