[TON-743] Add EKS add-on credential sync resources

marketplaces/charts/operator-eks-addon/README.md

@@ -1,6 +1,23 @@
 # Operator EKS Add-on
 
-This is a wrapper chart for installing EKS add-on. Charts required for the add-on are added as a dependency to this chart. Chart itself doesn't contain any templates or configurable properties.
+This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency.
+
+## Managed Agent installation credentials sync
+
+The optional `managedAgentInstallationCredentials` value renders the resources that sync a Datadog API key from AWS Secrets Manager into `datadog-secret[api-key]` in the add-on namespace:
+
+- `ServiceAccount/datadog-ascp-sync`
+- `SecretProviderClass/datadog-api-key`
+- a Linux-only `Deployment/datadog-ascp-secret-sync` that keeps the CSI volume mounted
+
+The cluster must have the AWS Secrets Store CSI Driver provider and EKS Pod Identity Agent add-ons installed. The CSI driver must enable Kubernetes Secret sync, and the sync ServiceAccount must have an EKS Pod Identity association whose IAM role can read the configured Secrets Manager secret. The add-on namespace and Pod Identity association namespace must match. The sync Deployment requires a Linux EC2 node because the AWS provider does not support Fargate.
+
+Enable the CSI driver's rotation reconciler if updates to the Secrets Manager value must propagate to `datadog-secret` without restarting the sync Deployment.
+
+```yaml
+managedAgentInstallationCredentials:
+  secretsManagerSecretID: arn:aws:secretsmanager:us-east-1:123456789012:secret:/datadog/eks-instrumenter/123456789012/example
+```
 
 ## Version Mapping
 | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent |

marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json

@@ -118,6 +118,23 @@
           "type": "object"
         }
       }
+    },
+    "managedAgentInstallationCredentials": {
+      "type": [
+        "object",
+        "null"
+      ],
+      "properties": {
+        "secretsManagerSecretID": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048
+        }
+      },
+      "required": [
+        "secretsManagerSecretID"
+      ],
+      "additionalProperties": false
     }
   }
-}
+}

marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml

@@ -0,0 +1,104 @@
+{{- with .Values.managedAgentInstallationCredentials }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: datadog-ascp-sync
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: datadog-ascp-secret-sync
+    app.kubernetes.io/managed-by: eks-addon
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: datadog-api-key
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: datadog-ascp-secret-sync
+    app.kubernetes.io/managed-by: eks-addon
+spec:
+  provider: aws
+  secretObjects:
+    - secretName: datadog-secret
+      type: Opaque
+      labels:
+        app.kubernetes.io/managed-by: eks-addon
+      data:
+        - objectName: api-key
+          key: api-key
+  parameters:
+    usePodIdentity: "true"
+    objects: |
+      - objectName: {{ .secretsManagerSecretID | quote }}
+        objectType: secretsmanager
+        objectAlias: api-key
+        filePermission: "0400"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: datadog-ascp-secret-sync
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: datadog-ascp-secret-sync
+    app.kubernetes.io/managed-by: eks-addon
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: datadog-ascp-secret-sync
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: datadog-ascp-secret-sync
+        app.kubernetes.io/managed-by: eks-addon
+    spec:
+      serviceAccountName: datadog-ascp-sync
+      nodeSelector:
+        kubernetes.io/os: linux
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: eks.amazonaws.com/compute-type
+                    operator: NotIn
+                    values:
+                      - fargate
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: secret-sync
+          image: public.ecr.aws/amazonlinux/amazonlinux:2023
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args: ["trap : TERM INT; sleep infinity & wait"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 50m
+              memory: 64Mi
+          volumeMounts:
+            - name: datadog-api-key
+              mountPath: /mnt/datadog-api-key
+              readOnly: true
+      volumes:
+        - name: datadog-api-key
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: datadog-api-key
+{{- end }}

marketplaces/charts/operator-eks-addon/values.yaml

@@ -7,3 +7,5 @@ datadog-operator:
     repository: 709825985650.dkr.ecr.us-east-1.amazonaws.com/datadog/operator
     tag: 1.28.0
   operatorMetricsEnabled: false
+
+managedAgentInstallationCredentials: null