Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CONTP-679] Fix bug in dca rbac generation for annotations and labels as tags: use deepcopy before merging #1719

Conversation

adel121
Copy link
Contributor

@adel121 adel121 commented Feb 27, 2025

What this PR does / why we need it:

Fixes bug that causes DD_KUBERNETES_ANNOTATIONS_AS_TAGS env var to be incorrectly set to the merged value of .Values.datadog.kubernetesResourcesLabelsAsTags and .Values.datadog.kubernetesResourcesAnnotationsAsTags.

Which issue this PR fixes

(optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged)

  • fixes #

Special notes for your reviewer:

The helm chart creates rbacs for the DCA based on user configuration of kubernetes resources labels and annotations as tags. This is needed so that workloadmeta can list and watch related resources to feed the tagger collector with labels and annotations so that it can generate tags.

The rbac generation is done here.

We are using mergeOverwrite directly over the values set by the user. (see here).

As a result, .Values.datadog.kubernetesResourcesAnnotationsAsTags is being modified in place (it includes a merged version with labels as tags).

Consequently, if the user does this:

kubernetesResourcesLabelsAsTags:
  pods:
    foo-1: foo-1
    
kubernetesResourcesAnnotationsAsTags:
  pods:
    foo-2: foo-2

The user gets the following env vars:

DD_KUBERNETES_RESOURCES_LABELS_AS_TAGS: '{"pods": {"foo-1": "foo-1"}}'
DD_KUBERNETES_RESOURCES_ANNOTATIONS_AS_TAGS: '{"pods":{"foo-1":"foo-1", "foo-2":"foo-2"}}'

As you can see, the second env var got a merged version of the two.

The documentation of helm says the following:

This is a deep merge operation but not a deep copy operation. Nested objects that are merged are the same instance on both dicts. If you want a deep copy along with the merge then use the deepCopy function along with merging.

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

  • Chart Version bumped
  • Documentation has been updated with helm-docs (run: .github/helm-docs.sh)
  • CHANGELOG.md has been updated
  • Variables are documented in the README.md
  • For Datadog Operator chart or value changes update the test baselines (run: make update-test-baselines)

@github-actions github-actions bot added the chart/datadog This issue or pull request is related to the datadog chart label Feb 27, 2025
@adel121 adel121 force-pushed the adelhajhassan/use_deepcopy_of_dict_when_merging_annotations_and_labels_as_tags branch from 988dc17 to b7cbbaa Compare February 27, 2025 10:50
@adel121 adel121 marked this pull request as ready for review February 27, 2025 10:52
@adel121 adel121 requested a review from a team as a code owner February 27, 2025 10:52
@adel121 adel121 changed the title Fix bug in dca rbac generation for annotations and labels as tags: use deepcopy before merging [CONTP-679] Fix bug in dca rbac generation for annotations and labels as tags: use deepcopy before merging Feb 27, 2025
@adel121 adel121 force-pushed the adelhajhassan/use_deepcopy_of_dict_when_merging_annotations_and_labels_as_tags branch from b7cbbaa to 765d358 Compare February 27, 2025 11:07
@adel121 adel121 force-pushed the adelhajhassan/use_deepcopy_of_dict_when_merging_annotations_and_labels_as_tags branch from 765d358 to 90171c3 Compare February 27, 2025 11:40
@adel121 adel121 marked this pull request as draft February 27, 2025 11:58
@adel121 adel121 force-pushed the adelhajhassan/use_deepcopy_of_dict_when_merging_annotations_and_labels_as_tags branch 2 times, most recently from b69baa7 to c79cafa Compare February 27, 2025 12:56
@adel121 adel121 force-pushed the adelhajhassan/use_deepcopy_of_dict_when_merging_annotations_and_labels_as_tags branch from c79cafa to aaa0dc4 Compare February 27, 2025 12:57
@adel121 adel121 marked this pull request as ready for review February 27, 2025 13:51
Comment on lines +44 to +47
imagePullSecrets: []
initContainers:
- name: init-volume
image: "gcr.io/datadoghq/agent:7.63.0"
imagePullPolicy: IfNotPresent
command: ["bash", "-c"]
args:
- cp -r /etc/datadog-agent /opt
volumeMounts:
- name: config
mountPath: /opt/datadog-agent
readOnly: false # Need RW for writing agent config files
resources:
{}
- name: init-config
image: "gcr.io/datadoghq/agent:7.63.0"
imagePullPolicy: IfNotPresent
command: ["bash", "-c"]
args:
- for script in $(find /etc/cont-init.d/ -type f -name '*.sh' | sort) ; do bash $script ; done
volumeMounts:
- name: config
mountPath: /etc/datadog-agent
readOnly: false # Need RW for writing datadog.yaml config file
resources:
{}
- name: init-volume
image: "gcr.io/datadoghq/agent:7.63.0"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for all this linter change. It would be good to sync with agent-onboarding team to know if we can commit in the repo the linter config so we can all use the same config.

Copy link
Collaborator

@clamoriniere clamoriniere left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change looks good. However it can be interesting to sync with agent-onboarding team to avoid having change in the baseline files if not necessary.

@adel121 adel121 merged commit 643aedf into main Feb 27, 2025
28 checks passed
@adel121 adel121 deleted the adelhajhassan/use_deepcopy_of_dict_when_merging_annotations_and_labels_as_tags branch February 27, 2025 14:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
chart/datadog This issue or pull request is related to the datadog chart
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants