Skip to content

Commit d17d3f8

Browse files
francesco-furlanfrancesco-furlan
authored
feat(agent): mount agent http-proxy credentials as secret (#1517)
1 parent 346cf20 commit d17d3f8

File tree

10 files changed

+173
-4
lines changed

10 files changed

+173
-4
lines changed

‎charts/agent/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ sources:
3030
- https://app.sysdigcloud.com/#/settings/user
3131
- https://github.com/draios/sysdig
3232
type: application
33-
version: 1.17.3
33+
version: 1.18.0

‎charts/agent/templates/_helpers.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,16 @@ Return the default only if the value is not defined in sysdig.settings.<agent_se
183183
The following helper functions are all designed to use global values where
184184
possible, but accept overrides from the chart values.
185185
*/}}
186+
187+
{{- define "agent.httpProxyCredentials" -}}
188+
{{- if hasKey .Values.sysdig.settings "http_proxy" -}}
189+
{{- if and (hasKey .Values.sysdig.settings.http_proxy "proxy_user") (hasKey .Values.sysdig.settings.http_proxy "proxy_password") -}}
190+
proxy_user: {{ .Values.sysdig.settings.http_proxy.proxy_user | toString | b64enc | quote }}
191+
proxy_password: {{ .Values.sysdig.settings.http_proxy.proxy_password | toString | b64enc | quote }}
192+
{{- end }}
193+
{{- end }}
194+
{{- end -}}
195+
186196
{{- define "agent.accessKey" -}}
187197
{{- required "A valid accessKey is required" (.Values.sysdig.accessKey | default .Values.global.sysdig.accessKey) -}}
188198
{{- end -}}

‎charts/agent/templates/configmap.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,13 @@ data:
2626
{{- if .Values.global.sysdig.tags }}
2727
tags: {{ include "agent.tags" . }}
2828
{{- end }}
29+
{{/*
30+
Unset proxy_user and proxy_password if present and gke autopilot is disabled.
31+
*/}}
32+
{{- if and (hasKey .Values.sysdig.settings "http_proxy") (not (include "agent.gke.autopilot" .)) }}
33+
{{- $_ := unset .Values.sysdig.settings.http_proxy "proxy_user" -}}
34+
{{- $_ := unset .Values.sysdig.settings.http_proxy "proxy_password" -}}
35+
{{- end }}
2936
{{/*
3037
Checking here the user is using Custom CA and if http_proxy.ssl = true
3138
If these conditions are true, then we use the agent.sslCaFileName for the http_proxy.ca_certificate

‎charts/agent/templates/daemonset.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,10 @@ spec:
249249
name: sysdig-agent-config
250250
- mountPath: /opt/draios/etc/kubernetes/secrets
251251
name: sysdig-agent-secrets
252+
{{- if and (include "agent.httpProxyCredentials" .) (not (include "agent.gke.autopilot" .)) }}
253+
- mountPath: /opt/draios/etc/secrets/http_proxy
254+
name: sysdig-agent-http-proxy-secrets
255+
{{- end }}
252256
- mountPath: /etc/podinfo
253257
name: podinfo
254258

@@ -369,6 +373,11 @@ spec:
369373
{{- else }}
370374
secretName: {{ include "agent.accessKeySecret" . }}
371375
{{- end }}
376+
{{- if and (include "agent.httpProxyCredentials" .) (not (include "agent.gke.autopilot" .)) }}
377+
- name: sysdig-agent-http-proxy-secrets
378+
secret:
379+
secretName: {{ template "agent.fullname" . }}-proxy
380+
{{- end }}
372381
- name: podinfo
373382
downwardAPI:
374383
defaultMode: 420

‎charts/agent/templates/deployment.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,10 @@ spec:
128128
name: sysdig-agent-config
129129
- mountPath: /opt/draios/etc/kubernetes/secrets
130130
name: sysdig-agent-secrets
131+
{{- if and (include "agent.httpProxyCredentials" .) (not (include "agent.gke.autopilot" .)) }}
132+
- mountPath: /opt/draios/etc/secrets/http_proxy
133+
name: sysdig-agent-http-proxy-secrets
134+
{{- end }}
131135
- mountPath: /etc/podinfo
132136
name: podinfo
133137
{{- if eq (include "sysdig.custom_ca.enabled" (dict "global" .Values.global.ssl "component" .Values.ssl)) "true" }}
@@ -252,6 +256,11 @@ spec:
252256
{{- else }}
253257
secretName: {{ include "agent.accessKeySecret" . }}
254258
{{- end }}
259+
{{- if and (include "agent.httpProxyCredentials" .) (not (include "agent.gke.autopilot" .)) }}
260+
- name: sysdig-agent-http-proxy-secrets
261+
secret:
262+
secretName: {{ template "agent.fullname" . }}-proxy
263+
{{- end }}
255264
- name: podinfo
256265
downwardAPI:
257266
defaultMode: 420

‎charts/agent/templates/secrets.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,16 @@ metadata:
3636
data:
3737
{{ include "sysdig.custom_ca.keyName" (dict "global" .Values.global.ssl "component" .Values.ssl) }}: {{ include "sysdig.custom_ca.cert" (dict "global" .Values.global.ssl "component" .Values.ssl "Files" .Subcharts.common.Files) | b64enc | quote }}
3838
{{- end }}
39+
{{- if and (include "agent.httpProxyCredentials" .) (not (include "agent.gke.autopilot" .)) }}
40+
---
41+
apiVersion: v1
42+
kind: Secret
43+
metadata:
44+
name: {{ template "agent.fullname" . }}-proxy
45+
namespace: {{ include "agent.namespace" $ }}
46+
labels:
47+
{{ include "agent.labels" $ | indent 4 }}
48+
type: Opaque
49+
data:
50+
{{ include "agent.httpProxyCredentials" . | indent 2 }}
51+
{{- end }}

‎charts/agent/tests/api_endpoint_region_test.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -510,3 +510,18 @@ tests:
510510
asserts:
511511
- failedTemplate:
512512
errorMessage: "global.sysdig.region=us7 provided is not recognized."
513+
514+
- it: Checking proxy_user and proxy_password are not set
515+
set:
516+
sysdig:
517+
settings:
518+
http_proxy:
519+
proxy_user: "user"
520+
proxy_password: "password"
521+
asserts:
522+
- notMatchRegex:
523+
path: data['dragent.yaml']
524+
pattern: .*username.*
525+
- notMatchRegex:
526+
path: data['dragent.yaml']
527+
pattern: .*password.*

‎charts/agent/tests/secrets_test.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,39 @@ tests:
5353
path: data.sysdig-new-password-key1
5454
value: bXlwYXNzd29yZA==
5555
documentIndex: 2
56+
57+
- it: Should create proxy secret with http_proxy settings
58+
set:
59+
sysdig:
60+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
61+
settings:
62+
http_proxy:
63+
proxy_user: username
64+
proxy_password: password
65+
asserts:
66+
- isKind:
67+
of: Secret
68+
- equal:
69+
path: data.proxy_user
70+
value: dXNlcm5hbWU=
71+
documentIndex: 1
72+
- equal:
73+
path: data.proxy_password
74+
value: cGFzc3dvcmQ=
75+
documentIndex: 1
76+
77+
- it: Should not create proxy secret with http_proxy settings and autopilot enabled
78+
set:
79+
sysdig:
80+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
81+
settings:
82+
http_proxy:
83+
proxy_user: username
84+
proxy_password: password
85+
gke:
86+
autopilot: true
87+
asserts:
88+
- hasDocuments:
89+
count: 1
90+
- isKind:
91+
of: Secret

‎charts/agent/tests/volumes_test.yaml‎

Lines changed: 71 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
suite: Host volumes are available for agent
22
templates:
3-
- templates/daemonset.yaml
3+
- daemonset.yaml
4+
- deployment.yaml
45
tests:
56
- it: Ensure /var/run host volume is mounted as /host/var/run in container
67
asserts:
@@ -10,6 +11,9 @@ tests:
1011
- equal:
1112
path: spec.template.spec.volumes[?(@.name == "varrun-vol")].hostPath.path
1213
value: /var/run
14+
templates:
15+
- daemonset.yaml
16+
1317
- it: Ensure /var/lib host volume is mounted as /host/var/lib in container
1418
asserts:
1519
- equal:
@@ -18,6 +22,9 @@ tests:
1822
- equal:
1923
path: spec.template.spec.volumes[?(@.name == "varlib-vol")].hostPath.path
2024
value: /var/lib
25+
templates:
26+
- daemonset.yaml
27+
2128
- it: Ensure /var/lib host volume is not mounted as /host/var/lib in container when running on gke.autopilot
2229
set:
2330
gke:
@@ -27,6 +34,9 @@ tests:
2734
path: spec.template.spec.containers[*].volumeMounts[?(@.name == "varlib-vol")]
2835
- isNull:
2936
path: spec.template.spec.volumes[?(@.name == "varlib-vol")]
37+
templates:
38+
- daemonset.yaml
39+
3040
- it: Ensure /var/lib host volume is not mounted as /host/var/lib in container when running on global.gke.autopilot
3141
set:
3242
global:
@@ -37,3 +47,63 @@ tests:
3747
path: spec.template.spec.containers[*].volumeMounts[?(@.name == "varlib-vol")]
3848
- isNull:
3949
path: spec.template.spec.volumes[?(@.name == "varlib-vol")]
50+
templates:
51+
- daemonset.yaml
52+
53+
- it: Ensure agent http proxy volume is not mounted when http_proxy settings is not set
54+
set:
55+
sysdig:
56+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
57+
delegatedAgentDeployment:
58+
enabled: true
59+
asserts:
60+
- isNull:
61+
path: spec.template.spec.volumes[?(@.name == "sysdig-agent-http-proxy-secrets")]
62+
- isNull:
63+
path: spec.template.spec.containers[*].volumeMounts[?(@.name == "sysdig-agent-http-proxy-secrets")]
64+
templates:
65+
- deployment.yaml
66+
- daemonset.yaml
67+
68+
- it: Ensure agent http proxy volume is not mounted when http_proxy settings is set and autopilot is enabled
69+
set:
70+
sysdig:
71+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
72+
settings:
73+
http_proxy:
74+
proxy_user: username
75+
proxy_password: password
76+
delegatedAgentDeployment:
77+
enabled: true
78+
gke:
79+
autopilot: true
80+
asserts:
81+
- isNull:
82+
path: spec.template.spec.volumes[?(@.name == "sysdig-agent-http-proxy-secrets")]
83+
- isNull:
84+
path: spec.template.spec.containers[*].volumeMounts[?(@.name == "sysdig-agent-http-proxy-secrets")]
85+
templates:
86+
- deployment.yaml
87+
- daemonset.yaml
88+
89+
- it: Ensure agent http proxy volume is mounted when http_proxy settings is set
90+
set:
91+
delegatedAgentDeployment:
92+
enabled: true
93+
sysdig:
94+
accessKey: AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
95+
settings:
96+
http_proxy:
97+
proxy_user: username
98+
proxy_password: password
99+
asserts:
100+
- equal:
101+
path: spec.template.spec.volumes[?(@.name == "sysdig-agent-http-proxy-secrets")].secret
102+
value:
103+
secretName: RELEASE-NAME-agent-proxy
104+
- equal:
105+
path: spec.template.spec.containers[*].volumeMounts[?(@.name == "sysdig-agent-http-proxy-secrets")].mountPath
106+
value: /opt/draios/etc/secrets/http_proxy
107+
templates:
108+
- deployment.yaml
109+
- daemonset.yaml

‎charts/sysdig-deploy/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: sysdig-deploy
33
description: A chart with various Sysdig components for Kubernetes
44
type: application
5-
version: 1.32.1
5+
version: 1.33.0
66
maintainers:
77
- name: AlbertoBarba
88
email: [email protected]
@@ -26,7 +26,7 @@ dependencies:
2626
- name: agent
2727
# repository: https://charts.sysdig.com
2828
repository: file://../agent
29-
version: ~1.17.3
29+
version: ~1.18.0
3030
alias: agent
3131
condition: agent.enabled
3232
- name: common

0 commit comments

Comments
 (0)