Skip to content

feat: add support for SHA #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ocofaigh merged 6 commits into from
Sep 4, 2025
Merged

feat: add support for SHA #154

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dd73b7a
feat: add support for SHA
Aashiq-J Aug 25, 2025
d797e28
update renovate
Aashiq-J Aug 25, 2025
63f5a10
Merge branch 'main' into sha
Aashiq-J Sep 1, 2025
c031976
update
Aashiq-J Sep 1, 2025
69a394c
Merge branch 'main' into sha
Aashiq-J Sep 3, 2025
8ce3882
update
Aashiq-J Sep 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,8 @@ No modules.
| <a name="input_logs_agent_iam_api_key"></a> [logs\_agent\_iam\_api\_key](#input\_logs\_agent\_iam\_api\_key) | The IBM Cloud API key for the Logs agent to authenticate and communicate with the IBM Cloud Logs. It is required if `logs_agent_iam_mode` is set to `IAMAPIKey`. | `string` | `null` | no |
| <a name="input_logs_agent_iam_environment"></a> [logs\_agent\_iam\_environment](#input\_logs\_agent\_iam\_environment) | IAM authentication Environment: `Production` or `PrivateProduction` or `Staging` or `PrivateStaging`. `Production` specifies the public endpoint & `PrivateProduction` specifies the private endpoint. | `string` | `"PrivateProduction"` | no |
| <a name="input_logs_agent_iam_mode"></a> [logs\_agent\_iam\_mode](#input\_logs\_agent\_iam\_mode) | IAM authentication mode: `TrustedProfile` or `IAMAPIKey`. | `string` | `"TrustedProfile"` | no |
| <a name="input_logs_agent_image_version"></a> [logs\_agent\_image\_version](#input\_logs\_agent\_image\_version) | The version of the Logs agent image to deploy. | `string` | `"1.6.1"` | no |
| <a name="input_logs_agent_image_version"></a> [logs\_agent\_image\_version](#input\_logs\_agent\_image\_version) | The version of the Logs agent image to deploy. | `string` | `"1.6.1@sha256:0265b85c698e74dfd9e21ad0332a430a3b398c4f0e590dad314c43b3cd796bce"` | no |
| <a name="input_logs_agent_init_image_version"></a> [logs\_agent\_init\_image\_version](#input\_logs\_agent\_init\_image\_version) | The version of the Logs agent init container image to deploy. | `string` | `"1.6.1@sha256:d2c1bb5a97c0d8950d3dfee016cec4347a6cfa8a43123d9c2eecbdee70500f8b"` | no |
| <a name="input_logs_agent_log_source_namespaces"></a> [logs\_agent\_log\_source\_namespaces](#input\_logs\_agent\_log\_source\_namespaces) | The list of namespaces from which logs should be forwarded by agent. If namespaces are not listed, logs from all namespaces will be sent. | `list(string)` | `[]` | no |
| <a name="input_logs_agent_name"></a> [logs\_agent\_name](#input\_logs\_agent\_name) | The name of the Logs agent. The name is used in all Kubernetes and Helm resources in the cluster. | `string` | `"logs-agent"` | no |
| <a name="input_logs_agent_namespace"></a> [logs\_agent\_namespace](#input\_logs\_agent\_namespace) | The namespace where the Logs agent is deployed. The default value is `ibm-observe`. | `string` | `"ibm-observe"` | no |
Expand Down
2 changes: 1 addition & 1 deletion examples/logs-agent-ocp/version.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ terraform {
required_version = ">= 1.9.0"

# Ensure that there is always 1 example locked into the lowest provider version of the range defined in the main
# module's version.tf (logs-agent-iks), and 1 example that will always use the latest provider version (this exammple).
# module's version.tf (logs-agent-iks), and 1 example that will always use the latest provider version (this example).
required_providers {
ibm = {
source = "ibm-cloud/ibm"
Expand Down
14 changes: 12 additions & 2 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ locals {
for metadata in var.logs_agent_additional_metadata : {
(metadata.key) = metadata.value
}]...) : {} # DO NOT REMOVE "...", it is used to convert list of objects into a single object
cluster_name = var.is_vpc_cluster ? data.ibm_container_vpc_cluster.cluster[0].resource_name : data.ibm_container_cluster.cluster[0].resource_name # Not publically documented in provider. See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4485
cluster_name = var.is_vpc_cluster ? data.ibm_container_vpc_cluster.cluster[0].resource_name : data.ibm_container_cluster.cluster[0].resource_name # Not publicly documented in provider. See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4485
}

resource "helm_release" "logs_agent" {
Expand All @@ -55,7 +55,17 @@ resource "helm_release" "logs_agent" {
set {
name = "image.version"
type = "string"
value = var.logs_agent_image_version
value = split("@", var.logs_agent_image_version)[0]
Copy link
Contributor

@ocofaigh ocofaigh Sep 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, did you check what happens when image.version and image.containerSha are both being passed? Will SHA take precedence?

Copy link
Member Author

@Aashiq-J Aashiq-J Sep 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image version is always required.
Here is the logic which the observability team implemented to use the SHA digest
https://github.ibm.com/Observability/helm-charts/blob/5a08774693cfd18c66cbf4e88e6f0cbbcbacd353/logs-agent/templates/_helpers.tpl#L46

If the user passes the sha they just append it to the version.

Copy link
Contributor

@ocofaigh ocofaigh Sep 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah I see - so thats why we need to remove it in our code - thanks

}
set {
name = "image.containerSha"
type = "string"
value = strcontains(var.logs_agent_image_version, "@") ? split("@", var.logs_agent_image_version)[1] : ""
}
set {
name = "image.initContainerSha"
type = "string"
value = strcontains(var.logs_agent_init_image_version, "@") ? split("@", var.logs_agent_init_image_version)[1] : ""
}
set {
name = "env.ingestionHost"
Expand Down
2 changes: 1 addition & 1 deletion renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
"fileMatch": ["variables.tf$"],
"datasourceTemplate": "docker",
"matchStrings": [
"default\\s*=\\s*\"(?<currentValue>.*)\"\\s*# datasource: (?<depName>[^\\s]+)"
"default\\s*=\\s*\"(?<currentValue>[\\w.-]+)@(?<currentDigest>sha256:[a-f0-9]+)\"\\s*# datasource: (?<depName>[^\\s]+)"
]
}
]
Expand Down
13 changes: 12 additions & 1 deletion variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,11 +76,22 @@ variable "logs_agent_chart_version" {
nullable = false
}

variable "logs_agent_init_image_version" {
description = "The version of the Logs agent init container image to deploy."
type = string
default = "1.6.1@sha256:d2c1bb5a97c0d8950d3dfee016cec4347a6cfa8a43123d9c2eecbdee70500f8b" # datasource: icr.io/ibm/observe/logs-router-agent-init
nullable = false
}

variable "logs_agent_image_version" {
description = "The version of the Logs agent image to deploy."
type = string
default = "1.6.1" # datasource: icr.io/ibm/observe/logs-agent-helm
default = "1.6.1@sha256:0265b85c698e74dfd9e21ad0332a430a3b398c4f0e590dad314c43b3cd796bce" # datasource: icr.io/ibm/observe/logs-router-agent
nullable = false
validation {
condition = split("@", var.logs_agent_image_version)[0] == split("@", var.logs_agent_init_image_version)[0]
error_message = "The image tags for `logs_agent_init_image_version` and `logs_agent_image_version` should be same."
}
}

variable "logs_agent_name" {
Expand Down