From 82c47a42243d4916294179810e10e8369d8bdaae Mon Sep 17 00:00:00 2001 From: Bram Schuur Date: Wed, 12 Mar 2025 15:39:40 +0100 Subject: [PATCH 1/2] STAC-22206: Docs for new way of defining an external secret for the agent --- SUMMARY.md | 1 + .../k8s-custom-secrets-setup-deprecated.md | 43 +++++++++++++++++++ setup/agent/k8s-custom-secrets-setup.md | 29 +++++++------ 3 files changed, 60 insertions(+), 13 deletions(-) create mode 100644 setup/agent/k8s-custom-secrets-setup-deprecated.md diff --git a/SUMMARY.md b/SUMMARY.md index 33c78ced8..fc8561bb4 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -87,6 +87,7 @@ * [Proxy Configuration](setup/agent/k8s-network-configuration-proxy.md) * [Using a custom registry](k8s-suse-rancher-prime-agent-air-gapped.md) * [Custom Secret Management](setup/agent/k8s-custom-secrets-setup.md) + * * [Custom Secret Management (Deprecated)](setup/agent/k8s-custom-secrets-setup-deprecated.md) * [Request tracing](setup/agent/k8sTs-agent-request-tracing.md) * [Certificates for sidecar injection](setup/agent/k8sTs-agent-request-tracing-certificates.md) diff --git a/setup/agent/k8s-custom-secrets-setup-deprecated.md b/setup/agent/k8s-custom-secrets-setup-deprecated.md new file mode 100644 index 000000000..c1660804c --- /dev/null +++ b/setup/agent/k8s-custom-secrets-setup-deprecated.md @@ -0,0 +1,43 @@ +## Custom Secret Management (Deprecated) + +### Overview + +The SUSE Observability agent supports specifying the name of a custom secret that contains the API key and cluster authorization token. This feature is useful for users who wish to manage their own secrets and avoid the automatic creation of secrets by the Helm chart. + +{% hint style="warning" %} +**This method of customizing secrets is deprecated and is incompatible with the RBAC feature.** + +Please use [the new method](./k8s-custom-secrets-setup.md) for using external secrets. +{% endhint %} + +### Regarding the Helm Chart + +#### Configuration Options + +- `stackstate.manageOwnSecrets`: A boolean flag that determines whether the user wishes to manage their own secrets. Default value is `false`. +- `stackstate.customSecretName`: (Optional) Name of the custom secret to be created by the user. Required if `stackstate.manageOwnSecrets` is set to `true`. +- `stackstate.customApiKeySecretKey`: (Optional) Key name for the API key within the custom secret. Required if `stackstate.manageOwnSecrets` is set to `true`. +- `stackstate.customClusterAuthTokenSecretKey`: (Optional) Key name for the cluster authorization token within the custom secret. Required if `stackstate.manageOwnSecrets` is set to `true`. + +#### Behavior Description + +- **Automatic Secret Creation**: By default, the chart continues to automatically create secrets as before if `stackstate.manageOwnSecrets` is set to `false`. +- **Custom Secret Management**: If `stackstate.manageOwnSecrets` is set to `true`, the chart expects the user to provide the name of the custom secret (`stackstate.customSecretName`) along with the keys for the API key and authorization token (`stackstate.customApiKeySecretKey` and `stackstate.customClusterAuthTokenSecretKey`, respectively). +- **Implied Omission**: When specifying that you would like to manage your own secrets, the chart will ignore values for `stackstate.apiKey` and `stackstate.cluster.authToken`. +### How to Use in values.yaml + +1. **Using Automatic Secret Creation (Default)**: + ```yaml + stackstate: + manageOwnSecrets: false + apiKey: "" + ``` + +2. **Managing Own Secrets**: + ```yaml + stackstate: + manageOwnSecrets: true + customSecretName: my-custom-secret + customApiKeySecretKey: api-key + customClusterAuthTokenSecretKey: auth-token + ``` \ No newline at end of file diff --git a/setup/agent/k8s-custom-secrets-setup.md b/setup/agent/k8s-custom-secrets-setup.md index 5a532700d..8e450cbdf 100644 --- a/setup/agent/k8s-custom-secrets-setup.md +++ b/setup/agent/k8s-custom-secrets-setup.md @@ -1,37 +1,40 @@ ## Custom Secret Management + ### Overview -The stackstate/stackstate-k8s-agent (starting from version 1.0.79) supports specifying the name of a custom secret that contains the API key and cluster authorization token. This feature is useful for users who wish to manage their own secrets and avoid the automatic creation of secrets by the Helm chart. +The SUSE Observability Agent supports specifying the name of a custom secret that contains the API key and cluster authorization token. This feature is useful for users who wish to manage their own secrets and avoid the automatic creation of secrets by the Helm chart. + +{% hint style="info" %} +**There was a previous method of specifying this that is now deprecated, see the [deprecated method](./k8s-custom-secrets-setup-deprecated.md) .** +{% endhint %} ### Regarding the Helm Chart #### Configuration Options -- `stackstate.manageOwnSecrets`: A boolean flag that determines whether the user wishes to manage their own secrets. Default value is `false`. -- `stackstate.customSecretName`: (Optional) Name of the custom secret to be created by the user. Required if `stackstate.manageOwnSecrets` is set to `true`. -- `stackstate.customApiKeySecretKey`: (Optional) Key name for the API key within the custom secret. Required if `stackstate.manageOwnSecrets` is set to `true`. -- `stackstate.customClusterAuthTokenSecretKey`: (Optional) Key name for the cluster authorization token within the custom secret. Required if `stackstate.manageOwnSecrets` is set to `true`. +- `global.apiKey.fromSecret`: Specify a pre-existing secret name residing in the same namespace which contains an `STS_API_KEY` field containing the api key. +- `global.clusterAgentAuthToken.fromSecret`: Specify a pre-existing secret name residing in the same namespace which contains an `STS_CLUSTER_AGENT_AUTH_TOKEN` field containing a token for securing connections between the cluster and node agents. #### Behavior Description -- **Automatic Secret Creation**: By default, the chart continues to automatically create secrets as before if `stackstate.manageOwnSecrets` is set to `false`. -- **Custom Secret Management**: If `stackstate.manageOwnSecrets` is set to `true`, the chart expects the user to provide the name of the custom secret (`stackstate.customSecretName`) along with the keys for the API key and authorization token (`stackstate.customApiKeySecretKey` and `stackstate.customClusterAuthTokenSecretKey`, respectively). +- **Automatic Secret Creation**: By default, the chart requires an `stackstate.apiKey` to be specified and will create a secret by itself. The `STS_CLUSTER_AGENT_AUTH_TOKEN` is generated automatically. +- **Custom Secret Management**: When overriding the `fromSecret` fields, the api key and cluster auth token will be taken from those secrets. - **Implied Omission**: When specifying that you would like to manage your own secrets, the chart will ignore values for `stackstate.apiKey` and `stackstate.cluster.authToken`. + ### How to Use in values.yaml 1. **Using Automatic Secret Creation (Default)**: ```yaml stackstate: - manageOwnSecrets: false apiKey: "" ``` 2. **Managing Own Secrets**: ```yaml - stackstate: - manageOwnSecrets: true - customSecretName: my-custom-secret - customApiKeySecretKey: api-key - customClusterAuthTokenSecretKey: auth-token + global: + apiKey: + fromSecret: "name-of-my-api-key-secret" + clusterAgentAuthToken: + fromSecret: "name-of-my-cluster-agent-auth-token-secret" ``` \ No newline at end of file From f80350d9e40a840a6369a2fe3f3dae4c3bcf0986 Mon Sep 17 00:00:00 2001 From: Bram Schuur Date: Wed, 12 Mar 2025 15:41:17 +0100 Subject: [PATCH 2/2] STAC-22206: Small fix --- SUMMARY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SUMMARY.md b/SUMMARY.md index fc8561bb4..68245c8e4 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -87,7 +87,7 @@ * [Proxy Configuration](setup/agent/k8s-network-configuration-proxy.md) * [Using a custom registry](k8s-suse-rancher-prime-agent-air-gapped.md) * [Custom Secret Management](setup/agent/k8s-custom-secrets-setup.md) - * * [Custom Secret Management (Deprecated)](setup/agent/k8s-custom-secrets-setup-deprecated.md) + * [Custom Secret Management (Deprecated)](setup/agent/k8s-custom-secrets-setup-deprecated.md) * [Request tracing](setup/agent/k8sTs-agent-request-tracing.md) * [Certificates for sidecar injection](setup/agent/k8sTs-agent-request-tracing-certificates.md)