feat: module has been updated to use image digest SHA instead of an image tag as per best practises. That means the log_analysis_agent_version and cloud_monitoring_agent_version input variables have been removed. It means its not longer supported to pass the version to the module. Instead every module release will be locked into a specific version, and there will be regular module releases with updated versions in them. (#275)

daniel-butler-irl · web-flow · commit e6fd5cd6b462 · 2024-01-17T11:06:49.000Z
diff --git a/README.md b/README.md
@@ -136,7 +136,6 @@ No modules.
 | <a name="input_cloud_monitoring_agent_namespace"></a> [cloud\_monitoring\_agent\_namespace](#input\_cloud\_monitoring\_agent\_namespace) | Namespace where to deploy the Cloud Monitoring agent. Default value is 'ibm-observe' | `string` | `"ibm-observe"` | no |
 | <a name="input_cloud_monitoring_agent_tags"></a> [cloud\_monitoring\_agent\_tags](#input\_cloud\_monitoring\_agent\_tags) | List of tags to associate to all matrics that the agent collects. NOTE: Use the 'cloud\_monitoring\_add\_cluster\_name' variable to add the cluster name as a tag. | `list(string)` | `[]` | no |
 | <a name="input_cloud_monitoring_agent_tolerations"></a> [cloud\_monitoring\_agent\_tolerations](#input\_cloud\_monitoring\_agent\_tolerations) | List of tolerations to apply to Cloud Monitoring agent. | <pre>list(object({<br>    key               = optional(string)<br>    operator          = optional(string)<br>    value             = optional(string)<br>    effect            = optional(string)<br>    tolerationSeconds = optional(number)<br>  }))</pre> | <pre>[<br>  {<br>    "operator": "Exists"<br>  },<br>  {<br>    "effect": "NoSchedule",<br>    "key": "node-role.kubernetes.io/master",<br>    "operator": "Exists"<br>  }<br>]</pre> | no |
-| <a name="input_cloud_monitoring_agent_version"></a> [cloud\_monitoring\_agent\_version](#input\_cloud\_monitoring\_agent\_version) | IBM Cloud Monitoring Agent Version. To lookup version run: `ibmcloud cr images --restrict ext/sysdig/agent`. If null, the default value is used. | `string` | `"12.19.0"` | no |
 | <a name="input_cloud_monitoring_enabled"></a> [cloud\_monitoring\_enabled](#input\_cloud\_monitoring\_enabled) | Deploy IBM Cloud Monitoring agent | `bool` | `true` | no |
 | <a name="input_cloud_monitoring_endpoint_type"></a> [cloud\_monitoring\_endpoint\_type](#input\_cloud\_monitoring\_endpoint\_type) | Specify the IBM Cloud Monitoring instance endpoint type (public or private) to use. Used to construct the ingestion endpoint. | `string` | `"private"` | no |
 | <a name="input_cloud_monitoring_instance_region"></a> [cloud\_monitoring\_instance\_region](#input\_cloud\_monitoring\_instance\_region) | The IBM Cloud Monitoring instance region. Used to construct the ingestion endpoint. | `string` | `null` | no |
@@ -152,7 +151,6 @@ No modules.
 | <a name="input_log_analysis_agent_namespace"></a> [log\_analysis\_agent\_namespace](#input\_log\_analysis\_agent\_namespace) | Namespace where to deploy the Log Analysis agent. Default value is 'ibm-observe' | `string` | `"ibm-observe"` | no |
 | <a name="input_log_analysis_agent_tags"></a> [log\_analysis\_agent\_tags](#input\_log\_analysis\_agent\_tags) | List of tags to associate to all log records that the agent collects so that you can identify the agent's data quicker in the logging UI. NOTE: Use the 'log\_analysis\_add\_cluster\_name' variable to add the cluster name as a tag. | `list(string)` | `[]` | no |
 | <a name="input_log_analysis_agent_tolerations"></a> [log\_analysis\_agent\_tolerations](#input\_log\_analysis\_agent\_tolerations) | List of tolerations to apply to Log Analysis agent. | <pre>list(object({<br>    key               = optional(string)<br>    operator          = optional(string)<br>    value             = optional(string)<br>    effect            = optional(string)<br>    tolerationSeconds = optional(number)<br>  }))</pre> | <pre>[<br>  {<br>    "operator": "Exists"<br>  }<br>]</pre> | no |
-| <a name="input_log_analysis_agent_version"></a> [log\_analysis\_agent\_version](#input\_log\_analysis\_agent\_version) | Version of the agent to deploy. To lookup version run: `ibmcloud cr images --restrict ext/logdna-agent`. If null, the default value is used. | `string` | `"3.9.1-20231225.fb0af936e8df898f"` | no |
 | <a name="input_log_analysis_enabled"></a> [log\_analysis\_enabled](#input\_log\_analysis\_enabled) | Deploy IBM Cloud Logging agent | `bool` | `true` | no |
 | <a name="input_log_analysis_endpoint_type"></a> [log\_analysis\_endpoint\_type](#input\_log\_analysis\_endpoint\_type) | Specify the IBM Log Analysis instance endpoint type (public or private) to use. Used to construct the ingestion endpoint. | `string` | `"private"` | no |
 | <a name="input_log_analysis_ingestion_key"></a> [log\_analysis\_ingestion\_key](#input\_log\_analysis\_ingestion\_key) | Ingestion key for the IBM Cloud Logging agent to communicate with the instance | `string` | `null` | no |
diff --git a/chart/logdna-agent/templates/clusterrole.yaml b/chart/logdna-agent/templates/clusterrole.yaml
@@ -5,7 +5,8 @@ metadata:
   labels:
     app.kubernetes.io/name: {{ .Values.metadata.name }}
     app.kubernetes.io/instance: {{ .Values.metadata.name }}
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 rules:
   - apiGroups: [""]
     resources: ["events"]
diff --git a/chart/logdna-agent/templates/clusterrolebinding.yaml b/chart/logdna-agent/templates/clusterrolebinding.yaml
@@ -5,7 +5,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/chart/logdna-agent/templates/daemonset.yaml b/chart/logdna-agent/templates/daemonset.yaml
@@ -6,7 +6,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
   annotations:
     {{- range .Values.checkov_skips }}
     {{- . | toYaml | nindent 4 -}}
@@ -25,7 +26,7 @@ spec:
         app: "{{ .Values.metadata.name }}"
         app.kubernetes.io/name: "{{ .Values.metadata.name }}"
         app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-        app.kubernetes.io/version: {{ .Values.image.version }}
+        app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
     spec:
       serviceAccountName: "{{ .Values.metadata.name }}"
       priorityClassName: "{{ .Values.metadata.name }}-ds-priority"
diff --git a/chart/logdna-agent/templates/role.yaml b/chart/logdna-agent/templates/role.yaml
@@ -6,7 +6,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
   annotations:
     {{- range .Values.checkov_skips }}
     {{- . | toYaml | nindent 4 -}}
diff --git a/chart/logdna-agent/templates/rolebinding.yaml b/chart/logdna-agent/templates/rolebinding.yaml
@@ -6,7 +6,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
   annotations:
     {{- range .Values.checkov_skips }}
     {{- . | toYaml | nindent 4 -}}
diff --git a/chart/logdna-agent/templates/scc.yaml b/chart/logdna-agent/templates/scc.yaml
@@ -10,7 +10,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 priority: 9
 allowHostDirVolumePlugin: true
 allowHostIPC: false
diff --git a/chart/logdna-agent/templates/secret.yaml b/chart/logdna-agent/templates/secret.yaml
@@ -8,7 +8,8 @@ metadata:
   labels:
     app.kubernetes.io/name: {{ .Values.metadata.name }}
     app.kubernetes.io/instance: {{ .Values.metadata.name }}
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
   annotations:
     {{- range .Values.checkov_skips }}
     {{- . | toYaml | nindent 4 -}}
diff --git a/chart/logdna-agent/templates/serviceaccount.yaml b/chart/logdna-agent/templates/serviceaccount.yaml
@@ -6,7 +6,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
   annotations:
     {{- range .Values.checkov_skips }}
     {{- . | toYaml | nindent 4 -}}
diff --git a/chart/logdna-agent/values.yaml b/chart/logdna-agent/values.yaml
@@ -3,8 +3,6 @@ metadata:
   name: "logdna-agent"
 image:
   repository: "ext/logdna-agent"
-  # renovate: datasource=docker depName=icr.io/ext/logdna-agent versioning=regex:^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)-(?<build>\d{8}).\w+?$
-  version: "3.9.1-20231225.fb0af936e8df898f"
   registry: icr.io
 env:
   host: "logs.private.us-south.logging.cloud.ibm.com"
@@ -17,7 +15,6 @@ agent:
 checkov_skips:
   - checkov.io/skip1: CKV_K8S_21  # "The default namespace should not be used" - false positive - the helm namespace is always used, but not picked up by linter
   - checkov.io/skip2: CKV_K8S_11  # "CPU limits should be set" - ignoring as chart not owned by us
-  - checkov.io/skip3: CKV_K8S_43  # Valid issue, tracked at https://github.ibm.com/GoldenEye/issues/issues/6704
   - checkov.io/skip4: CKV_K8S_38  # "Ensure that Service Account Tokens are only mounted where necessary" - ignoring as chart not owned by us
   - checkov.io/skip5: CKV_K8S_29  # "Apply security context to your pods and containers" - ignoring as chart not owned by us
   - checkov.io/skip6: CKV_K8S_25  # "Minimize the admission of containers with added capability" - ignoring as chart not owned by us
diff --git a/chart/sysdig-agent/templates/clusterrole.yaml b/chart/sysdig-agent/templates/clusterrole.yaml
@@ -5,7 +5,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 rules:
 - apiGroups:
   - ""
diff --git a/chart/sysdig-agent/templates/clusterrolebinding.yaml b/chart/sysdig-agent/templates/clusterrolebinding.yaml
@@ -5,7 +5,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/chart/sysdig-agent/templates/configmap.yaml b/chart/sysdig-agent/templates/configmap.yaml
@@ -6,7 +6,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 data:
   dragent.yaml: |
     configmap: true
diff --git a/chart/sysdig-agent/templates/daemonset.yaml b/chart/sysdig-agent/templates/daemonset.yaml
@@ -8,7 +8,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 spec:
   selector:
     matchLabels:
diff --git a/chart/sysdig-agent/templates/scc.yaml b/chart/sysdig-agent/templates/scc.yaml
@@ -5,7 +5,8 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 allowHostDirVolumePlugin: true
 allowHostIPC: true
 allowHostNetwork: true
diff --git a/chart/sysdig-agent/templates/secret.yaml b/chart/sysdig-agent/templates/secret.yaml
@@ -8,5 +8,6 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
 type: Opaque
diff --git a/chart/sysdig-agent/templates/serviceaccount.yaml b/chart/sysdig-agent/templates/serviceaccount.yaml
@@ -6,4 +6,5 @@ metadata:
   labels:
     app.kubernetes.io/name: "{{ .Values.metadata.name }}"
     app.kubernetes.io/instance: "{{ .Values.metadata.name }}"
-    app.kubernetes.io/version: {{ .Values.image.version }}
+    # Extracts the first part before '@' from .Values.image.version, ensuring it's treated as a string.
+    app.kubernetes.io/version: {{ .Values.image.version | default "" | toString | splitList "@" | first }}
diff --git a/main.tf b/main.tf
@@ -18,18 +18,20 @@ data "ibm_container_cluster_config" "cluster_config" {
 
 locals {
   # LOCALS
-  cluster_name                = data.ibm_container_vpc_cluster.cluster.resource_name # Not publically documented in provider. See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4485
-  log_analysis_chart_location = "${path.module}/chart/logdna-agent"
-  log_analysis_agent_registry = "icr.io/ext/logdna-agent"
-  log_analysis_agent_tags     = var.log_analysis_add_cluster_name ? concat([local.cluster_name], var.log_analysis_agent_tags) : var.log_analysis_agent_tags
-  log_analysis_host           = var.log_analysis_endpoint_type == "private" ? "logs.private.${var.log_analysis_instance_region}.logging.cloud.ibm.com" : "logs.${var.log_analysis_instance_region}.logging.cloud.ibm.com"
+  cluster_name                  = data.ibm_container_vpc_cluster.cluster.resource_name # Not publically documented in provider. See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4485
+  log_analysis_chart_location   = "${path.module}/chart/logdna-agent"
+  log_analysis_image_tag_digest = "3.9.1-20231225.fb0af936e8df898f@sha256:3d572353ca69c8d0817ba0c9cb80ef269f4e6f524cee3c98ffe18ef9420b253f" # datasource: icr.io/ext/logdna-agent
+  log_analysis_agent_registry   = "icr.io/ext/logdna-agent"
+  log_analysis_agent_tags       = var.log_analysis_add_cluster_name ? concat([local.cluster_name], var.log_analysis_agent_tags) : var.log_analysis_agent_tags
+  log_analysis_host             = var.log_analysis_endpoint_type == "private" ? "logs.private.${var.log_analysis_instance_region}.logging.cloud.ibm.com" : "logs.${var.log_analysis_instance_region}.logging.cloud.ibm.com"
   # The directory in which the logdna agent will store its state database.
   # Note that the agent must have write access to the directory (handlded by the initContainer) and be a persistent volume.
-  log_analysis_agent_db_path      = "/var/lib/logdna"
-  cloud_monitoring_chart_location = "${path.module}/chart/sysdig-agent"
-  cloud_monitoring_agent_registry = "icr.io/ext/sysdig/agent"
-  cloud_monitoring_agent_tags     = var.cloud_monitoring_add_cluster_name ? concat(["ibm.containers-kubernetes.cluster.name:${local.cluster_name}"], var.cloud_monitoring_agent_tags) : var.cloud_monitoring_agent_tags
-  cloud_monitoring_host           = var.cloud_monitoring_endpoint_type == "private" ? "ingest.private.${var.cloud_monitoring_instance_region}.monitoring.cloud.ibm.com" : "logs.${var.cloud_monitoring_instance_region}.monitoring.cloud.ibm.com"
+  log_analysis_agent_db_path        = "/var/lib/logdna"
+  cloud_monitoring_chart_location   = "${path.module}/chart/sysdig-agent"
+  cloud_monitoring_image_tag_digest = "12.19.0@sha256:5ab96c580f2cc33bf55afcb9889e9195a70b80e83909d861f020eec461239fad" # datasource: icr.io/ext/sysdig/agent
+  cloud_monitoring_agent_registry   = "icr.io/ext/sysdig/agent"
+  cloud_monitoring_agent_tags       = var.cloud_monitoring_add_cluster_name ? concat(["ibm.containers-kubernetes.cluster.name:${local.cluster_name}"], var.cloud_monitoring_agent_tags) : var.cloud_monitoring_agent_tags
+  cloud_monitoring_host             = var.cloud_monitoring_endpoint_type == "private" ? "ingest.private.${var.cloud_monitoring_instance_region}.monitoring.cloud.ibm.com" : "logs.${var.cloud_monitoring_instance_region}.monitoring.cloud.ibm.com"
 
   # VARIABLE VALIDATION
   log_analysis_key_validate_condition = var.log_analysis_enabled == true && var.log_analysis_instance_region == null && var.log_analysis_ingestion_key == null
@@ -63,7 +65,7 @@ resource "helm_release" "log_analysis_agent" {
   set {
     name  = "image.version"
     type  = "string"
-    value = var.log_analysis_agent_version
+    value = local.log_analysis_image_tag_digest
   }
   set {
     name  = "image.registry"
@@ -152,7 +154,7 @@ resource "helm_release" "cloud_monitoring_agent" {
   set {
     name  = "image.version"
     type  = "string"
-    value = var.cloud_monitoring_agent_version
+    value = local.cloud_monitoring_image_tag_digest
   }
   set {
     name  = "image.registry"
diff --git a/renovate.json b/renovate.json
@@ -3,18 +3,11 @@
   "extends": ["github>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"],
   "regexManagers": [
     {
-      "fileMatch": ["^chart/logdna-agent/values.yaml$"],
+      "fileMatch": ["\\.tf$"],
       "matchStrings": [
-        "datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\s.*?tag: \"(?<currentValue>.*)\"\\s"
+        "[\\w-]+_image_tag_digest\\s*=\\s*\"(?<currentValue>[\\w.-]+)@(?<currentDigest>sha256:[a-f0-9]+)\"\\s*# datasource: (?<depName>[^\\s]+)"
       ],
-      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
-    },
-    {
-      "fileMatch": ["^variables.tf$"],
-      "matchStrings": [
-        "datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\s.*? = \"(?<currentValue>.*)\"\\s"
-      ],
-      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
+      "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
diff --git a/variables.tf b/variables.tf
@@ -33,13 +33,6 @@ variable "log_analysis_enabled" {
   default     = true
 }
 
-variable "log_analysis_agent_version" {
-  type        = string
-  description = "Version of the agent to deploy. To lookup version run: `ibmcloud cr images --restrict ext/logdna-agent`. If null, the default value is used."
-  # renovate: datasource=docker depName=icr.io/ext/logdna-agent versioning=regex:^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)-(?<build>\d{8}).\w+?$
-  default  = "3.9.1-20231225.fb0af936e8df898f"
-  nullable = false
-}
 
 variable "log_analysis_agent_tags" {
   type        = list(string)
@@ -134,14 +127,6 @@ variable "cloud_monitoring_enabled" {
   default     = true
 }
 
-variable "cloud_monitoring_agent_version" {
-  type        = string
-  description = "IBM Cloud Monitoring Agent Version. To lookup version run: `ibmcloud cr images --restrict ext/sysdig/agent`. If null, the default value is used."
-  # renovate: datasource=docker depName=icr.io/ext/sysdig/agent
-  default  = "12.19.0"
-  nullable = false
-}
-
 variable "cloud_monitoring_access_key" {
   type        = string
   description = "Access key used by the IBM Cloud Monitoring agent to communicate with the instance"
