Agent version
7.80.0
Bug Report
TL;DR - It would be helpful, for the cluster-agent to check the configuration conditions, including existence of datadog-agent Secret best as possible before injecting ...
When a pod has labels:
agent.datadoghq.com/sidecar: fargate
It will inject a datadog-agent-injected sidecar.
Some of the related things are fine if they are missing or misconfigured. It will only make the sidecar complain about permissions issues. These involved RBAC-related issues.
But if the Secret called datadog-agent isn't there, there will be a "fatal" CreateContainerConfigError and the entire Pod will not come up at all. Big oopsie if we're talking about for example coredns or similar.
Related to security in the cluster I think it wouldn't be a big issue either, as it would be a simple rbac permission:
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["datadog-secret"]
verbs: ["get"]
Anyway. It's just a sanitary, helpful thing as usually secrets come from external sources or processes (external-secrets operator for example) ... and sometimes unfavourable things happen.
Reproduction Steps
No response
Agent configuration
values:
clusterAgent:
admissionController:
agentSidecarInjection:
profiles:
- env:
- name: DD_DISABLE_CLUSTER_NAME_TAG_KEY
value: "true"
resources:
limits:
cpu: "2"
memory: 1024Mi
requests:
cpu: "1"
memory: 512Mi
configMode: hostip
mutateUnlabelled: true
tokenExistingSecret: datadog-secret
Operating System
No response
Other environment details
Amazon EKS with some Fargate Pods
Agent version
7.80.0
Bug Report
TL;DR - It would be helpful, for the cluster-agent to check the configuration conditions, including existence of
datadog-agentSecret best as possible before injecting ...When a pod has labels:
It will inject a
datadog-agent-injectedsidecar.Some of the related things are fine if they are missing or misconfigured. It will only make the sidecar complain about permissions issues. These involved RBAC-related issues.
But if the
Secretcalleddatadog-agentisn't there, there will be a "fatal"CreateContainerConfigErrorand the entire Pod will not come up at all. Big oopsie if we're talking about for examplecorednsor similar.Related to security in the cluster I think it wouldn't be a big issue either, as it would be a simple rbac permission:
Anyway. It's just a sanitary, helpful thing as usually secrets come from external sources or processes (external-secrets operator for example) ... and sometimes unfavourable things happen.
Reproduction Steps
No response
Agent configuration
values:
Operating System
No response
Other environment details
Amazon EKS with some Fargate Pods