Merge pull request #50 from lightrun-platform/DEVOPS-2694-security-lightrun-installer-container-must-not-consume-secrets-as-env-vars-2nd-attempt

DEVOPS-2694-security-lightrun-installer-container-must-not-consume-secrets-as-env-vars-2nd-attempt

Author: yitzhaktal

.github/workflows/tests_data/lightrunjavaagent.yaml

@@ -10,6 +10,7 @@ spec:
   deploymentName: sample-deployment  
   secretName: lightrun-secrets 
   serverHostname: dogfood.internal.lightrun.com
+  useSecretsAsMountedFiles: false
   agentEnvVarName: JAVA_TOOL_OPTIONS
   agentConfig:
     max_log_cpu_cost: "2"

api/v1beta/lightrunjavaagent_types.go

@@ -93,6 +93,10 @@ type LightrunJavaAgentSpec struct {
 	// +optional
 	// Agent name for registration to the server
 	AgentName string `json:"agentName,omitempty"`
+
+	// UseSecretsAsMountedFiles determines whether to use secret values as mounted files (true) or as environment variables (false)
+	// +kubebuilder:default=false
+	UseSecretsAsMountedFiles bool `json:"useSecretsAsMountedFiles,omitempty"`
 }
 
 // LightrunJavaAgentStatus defines the observed state of LightrunJavaAgent

charts/lightrun-agents/templates/java-agent-cr.yaml

@@ -29,6 +29,9 @@ spec:
   secretName: {{ .name }}-secret
   {{- end }}
   serverHostname: {{ .serverHostname }}
+  {{- if .useSecretsAsMountedFiles }}
+  useSecretsAsMountedFiles: {{ .useSecretsAsMountedFiles | default false }}
+  {{- end }}
   agentEnvVarName: {{ .agentEnvVarName | default "JAVA_TOOL_OPTIONS" }}
   {{- if .agentConfig }}
   agentConfig: {{ toYaml .agentConfig | nindent 4 }}

charts/lightrun-agents/values.yaml

@@ -19,6 +19,7 @@ javaAgents: []
 #    containerSelector:
 #      - my-container-1
 #    serverHostname: 'lightrun.example.com'
+#    useSecretsAsMountedFiles: false
 #    initContainer:
 #      image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
 #      imagePullPolicy: "IfNotPresent"
@@ -42,6 +43,7 @@ javaAgents: []
 #    containerSelector:
 #      - my-container-2
 #    serverHostname: 'lightrun.example.com'
+#    useSecretsAsMountedFiles: false
 #    agentPoolCredentials:
 #      existingSecret: "my-existing-secret"
 #      apiKey: ""
@@ -69,6 +71,7 @@ javaAgents: []
 #    containerSelector:
 #      - my-container-1
 #    serverHostname: 'lightrun.example.com'
+#    useSecretsAsMountedFiles: false
 #    agentEnvVarName: '_JAVA_OPTIONS'
 #    agentConfig:
 #      max_log_cpu_cost: "2"
@@ -100,6 +103,7 @@ javaAgents: []
 #    containerSelector:
 #      - my-container-2
 #    serverHostname: 'lightrun.example.com'
+#    useSecretsAsMountedFiles: false
 #    agentEnvVarName: 'JAVA_OPTS'
 #    agentConfig:
 #      max_log_cpu_cost: "2"

charts/lightrun-operator/crds/lightrunjavaagent_crd.yaml

@@ -123,6 +123,11 @@ spec:
                   Lightrun server hostname that will be used for downloading an agent
                   Key and company id in the secret has to be taken from this server as well
                 type: string
+              useSecretsAsMountedFiles:
+                default: false
+                description: UseSecretsAsMountedFiles determines whether to use secret
+                  values as mounted files (true) or as environment variables (false)
+                type: boolean
               workloadName:
                 description: Name of the Workload that will be patched. workload can
                   be either Deployment or StatefulSet e.g. my-deployment, my-statefulset

config/crd/bases/agents.lightrun.com_lightrunjavaagents.yaml

@@ -124,6 +124,11 @@ spec:
                   Lightrun server hostname that will be used for downloading an agent
                   Key and company id in the secret has to be taken from this server as well
                 type: string
+              useSecretsAsMountedFiles:
+                default: false
+                description: UseSecretsAsMountedFiles determines whether to use secret
+                  values as mounted files (true) or as environment variables (false)
+                type: boolean
               workloadName:
                 description: Name of the Workload that will be patched. workload can
                   be either Deployment or StatefulSet e.g. my-deployment, my-statefulset

config/samples/agents_v1beta_lightrunjavaagent.yaml

@@ -11,6 +11,7 @@ spec:
   workloadType: Deployment
   secretName: lightrun-secrets 
   serverHostname: <lightrun_server>  #for saas it will be app.lightrun.com
+  useSecretsAsMountedFiles: false
   agentEnvVarName: JAVA_TOOL_OPTIONS
   agentConfig:
     max_log_cpu_cost: "2"

config/samples/operator.yaml

@@ -135,6 +135,11 @@ spec:
                   Lightrun server hostname that will be used for downloading an agent
                   Key and company id in the secret has to be taken from this server as well
                 type: string
+              useSecretsAsMountedFiles:
+                default: false
+                description: UseSecretsAsMountedFiles determines whether to use secret
+                  values as mounted files (true) or as environment variables (false)
+                type: boolean
               workloadName:
                 description: Name of the Workload that will be patched. workload can
                   be either Deployment or StatefulSet e.g. my-deployment, my-statefulset

docs/custom_resource.md

@@ -51,6 +51,9 @@ spec:
   # If container not mentioned here it will be not patched
   containerSelector:
     - app
+  # useSecretsAsMountedFiles determines whether to use secret values as environment variables (false) or as mounted files (true)
+  # Default is false for backward compatibility
+  useSecretsAsMountedFiles: false
 ---
 apiVersion: v1
 metadata: 

examples/lightrunjavaagent.yaml

@@ -61,3 +61,7 @@ spec:
     - latest
   # Agent name. If not provided, pod name will be used
   #agentName: "operator-test-agent"
+
+  # UseSecretsAsMountedFiles determines whether to use secret values as mounted files (true) or as environment variables (false)
+  # Default is false for better security practices
+  useSecretsAsMountedFiles: false