Skip to content

fix: use FQDN for CloudWatch agent auto-instrumentation endpoint (#392)#393

Open
pete911 wants to merge 1 commit into
aws:mainfrom
pete911:cloudwatch-agent-dns-name
Open

fix: use FQDN for CloudWatch agent auto-instrumentation endpoint (#392)#393
pete911 wants to merge 1 commit into
aws:mainfrom
pete911:cloudwatch-agent-dns-name

Conversation

@pete911

@pete911 pete911 commented Jul 5, 2026

Copy link
Copy Markdown

Closes #392.

The auto-instrumentation defaults injected by the operator's admission webhook pointed at the CloudWatch agent service using a short, 2-label hostname (cloudwatch-agent.amazon-cloudwatch) instead of a fully-qualified domain name. Because the value only
has one dot, resolving it depended entirely on the pod's DNS search list, which:

Changes

  • pkg/instrumentation/helper.go: updated the cloudwatchAgentStandardEndpoint constant to the FQDN (cloudwatch-agent.amazon-cloudwatch.svc.cluster.local), matching the existing cloudwatchAgentWindowsEndpoint pattern.
  • pkg/instrumentation/defaultinstrumentation.go: getDefaultInstrumentation() now references cloudwatchAgentStandardEndpoint/cloudwatchAgentWindowsEndpoint from helper.go instead of duplicating the hostname as a separate literal, so there's a single
    source of truth for both.
  • pkg/instrumentation/defaultinstrumentation_test.go, helper_test.go, podmutator_test.go: updated hardcoded expected env var values to the new FQDN. TestContainsCloudWatchAgent's negative/edge-case assertions (path-embedded host, prefix-mismatch host,
    no-protocol-separator) were preserved with their original intent against the new FQDN boundary.
  • README.md: updated the two example Instrumentation CR snippets to use the FQDN.

Testing

  • go build ./... — pass
  • go vet ./... — pass
  • make test (full suite, envtest-backed) — all packages pass, including pkg/instrumentation
  • Manually verified containsCloudWatchAgent() still correctly accepts/rejects each case in TestContainsCloudWatchAgent after the constant change (substring matching against the FQDN, including the windows-headless and negative cases)

Behavior change

None for existing clusters at default ndots — the FQDN resolves identically today. This unblocks operators who want to set ndots: 1 and removes the NXDOMAIN log noise from Route53 Resolver query logging.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Auto-instrumentation hardcodes cloudwatch-agent.amazon-cloudwatch as a 2-label DNS name

1 participant