Skip to content

Commit fa07dd8

Browse files
yitzhaktalyitzhaktal
committed
DEVOPS-2694 - Update the lightrun-k8s-operator deployment to mount Secrets as files via volumes instead of exposing them as environment variables in containers.
1 parent 2be38da commit fa07dd8

File tree

3 files changed

+70
-71
lines changed

3 files changed

+70
-71
lines changed

‎config/crd/bases/agents.lightrun.com_lightrunjavaagents.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,10 @@ spec:
112112
- sharedVolumeName
113113
type: object
114114
secretName:
115-
description: Name of the Secret in the same namespace contains lightrun
116-
key and conmpany id
115+
description: |-
116+
Name of the Secret in the same namespace that contains the Lightrun API key.
117+
The secret should have a key named 'lightrun_key'.
118+
The pinned certificate hash is now stored in a ConfigMap created by the operator.
117119
type: string
118120
serverHostname:
119121
description: |-

‎internal/controller/patch_funcs.go‎

Lines changed: 42 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package controller
22

33
import (
4+
"context"
45
"encoding/json"
56
"errors"
67
"fmt"
@@ -27,7 +28,7 @@ const (
2728
annotationAgentName = "lightrun.com/lightrunjavaagent"
2829
)
2930

30-
func (r *LightrunJavaAgentReconciler) createAgentConfig(lightrunJavaAgent *agentv1beta.LightrunJavaAgent) (corev1.ConfigMap, error) {
31+
func (r *LightrunJavaAgentReconciler) createAgentConfig(lightrunJavaAgent *agentv1beta.LightrunJavaAgent, secret *corev1.Secret) (corev1.ConfigMap, error) {
3132
populateTags(lightrunJavaAgent.Spec.AgentTags, lightrunJavaAgent.Spec.AgentName, &metadata)
3233
jsonString, err := json.Marshal(metadata)
3334
if err != nil {
@@ -42,6 +43,7 @@ func (r *LightrunJavaAgentReconciler) createAgentConfig(lightrunJavaAgent *agent
4243
Data: map[string]string{
4344
"config": parseAgentConfig(lightrunJavaAgent.Spec.AgentConfig),
4445
"metadata": string(jsonString),
46+
"pinned_cert_hash": string(secret.Data["pinned_cert_hash"]),
4547
},
4648
}
4749

@@ -98,54 +100,58 @@ func (r *LightrunJavaAgentReconciler) addVolume(deploymentApplyConfig *appsv1ac.
98100
)
99101
}
100102

101-
func (r *LightrunJavaAgentReconciler) addInitContainer(deploymentApplyConfig *appsv1ac.DeploymentApplyConfiguration, lightrunJavaAgent *agentv1beta.LightrunJavaAgent, secret *corev1.Secret) {
103+
func (r *LightrunJavaAgentReconciler) createPinnedCertConfigMap(ctx context.Context, lightrunJavaAgent *agentv1beta.LightrunJavaAgent, secret *corev1.Secret) (*corev1.ConfigMap, error) {
104+
configMap := &corev1.ConfigMap{
105+
ObjectMeta: metav1.ObjectMeta{
106+
Name: fmt.Sprintf("%s-pinned-cert", lightrunJavaAgent.Name),
107+
Namespace: lightrunJavaAgent.Namespace,
108+
},
109+
Data: map[string]string{
110+
"pinned_cert_hash": string(secret.Data["pinned_cert_hash"]),
111+
},
112+
}
102113

114+
err := r.Create(ctx, configMap)
115+
if err != nil {
116+
return nil, err
117+
}
118+
119+
return configMap, nil
120+
}
121+
122+
func (r *LightrunJavaAgentReconciler) addInitContainer(deploymentApplyConfig *appsv1ac.DeploymentApplyConfiguration, lightrunJavaAgent *agentv1beta.LightrunJavaAgent, secret *corev1.Secret) {
103123
deploymentApplyConfig.Spec.Template.Spec.WithInitContainers(
104124
corev1ac.Container().
105125
WithName(initContainerName).
106126
WithImage(lightrunJavaAgent.Spec.InitContainer.Image).
107127
WithVolumeMounts(
108128
corev1ac.VolumeMount().WithName(lightrunJavaAgent.Spec.InitContainer.SharedVolumeName).WithMountPath("/tmp/"),
109129
corev1ac.VolumeMount().WithName(cmVolumeName).WithMountPath("/tmp/cm/"),
130+
corev1ac.VolumeMount().WithName("lightrun-secret").WithMountPath("/etc/lightrun/secret").WithReadOnly(true),
110131
).WithEnv(
111-
corev1ac.EnvVar().WithName("LIGHTRUN_KEY").WithValueFrom(
112-
corev1ac.EnvVarSource().WithSecretKeyRef(
113-
corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("lightrun_key"),
114-
),
115-
),
116-
corev1ac.EnvVar().WithName("PINNED_CERT").WithValueFrom(
117-
corev1ac.EnvVarSource().WithSecretKeyRef(
118-
corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("pinned_cert_hash"),
119-
),
120-
),
121132
corev1ac.EnvVar().WithName("LIGHTRUN_SERVER").WithValue(lightrunJavaAgent.Spec.ServerHostname),
122133
).
123134
WithResources(
124135
corev1ac.ResourceRequirements().
125136
WithLimits(
126137
corev1.ResourceList{
127138
corev1.ResourceCPU: *resource.NewMilliQuantity(int64(50), resource.BinarySI),
128-
corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)), // 500 * 10^6 = 500M
139+
corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
129140
},
130141
).WithRequests(
131142
corev1.ResourceList{
132143
corev1.ResourceCPU: *resource.NewMilliQuantity(int64(50), resource.BinarySI),
133144
corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
134145
},
135146
),
136-
).
137-
WithSecurityContext(
138-
corev1ac.SecurityContext().
139-
WithCapabilities(
140-
corev1ac.Capabilities().WithDrop(corev1.Capability("ALL")),
141-
).
142-
WithAllowPrivilegeEscalation(false).
143-
WithRunAsNonRoot(true).
144-
WithSeccompProfile(
145-
corev1ac.SeccompProfile().
146-
WithType(corev1.SeccompProfileTypeRuntimeDefault),
147-
),
148-
),
147+
)
148+
149+
// Add volume for secret
150+
deploymentApplyConfig.Spec.Template.Spec.WithVolumes(
151+
corev1ac.Volume().WithName("lightrun-secret").
152+
WithSecret(corev1ac.SecretVolumeSource().
153+
WithSecretName(secret.Name).
154+
WithItems(corev1ac.KeyToPath().WithKey("lightrun_key").WithPath("lightrun_key"))),
149155
)
150156
}
151157

@@ -282,45 +288,31 @@ func (r *LightrunJavaAgentReconciler) addInitContainerToStatefulSet(statefulSetA
282288
WithVolumeMounts(
283289
corev1ac.VolumeMount().WithName(lightrunJavaAgent.Spec.InitContainer.SharedVolumeName).WithMountPath("/tmp/"),
284290
corev1ac.VolumeMount().WithName(cmVolumeName).WithMountPath("/tmp/cm/"),
291+
corev1ac.VolumeMount().WithName("lightrun-secret").WithMountPath("/etc/lightrun/secret").WithReadOnly(true),
285292
).WithEnv(
286-
corev1ac.EnvVar().WithName("LIGHTRUN_KEY").WithValueFrom(
287-
corev1ac.EnvVarSource().WithSecretKeyRef(
288-
corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("lightrun_key"),
289-
),
290-
),
291-
corev1ac.EnvVar().WithName("PINNED_CERT").WithValueFrom(
292-
corev1ac.EnvVarSource().WithSecretKeyRef(
293-
corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("pinned_cert_hash"),
294-
),
295-
),
296293
corev1ac.EnvVar().WithName("LIGHTRUN_SERVER").WithValue(lightrunJavaAgent.Spec.ServerHostname),
297294
).
298295
WithResources(
299296
corev1ac.ResourceRequirements().
300297
WithLimits(
301298
corev1.ResourceList{
302299
corev1.ResourceCPU: *resource.NewMilliQuantity(int64(50), resource.BinarySI),
303-
corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)), // 64M
300+
corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
304301
},
305302
).WithRequests(
306303
corev1.ResourceList{
307304
corev1.ResourceCPU: *resource.NewMilliQuantity(int64(50), resource.BinarySI),
308305
corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
309306
},
310307
),
311-
).
312-
WithSecurityContext(
313-
corev1ac.SecurityContext().
314-
WithCapabilities(
315-
corev1ac.Capabilities().WithDrop(corev1.Capability("ALL")),
316-
).
317-
WithAllowPrivilegeEscalation(false).
318-
WithRunAsNonRoot(true).
319-
WithSeccompProfile(
320-
corev1ac.SeccompProfile().
321-
WithType(corev1.SeccompProfileTypeRuntimeDefault),
322-
),
323-
),
308+
)
309+
310+
// Add volume for secret
311+
statefulSetApplyConfig.Spec.Template.Spec.WithVolumes(
312+
corev1ac.Volume().WithName("lightrun-secret").
313+
WithSecret(corev1ac.SecretVolumeSource().
314+
WithSecretName(secret.Name).
315+
WithItems(corev1ac.KeyToPath().WithKey("lightrun_key").WithPath("lightrun_key"))),
324316
)
325317
}
326318

‎lightrun-init-agent/update_config.sh‎

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
#!/bin/sh
22
# Script to initialize and configure the Lightrun agent
33
# This script:
4-
# 1. Validates required environment variables
4+
# 1. Validates required environment variables and files
55
# 2. Sets up a working directory
66
# 3. Merges configuration files
7-
# 4. Updates configuration with environment variables
7+
# 4. Updates configuration with values from files
88
# 5. Copies the final configuration to destination
99

1010
set -e
@@ -14,23 +14,24 @@ TMP_DIR="/tmp"
1414
WORK_DIR="${TMP_DIR}/agent-workdir"
1515
FINAL_DEST="${TMP_DIR}/agent"
1616
CONFIG_MAP_DIR="${TMP_DIR}/cm"
17+
SECRET_DIR="/etc/lightrun/secret"
1718

18-
# Function to validate required environment variables
19-
validate_env_vars() {
20-
local missing_vars=""
19+
# Function to validate required files and environment variables
20+
validate_requirements() {
21+
local missing_requirements=""
2122

22-
if [ -z "${LIGHTRUN_KEY}" ]; then
23-
missing_vars="${missing_vars} LIGHTRUN_KEY"
23+
if [ ! -f "${SECRET_DIR}/lightrun_key" ]; then
24+
missing_requirements="${missing_requirements} ${SECRET_DIR}/lightrun_key"
2425
fi
25-
if [ -z "${PINNED_CERT}" ]; then
26-
missing_vars="${missing_vars} PINNED_CERT"
26+
if [ ! -f "${CONFIG_MAP_DIR}/pinned_cert_hash" ]; then
27+
missing_requirements="${missing_requirements} ${CONFIG_MAP_DIR}/pinned_cert_hash"
2728
fi
2829
if [ -z "${LIGHTRUN_SERVER}" ]; then
29-
missing_vars="${missing_vars} LIGHTRUN_SERVER"
30+
missing_requirements="${missing_requirements} LIGHTRUN_SERVER"
3031
fi
3132

32-
if [ -n "${missing_vars}" ]; then
33-
echo "Error: Missing required environment variables:${missing_vars}"
33+
if [ -n "${missing_requirements}" ]; then
34+
echo "Error: Missing required files or environment variables:${missing_requirements}"
3435
exit 1
3536
fi
3637
}
@@ -64,27 +65,31 @@ merge_configs() {
6465
rm "${temp_conf}"
6566
}
6667

67-
# Function to update configuration with environment variables
68+
# Function to update configuration with values from files
6869
update_config() {
69-
echo "Updating configuration with environment variables"
70+
echo "Updating configuration with values from files"
7071
local config_file="${WORK_DIR}/agent.config"
7172
local missing_configuration_params=""
7273

74+
# Read values from files
75+
local lightrun_key=$(cat "${SECRET_DIR}/lightrun_key")
76+
local pinned_cert=$(cat "${CONFIG_MAP_DIR}/pinned_cert_hash")
77+
7378
if sed -n "s|com.lightrun.server=.*|com.lightrun.server=https://${LIGHTRUN_SERVER}|p" "${config_file}" | grep -q .; then
7479
# Perform actual in-place change
7580
sed -i "s|com.lightrun.server=.*|com.lightrun.server=https://${LIGHTRUN_SERVER}|" "${config_file}"
7681
else
7782
missing_configuration_params="${missing_configuration_params} com.lightrun.server"
7883
fi
79-
if sed -n "s|com.lightrun.secret=.*|com.lightrun.secret=${LIGHTRUN_KEY}|p" "${config_file}" | grep -q .; then
84+
if sed -n "s|com.lightrun.secret=.*|com.lightrun.secret=${lightrun_key}|p" "${config_file}" | grep -q .; then
8085
# Perform actual in-place change
81-
sed -i "s|com.lightrun.secret=.*|com.lightrun.secret=${LIGHTRUN_KEY}|" "${config_file}"
86+
sed -i "s|com.lightrun.secret=.*|com.lightrun.secret=${lightrun_key}|" "${config_file}"
8287
else
8388
missing_configuration_params="${missing_configuration_params} com.lightrun.secret"
8489
fi
85-
if sed -n "s|pinned_certs=.*|pinned_certs=${PINNED_CERT}|p" "${config_file}" | grep -q .; then
90+
if sed -n "s|pinned_certs=.*|pinned_certs=${pinned_cert}|p" "${config_file}" | grep -q .; then
8691
# Perform actual in-place change
87-
sed -i "s|pinned_certs=.*|pinned_certs=${PINNED_CERT}|" "${config_file}"
92+
sed -i "s|pinned_certs=.*|pinned_certs=${pinned_cert}|" "${config_file}"
8893
else
8994
missing_configuration_params="${missing_configuration_params} pinned_certs"
9095
fi
@@ -108,7 +113,7 @@ cleanup() {
108113

109114
# Main execution
110115
main() {
111-
validate_env_vars
116+
validate_requirements
112117
setup_working_dir
113118
merge_configs
114119
update_config

0 commit comments

Comments
 (0)