Copy OpenShift etcd metric secret#3131
Conversation
This comment has been minimized.
This comment has been minimized.
Codecov Report❌ Patch coverage is ❌ Your patch status has failed because the patch coverage (55.55%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## levan-m/introspection-ddai #3131 +/- ##
==============================================================
+ Coverage 43.60% 43.64% +0.04%
==============================================================
Files 353 353
Lines 30168 30215 +47
==============================================================
+ Hits 13154 13187 +33
- Misses 16139 16147 +8
- Partials 875 881 +6
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e0d2cbde9b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
* Extend introspection and support DDAI code path * handle edge cases when user unsets annotation * pr review fixes * skip adding default provider to ddai * remove logging * Copy OpenShift etcd metric secret (#3131) * copy OpenShift etcd metric secret * Add 5s timeout * Keep existing secret if source read fails * fix podstartup (#3179) * Avoid agent getting stuck in container creating * Do not use direct apireader client and instead make f.etcdSecretPresent as part of existing calls (#3180) --------- Co-authored-by: Timothée Bavelier <[email protected]> --------- Co-authored-by: Timothée Bavelier <[email protected]>
3 participants
What
PoC for automatically copying the OpenShift etcd metric client Secret when OpenShift control plane monitoring is enabled.
openshift-etcd-operator/etcd-metric-clientdirectly from the API server.etcd-metric-clientSecret in the DatadogAgent namespace through the existing dependency store.Why
OpenShift etcd monitoring mounts
etcd-metric-clientin the DatadogAgent namespace. Previously the operator only logged anoc get ... | oc apply ...command for users to copy it manually. This secret is necessary otherwise the pod fails to initialize. Now that introspection is enabled by default through target PR, it would "break" users that do not expect/use control-plane monitoring.The operator ClusterRole already allows core Secret
get/list/watch/create/update/patch/delete, so it has the required RBAC to perform this copy.Alternatives considered
openshift-etcd-operatorby default: rejected for this PoC because it broadens the controller cache to a sensitive platform namespace, keeps platform Secrets in memory, and ties this behavior to bundle/install packaging.openshift-etcd-operator, producingunknown namespace for the cache.Follow-ups before productionizing
This PoC performs the direct source Secret read during each relevant DDAI reconciliation. Better production options include:
Validation