Commit 8dd52d6
authored
[CONTINT-5064] Apply the scrubber to pod list in flares (#45064)
### What does this PR do?
Applies the orchestrator scrubber to pod lists in agent flares to prevent secret environment variables from being exposed. As a result, some additional changes were made:
- The scrubber should not act on env vars that aren't using the `value` field. That indicates the field is populated used `valueFrom`, and should not be scrubbed.
- Added a list of known "safe" DD_ env vars to not scrub. This is so that flares do not redact helpful, non-sensitive information. The scrubber only looks for exact matches, to err on the side of caution.
- Moved the `redact` package from `pkg/orchestrator/redact` to `pkg/redact` to reflect that the orchestrator check is no longer the only part of the agent using it (though, I could be convinced otherwise)
- Gated `archive_k8s.go` behind the `orchestrator` build tag. This is strictly because of artifact size/import problems that are introduced because of the need to decode the kubelet response.
### Motivation
Addresses [CONTINT-5064](https://datadoghq.atlassian.net/browse/CONTINT-5064) and [CONS-7961](https://datadoghq.atlassian.net/browse/CONS-7961). Essentially scrubber currently being used on flares is not sufficient to properly scrub environment variables, so we want to also reuse the specialized [pod scrubber](https://github.com/DataDog/datadog-agent/blob/fd53b327b45e068e802401f3f03134c15d271360/pkg/orchestrator/redact/pod.go#L43).
### Describe how you validated your changes
Deployed v7.74.1 of the agent to a local kind cluster configured to add the env-var `AWS_SECRET_ACCESS_KEY= randomsecretsgohere` to each agent container. Generating a flare using `agent flare` and examined the output of `k8s/kubelet_pods.yaml`:
```yaml
...
containers:
- command:
- agent
- run
env:
- name: DD_API_KEY
valueFrom:
secretKeyRef:
key: api-key
name: datadog-agent
- name: DD_REMOTE_CONFIGURATION_ENABLED
value: "true"
- name: DD_AUTH_TOKEN_FILE_PATH
value: /etc/datadog-agent/auth/token
- name: AWS_SECRET_ACCESS_KEY
value: randomsecretsgohere
...
```
versus an agent built off of this branch:
```yaml
...
containers:
- command:
- agent
- run
env:
- name: DD_API_KEY
valueFrom:
secretKeyRef:
key: api-key
name: datadog-agent
- name: DD_REMOTE_CONFIGURATION_ENABLED
value: "true"
- name: DD_AUTH_TOKEN_FILE_PATH
value: /etc/datadog-agent/auth/token
- name: AWS_SECRET_ACCESS_KEY
value: '********'
...
```
### Additional Notes
[CONTINT-5064]: https://datadoghq.atlassian.net/browse/CONTINT-5064?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
[CONS-7961]: https://datadoghq.atlassian.net/browse/CONS-7961?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
Co-authored-by: jon.rosario <jon.rosario@datadoghq.com>1 parent 492a8d6 commit 8dd52d6
File tree
40 files changed
+145
-34
lines changed- .github
- pkg
- collector/corechecks/cluster/orchestrator/processors/k8s
- flare
- orchestrator/config
- redact
- releasenotes/notes
40 files changed
+145
-34
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
543 | 543 | | |
544 | 544 | | |
545 | 545 | | |
| 546 | + | |
546 | 547 | | |
547 | 548 | | |
548 | 549 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
12 | 13 | | |
13 | 14 | | |
14 | 15 | | |
15 | 16 | | |
16 | | - | |
| 17 | + | |
17 | 18 | | |
18 | 19 | | |
19 | 20 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
12 | 13 | | |
13 | 14 | | |
14 | 15 | | |
15 | 16 | | |
16 | 17 | | |
17 | | - | |
| 18 | + | |
18 | 19 | | |
19 | 20 | | |
20 | 21 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
13 | 13 | | |
14 | 14 | | |
15 | 15 | | |
| 16 | + | |
16 | 17 | | |
17 | 18 | | |
18 | | - | |
| 19 | + | |
19 | 20 | | |
20 | 21 | | |
21 | 22 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
| 15 | + | |
15 | 16 | | |
16 | 17 | | |
17 | | - | |
| 18 | + | |
18 | 19 | | |
19 | 20 | | |
20 | 21 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
12 | 13 | | |
13 | 14 | | |
14 | 15 | | |
15 | 16 | | |
16 | | - | |
| 17 | + | |
17 | 18 | | |
18 | 19 | | |
19 | 20 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
12 | 13 | | |
13 | 14 | | |
14 | 15 | | |
15 | 16 | | |
16 | 17 | | |
17 | | - | |
| 18 | + | |
18 | 19 | | |
19 | 20 | | |
20 | 21 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
12 | 13 | | |
13 | 14 | | |
14 | 15 | | |
15 | 16 | | |
16 | 17 | | |
17 | | - | |
| 18 | + | |
18 | 19 | | |
19 | 20 | | |
20 | 21 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| 12 | + | |
12 | 13 | | |
13 | 14 | | |
14 | 15 | | |
15 | 16 | | |
16 | 17 | | |
17 | | - | |
| 18 | + | |
18 | 19 | | |
19 | 20 | | |
20 | 21 | | |
| |||
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
| 15 | + | |
15 | 16 | | |
16 | 17 | | |
17 | 18 | | |
18 | 19 | | |
19 | | - | |
| 20 | + | |
20 | 21 | | |
21 | 22 | | |
22 | 23 | | |
| |||
0 commit comments