Skip to content

Native SGC support for the operator #3231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
s-alad wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Native SGC support for the operator #3231

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8beec58
native SGC usage in the operator
s-alad Jul 7, 2026
9bb02af
go work
s-alad Jul 7, 2026
2814650
increase timeout
s-alad Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,18 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${GOARCH} go build -a -ldflags "${LDFLAGS}"

FROM registry.access.redhat.com/ubi10/ubi-minimal:latest AS certs

FROM registry.access.redhat.com/ubi10/ubi-micro:latest
# secret-generic-connector (SGC) source image, pinned by digest
ARG SGC_IMAGE=datadog/secret-generic-connector:7.81.0-rc.1@sha256:9bf1ecb5018deea4e7b6dd1522455a0cebfeea50a9aae481b91fbca00251bfb8
FROM ${SGC_IMAGE} AS sgc

# Non-FIPS runtime: embed SGC so the operator can resolve its own secrets via the connector.
FROM registry.access.redhat.com/ubi10/ubi-micro:latest AS runtime-false
COPY --from=sgc --chmod=550 /secret-generic-connector /opt/datadog-agent/bin/secret-generic-connector

# FIPS runtime: omit SGC until a FIPS SGC image is published (no -fips tag exists yet).
FROM registry.access.redhat.com/ubi10/ubi-micro:latest AS runtime-true

FROM runtime-${FIPS_ENABLED}

LABEL name="datadog/operator"
LABEL vendor="Datadog Inc."
Expand Down
21 changes: 18 additions & 3 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
package main

import (
"encoding/json"
"flag"
"fmt"
"net/http"
Expand Down Expand Up @@ -159,6 +160,8 @@ type options struct {
// Secret Backend options
secretBackendCommand string
secretBackendArgs stringSlice
secretBackendType string
secretBackendConfig string
secretRefreshInterval time.Duration
}

Expand All @@ -180,6 +183,8 @@ func (opts *options) Parse() {
// Custom flags
flag.StringVar(&opts.secretBackendCommand, "secretBackendCommand", "", "Secret backend command")
flag.Var(&opts.secretBackendArgs, "secretBackendArgs", "Space separated arguments of the secret backend command")
flag.StringVar(&opts.secretBackendType, "secretBackendType", "", "Secret backend type for the embedded secret-generic-connector")
flag.StringVar(&opts.secretBackendConfig, "secretBackendConfig", "", "JSON object of secret backend config for the secret-generic-connector")
flag.DurationVar(&opts.secretRefreshInterval, "secretRefreshInterval", 0, "Interval for refreshing secrets from secret backend")
flag.BoolVar(&opts.supportCilium, "supportCilium", false, "Support usage of Cilium network policies.")
flag.BoolVar(&opts.datadogAgentEnabled, "datadogAgentEnabled", true, "Enable the DatadogAgent controller")
Expand Down Expand Up @@ -352,6 +357,15 @@ func run(opts *options) error {
// Dispatch CLI flags to each package
secrets.SetSecretBackendCommand(opts.secretBackendCommand)
secrets.SetSecretBackendArgs(opts.secretBackendArgs)
secrets.SetSecretBackendType(opts.secretBackendType)
if opts.secretBackendConfig != "" {
var backendConfig map[string]any
if err := json.Unmarshal([]byte(opts.secretBackendConfig), &backendConfig); err != nil {
setupLog.Error(err, "Invalid -secretBackendConfig JSON, ignoring")
} else {
secrets.SetSecretBackendConfig(backendConfig)
}
}

renewDeadline := opts.leaderElectionLeaseDuration / 2
retryPeriod := opts.leaderElectionLeaseDuration / 4
Expand Down Expand Up @@ -416,9 +430,10 @@ func run(opts *options) error {
setupLog.Error(err, "Unable to get credentials")
}

if opts.secretRefreshInterval > 0 && opts.secretBackendCommand == "" {
setupLog.Error(nil, "secretRefreshInterval is set but secretBackendCommand is not configured")
} else if opts.secretBackendCommand != "" && opts.secretRefreshInterval > 0 {
secretBackendConfigured := opts.secretBackendCommand != "" || opts.secretBackendType != ""
if opts.secretRefreshInterval > 0 && !secretBackendConfigured {
setupLog.Error(nil, "secretRefreshInterval is set but no secret backend is configured")
} else if secretBackendConfigured && opts.secretRefreshInterval > 0 {
go credsManager.StartCredentialRefreshRoutine(opts.secretRefreshInterval, setupLog)
}

Expand Down
Loading
Loading