Fix RBAC resource name too long #386
Conversation
We introduced the `namespace` as prefix of the clusterrole and clusterrolebinding to allow multi DatadogAgent deployment in a cluster. But if the DatadogAgent namespace/name is very long like: datadog-agent/datadog-agent the final rbac name for `orchestrator-explorer` RBAC was: `datadog-agent-datadog-agent-orchestrator-explorer-cluster-agent` which is longer than the limit of 64 chars. This PR reduce the size by renaming it to `datadog-agent-datadog-agent-orch-exp-dca`
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Codecov Report
@@ Coverage Diff @@
## main #386 +/- ##
=======================================
Coverage 66.24% 66.24%
=======================================
Files 64 64
Lines 6933 6933
=======================================
Hits 4593 4593
Misses 2020 2020
Partials 320 320
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
|
I think this only solves the issue in some cases. We can have the same issue if the DDA has a long name or is deployed in a namespace with a long name. |
| @@ -31,7 +31,7 @@ type roleBindingInfo struct { | |||
| func buildRoleBinding(dda *datadoghqv1alpha1.DatadogAgent, info roleBindingInfo, agentVersion string) *rbacv1.RoleBinding { | |||
| return &rbacv1.RoleBinding{ | |||
| ObjectMeta: metav1.ObjectMeta{ | |||
| Labels: getDefaultLabels(dda, info.name, agentVersion), | |||
| Labels: getDefaultLabels(dda, dda.Name, agentVersion), | |||
There was a problem hiding this comment.
Shouldn't this one and the one in buildServiceAccount() be NewPartOfLabelValue(dda).String() like the rest?
There was a problem hiding this comment.
Here it is a rolebinding not a clusterrolebinding.
So I was thinking we don't need to add the namespace
There was a problem hiding this comment.
You're right, the namespace of the DDA is not needed in roles, but I wonder if we should just use the same format everywhere for consistency.
buildAgentClusterAgentRole (https://github.com/DataDog/datadog-operator/pull/386/files/d695397051a98d999df874dabfeba119ddfde1dd#diff-1ab2275c9afe43600275bda29e5e505bb4ecda385774675935de82f60e27a1b7R1363) is a role and uses NewPartOfLabelValue(dda).String(). That'd need to be changed if we keep dda.Name here.
There was a problem hiding this comment.
good catch,
PR updated with 85c0a1c
We introduced the `namespace` as prefix of the clusterrole and clusterrolebinding to allow multi DatadogAgent deployment in a cluster. But if the DatadogAgent namespace/name is very long like: datadog-agent/datadog-agent the final rbac name for `orchestrator-explorer` RBAC was: `datadog-agent-datadog-agent-orchestrator-explorer-cluster-agent` which is longer than the limit of 64 chars. This PR reduce the size by renaming it to `datadog-agent-datadog-agent-orch-exp-dca` Update app.kubernetes.io/instance label value for cluster resources
What does this PR do?
We introduced the
namespaceas prefix of the clusterrole andclusterrolebinding to allow multi DatadogAgent deployment in a cluster.
But if the DatadogAgent namespace/name is very long like:
datadog-agent/datadog-agent the final rbac name for
orchestrator-explorerRBAC was:
datadog-agent-datadog-agent-orchestrator-explorer-cluster-agentwhich is longer than the limit of 64 chars.
This PR reduce the size by renaming it to
datadog-agent-datadog-agent-orch-exp-dcaThis PR also update the value in
app.kubernetes.io/instancesfor cluster scoped resources like:Motivation
Fix agent deployment
Additional Notes
Anything else we should know when reviewing?
Describe your test plan
try to deploy the datadogAgent named
datadog-agentin the namespace:datadog-agentthe install should work.