Skip to content

Commit 0073e7f

Browse files
yitzhaktalyitzhaktal
committed
Merge remote-tracking branch 'origin/main' into DEVOPS-2694-security-lightrun-installer-container-must-not-consume-secrets-as-env-vars
2 parents 0ec4cf9 + c174820 commit 0073e7f

File tree

14 files changed

+276
-152
lines changed

14 files changed

+276
-152
lines changed

‎.github/workflows/tests_data/lightrunjavaagent.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ spec:
1010
deploymentName: sample-deployment
1111
secretName: lightrun-secrets
1212
serverHostname: dogfood.internal.lightrun.com
13-
useSecretAsEnvVars: true
13+
useSecretsAsMountedFiles: false
1414
agentEnvVarName: JAVA_TOOL_OPTIONS
1515
agentConfig:
1616
max_log_cpu_cost: "2"

‎api/v1beta/lightrunjavaagent_types.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package v1beta
1818

1919
import (
20+
corev1 "k8s.io/api/core/v1"
2021
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2122
)
2223

@@ -41,6 +42,8 @@ type InitContainer struct {
4142
SharedVolumeMountPath string `json:"sharedVolumeMountPath"`
4243
// Image of the init container. Image name and tag will define platform and version of the agent
4344
Image string `json:"image"`
45+
// Pull policy of the init container. Can be one of: Always, IfNotPresent, or Never.
46+
ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
4447
}
4548

4649
// LightrunJavaAgentSpec defines the desired state of LightrunJavaAgent
@@ -91,9 +94,9 @@ type LightrunJavaAgentSpec struct {
9194
// Agent name for registration to the server
9295
AgentName string `json:"agentName,omitempty"`
9396

94-
// UseSecretAsEnvVars determines whether to use secret values as environment variables (true) or as mounted files (false)
95-
// +kubebuilder:default=true
96-
UseSecretAsEnvVars bool `json:"useSecretAsEnvVars,omitempty"`
97+
// UseSecretsAsMountedFiles determines whether to use secret values as mounted files (true) or as environment variables (false)
98+
// +kubebuilder:default=false
99+
UseSecretsAsMountedFiles bool `json:"useSecretsAsMountedFiles,omitempty"`
97100
}
98101

99102
// LightrunJavaAgentStatus defines the observed state of LightrunJavaAgent

‎charts/lightrun-agents/README.md

Lines changed: 75 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,11 @@ The values.yaml file includes the following configurable parameters for each Jav
3131
| `javaAgents[].agentPoolCredentials.pinnedCertHash` | 64 character sha256 certificate public key hash for pinning. | Required if `existingSecret` not set |
3232
| `javaAgents[].agentTags` | [List of Lightrun Java Agent tags](https://docs.lightrun.com/jvm/tagging/#manage-lightrun-java-agent-tags). | Optional `[]` (empty list) |
3333
| `javaAgents[].containerSelector` | Selector for containers within the deployment to inject the Lightrun Java Agent. | Required |
34-
| `javaAgents[].deploymentName` | Name of the Kubernetes deployment to attach the Lightrun Java Agent. | Required |
34+
| `javaAgents[].workloadName` | Name of the Kubernetes workload (Deployment or StatefulSet) to attach the Lightrun Java Agent. **Recommended over `deploymentName`**. | Required (if `deploymentName` not used) |
35+
| `javaAgents[].workloadType` | Type of the Kubernetes workload. Must be either `"Deployment"` or `"StatefulSet"`. **Required when using `workloadName`**. | Required (if `workloadName` is used) |
36+
| `javaAgents[].deploymentName` | **[DEPRECATED]** Name of the Kubernetes deployment to attach the Lightrun Java Agent. Use `workloadName` and `workloadType` instead. | Required (if `workloadName` not used) |
3537
| `javaAgents[].initContainer.image` | Image for the Lightrun Java Agent init container. | Required |
38+
| `javaAgents[].initContainer.imagePullPolicy` | Image pull policy for the init container. Can be one of: Always, IfNotPresent, or Never. | Optional (if not provided, defaults according to [Kubernetes Default Image Pull Policy](https://kubernetes.io/docs/concepts/containers/images/#imagepullpolicy-defaulting)) |
3639
| `javaAgents[].initContainer.sharedVolumeMountPath` | Mount path for the shared volume in the init container. | Optional (if not provided, defaults to `"/lightrun"`" |
3740
| `javaAgents[].initContainer.sharedVolumeName` | Name of the shared volume for the init container. | Optional (if not provided, defaults to `"lightrun-agent-init"`" |
3841
| `javaAgents[].name` | Name of the Lightrun Java Agent custom resource. | Required |
@@ -73,24 +76,62 @@ Use the -n flag to specify a namespace, either using the same namespace where yo
7376
helm install <release-name> lightrun-k8s-operator/lightrun-agents -n <namespace> -f values.yaml
7477
```
7578

79+
## Migration from Legacy Configuration
80+
81+
If you are currently using the `deploymentName` field, you should migrate to the new `workloadName` and `workloadType` fields for better clarity and StatefulSet support:
82+
83+
**Legacy Configuration (deprecated):**
84+
```yaml
85+
javaAgents:
86+
- name: 'my-service'
87+
namespace: 'my-namespace'
88+
deploymentName: "my-deployment" # deprecated
89+
# ... other fields
90+
```
91+
92+
**New Configuration (recommended):**
93+
```yaml
94+
javaAgents:
95+
- name: 'my-service'
96+
namespace: 'my-namespace'
97+
workloadName: "my-deployment" # new field
98+
workloadType: "Deployment" # new field (required)
99+
# ... other fields
100+
```
101+
102+
**For StatefulSets:**
103+
```yaml
104+
javaAgents:
105+
- name: 'my-service'
106+
namespace: 'my-namespace'
107+
workloadName: "my-statefulset" # new field
108+
workloadType: "StatefulSet" # new field (required)
109+
# ... other fields
110+
```
111+
112+
> **Note:** You cannot use both `deploymentName` and `workloadName`/`workloadType` in the same configuration. The chart validation will fail if both are specified.
113+
76114
## Examples
77115

78116
### Basic
79117

80-
- The `my-service-1` does not use an `existingSecret` and instead the `agentPoolCredentials.apiKey` and `agentPoolCredentials.pinnedCertHash` are provided directly.
81-
82-
- The `my-service-2` uses an `existingSecret` named `my-existing-secret`
118+
- The `my-service-1` uses the new workload configuration (recommended) for a Deployment and does not use an `existingSecret`
119+
- The `my-service-2` uses the new workload configuration for a StatefulSet and uses an `existingSecret` named `my-existing-secret`
120+
- The `my-service-3` shows the legacy configuration using `deploymentName` (deprecated but still supported)
83121

84122
```yaml
85123
javaAgents:
86124
- name: 'my-service-1'
87125
namespace: 'my-namespace-1'
88-
deploymentName: "my-deployment-1"
126+
# New workload configuration (recommended)
127+
workloadName: "my-deployment-1"
128+
workloadType: "Deployment"
89129
containerSelector:
90130
- my-container-1
91131
serverHostname: 'lightrun.example.com'
92132
initContainer:
93133
image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
134+
imagePullPolicy: "IfNotPresent"
94135
agentPoolCredentials:
95136
existingSecret: ""
96137
apiKey: "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
@@ -104,7 +145,9 @@ javaAgents:
104145
namespace: 'my-namespace-2'
105146
initContainer:
106147
image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
107-
deploymentName: "my-deployment-2"
148+
# StatefulSet configuration
149+
workloadName: "my-statefulset-2"
150+
workloadType: "StatefulSet"
108151
containerSelector:
109152
- my-container-2
110153
serverHostname: 'lightrun.example.com'
@@ -117,19 +160,36 @@ javaAgents:
117160
- service-my-other-server
118161
- region-us_east_1
119162
- provider-aws
163+
- name: 'my-service-3'
164+
namespace: 'my-namespace-3'
165+
# Legacy configuration (deprecated but still supported)
166+
deploymentName: "my-deployment-3"
167+
containerSelector:
168+
- my-container-3
169+
serverHostname: 'lightrun.example.com'
170+
initContainer:
171+
image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
172+
agentPoolCredentials:
173+
existingSecret: "my-existing-secret"
174+
apiKey: ""
175+
pinnedCertHash: ""
176+
agentTags:
177+
- env-production
178+
- service-legacy
120179
```
121180
122181
### Full
123182
124-
- The `my-service-1` does not use an `existingSecret` and instead the `agentPoolCredentials.apiKey` and `agentPoolCredentials.pinnedCertHash` are provided directly.
125-
126-
- The `my-service-2` uses an `existingSecret` named `my-existing-secret`
183+
- The `my-service-1` uses the new workload configuration for a Deployment with full configuration options
184+
- The `my-service-2` uses the new workload configuration for a StatefulSet with an `existingSecret`
127185

128186
```yaml
129187
javaAgents:
130188
- name: 'my-service-1'
131189
namespace: 'my-namespace-1'
132-
deploymentName: "my-deployment-1"
190+
# New workload configuration (recommended)
191+
workloadName: "my-deployment-1"
192+
workloadType: "Deployment"
133193
containerSelector:
134194
- my-container-1
135195
serverHostname: 'lightrun.example.com'
@@ -139,6 +199,7 @@ javaAgents:
139199
agentCliFlags: "--lightrun_extra_class_path=<PATH_TO_JAR>:<PATH_TO_JAR>,lightrun_init_wait_time_ms"
140200
initContainer:
141201
image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
202+
imagePullPolicy: "IfNotPresent"
142203
sharedVolumeName: 'my-shared-volume'
143204
sharedVolumeMountPath: '/mypath'
144205
agentPoolCredentials:
@@ -154,9 +215,12 @@ javaAgents:
154215
namespace: 'my-namespace-2'
155216
initContainer:
156217
image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
218+
imagePullPolicy: "IfNotPresent"
157219
sharedVolumeName: 'my-shared-volume'
158220
sharedVolumeMountPath: '/mypath'
159-
deploymentName: "my-deployment-2"
221+
# StatefulSet configuration with full options
222+
workloadName: "my-statefulset-2"
223+
workloadType: "StatefulSet"
160224
containerSelector:
161225
- my-container-2
162226
serverHostname: 'lightrun.example.com'

‎charts/lightrun-agents/templates/_checkConfig.tpl

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,17 @@ Compile all warnings into a single message, and call fail.
2222
{{- if not .initContainer.image }}
2323
{{- $objectErrorMsgs = append $objectErrorMsgs "Init Container Image Checker:\n Error: The 'initContainer.image' field is missing. Please provide the 'initContainer.image' parameter." -}}
2424
{{- end }}
25-
{{- if not .deploymentName }}
26-
{{- $objectErrorMsgs = append $objectErrorMsgs "Deployment Name Checker:\n Error: The 'deploymentName' field is missing. Please provide the 'deploymentName' parameter." -}}
25+
26+
{{- /* Workload configuration validation */}}
27+
{{- $hasDeploymentName := .deploymentName }}
28+
{{- $hasWorkloadConfig := and .workloadName .workloadType }}
29+
30+
{{- if and $hasDeploymentName $hasWorkloadConfig }}
31+
{{- $objectErrorMsgs = append $objectErrorMsgs "Workload Configuration Checker:\n Error: Both 'deploymentName' (legacy) and 'workloadName'/'workloadType' (new) are specified. Please use only one configuration method: either 'deploymentName' OR 'workloadName' with 'workloadType'." -}}
32+
{{- else if not (or $hasDeploymentName $hasWorkloadConfig) }}
33+
{{- $objectErrorMsgs = append $objectErrorMsgs "Workload Configuration Checker:\n Error: No workload configuration specified. Please provide either 'deploymentName' (legacy) OR 'workloadName' with 'workloadType' (recommended)." -}}
2734
{{- end }}
35+
2836
{{- if not .containerSelector }}
2937
{{- $objectErrorMsgs = append $objectErrorMsgs "Container Selector Checker:\n Error: The 'containerSelector' field is missing. Please provide the 'containerSelector' parameter." -}}
3038
{{- end }}

‎charts/lightrun-agents/templates/java-agent-cr.yaml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,29 @@ metadata:
88
spec:
99
initContainer:
1010
image: {{ .initContainer.image }}
11+
{{- if .initContainer.imagePullPolicy }}
12+
imagePullPolicy: {{ .initContainer.imagePullPolicy }}
13+
{{- end }}
1114
sharedVolumeName: {{ .initContainer.sharedVolumeName | default "lightrun-agent-init" }}
1215
sharedVolumeMountPath: {{ .initContainer.sharedVolumeMountPath | default "/lightrun" }}
16+
{{- if .workloadName }}
17+
workloadName: {{ .workloadName }}
18+
{{- end }}
19+
{{- if .workloadType }}
20+
workloadType: {{ .workloadType }}
21+
{{- end }}
22+
{{- if .deploymentName }}
1323
deploymentName: {{ .deploymentName }}
24+
{{- end }}
1425
containerSelector: {{- toYaml .containerSelector | nindent 4 }}
1526
{{- if .agentPoolCredentials.existingSecret }}
1627
secretName: {{ .agentPoolCredentials.existingSecret }}
1728
{{- else }}
1829
secretName: {{ .name }}-secret
1930
{{- end }}
2031
serverHostname: {{ .serverHostname }}
21-
{{- if .useSecretAsEnvVars }}
22-
useSecretAsEnvVars: {{ .useSecretAsEnvVars | default true }}
32+
{{- if .useSecretsAsMountedFiles }}
33+
useSecretsAsMountedFiles: {{ .useSecretsAsMountedFiles | default false }}
2334
{{- end }}
2435
agentEnvVarName: {{ .agentEnvVarName | default "JAVA_TOOL_OPTIONS" }}
2536
{{- if .agentConfig }}

‎charts/lightrun-agents/values.yaml

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,18 @@ javaAgents: []
1111
#javaAgents:
1212
# - name: 'my-service-1'
1313
# namespace: 'my-namespace-1'
14-
# deploymentName: "my-deployment-1"
14+
# # New workload configuration (recommended)
15+
# workloadName: "my-deployment-1"
16+
# workloadType: "Deployment" # or "StatefulSet"
17+
# # Legacy configuration (deprecated, use workloadName and workloadType instead)
18+
# # deploymentName: "my-deployment-1"
1519
# containerSelector:
1620
# - my-container-1
1721
# serverHostname: 'lightrun.example.com'
18-
# useSecretAsEnvVars: true
22+
# useSecretsAsMountedFiles: false
1923
# initContainer:
2024
# image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
25+
# imagePullPolicy: "IfNotPresent"
2126
# agentPoolCredentials:
2227
# existingSecret: ""
2328
# apiKey: "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
@@ -31,11 +36,14 @@ javaAgents: []
3136
# namespace: 'my-namespace-2'
3237
# initContainer:
3338
# image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
34-
# deploymentName: "my-deployment-2"
39+
# imagePullPolicy: "IfNotPresent"
40+
# # Example of StatefulSet configuration
41+
# workloadName: "my-statefulset-2"
42+
# workloadType: "StatefulSet"
3543
# containerSelector:
3644
# - my-container-2
3745
# serverHostname: 'lightrun.example.com'
38-
# useSecretAsEnvVars: true
46+
# useSecretsAsMountedFiles: false
3947
# agentPoolCredentials:
4048
# existingSecret: "my-existing-secret"
4149
# apiKey: ""
@@ -55,17 +63,22 @@ javaAgents: []
5563
#javaAgents:
5664
# - name: 'my-service-1'
5765
# namespace: 'my-namespace-1'
58-
# deploymentName: "my-deployment-1"
66+
# # New workload configuration (recommended)
67+
# workloadName: "my-deployment-1"
68+
# workloadType: "Deployment" # or "StatefulSet"
69+
# # Legacy configuration (deprecated, use workloadName and workloadType instead)
70+
# # deploymentName: "my-deployment-1"
5971
# containerSelector:
6072
# - my-container-1
6173
# serverHostname: 'lightrun.example.com'
62-
# useSecretAsEnvVars: true
74+
# useSecretsAsMountedFiles: false
6375
# agentEnvVarName: '_JAVA_OPTIONS'
6476
# agentConfig:
6577
# max_log_cpu_cost: "2"
6678
# agentCliFlags: "--lightrun_extra_class_path=<PATH_TO_JAR>:<PATH_TO_JAR>,lightrun_init_wait_time_ms"
6779
# initContainer:
6880
# image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
81+
# imagePullPolicy: "IfNotPresent"
6982
# sharedVolumeName: 'my-shared-volume'
7083
# sharedVolumeMountPath: '/mypath'
7184
# agentPoolCredentials:
@@ -81,13 +94,16 @@ javaAgents: []
8194
# namespace: 'my-namespace-2'
8295
# initContainer:
8396
# image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
97+
# imagePullPolicy: "IfNotPresent"
8498
# sharedVolumeName: 'my-shared-volume'
8599
# sharedVolumeMountPath: '/mypath'
86-
# deploymentName: "my-deployment-2"
100+
# # Example of StatefulSet configuration
101+
# workloadName: "my-statefulset-2"
102+
# workloadType: "StatefulSet"
87103
# containerSelector:
88104
# - my-container-2
89105
# serverHostname: 'lightrun.example.com'
90-
# useSecretAsEnvVars: true
106+
# useSecretsAsMountedFiles: false
91107
# agentEnvVarName: 'JAVA_OPTS'
92108
# agentConfig:
93109
# max_log_cpu_cost: "2"

‎charts/lightrun-operator/crds/lightrunjavaagent_crd.yaml

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,10 @@ spec:
9898
description: Image of the init container. Image name and tag will
9999
define platform and version of the agent
100100
type: string
101+
imagePullPolicy:
102+
description: 'Pull policy of the init container. Can be one of:
103+
Always, IfNotPresent, or Never.'
104+
type: string
101105
sharedVolumeMountPath:
102106
description: Path in the app container where volume with agent
103107
will be mounted
@@ -119,10 +123,10 @@ spec:
119123
Lightrun server hostname that will be used for downloading an agent
120124
Key and company id in the secret has to be taken from this server as well
121125
type: string
122-
useSecretAsEnvVars:
123-
default: true
124-
description: UseSecretAsEnvVars determines whether to use secret values
125-
as environment variables (true) or as mounted files (false)
126+
useSecretsAsMountedFiles:
127+
default: false
128+
description: UseSecretsAsMountedFiles determines whether to use secret
129+
values as mounted files (true) or as environment variables (false)
126130
type: boolean
127131
workloadName:
128132
description: Name of the Workload that will be patched. workload can

‎config/crd/bases/agents.lightrun.com_lightrunjavaagents.yaml

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ spec:
9999
description: Image of the init container. Image name and tag will
100100
define platform and version of the agent
101101
type: string
102+
imagePullPolicy:
103+
description: 'Pull policy of the init container. Can be one of:
104+
Always, IfNotPresent, or Never.'
105+
type: string
102106
sharedVolumeMountPath:
103107
description: Path in the app container where volume with agent
104108
will be mounted
@@ -120,10 +124,10 @@ spec:
120124
Lightrun server hostname that will be used for downloading an agent
121125
Key and company id in the secret has to be taken from this server as well
122126
type: string
123-
useSecretAsEnvVars:
124-
default: true
125-
description: UseSecretAsEnvVars determines whether to use secret values
126-
as environment variables (true) or as mounted files (false)
127+
useSecretsAsMountedFiles:
128+
default: false
129+
description: UseSecretsAsMountedFiles determines whether to use secret
130+
values as mounted files (true) or as environment variables (false)
127131
type: boolean
128132
workloadName:
129133
description: Name of the Workload that will be patched. workload can

‎config/samples/agents_v1beta_lightrunjavaagent.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
workloadType: Deployment
1212
secretName: lightrun-secrets
1313
serverHostname: <lightrun_server> #for saas it will be app.lightrun.com
14-
useSecretAsEnvVars: true
14+
useSecretsAsMountedFiles: false
1515
agentEnvVarName: JAVA_TOOL_OPTIONS
1616
agentConfig:
1717
max_log_cpu_cost: "2"

0 commit comments

Comments
 (0)