Skip to content

Commit c27e362

Browse files
krlvkrlv
committed
OTAGENT-254 Add support for enhanced RBAC permissions for otel-agent
1 parent c7c5991 commit c27e362

File tree

8 files changed

+164
-2
lines changed

8 files changed

+164
-2
lines changed

‎charts/datadog/CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Datadog changelog
22

3+
## 3.91.0
4+
5+
* Add `datadog.otelCollector.rbac.create` to control creation additional ClusterRole for `otel-agent` required by Kubernetes Attributes processor.
6+
* Add `datadog.otelCollector.rbac.rules` to support additional RBAC permissions required by OTel components that are not included by default with `otel-agent`.
7+
38
## 3.90.5
49

510
* Update `fips.image.tag` to `1.1.7` updating openSSL version to 3.0.16

‎charts/datadog/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
apiVersion: v1
33
name: datadog
4-
version: 3.90.5
4+
version: 3.91.0
55
appVersion: "7"
66
description: Datadog Agent
77
keywords:

‎charts/datadog/README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Datadog
22

3-
![Version: 3.90.5](https://img.shields.io/badge/Version-3.90.5-informational?style=flat-square) ![AppVersion: 7](https://img.shields.io/badge/AppVersion-7-informational?style=flat-square)
3+
![Version: 3.91.0](https://img.shields.io/badge/Version-3.91.0-informational?style=flat-square) ![AppVersion: 7](https://img.shields.io/badge/AppVersion-7-informational?style=flat-square)
44

55
[Datadog](https://www.datadoghq.com/) is a hosted infrastructure monitoring platform. This chart adds the Datadog Agent to all nodes in your cluster via a DaemonSet. It also optionally depends on the [kube-state-metrics chart](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-state-metrics). For more information about monitoring Kubernetes with Datadog, please refer to the [Datadog documentation website](https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/).
66

@@ -803,6 +803,8 @@ helm install <RELEASE_NAME> \
803803
| datadog.otelCollector.config | string | `nil` | OTel collector configuration |
804804
| datadog.otelCollector.enabled | bool | `false` | Enable the OTel Collector |
805805
| datadog.otelCollector.ports | list | `[{"containerPort":"4317","name":"otel-grpc"},{"containerPort":"4318","name":"otel-http"}]` | Ports that OTel Collector is listening |
806+
| datadog.otelCollector.rbac.create | bool | `true` | If true, check OTel Collector config for k8sattributes processor and create required ClusterRole to access Kubernetes API |
807+
| datadog.otelCollector.rbac.rules | list | `[]` | A set of additional RBAC rules to apply to OTel Collector's ClusterRole |
806808
| datadog.otlp.logs.enabled | bool | `false` | Enable logs support in the OTLP ingest endpoint |
807809
| datadog.otlp.receiver.protocols.grpc.enabled | bool | `false` | Enable the OTLP/gRPC endpoint |
808810
| datadog.otlp.receiver.protocols.grpc.endpoint | string | `"0.0.0.0:4317"` | OTLP/gRPC endpoint |

‎charts/datadog/ci/agent-otel-collector-with-rbac-custom-rules-values.yaml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
targetSystem: "linux"
2+
agents:
3+
image:
4+
repository: datadog/agent-dev
5+
tag: nightly-ot-beta-main
6+
doNotCheckTag: true
7+
containers:
8+
agent:
9+
env:
10+
- name: DD_HOSTNAME
11+
value: "datadog"
12+
datadog:
13+
apiKey: "00000000000000000000000000000000"
14+
appKey: "0000000000000000000000000000000000000000"
15+
otelCollector:
16+
enabled: true
17+
rbac:
18+
create: true
19+
rules:
20+
- apiGroups: [""]
21+
resources: ["nodes"]
22+
verbs: ["get", "watch", "list"]
23+
config: |
24+
processors:
25+
k8sattributes/passthrough:
26+
passthrough: true
27+
k8sattributes:
28+
receivers:
29+
otlp:
30+
exporters:
31+
datadog:
32+
api:
33+
key: "00000000000000000000000000000000"
34+
service:
35+
pipelines:
36+
traces:
37+
receivers: [otlp]
38+
processors: [k8sattributes]
39+
exporters: [datadog]
40+
metrics:
41+
receivers: [otlp]
42+
processors: [k8sattributes]
43+
exporters: [datadog]
44+
logs:
45+
receivers: [otlp]
46+
processors: [k8sattributes]
47+
exporters: [datadog]

‎charts/datadog/ci/agent-otel-collector-with-rbac-values.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
targetSystem: "linux"
2+
agents:
3+
image:
4+
repository: datadog/agent-dev
5+
tag: nightly-ot-beta-main
6+
doNotCheckTag: true
7+
containers:
8+
agent:
9+
env:
10+
- name: DD_HOSTNAME
11+
value: "datadog"
12+
datadog:
13+
apiKey: "00000000000000000000000000000000"
14+
appKey: "0000000000000000000000000000000000000000"
15+
otelCollector:
16+
enabled: true
17+
config: |
18+
processors:
19+
k8sattributes:
20+
k8sattributes/passthrough:
21+
passthrough: true
22+
receivers:
23+
otlp:
24+
exporters:
25+
datadog:
26+
api:
27+
key: "00000000000000000000000000000000"
28+
service:
29+
pipelines:
30+
traces:
31+
receivers: [otlp]
32+
processors: [k8sattributes]
33+
exporters: [datadog]
34+
metrics:
35+
receivers: [otlp]
36+
processors: [k8sattributes]
37+
exporters: [datadog]
38+
logs:
39+
receivers: [otlp]
40+
processors: [k8sattributes]
41+
exporters: [datadog]

‎charts/datadog/templates/_helpers.tpl

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,22 @@ false
117117
{{- end -}}
118118
{{- end -}}
119119

120+
{{/*
121+
Return true if k8sattributes RBAC rules should be added to the OTel Agent ClusterRole
122+
*/}}
123+
{{- define "should-add-otel-agent-k8sattributes-rules" -}}
124+
{{- $return := false }}
125+
{{- $config := .Values.datadog.otelCollector.config | default "" | fromYaml }}
126+
{{- range $key, $val := $config.processors }}
127+
{{- if hasPrefix "k8sattributes" $key }}
128+
{{- if or (empty $val) (empty $val.passthrough) }}
129+
{{- $return = true }}
130+
{{- end }}
131+
{{- end }}
132+
{{- end }}
133+
{{- $return }}
134+
{{- end -}}
135+
120136
{{/*
121137
Return secret name to be used based on provided values.
122138
*/}}

‎charts/datadog/templates/otel-agent-rbac.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{{- if and .Values.agents.rbac.create (eq (include "should-enable-otel-agent" .) "true") .Values.datadog.otelCollector.rbac.create -}}
2+
{{- if or (eq (include "should-add-otel-agent-k8sattributes-rules" .) "true") .Values.datadog.otelCollector.rbac.rules -}}
3+
apiVersion: {{ template "rbac.apiVersion" . }}
4+
kind: ClusterRole
5+
metadata:
6+
name: {{ template "datadog.fullname" . }}-otel-agent
7+
labels:
8+
{{ include "datadog.labels" . | indent 4 }}
9+
rules:
10+
{{- if eq (include "should-add-otel-agent-k8sattributes-rules" .) "true" }}
11+
- apiGroups: [""]
12+
resources: ["pods", "namespaces"]
13+
verbs: ["get", "watch", "list"]
14+
- apiGroups: ["apps"]
15+
resources: ["replicasets"]
16+
verbs: ["get", "list", "watch"]
17+
- apiGroups: ["extensions"]
18+
resources: ["replicasets"]
19+
verbs: ["get", "list", "watch"]
20+
{{- end -}}
21+
{{- if .Values.datadog.otelCollector.rbac.rules -}}
22+
{{ toYaml .Values.datadog.otelCollector.rbac.rules | nindent 2 -}}
23+
{{- end }}
24+
---
25+
apiVersion: {{ template "rbac.apiVersion" . }}
26+
kind: ClusterRoleBinding
27+
metadata:
28+
name: {{ template "datadog.fullname" . }}-otel-agent
29+
labels:
30+
{{ include "datadog.labels" . | indent 4 }}
31+
roleRef:
32+
apiGroup: rbac.authorization.k8s.io
33+
kind: ClusterRole
34+
name: {{ template "datadog.fullname" . }}-otel-agent
35+
subjects:
36+
- kind: ServiceAccount
37+
name: {{ include "agents.serviceAccountName" . }}-otel-agent
38+
namespace: {{ .Release.Namespace }}
39+
{{- end -}}
40+
{{- end -}}

‎charts/datadog/values.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -600,6 +600,17 @@ datadog:
600600
# datadog.otelCollector.config -- OTel collector configuration
601601
config: null
602602

603+
## Provide OTel Collector RBAC configuration
604+
rbac:
605+
# datadog.otelCollector.rbac.create -- If true, check OTel Collector config for k8sattributes processor
606+
# and create required ClusterRole to access Kubernetes API
607+
create: true
608+
# datadog.otelCollector.rbac.rules -- A set of additional RBAC rules to apply to OTel Collector's ClusterRole
609+
rules: []
610+
# - apiGroups: [""]
611+
# resources: ["pods", "nodes"]
612+
# verbs: ["get", "list", "watch"]
613+
603614
## Continuous Profiler configuration
604615
##
605616
## Continuous Profiler is disabled by default and can be enabled by setting the `enabled` field to

0 commit comments

Comments
 (0)