rosstimothy
5870768c88
All existing template usage was converted to make use of github.com/DataDog/datadog-agent/pkg/template. The DataDog package is a fork of the stdlib template packages with method calling removed so that reflect.MethodByName does not prevent DCE. There were a handful of method calls in our templates that were trivially changed to use custom functions defined via FuncMaps or specifying the calculated value to the template instead of calling a function in the template. A future change will add linter rules to prevent new text/template or html/imports from landing. They have not been included here so as to not to break enterprise code while it is migrated.
Teleport Kubernetes Agent Updater (teleport-kube-agent-updater)
The Teleport kubernetes updater is a controller in charge of updating Teleport Kubernetes agents. This alleviates the cost of updating all agents on large-scale deployments.
Note: Teleport Kubernetes agents are not limited to Kubernetes Access. The term applies to every Teleport instance running in a Kubernetes cluster and not running the Proxy nor Auth Service. Agents are typically deployed by the teleport-kube-agent chart.
Design
This updater was designed first for cloud customers but can be adapter to run for on-prem users as well.
See the cloud update RFD for more context.
If an update goes wrong, a temporary downtime is acceptable until a correct version is pushed (this risk is mitigated by multi-replica deployments). However, the failure mode in which the deployment is stuck and the user has to take manual action must not happen.
The updater validates the image provenance to protect against registry compromise.
The updater logic is the following:
- check if maintenance is allowed
- check if a new version is available and version change is valid
- check if the new image can be validated