Repository navigation
Kubernetes agent as a free Amazon EKS add-on on AWS Marketplace - #5007
Merged
Merged
Conversation
oneuptime.existingSecretName names a Secret the operator created, holding the key under api-key. Every workload that sends to OneUptime then reads it from there, and the chart renders no Secret of its own; setting it together with oneuptime.apiKey is refused. The Amazon EKS add-on needs this: EKS shows an add-on's configuration values in plain text and refuses configuration schemas that take keys. The common labels write managed-by out instead of reading .Release.Service, which EKS refuses in an add-on, and two comments no longer name lookup.
build.py --marketplace aws-eks-addon builds the agent chart for the AWS Marketplace EKS add-on catalog: every image it can run from the add-on product's Marketplace ECR repositories (third-party ones at the chart's pins, OneUptime's at the release), OneUptime Cloud's address, the key from the Secret oneuptime-ingestion-key, the Helm install's resource names, a cluster name EKS replaces at install, no profiler or debug sidecar, and aws_mp_configuration_schema.json: a draft-07 schema of the few values a buyer may set, none of them a secret. The chart's own schema is open at its root for the k8version value EKS renders add-ons with. mirror-images.sh copies the add-on's images like the AWS edition's: linux/amd64 and linux/arm64 only, nothing an earlier run copied.
…add-on aws-eks-addon is a fourth edition the Marketplace Release workflow can ship, signed in with the same AWS role. aws_catalog.py builds its version as one EKS add-on delivery option (AddDeliveryOptions with EksAddOnDeliveryOptionDetails, Limited, the cluster's name filled in by EKS) and checks it against AWS's own limits before sending it. The weekly run adds no add-on version while AWS is still applying one or a version is in testing; a run by hand ships whatever. go-public makes a tested version public, by hand. ci_setup.py lets the release role add versions to the add-on product once editions.json has its ID.
The Marketplace Release workflow ships aws-eks-addon like the AWS edition: aws-eks-addon-push (marketplace-push) asks the add-on product whether it has the release, and on the weekly run whether a version is still being published or tested, then copies the images and pushes the chart, each skipped when an earlier run did it; aws-eks-addon-publish (marketplace-publish, approved by a maintainer) adds the version for testing. The edition action takes the released agent chart too, and build.py refuses one from before the add-on, which the marketplace suite then skips. The marketplace suite checks the add-on as AWS does: its helm lint and helm template for every Kubernetes version it names, no hook, lookup, CRD or Release object but .Name and .Namespace, every image from its registry and named in its version, the key only read from the buyer's Secret, the configuration examples and a Region change rendering.
What the add-on is and how it meets AWS's add-on rules, the one-time setup on the AWS side (the free product, its ID, repositories, the release role, the add-on delivery option and the seller alias), how a version is released, tested in ap-northeast-2 on every Kubernetes version it names and made public, its listing content, and what has not met AWS yet. The chart README's section on the Secret moves below the AI agent's.
The Kubernetes agent page says how to add the agent from the EKS console or with aws eks create-addon: the Secret with the ingestion key first, the add-on's defaults (OneUptime Cloud, the EKS cluster's name, the oneuptime-agent namespace), the configuration values it takes, with an update-addon example, and what needs the Helm install instead. It also says how a Helm install keeps the key in a Secret (oneuptime.existingSecretName), and the cloud marketplaces page links to the add-on. In every docs language, line for line, with the EKS console's labels in English.
…thout known critical CVEs AWS Marketplace scans every image of the EKS add-on. Scanned with trivy 0.75.0 (HIGH and CRITICAL, linux/amd64 and linux/arm64): - kube-state-metrics v2.13.0 -> v2.20.0: 1 critical and 49 high -> 9 high. The same flags; /healthz and / are still served on the probed ports. - OpenCost 1.121.0 -> 1.121.3: 36 high -> 7 high (a patch release, the one OpenCost's own chart runs). - Prometheus v2.55.1 -> v3.15.0: 4 critical and 104 high -> 8 high. promtool 3.15 accepts the bundled config, the flags and health paths are unchanged, OpenCost keys its range offsets on the Prometheus version, and the cost poller's max_over_time peak query reads the same on 3.x. What is left is Go stdlib and golang.org/x issues newer than each upstream build.
Contributor
Author
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
This was referenced Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the free Kubernetes agent installable as an Amazon EKS add-on through AWS Marketplace, so clusters that send to OneUptime Cloud (or a self-hosted OneUptime) can add it from the EKS console's Get more add-ons, next to Datadog, Dynatrace and New Relic. Nothing is submitted to AWS here: the AWS-side steps are below.
What changes
HelmChart/Public/kubernetes-agent): new valueoneuptime.existingSecretName, so the ingestion key can come from a Secret the operator creates (keyapi-key). Every workload then reads it from there and the chart renders no Secret of its own; setting it together withoneuptime.apiKeyis refused. EKS shows add-on configuration values in plain text and refuses configuration schemas that take keys, so the add-on needs this. The common labels writeapp.kubernetes.io/managed-by: Helminstead of reading.Release.Service, which EKS rejects in an add-on.build.py --marketplace aws-eks-addonbuilds the agent chart for AWS's add-on rules. Every image comes from the add-on product's Marketplace ECR (amd64 and arm64), with the release's tags. Defaults: OneUptime Cloud, the key from the Secretoneuptime-ingestion-key, theoneuptime-agentnamespace, the Helm install's resource names, and a cluster name that EKS fills in at install (${AWS_EKS_CLUSTER_NAME}). It leaves out the profiler and the debug sidecar. It shipsaws_mp_configuration_schema.json: a draft-07 schema of the few values a buyer may set, none of them a secret. The chart's own schema is open at its root for thek8versionvalue EKS renders add-ons with: unopened, AWS's ownhelm templatecommand fails on the chart.HelmChart/Marketplace/automation):aws_catalog.pybuilds the add-on version (AddDeliveryOptionswithEksAddOnDeliveryOptionDetails, Limited), checked against AWS's own field rules, and addsgo-publicfor after testing.release_plan.pyandci_setup.pycover the new product.marketplace-release.yml):aws-eks-addon-push(marketplace-push) andaws-eks-addon-publish(marketplace-publish, waits for approval), in the same skip-what-is-there style as the AWS jobs. The weekly run adds no add-on version while AWS is still applying one or one is still in testing; a run by hand ships whatever.release.ymlis untouched.promtool3.15, and in a KinD run it scrapes cAdvisor and OpenCost with the cost series present.aws eks create-addonand configuration-value examples) and "Keep the ingestion key in a Secret" on the Kubernetes agent page, and a card on the cloud marketplaces page. Both are in all 17 docs languages, line for line.SELF_HOSTED_RELEASING.mdcovers the product, its setup, releasing, testing in ap-northeast-2, going public and the listing text.Testing
python3 -m unittest discover -s HelmChart/Marketplace -p 'test_*.py': 136 tests.bash HelmChart/Tests/run.sh lint marketplacewith Helm 3.19.0, the version AWS validates with: 149 marketplace checks, including AWS's exacthelm lintandhelm template --set k8version=<v> --kube-version <v> --include-crds --no-hooksfor EKS 1.34 to 1.37. The unmodified chart fails that command (additional properties 'k8version' not allowed).helm unittest HelmChart/Public/kubernetes-agent: 346 tests, including the newexisting-secret_test.yaml.Tests/Ops:MarketplaceReleaseand the other suites that read the workflows or the agent chart.npm run docs:check-anchors.On the AWS side (maintainer)
kubernetes-agent. Submit, which makes it Limited.editions.json: runaws_catalog.py find-product, setaws-eks-addon.productId, then runaws_catalog.py add-repositories --edition aws-eks-addon.ci_setup.py aws --applyagain, so it may add versions to the new product.kubernetes-agent, typemonitoring, namespaceoneuptime-agent, Kubernetes 1.34 to 1.37, no IAM permissions. Confirm the seller alias EKS puts before the name: the docs assumeoneuptime_kubernetes-agent(sellerAliasineditions.json)."ready": trueforaws-eks-addon, run Marketplace Release by hand with marketplacesaws-eks-addonand dry run off, then approve the publish job.aws_catalog.py go-public --version X.Y.Z. The first time, also submit Update visibility for the product.No IAM is needed: the agent calls no AWS API, and the product is free.
Not done here
otel/opentelemetry-collector-contrib:0.96.0has 4 critical findings, all fixed upstream, and AWS's scan would block the add-on on them. Moving the chart off 0.96.0 is a follow-up of its own. Collector 0.161.0, which the other agents run, has none, but its kubeletstats receiver no longer emitsk8s.node.cpu.utilization,k8s.pod.cpu.utilizationorcontainer.cpu.utilization. OneUptime's ingest, dashboards and monitors read those names, so that change keeps them.