[ACTP] PAR: per-environment paths for rshell allow-list#49950
Open
julesmcrt wants to merge 1 commit intojules.macret/Q/rshell/03-redesignfrom
Open
[ACTP] PAR: per-environment paths for rshell allow-list#49950julesmcrt wants to merge 1 commit intojules.macret/Q/rshell/03-redesignfrom
julesmcrt wants to merge 1 commit intojules.macret/Q/rshell/03-redesignfrom
Conversation
Adds per-environment routing to the rshell allowed_paths task input. The
backend now ships allowedPaths as a map keyed by execution environment;
the runner picks the relevant slice based on env.IsContainerized().
{
"bare_metal": ["/var/log"],
"containerized": ["/host/var/log"]
}
This lets a single Balto rule cover both host-installed agents (which
see /var/log) and containerized agents (which see /host/var/log).
WIRE-FORMAT CHANGE: allowedPaths is no longer a slice. The runner side
ships in this PR; Balto / wf-actions-server need to ship the new shape
concurrently. Old tasks (slice shape) will fail to deserialize on the
new runner; coordinate the rollout.
julesmcrt
requested review from
dustmop and
maddiefranke
and removed request for
a team
Contributor
|
🎯 Code Coverage (details) 🔗 Commit SHA: 3fd5c8f | Docs | Datadog PR Page | Give us feedback! |
Contributor
Files inventory check summaryFile checks results against ancestor c1888d89: Results for datadog-agent_7.80.0~devel.git.266.3fd5c8f.pipeline.109975006-1_amd64.deb:No change detected |
Contributor
Static quality checks✅ Please find below the results from static quality gates Successful checksInfo
21 successful checks with minimal change (< 2 KiB)
On-wire sizes (compressed)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds per-environment routing to the rshell
allowedPathstask input. The backend now shipsallowedPathsas a map keyed by execution environment:{ "bare_metal": ["/var/log"], "containerized": ["/host/var/log"] }The runner picks the relevant slice based on
env.IsContainerized()via the newselectBackendPathsFromEnvhelper, then the slice flows through the existing intersection logic. This lets a single Balto rule cover both host-installed agents (which see/var/log) and containerized agents (which see/host/var/log).allowedPathsis no longer a slice on the wire. The runner ships in this PR; Balto /wf-actions-serverneed to ship the new shape concurrently. Old tasks (slice shape) will fail to deserialize on the new runner — coordinate the rollout.Stacked on top of #49949 (PR3 in the split)
This is PR4 of 4 splitting #49825. Base: PR3 branch. Will retarget after PR1+PR2+PR3 land.
Describe how you validated your changes
TestSelectBackendPathsFromEnvinhelper_test.gocovers 7 cases: nil/empty maps (kill-switch), bare-metal/containerized branches, missing-key kill-switch in either direction, and unknown future keys ignored. Usest.Setenv("DOCKER_DD_AGENT", ...)to flipenv.IsContainerized().TestRunCommandBackendAllowedPathsRestrictsAccessupdated to use the map shape with the bare-metal key.pkg/privateactionrunner/adapters/config,pkg/privateactionrunner/bundles/remoteaction/rshell, andpkg/config/setup. Linter clean.🤖 Generated with Claude Code