DataDog / helm-charts

Helm charts for Datadog products
Apache License 2.0
349 stars 1.02k forks source link

Improve private actions runner helm chart for kubernetes actions #1529

Closed dd-gplassard closed 2 months ago

dd-gplassard commented 2 months ago

What this PR does / why we need it:

We want to simplify onboarding for kubernetes actions for the private action runner. Most use cases will use service accounts and this requires to

which is not user friendly because you have to know low level details like the apiGroup, the name of the bundle, which API the actions are actually using (for instance restartDeployment requires patch but customers don't really have a way to know this)

With this PR we are introducing kubernetesActions for all supported resource types which will take care of adding the proper actionsAllowlist and permissions.

kubernetesPermissions and actionsAllowlist are still supported because they are still required (for non kubernetes actions and for CRD permissions where we can't know which permissions will be required).

It is also possible to mix and match kubernetesActions and kubernetesPermissions and actionsAllowlist but not recommended

Special notes for your reviewer:

Also includes baseline tests and updates the Codeowners file

Checklist

oliverli commented 2 months ago

Sorry, just merged #1531 so you'll need to resolve the merge conflicts and bump the version as well

dd-gplassard commented 2 months ago

I ended up removing the tests because I noticed the assertions are actually not working :( I'll be adressing this in another PR (here)