From bf2e1ef63a543b32023e19b240b368252987c18e Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Thu, 16 Jul 2026 12:17:22 -0400 Subject: [PATCH 1/4] Add EKS add-on lifecycle chart contract --- .../charts/operator-eks-addon/README.md | 23 +++- .../aws_mp_configuration_schema.json | 118 +++++++++++++++++- .../templates/lifecycle.yaml | 39 ++++++ .../charts/operator-eks-addon/values.yaml | 2 + 4 files changed, 180 insertions(+), 2 deletions(-) create mode 100644 marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml diff --git a/marketplaces/charts/operator-eks-addon/README.md b/marketplaces/charts/operator-eks-addon/README.md index 3ca882a2e5..ebb7df7da7 100644 --- a/marketplaces/charts/operator-eks-addon/README.md +++ b/marketplaces/charts/operator-eks-addon/README.md @@ -1,6 +1,27 @@ # Operator EKS Add-on -This is a wrapper chart for installing EKS add-on. Charts required for the add-on are added as a dependency to this chart. Chart itself doesn't contain any templates or configurable properties. +This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the lifecycle bridge resources when lifecycle values are present. + +## Instrumenter lifecycle bridge + +The optional `lifecycle` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_ADDON_LIFECYCLE_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. + +Lifecycle configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. + +```yaml +lifecycle: + version: v1 + installationID: 123e4567-e89b-42d3-a456-426614174000 + eksARNSHA256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + operationID: 123e4567-e89b-42d3-a456-426614174010 + desiredState: installed + acknowledgedOperationID: "" + bootstrap: + clusterName: example-cluster + site: datadoghq.com +``` + +The lifecycle specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. ## Version Mapping | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent | diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index 880afe4e2c..a8f18b9274 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -110,6 +110,49 @@ "collectOperatorMetrics": { "type": "boolean" }, + "apiKeyExistingSecret": { + "type": "string" + }, + "datadogCRDs": { + "type": "object", + "properties": { + "crds": { + "type": "object", + "properties": { + "datadogAgentProfiles": { + "type": "boolean" + } + } + } + } + }, + "datadogAgentProfile": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "remoteConfiguration": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "remoteUpdates": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "createControllerRevisions": { + "type": "boolean" + }, "watchNamespaces": { "type": "array", "items": {} @@ -118,6 +161,79 @@ "type": "object" } } + }, + "lifecycle": { + "type": [ + "object", + "null" + ], + "properties": { + "version": { + "type": "string", + "enum": [ + "v1" + ] + }, + "installationID": { + "type": "string", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" + }, + "eksARNSHA256": { + "type": "string", + "pattern": "^[0-9a-f]{64}$" + }, + "operationID": { + "type": "string", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" + }, + "desiredState": { + "type": "string", + "enum": [ + "installed", + "absent" + ] + }, + "acknowledgedOperationID": { + "type": "string", + "pattern": "^$|^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" + }, + "bootstrap": { + "type": "object", + "properties": { + "clusterName": { + "type": "string", + "minLength": 1, + "maxLength": 100 + }, + "site": { + "type": "string", + "enum": [ + "datadoghq.com", + "datadoghq.eu", + "us3.datadoghq.com", + "us5.datadoghq.com", + "ddog-gov.com", + "ap1.datadoghq.com", + "ap2.datadoghq.com" + ] + } + }, + "required": [ + "clusterName", + "site" + ], + "additionalProperties": false + } + }, + "required": [ + "version", + "installationID", + "eksARNSHA256", + "operationID", + "desiredState", + "bootstrap" + ], + "additionalProperties": false } } -} \ No newline at end of file +} diff --git a/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml b/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml new file mode 100644 index 0000000000..8204a34350 --- /dev/null +++ b/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml @@ -0,0 +1,39 @@ +{{- with .Values.lifecycle }} +{{- $intent := dict + "version" .version + "installationID" .installationID + "eksARNSHA256" .eksARNSHA256 + "operationID" .operationID + "desiredState" .desiredState + "bootstrap" .bootstrap +-}} +{{- with .acknowledgedOperationID }} +{{- $_ := set $intent "acknowledgedOperationID" . -}} +{{- end }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: datadog-agent-lifecycle-intent + namespace: datadog + labels: + app.kubernetes.io/managed-by: eks-addon +data: + intent.json: |- + {{ $intent | toJson }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: datadog-agent-lifecycle-runtime + namespace: {{ $.Release.Namespace }} + labels: + app.kubernetes.io/managed-by: eks-addon +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: datadog-agent-lifecycle-runtime + labels: + app.kubernetes.io/managed-by: eks-addon +rules: [] +{{- end }} diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index 2ff26d5f4f..c699d6da34 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -7,3 +7,5 @@ datadog-operator: repository: 709825985650.dkr.ecr.us-east-1.amazonaws.com/datadog/operator tag: 1.28.0 operatorMetricsEnabled: false + +lifecycle: null From 623ecc111d33ca66f99202269734ccdab47d9ab9 Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Thu, 16 Jul 2026 18:17:31 -0400 Subject: [PATCH 2/4] Rename managed installation chart values --- marketplaces/charts/operator-eks-addon/README.md | 12 ++++++------ .../aws_mp_configuration_schema.json | 2 +- ...ifecycle.yaml => managed_agent_installation.yaml} | 8 ++++---- marketplaces/charts/operator-eks-addon/values.yaml | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) rename marketplaces/charts/operator-eks-addon/templates/{lifecycle.yaml => managed_agent_installation.yaml} (79%) diff --git a/marketplaces/charts/operator-eks-addon/README.md b/marketplaces/charts/operator-eks-addon/README.md index ebb7df7da7..da8cdc056c 100644 --- a/marketplaces/charts/operator-eks-addon/README.md +++ b/marketplaces/charts/operator-eks-addon/README.md @@ -1,15 +1,15 @@ # Operator EKS Add-on -This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the lifecycle bridge resources when lifecycle values are present. +This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the managed Agent installation bridge resources when managed Agent installation values are present. -## Instrumenter lifecycle bridge +## Instrumenter managed Agent installation bridge -The optional `lifecycle` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_ADDON_LIFECYCLE_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. +The optional `managedAgentInstallation` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_MANAGED_AGENT_INSTALLATION_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. -Lifecycle configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. +Managed Agent installation configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. ```yaml -lifecycle: +managedAgentInstallation: version: v1 installationID: 123e4567-e89b-42d3-a456-426614174000 eksARNSHA256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef @@ -21,7 +21,7 @@ lifecycle: site: datadoghq.com ``` -The lifecycle specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. +The managed Agent installation specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. ## Version Mapping | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent | diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index a8f18b9274..45239050e9 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -162,7 +162,7 @@ } } }, - "lifecycle": { + "managedAgentInstallation": { "type": [ "object", "null" diff --git a/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml similarity index 79% rename from marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml rename to marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml index 8204a34350..b4099d3709 100644 --- a/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml @@ -1,4 +1,4 @@ -{{- with .Values.lifecycle }} +{{- with .Values.managedAgentInstallation }} {{- $intent := dict "version" .version "installationID" .installationID @@ -13,7 +13,7 @@ apiVersion: v1 kind: ConfigMap metadata: - name: datadog-agent-lifecycle-intent + name: datadog-agent-managed-installation-intent namespace: datadog labels: app.kubernetes.io/managed-by: eks-addon @@ -24,7 +24,7 @@ data: apiVersion: v1 kind: ConfigMap metadata: - name: datadog-agent-lifecycle-runtime + name: datadog-agent-managed-installation-runtime namespace: {{ $.Release.Namespace }} labels: app.kubernetes.io/managed-by: eks-addon @@ -32,7 +32,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: datadog-agent-lifecycle-runtime + name: datadog-agent-managed-installation-runtime labels: app.kubernetes.io/managed-by: eks-addon rules: [] diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index c699d6da34..0aceed94b0 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -8,4 +8,4 @@ datadog-operator: tag: 1.28.0 operatorMetricsEnabled: false -lifecycle: null +managedAgentInstallation: null From 3c792a1def53cd6f20d9595a0114ebc4a5099699 Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Tue, 21 Jul 2026 10:43:30 -0400 Subject: [PATCH 3/4] Support managed installation credentials in EKS add-on --- .../aws_mp_configuration_schema.json | 36 +++++++++++++------ .../templates/managed_agent_installation.yaml | 18 +--------- ...anaged_agent_installation_credentials.yaml | 24 +++++++++++++ .../charts/operator-eks-addon/values.yaml | 1 + 4 files changed, 51 insertions(+), 28 deletions(-) create mode 100644 marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index 45239050e9..70c069b8f4 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -142,23 +142,20 @@ } } }, - "remoteUpdates": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean" - } - } - }, - "createControllerRevisions": { - "type": "boolean" - }, "watchNamespaces": { "type": "array", "items": {} }, "containerSecurityContext": { "type": "object" + }, + "volumes": { + "type": "array", + "items": {} + }, + "volumeMounts": { + "type": "array", + "items": {} } } }, @@ -234,6 +231,23 @@ "bootstrap" ], "additionalProperties": false + }, + "managedAgentInstallationCredentials": { + "type": [ + "object", + "null" + ], + "properties": { + "secretsManagerSecretID": { + "type": "string", + "minLength": 1, + "maxLength": 2048 + } + }, + "required": [ + "secretsManagerSecretID" + ], + "additionalProperties": false } } } diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml index b4099d3709..63911619b1 100644 --- a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml @@ -14,26 +14,10 @@ apiVersion: v1 kind: ConfigMap metadata: name: datadog-agent-managed-installation-intent - namespace: datadog + namespace: {{ $.Release.Namespace }} labels: app.kubernetes.io/managed-by: eks-addon data: intent.json: |- {{ $intent | toJson }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: datadog-agent-managed-installation-runtime - namespace: {{ $.Release.Namespace }} - labels: - app.kubernetes.io/managed-by: eks-addon ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: datadog-agent-managed-installation-runtime - labels: - app.kubernetes.io/managed-by: eks-addon -rules: [] {{- end }} diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml new file mode 100644 index 0000000000..6e2f9db948 --- /dev/null +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml @@ -0,0 +1,24 @@ +{{- with .Values.managedAgentInstallationCredentials }} +apiVersion: secrets-store.csi.x-k8s.io/v1 +kind: SecretProviderClass +metadata: + name: datadog-api-key + namespace: {{ $.Release.Namespace }} + labels: + app.kubernetes.io/managed-by: eks-addon +spec: + provider: aws + secretObjects: + - secretName: datadog-secret + type: Opaque + data: + - objectName: api-key + key: api-key + parameters: + usePodIdentity: "true" + objects: | + - objectName: {{ .secretsManagerSecretID | quote }} + objectType: secretsmanager + objectAlias: api-key + filePermission: "0400" +{{- end }} diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index 0aceed94b0..1d93de25a2 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -9,3 +9,4 @@ datadog-operator: operatorMetricsEnabled: false managedAgentInstallation: null +managedAgentInstallationCredentials: null From 6c9ce50c8e2b109979d54d4092ba0c11cd9d9a70 Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Tue, 21 Jul 2026 14:21:11 -0400 Subject: [PATCH 4/4] Add EKS add-on credential sync resources --- .../charts/operator-eks-addon/README.md | 28 ++--- .../aws_mp_configuration_schema.json | 113 ------------------ .../templates/managed_agent_installation.yaml | 23 ---- ...anaged_agent_installation_credentials.yaml | 80 +++++++++++++ .../charts/operator-eks-addon/values.yaml | 1 - 5 files changed, 92 insertions(+), 153 deletions(-) delete mode 100644 marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml diff --git a/marketplaces/charts/operator-eks-addon/README.md b/marketplaces/charts/operator-eks-addon/README.md index da8cdc056c..b994006bc5 100644 --- a/marketplaces/charts/operator-eks-addon/README.md +++ b/marketplaces/charts/operator-eks-addon/README.md @@ -1,28 +1,24 @@ # Operator EKS Add-on -This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the managed Agent installation bridge resources when managed Agent installation values are present. +This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency. -## Instrumenter managed Agent installation bridge +## Managed Agent installation credentials sync -The optional `managedAgentInstallation` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_MANAGED_AGENT_INSTALLATION_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. +The optional `managedAgentInstallationCredentials` value renders the resources that sync a Datadog API key from AWS Secrets Manager into `datadog-secret[api-key]` in the add-on namespace: -Managed Agent installation configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. +- `ServiceAccount/datadog-ascp-sync` +- `SecretProviderClass/datadog-api-key` +- a Linux-only `Deployment/datadog-ascp-secret-sync` that keeps the CSI volume mounted + +The cluster must have the AWS Secrets Store CSI Driver provider and EKS Pod Identity Agent add-ons installed. The CSI driver must enable Kubernetes Secret sync, and the sync ServiceAccount must have an EKS Pod Identity association whose IAM role can read the configured Secrets Manager secret. The add-on namespace and Pod Identity association namespace must match. The sync Deployment requires a Linux EC2 node because the AWS provider does not support Fargate. + +Enable the CSI driver's rotation reconciler if updates to the Secrets Manager value must propagate to `datadog-secret` without restarting the sync Deployment. ```yaml -managedAgentInstallation: - version: v1 - installationID: 123e4567-e89b-42d3-a456-426614174000 - eksARNSHA256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - operationID: 123e4567-e89b-42d3-a456-426614174010 - desiredState: installed - acknowledgedOperationID: "" - bootstrap: - clusterName: example-cluster - site: datadoghq.com +managedAgentInstallationCredentials: + secretsManagerSecretID: arn:aws:secretsmanager:us-east-1:123456789012:secret:/datadog/eks-instrumenter/123456789012/example ``` -The managed Agent installation specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. - ## Version Mapping | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent | | :-: | :-: | :-: | :-: | :-: | :-: | diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index 70c069b8f4..0220e5451e 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -110,128 +110,15 @@ "collectOperatorMetrics": { "type": "boolean" }, - "apiKeyExistingSecret": { - "type": "string" - }, - "datadogCRDs": { - "type": "object", - "properties": { - "crds": { - "type": "object", - "properties": { - "datadogAgentProfiles": { - "type": "boolean" - } - } - } - } - }, - "datadogAgentProfile": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean" - } - } - }, - "remoteConfiguration": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean" - } - } - }, "watchNamespaces": { "type": "array", "items": {} }, "containerSecurityContext": { "type": "object" - }, - "volumes": { - "type": "array", - "items": {} - }, - "volumeMounts": { - "type": "array", - "items": {} } } }, - "managedAgentInstallation": { - "type": [ - "object", - "null" - ], - "properties": { - "version": { - "type": "string", - "enum": [ - "v1" - ] - }, - "installationID": { - "type": "string", - "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" - }, - "eksARNSHA256": { - "type": "string", - "pattern": "^[0-9a-f]{64}$" - }, - "operationID": { - "type": "string", - "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" - }, - "desiredState": { - "type": "string", - "enum": [ - "installed", - "absent" - ] - }, - "acknowledgedOperationID": { - "type": "string", - "pattern": "^$|^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" - }, - "bootstrap": { - "type": "object", - "properties": { - "clusterName": { - "type": "string", - "minLength": 1, - "maxLength": 100 - }, - "site": { - "type": "string", - "enum": [ - "datadoghq.com", - "datadoghq.eu", - "us3.datadoghq.com", - "us5.datadoghq.com", - "ddog-gov.com", - "ap1.datadoghq.com", - "ap2.datadoghq.com" - ] - } - }, - "required": [ - "clusterName", - "site" - ], - "additionalProperties": false - } - }, - "required": [ - "version", - "installationID", - "eksARNSHA256", - "operationID", - "desiredState", - "bootstrap" - ], - "additionalProperties": false - }, "managedAgentInstallationCredentials": { "type": [ "object", diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml deleted file mode 100644 index 63911619b1..0000000000 --- a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- with .Values.managedAgentInstallation }} -{{- $intent := dict - "version" .version - "installationID" .installationID - "eksARNSHA256" .eksARNSHA256 - "operationID" .operationID - "desiredState" .desiredState - "bootstrap" .bootstrap --}} -{{- with .acknowledgedOperationID }} -{{- $_ := set $intent "acknowledgedOperationID" . -}} -{{- end }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: datadog-agent-managed-installation-intent - namespace: {{ $.Release.Namespace }} - labels: - app.kubernetes.io/managed-by: eks-addon -data: - intent.json: |- - {{ $intent | toJson }} -{{- end }} diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml index 6e2f9db948..9d218c607a 100644 --- a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml @@ -1,16 +1,28 @@ {{- with .Values.managedAgentInstallationCredentials }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: datadog-ascp-sync + namespace: {{ $.Release.Namespace }} + labels: + app.kubernetes.io/name: datadog-ascp-secret-sync + app.kubernetes.io/managed-by: eks-addon +--- apiVersion: secrets-store.csi.x-k8s.io/v1 kind: SecretProviderClass metadata: name: datadog-api-key namespace: {{ $.Release.Namespace }} labels: + app.kubernetes.io/name: datadog-ascp-secret-sync app.kubernetes.io/managed-by: eks-addon spec: provider: aws secretObjects: - secretName: datadog-secret type: Opaque + labels: + app.kubernetes.io/managed-by: eks-addon data: - objectName: api-key key: api-key @@ -21,4 +33,72 @@ spec: objectType: secretsmanager objectAlias: api-key filePermission: "0400" +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: datadog-ascp-secret-sync + namespace: {{ $.Release.Namespace }} + labels: + app.kubernetes.io/name: datadog-ascp-secret-sync + app.kubernetes.io/managed-by: eks-addon +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: datadog-ascp-secret-sync + template: + metadata: + labels: + app.kubernetes.io/name: datadog-ascp-secret-sync + app.kubernetes.io/managed-by: eks-addon + spec: + serviceAccountName: datadog-ascp-sync + nodeSelector: + kubernetes.io/os: linux + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: eks.amazonaws.com/compute-type + operator: NotIn + values: + - fargate + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: secret-sync + image: public.ecr.aws/amazonlinux/amazonlinux:2023 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-c"] + args: ["trap : TERM INT; sleep infinity & wait"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 65534 + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 50m + memory: 64Mi + volumeMounts: + - name: datadog-api-key + mountPath: /mnt/datadog-api-key + readOnly: true + volumes: + - name: datadog-api-key + csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: datadog-api-key {{- end }} diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index 1d93de25a2..9d16658447 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -8,5 +8,4 @@ datadog-operator: tag: 1.28.0 operatorMetricsEnabled: false -managedAgentInstallation: null managedAgentInstallationCredentials: null