attune-io/attune v0.1.31 on GitHub

What's New in v0.1.31

v0.1.31 lets the operator authenticate to a cluster Prometheus and to Datadog from the operator namespace. A Prometheus address that points at cloud metadata is refused before the operator connects.

Highlights

Cluster Prometheus auth can use a ServiceAccount token or one Secret in the operator namespace. A policy address, a namespace-defaults address, and an auto-discovered Prometheus do not receive that token.
Cluster Datadog API keys can live in one operator-namespace Secret. Kustomize and OperatorHub installs create a dedicated Prometheus query ServiceAccount.
A hostname that resolves to a cloud metadata address, including Alibaba IMDS, is blocked before the dial even when the request would carry the operator token.

Operator Prometheus identity

Copying a Prometheus token Secret into every policy namespace was the only cluster-wide option. The manager can send a ServiceAccount token, or read one bearer Secret in the operator namespace, only for an address taken from cluster AttuneDefaults. A policy address, an AttuneNamespaceDefaults address, an auto-discovered Prometheus, and a request that already has an Authorization header keep their own credentials. Helm openshift.bindClusterMonitoringView binds OpenShift cluster-monitoring-view and turns the token flag on. Helm prometheusAuth.queryServiceAccount.create, the OLM bundle, and config/rbac create attune-prometheus-query and pass --prometheus-query-service-account (#828, #841).
An inherited cluster bearerTokenSecret that is missing in the policy namespace failed the reconcile. When operator auth is configured, that NotFound falls back to the operator identity and the operator logs the fallback. A Secret that is present in the policy namespace is still used. A policy-set missing Secret still fails (#828).
bearerTokenSecret on cluster AttuneDefaults is deprecated. Admission warns. The Secret name is still copied onto each policy and looked up in the policy namespace. A later 0.1.x will reject that field on AttuneDefaults after two tagged minors have carried the warning. AttunePolicy and AttuneNamespaceDefaults are unchanged (#828).
A TokenRequest error during refresh failed the reconcile while the cached query token was still valid. The operator keeps using the cached token until it expires, and it refreshes inside a five-minute skew. After expiry, the error fails the reconcile. Startup still fails if --prometheus-bearer-token-secret, --prometheus-query-service-account, or --datadog-api-key-secret is set and POD_NAMESPACE is empty (#843).

Operator Datadog API key

A Datadog API key named on cluster AttuneDefaults was read from each policy namespace. --datadog-api-key-secret reads one Secret in the operator namespace when cluster AttuneDefaults chose Datadog. A policy or AttuneNamespaceDefaults apiKeySecretRef is still read in that namespace. The CRD still requires apiKeySecretRef on the object. When the operator flag is set, the cluster-chosen block ignores that copied name (#841).

Prometheus addresses

Some loopback and metadata spellings were accepted and then dialed. Admission rejects inet_aton forms, a trailing dot on a blocked metadata name, and the Alibaba metadata address. localhost stays allowed for kubectl attune doctor. Cluster-private addresses stay allowed. The dialer uses the same blocklist after DNS, so a hostname that resolves to Alibaba IMDS is refused before the connection, even when the request carries the operator bearer token. A single inet_aton value above 2^32-1 is rejected instead of being truncated, so 6425673729 is no longer treated as 127.0.0.1 (#845, #848).

Recommendation status

Status could show a confidence outside 0 through 1. The explanation now stores the value the buffer math used, clamped to that range. Memory derived from CPU publishes 1 instead of the internal sentinel. The recommended quantity for an in-range confidence is unchanged (#846).

Compatibility

Surface	Requires
Existing policy YAML with a per-namespace Prometheus token Secret	Still works. That Secret still wins over operator auth
Cluster `AttuneDefaults` `bearerTokenSecret`	Still copied into each policy namespace. Admission warns. Move cluster auth to the operator identity
Operator Prometheus token or operator Datadog Secret	Set the Helm flags (or the matching manager args) and `POD_NAMESPACE`
Kustomize and OperatorHub	Create `attune-prometheus-query` and pass the query ServiceAccount flags
Tested Kubernetes versions	1.32 through 1.37 on `7fb41191`

Upgrade notes

Upgrade the chart to 0.1.31, or set image.tag to 0.1.31 or v0.1.31.
Pull ghcr.io/attune-io/attune:v0.1.31 or ghcr.io/attune-io/attune:0.1.31. Both tags point at the same digest.
CRDs gain a description on Datadog apiKeySecretRef. Behavior does not depend on reapplying them. Helm still does not upgrade CRDs on helm upgrade.
To use operator Prometheus auth, set prometheusAuth.useServiceAccountToken, prometheusAuth.queryServiceAccount.create, or prometheusAuth.existingSecret. On OpenShift, openshift.bindClusterMonitoringView: true binds cluster-monitoring-view. Leave bearerTokenSecret off cluster AttuneDefaults once that identity is in place.
To use one Datadog API key for cluster AttuneDefaults, set datadogAuth.existingSecret. Leave apiKeySecretRef on the object. The schema requires it.
kubectl attune doctor skips HTTP 401 and 403 only for operator auth on the selected cluster AttuneDefaults address.

See Upgrading for this section and earlier releases.

Contributors

Thanks to external contributors in this release:

@adjurdjevic for reporting operator Prometheus identity so one cluster token can cover every policy namespace (#827)

Full changelog

v0.1.30...v0.1.31