feat(k8s): register system identities through cli command by sigilioso · Pull Request #2378 · newrelic/newrelic-agent-control

sigilioso · 2026-03-27T10:30:02Z

Summary

Adds a register-system-identity subcommand to the Kubernetes CLI binary. This command provisions a New Relic system identity (client ID + private key) and stores it as a Kubernetes Secret, making it available for Agent Control to authenticate with Fleet Control. The operation is idempotent — if the secret already exists, it exits early without modifying anything.

This aligns the approach between k8s and on-host for System Identity provisioning, leveraging the CLI to do so in both cases, it also allows simplifying the corresponding job in the helm chart.

Notes for reviewers

Identity Creation is not covered in e2e (we leverage an already existing System Identity). The approach has been manually using an updated helm-chart. Check out the corresponding draf-PR for details: [agent-control-deployment] use cli to register system identity [NR-537956] helm-charts#2189
The provide_system_identity_secret function takes the identity provider as a parameter specifically to enable unit testing without hitting real auth endpoints (the k8s client is also taken as a parameter for the same purpose).
A new comment has been added to the SystemIdentityArgs struct to clarify the broader tradeoff between arguments and sub-commands.
The changes in the Tiltfile prepare everything for the new version but are supposed to be compatible with the current chart.

🚧 newrelic-auth-rs update

After feat(k8s): register system identities through cli command #2378 (comment), a little refactor to avoid unnecessarily writing the private-key on System Identity generation.
To do so an update in newrelic-auth-rs was needed, check feat: extract rsa key generation into public module newrelic-auth-rs#195
~~We are currently pointing to main, but this won't be merged until the changes in newrelic-auth-rs are released~~

gsanchezgavier

Thanks! i left some doubts

gsanchezgavier · 2026-03-31T09:10:28Z

+        })?;
+
+    let private_key = LocalFile
+        .read(identity.private_key_path.as_path())


are we storing the pk in the fs and the reading it?

We are! Thanks for pointing out, I'm looking for alternatives to avoid it.

I finally changing by using a custom key::Creator for the k8s use-case (it actually doesn't create anything but it allow us referencing to the key pair without external components). LMKWYT.

gsanchezgavier · 2026-04-02T08:46:17Z

+}
+
+impl Creator for PublicKeyHolder {
+    type Error = Infallible;


gsanchezgavier

thanks for addressing the comments!

paologallinaharbur · 2026-04-02T15:30:39Z

+    public_key: PublicKeyPem,
+}
+
+impl Creator for PublicKeyHolder {


why can't it generate and return the key without storing it?
Would make sense to have a inMemoryCreator instead of the hack?

I started with a in-memory creator but it was adding complexity: the create() method would mutate the internal state and it would need to provide something to access to the private key.

paologallinaharbur · 2026-04-02T15:32:37Z

+    let KeyPair {
+        private_key,
+        public_key,
+    } = rsa(&KeyType::Rsa4096).map_err(|err| {


I am not sure this should have been public after all 😅
I think it would have been cleaner to have a inMemory creator

I agree but then I'd polish the Creator trait first. I'll leave it as it is for now and re-consider a future refactor for newrelic-auth-rs, if that's OK

We'll improve this in a PR on top of this after newrelic/newrelic-auth-rs#201 is merged

Addressed here: #2399 (there is no Creator anymore!)

paologallinaharbur

I have doubts regarding the keyHolder, but it is something internal, therefore I do not want to block it

sigilioso · 2026-04-08T14:57:08Z

Now that newrelic/newrelic-auth-rs#201 is ready, I'm working on a PR on top of this to simplify things. It should address: #2378 (comment)

DavSanchez · 2026-04-13T13:23:04Z

+        || String::from("--secret-name s  --region us --auth-private-key-path /some/path --auth-parent-token TOKEN --auth-parent-client-id id --organization-id org-id")
+    )]
+    #[case::client_secret_based_identity(
+        || String::from("--secret-name s --region us --auth-private-key-path /some/path --auth-parent-client-secret SECRET --auth-parent-client-id id --organization-id org-id")


Are the closures required?

DavSanchez · 2026-04-13T13:23:36Z

+        || String::from("--secret-name s --region us --auth-client-id some-id")
+    )]
+    #[case::no_identity_method(
+        || format!("--secret-name s --region us --auth-private-key-path {}", current_dir().unwrap().display())


Even with this case I'm not sure the closures are required.

DavSanchez

Needs rebase 🚀

sigilioso · 2026-04-13T15:43:12Z

Needs rebase 🚀

Rebased! Thanks!

sigilioso requested a review from a team as a code owner March 27, 2026 10:30

sigilioso added the k8s-extended-e2e Trigger extended k8s e2e on a PR label Mar 27, 2026

gsanchezgavier reviewed Mar 31, 2026

View reviewed changes

sigilioso force-pushed the feat/k8s-cli-system-identity branch from aa0e099 to 2f6bdf6 Compare March 31, 2026 15:11

danielorihuela reviewed Apr 1, 2026

View reviewed changes

Comment thread agent-control/src/cli/k8s/system_identity.rs Outdated

danielorihuela reviewed Apr 1, 2026

View reviewed changes

Comment thread agent-control/src/cli/k8s/system_identity.rs

danielorihuela reviewed Apr 1, 2026

View reviewed changes

Comment thread agent-control/src/cli/k8s/system_identity.rs Outdated

sigilioso force-pushed the feat/k8s-cli-system-identity branch from 2f6bdf6 to 6d98da8 Compare April 1, 2026 13:54

danielorihuela reviewed Apr 1, 2026

View reviewed changes

Comment thread agent-control/src/cli/on_host/config_gen.rs

sigilioso commented Apr 1, 2026

View reviewed changes

Comment thread agent-control/Cargo.toml

sigilioso requested review from a team, danielorihuela and gsanchezgavier April 1, 2026 14:21

sigilioso marked this pull request as draft April 1, 2026 14:21

gsanchezgavier reviewed Apr 2, 2026

View reviewed changes

Comment thread agent-control/src/cli/k8s/system_identity.rs Outdated

gsanchezgavier previously approved these changes Apr 2, 2026

View reviewed changes

sigilioso dismissed gsanchezgavier’s stale review via 0c7d509 April 2, 2026 15:07

sigilioso force-pushed the feat/k8s-cli-system-identity branch from 77a5477 to 0c7d509 Compare April 2, 2026 15:07

sigilioso marked this pull request as ready for review April 2, 2026 15:07

sigilioso requested review from a team and gsanchezgavier April 2, 2026 15:07

paologallinaharbur reviewed Apr 2, 2026

View reviewed changes

Comment thread agent-control/src/cli/common/system_identity.rs Outdated

paologallinaharbur reviewed Apr 2, 2026

View reviewed changes

Comment thread agent-control/src/cli/k8s/system_identity.rs Outdated

paologallinaharbur reviewed Apr 2, 2026

View reviewed changes

paologallinaharbur previously approved these changes Apr 2, 2026

View reviewed changes

sigilioso dismissed paologallinaharbur’s stale review via c51a3c8 April 2, 2026 15:34

sigilioso requested review from a team and paologallinaharbur April 2, 2026 16:14

This was referenced Apr 7, 2026

chore(deps): update dependency newrelic-auth-rs to v0.3.0 #2391

Closed

fix(deps): update rust crate nr-auth to v0.3.0 #2393

Closed

sigilioso mentioned this pull request Apr 9, 2026

chore: bump newrelic-auth-rs #2399

Merged

sigilioso force-pushed the feat/k8s-cli-system-identity branch from c51a3c8 to 8e82dca Compare April 13, 2026 09:18

DavSanchez reviewed Apr 13, 2026

View reviewed changes

sigilioso added 2 commits April 13, 2026 17:36

feat(k8s): register system identities through cli command

5ea89bd

chore: update nr-auth

55ca30a

DavSanchez previously approved these changes Apr 13, 2026

View reviewed changes

sigilioso added 6 commits April 13, 2026 17:39

chore(cli): avoid persisting private key on k8s

b0d31c5

chore: improve name and avoid type-meta repetition

92aca06

fix: typo

2a6a589

chore: bump newrelic-auth-rs

a66566c

fix: typo

81bbdfe

chore: bump newrelic-auth-rs (#2399)

05c81d0

sigilioso dismissed DavSanchez’s stale review via 05c81d0 April 13, 2026 15:42

sigilioso force-pushed the feat/k8s-cli-system-identity branch from f109f9f to 05c81d0 Compare April 13, 2026 15:42

sigilioso requested a review from DavSanchez April 13, 2026 15:43

DavSanchez approved these changes Apr 13, 2026

View reviewed changes

sigilioso merged commit e702f6c into main Apr 14, 2026
41 checks passed

sigilioso deleted the feat/k8s-cli-system-identity branch April 14, 2026 06:48

danielorihuela pushed a commit that referenced this pull request Apr 17, 2026

feat(k8s): register system identities through cli command (#2378)

ea3d7e8

Conversation

sigilioso commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Notes for reviewers

🚧 newrelic-auth-rs update

Uh oh!

gsanchezgavier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gsanchezgavier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sigilioso Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

paologallinaharbur left a comment

Choose a reason for hiding this comment

Uh oh!

sigilioso commented Apr 8, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DavSanchez left a comment

Choose a reason for hiding this comment

Uh oh!

sigilioso commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sigilioso commented Mar 27, 2026 •

edited

Loading

sigilioso Apr 8, 2026 •

edited

Loading