feat(agent): add CRD option to disable hostname verification

api/v1beta2/cryostat_types.go

@@ -94,6 +94,11 @@ type CryostatSpec struct {
 	// +optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Operand metadata"
 	OperandMetadata *OperandMetadata `json:"operandMetadata,omitempty"`
+	// Options to control how the operator configures Cryostat Agents
+	// to communicate with this Cryostat instance.
+	// +optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Agent Options"
+	AgentOptions *AgentOptions `json:"agentOptions,omitempty"`
 }
 
 type OperandMetadata struct {
@@ -638,3 +643,12 @@ type DatabaseOptions struct {
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:io.kubernetes:Secret"}
 	SecretName *string `json:"secretName,omitempty"`
 }
+
+// AgentOptions provides customization for how the operator configures Cryostat Agents.
+type AgentOptions struct {
+	// Disables hostname verification when Cryostat connects to Agents over TLS.
+	// Consider enabling this if the Cryostat Agent fails to determine the hostname of your pod.
+	// +optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Disable Hostname Verification",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
+	DisableHostnameVerification bool `json:"disableHostnameVerification,omitempty"`
+}

bundle/manifests/cryostat-operator.clusterserviceversion.yaml

@@ -30,7 +30,7 @@ metadata:
     capabilities: Seamless Upgrades
     categories: Monitoring, Developer Tools
     containerImage: quay.io/cryostat/cryostat-operator:4.0.0-dev
-    createdAt: "2025-01-13T22:30:07Z"
+    createdAt: "2025-01-14T22:32:19Z"
     description: JVM monitoring and profiling tool
     operatorframework.io/initialization-resource: |-
       {
@@ -95,6 +95,14 @@ spec:
             path: enableCertManager
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
+          - description: Options to control how the operator configures Cryostat Agents to communicate with this Cryostat instance.
+            displayName: Agent Options
+            path: agentOptions
+          - description: Disables hostname verification when Cryostat connects to Agents over TLS. Consider enabling this if the Cryostat Agent fails to determine the hostname of your pod.
+            displayName: Disable Hostname Verification
+            path: agentOptions.disableHostnameVerification
+            x-descriptors:
+              - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
           - description: Additional configuration options for the authorization proxy.
             displayName: Authorization Options
             path: authorizationOptions

bundle/manifests/operator.cryostat.io_cryostats.yaml

@@ -5388,6 +5388,17 @@ spec:
           spec:
             description: CryostatSpec defines the desired state of Cryostat.
             properties:
+              agentOptions:
+                description: |-
+                  Options to control how the operator configures Cryostat Agents
+                  to communicate with this Cryostat instance.
+                properties:
+                  disableHostnameVerification:
+                    description: |-
+                      Disables hostname verification when Cryostat connects to Agents over TLS.
+                      Consider enabling this if the Cryostat Agent fails to determine the hostname of your pod.
+                    type: boolean
+                type: object
               authorizationOptions:
                 description: Additional configuration options for the authorization
                   proxy.

config/crd/bases/operator.cryostat.io_cryostats.yaml

@@ -5375,6 +5375,17 @@ spec:
           spec:
             description: CryostatSpec defines the desired state of Cryostat.
             properties:
+              agentOptions:
+                description: |-
+                  Options to control how the operator configures Cryostat Agents
+                  to communicate with this Cryostat instance.
+                properties:
+                  disableHostnameVerification:
+                    description: |-
+                      Disables hostname verification when Cryostat connects to Agents over TLS.
+                      Consider enabling this if the Cryostat Agent fails to determine the hostname of your pod.
+                    type: boolean
+                type: object
               authorizationOptions:
                 description: Additional configuration options for the authorization
                   proxy.

config/manifests/bases/cryostat-operator.clusterserviceversion.yaml

@@ -76,6 +76,17 @@ spec:
         path: enableCertManager
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
+      - description: Options to control how the operator configures Cryostat Agents
+          to communicate with this Cryostat instance.
+        displayName: Agent Options
+        path: agentOptions
+      - description: Disables hostname verification when Cryostat connects to Agents
+          over TLS. Consider enabling this if the Cryostat Agent fails to determine
+          the hostname of your pod.
+        displayName: Disable Hostname Verification
+        path: agentOptions.disableHostnameVerification
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
       - description: Additional configuration options for the authorization proxy.
         displayName: Authorization Options
         path: authorizationOptions

internal/controllers/common/resource_definitions/resource_definitions.go

@@ -1176,6 +1176,16 @@ func NewCoreContainer(cr *model.CryostatInstance, specs *ServiceSpecs, imageTag
 	}
 	envs = append(envs, grafanaVars...)
 
+	if cr.Spec.AgentOptions != nil && cr.Spec.AgentOptions.DisableHostnameVerification {
+		envs = append(envs,
+			corev1.EnvVar{
+				// TODO This should eventually be replaced by an agent-specific toggle.
+				// See: https://github.com/cryostatio/cryostat/issues/778
+				Name:  "QUARKUS_REST_CLIENT_VERIFY_HOST",
+				Value: "false",
+			})
+	}
+
 	// Mount the templates specified in Cryostat CR under /opt/cryostat.d/templates.d
 	for _, template := range cr.Spec.EventTemplates {
 		mount := corev1.VolumeMount{

internal/controllers/reconciler_test.go

@@ -1683,6 +1683,20 @@ func (c *controllerTest) commonTests() {
 				})
 			})
 		})
+		Context("with Agent options", func() {
+			Context("with hostname verification disabled", func() {
+				BeforeEach(func() {
+					t.objs = append(t.objs, t.NewCryostatWithAgentHostnameVerifyDisabled().Object)
+					t.DisableAgentHostnameVerify = true
+				})
+				JustBeforeEach(func() {
+					t.reconcileCryostatFully()
+				})
+				It("should configure deployment appropriately", func() {
+					t.expectMainDeployment()
+				})
+			})
+		})
 		Context("with an existing Cryostat CR", func() {
 			var otherInput *cryostatTestInput
 

internal/test/resources.go

@@ -47,14 +47,15 @@ import (
 )
 
 type TestResources struct {
-	Name             string
-	Namespace        string
-	TLS              bool
-	ExternalTLS      bool
-	OpenShift        bool
-	ReportReplicas   int32
-	TargetNamespaces []string
-	InsightsURL      string
+	Name                       string
+	Namespace                  string
+	TLS                        bool
+	ExternalTLS                bool
+	OpenShift                  bool
+	ReportReplicas             int32
+	TargetNamespaces           []string
+	InsightsURL                string
+	DisableAgentHostnameVerify bool
 }
 
 func NewTestScheme() *runtime.Scheme {
@@ -760,6 +761,14 @@ func (r *TestResources) NewCryostatWithAdditionalMetadata() *model.CryostatInsta
 	return cr
 }
 
+func (r *TestResources) NewCryostatWithAgentHostnameVerifyDisabled() *model.CryostatInstance {
+	cr := r.NewCryostat()
+	cr.Spec.AgentOptions = &operatorv1beta2.AgentOptions{
+		DisableHostnameVerification: true,
+	}
+	return cr
+}
+
 func (r *TestResources) NewCryostatService() *corev1.Service {
 	appProtocol := "http"
 	return &corev1.Service{
@@ -1593,6 +1602,14 @@ func (r *TestResources) NewCoreEnvironmentVariables(reportsUrl string, ingress b
 			})
 	}
 
+	if r.DisableAgentHostnameVerify {
+		envs = append(envs,
+			corev1.EnvVar{
+				Name:  "QUARKUS_REST_CLIENT_VERIFY_HOST",
+				Value: "false",
+			})
+	}
+
 	if len(r.InsightsURL) > 0 {
 		envs = append(envs,
 			corev1.EnvVar{

internal/webhooks/agent/pod_defaulter.go

@@ -19,6 +19,7 @@ import (
 	"errors"
 	"fmt"
 	"slices"
+	"strconv"
 
 	operatorv1beta2 "github.com/cryostatio/cryostat-operator/api/v1beta2"
 	"github.com/cryostatio/cryostat-operator/internal/controllers/common"
@@ -291,23 +292,37 @@ func (r *podMutator) callbackEnv(cr *model.CryostatInstance, namespace string, t
 	if !tls {
 		scheme = "http"
 	}
-	envs := []corev1.EnvVar{
-		{
-			Name:  "CRYOSTAT_AGENT_CALLBACK_SCHEME",
-			Value: scheme,
-		},
-		{
-			Name:  "CRYOSTAT_AGENT_CALLBACK_HOST_NAME",
-			Value: fmt.Sprintf("$(%s), $(%s)[replace(\".\"\\, \"-\")]", podNameEnvVar, podIPEnvVar),
-		},
-		{
-			Name:  "CRYOSTAT_AGENT_CALLBACK_DOMAIN_NAME",
-			Value: fmt.Sprintf("%s.%s.svc", common.AgentHeadlessServiceName(r.gvk, cr), namespace),
-		},
-		{
-			Name:  "CRYOSTAT_AGENT_CALLBACK_PORT",
-			Value: "9977",
-		},
+
+	// TODO make customizable
+	port := 9977
+
+	var envs []corev1.EnvVar
+	if cr.Spec.AgentOptions != nil && cr.Spec.AgentOptions.DisableHostnameVerification {
+		envs = []corev1.EnvVar{
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK",
+				Value: fmt.Sprintf("%s://$(%s):%d", scheme, podIPEnvVar, port),
+			},
+		}
+	} else {
+		envs = []corev1.EnvVar{
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_SCHEME",
+				Value: scheme,
+			},
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_HOST_NAME",
+				Value: fmt.Sprintf("$(%s), $(%s)[replace(\".\"\\, \"-\")]", podNameEnvVar, podIPEnvVar),
+			},
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_DOMAIN_NAME",
+				Value: fmt.Sprintf("%s.%s.svc", common.AgentHeadlessServiceName(r.gvk, cr), namespace),
+			},
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_PORT",
+				Value: strconv.Itoa(port),
+			},
+		}
 	}
 
 	return envs

internal/webhooks/agent/pod_defaulter_test.go

@@ -286,6 +286,17 @@ var _ = Describe("PodDefaulter", func() {
 
 				ExpectPod()
 			})
+
+			Context("with hostname verification disabled", func() {
+				BeforeEach(func() {
+					t.DisableAgentHostnameVerify = true
+					t.objs = append(t.objs, t.NewCryostatWithAgentHostnameVerifyDisabled().Object)
+					originalPod = t.NewPod()
+					expectedPod = t.NewMutatedPod()
+				})
+
+				ExpectPod()
+			})
 		})
 
 		Context("with a missing Cryostat CR", func() {

internal/webhooks/agent/test/resources.go

@@ -249,23 +249,6 @@ func (r *AgentWebhookTestResources) newMutatedPod(options *mutatedPodOptions) *c
 							Name:  "CRYOSTAT_AGENT_API_WRITES_ENABLED",
 							Value: "true",
 						},
-
-						{
-							Name:  "CRYOSTAT_AGENT_CALLBACK_SCHEME",
-							Value: scheme,
-						},
-						{
-							Name:  "CRYOSTAT_AGENT_CALLBACK_HOST_NAME",
-							Value: "$(CRYOSTAT_AGENT_POD_NAME), $(CRYOSTAT_AGENT_POD_IP)[replace(\".\"\\, \"-\")]",
-						},
-						{
-							Name:  "CRYOSTAT_AGENT_CALLBACK_DOMAIN_NAME",
-							Value: fmt.Sprintf("%s.%s.svc", r.GetAgentServiceName(), options.namespace),
-						},
-						{
-							Name:  "CRYOSTAT_AGENT_CALLBACK_PORT",
-							Value: "9977",
-						},
 						{
 							Name:  "JAVA_TOOL_OPTIONS",
 							Value: options.javaToolOptions + "-javaagent:/tmp/cryostat-agent/cryostat-agent-shaded.jar",
@@ -310,8 +293,8 @@ func (r *AgentWebhookTestResources) newMutatedPod(options *mutatedPodOptions) *c
 		},
 	}
 
+	container := &pod.Spec.Containers[0]
 	if r.TLS {
-		container := &pod.Spec.Containers[0]
 		tlsEnvs := []corev1.EnvVar{
 			{
 				Name:  "CRYOSTAT_AGENT_WEBCLIENT_TLS_CLIENT_AUTH_CERT_PATH",
@@ -377,5 +360,35 @@ func (r *AgentWebhookTestResources) newMutatedPod(options *mutatedPodOptions) *c
 			})
 	}
 
+	var callbackEnvs []corev1.EnvVar
+	if r.DisableAgentHostnameVerify {
+		callbackEnvs = []corev1.EnvVar{
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK",
+				Value: fmt.Sprintf("%s://$(CRYOSTAT_AGENT_POD_IP):9977", scheme),
+			},
+		}
+	} else {
+		callbackEnvs = []corev1.EnvVar{
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_SCHEME",
+				Value: scheme,
+			},
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_HOST_NAME",
+				Value: "$(CRYOSTAT_AGENT_POD_NAME), $(CRYOSTAT_AGENT_POD_IP)[replace(\".\"\\, \"-\")]",
+			},
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_DOMAIN_NAME",
+				Value: fmt.Sprintf("%s.%s.svc", r.GetAgentServiceName(), options.namespace),
+			},
+			{
+				Name:  "CRYOSTAT_AGENT_CALLBACK_PORT",
+				Value: "9977",
+			},
+		}
+	}
+	container.Env = append(container.Env, callbackEnvs...)
+
 	return pod
 }