Fix agent env not overriding config#2832
Conversation
When agent envs are explicitely configured, they should always take priority over automatic configuration. E.g. TARGET_HOST could not be overriden by env. Fixes netobserv#2831
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR rewrites eBPF agent environment-variable assembly into controller-level envConfig logic with sorted overrides, new default handling for export targets and feature toggles, and OpenShift-dependent attach mode selection. It also removes the shared BuildEnvFromDefaults helper and updates envConfig tests. ChangeseBPF agent environment configuration
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jotak
added
the
ok-to-test
|
New images: quay.io/netobserv/network-observability-operator:369675b4
quay.io/netobserv/network-observability-operator-bundle:v0.0.0-sha-369675b4
quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-369675b4They will expire in two weeks. To deploy this build: # Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:369675b4 make deploy
# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-sha-369675b4Or as a Catalog Source: apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
name: netobserv-dev
namespace: openshift-marketplace
spec:
sourceType: grpc
image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-369675b4
displayName: NetObserv development catalog
publisher: Me
updateStrategy:
registryPoll:
interval: 1m |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/controller/ebpf/agent_controller.go`:
- Around line 779-794: Wrap the watcher failures in the TLS setup path with
contextual error messages instead of returning raw errors. In the reconciliation
logic around c.Watcher.ProcessFileReference and
c.Watcher.ProcessMTLSCertsFromRefs, use the existing error values but add clear
context that identifies which TLS reference/certificate step failed before
returning from the controller.
- Around line 750-765: The gRPC defaults on this branch are being appended
directly, so advanced env overrides can still collide with generated values.
Update the logic in the agent controller path that builds `config` to route both
`envExport` and the host-network `envFlowsTargetHost` through the same
override-aware helper used elsewhere, instead of appending them unconditionally.
Keep the existing `addEnv(...)` pattern and make sure
`helper.GetAdvancedProcessorConfig(&coll.Spec)` and `advancedConfig.Env` are
consulted before adding these defaults.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1bdc5bd2-1f14-49c9-8e09-ddb933e39951
📒 Files selected for processing (4)
internal/controller/ebpf/agent_controller.gointernal/controller/ebpf/agent_controller_test.gointernal/pkg/helper/env.gointernal/pkg/helper/env_test.go
💤 Files with no reviewable changes (2)
- internal/pkg/helper/env.go
- internal/pkg/helper/env_test.go
| caDigest, err := c.Watcher.ProcessFileReference(ctx, c.Client, *ca, c.PrivilegedNamespace()) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| annots[watchers.Annotation("tls-ca")] = caDigest | ||
| } | ||
| } else { | ||
| certPath, keyPath := c.volumes.AddCertificate(clientCert, "client-certs") | ||
| config = addEnv(config, envTargetTLSUserCertPath, certPath, advancedConfig.Env) | ||
| config = addEnv(config, envTargetTLSUserKeyPath, keyPath, advancedConfig.Env) | ||
|
|
||
| if !assumeCertInstalled { | ||
| // Annotate pod with certificate reference so that it is reloaded if modified | ||
| caDigest, userDigest, err := c.Watcher.ProcessMTLSCertsFromRefs(ctx, c.Client, ca, clientCert, c.PrivilegedNamespace()) | ||
| if err != nil { | ||
| return nil, err |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Wrap TLS watcher errors with context.
These raw returns make reconcile failures harder to diagnose.
As per coding guidelines, "Wrap errors with context using proper error handling patterns in the controller reconciliation logic and error handling paths."
Proposed fix
caDigest, err := c.Watcher.ProcessFileReference(ctx, c.Client, *ca, c.PrivilegedNamespace())
if err != nil {
- return nil, err
+ return nil, fmt.Errorf("process eBPF target TLS CA reference: %w", err)
}
annots[watchers.Annotation("tls-ca")] = caDigest
@@
caDigest, userDigest, err := c.Watcher.ProcessMTLSCertsFromRefs(ctx, c.Client, ca, clientCert, c.PrivilegedNamespace())
if err != nil {
- return nil, err
+ return nil, fmt.Errorf("process eBPF target mTLS certificate references: %w", err)
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| caDigest, err := c.Watcher.ProcessFileReference(ctx, c.Client, *ca, c.PrivilegedNamespace()) | |
| if err != nil { | |
| return nil, err | |
| } | |
| annots[watchers.Annotation("tls-ca")] = caDigest | |
| } | |
| } else { | |
| certPath, keyPath := c.volumes.AddCertificate(clientCert, "client-certs") | |
| config = addEnv(config, envTargetTLSUserCertPath, certPath, advancedConfig.Env) | |
| config = addEnv(config, envTargetTLSUserKeyPath, keyPath, advancedConfig.Env) | |
| if !assumeCertInstalled { | |
| // Annotate pod with certificate reference so that it is reloaded if modified | |
| caDigest, userDigest, err := c.Watcher.ProcessMTLSCertsFromRefs(ctx, c.Client, ca, clientCert, c.PrivilegedNamespace()) | |
| if err != nil { | |
| return nil, err | |
| caDigest, err := c.Watcher.ProcessFileReference(ctx, c.Client, *ca, c.PrivilegedNamespace()) | |
| if err != nil { | |
| return nil, fmt.Errorf("process eBPF target TLS CA reference: %w", err) | |
| } | |
| annots[watchers.Annotation("tls-ca")] = caDigest | |
| } | |
| } else { | |
| certPath, keyPath := c.volumes.AddCertificate(clientCert, "client-certs") | |
| config = addEnv(config, envTargetTLSUserCertPath, certPath, advancedConfig.Env) | |
| config = addEnv(config, envTargetTLSUserKeyPath, keyPath, advancedConfig.Env) | |
| if !assumeCertInstalled { | |
| // Annotate pod with certificate reference so that it is reloaded if modified | |
| caDigest, userDigest, err := c.Watcher.ProcessMTLSCertsFromRefs(ctx, c.Client, ca, clientCert, c.PrivilegedNamespace()) | |
| if err != nil { | |
| return nil, fmt.Errorf("process eBPF target mTLS certificate references: %w", err) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@internal/controller/ebpf/agent_controller.go` around lines 779 - 794, Wrap
the watcher failures in the TLS setup path with contextual error messages
instead of returning raw errors. In the reconciliation logic around
c.Watcher.ProcessFileReference and c.Watcher.ProcessMTLSCertsFromRefs, use the
existing error values but add clear context that identifies which TLS
reference/certificate step failed before returning from the controller.
Source: Coding guidelines
github-actions
Bot
removed
the
ok-to-test
|
@jotak: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Description
When agent envs are explicitely configured, they should always take priority over automatic configuration. E.g. TARGET_HOST could not be overriden by env.
Fixes #2831
Dependencies
n/a
Checklist
Summary by CodeRabbit