multi account support

Author: kkhandelwal-nr

charts/nr-ebpf-agent/templates/nr-ebpf-agent-daemonset.yaml

@@ -92,6 +92,18 @@ spec:
                 key: {{ include "newrelic.common.license._customSecretKey" . }}
                 name: {{ include "newrelic.common.license._customSecretName" . }}
                 {{- end }}
+          {{- if or .Values.namespaceLicenseKeys .Values.customSecretNamespaceLicenseKeys }}
+          - name: NAMESPACE_LICENSE_KEY_MAP
+            valueFrom:
+              secretKeyRef:
+                {{- if .Values.namespaceLicenseKeys }}
+                key: NAMESPACE_LICENSE_KEY_MAP
+                name: nr-ebpf-agent-secrets
+                {{- else }}
+                key: NAMESPACE_LICENSE_KEY_MAP
+                name: {{ .Values.customSecretNamespaceLicenseKeys }}
+                {{- end }}
+          {{- end }}
 
           {{- if .Values.tableStoreDataLimitMB }}
           - name: TABLE_STORE_DATA_LIMIT_MB

charts/nr-ebpf-agent/templates/secrets.yaml

@@ -17,3 +17,6 @@ data:
   {{- else }}
   NEW_RELIC_LICENSE_KEY: {{ required "secrets.licenseKey is required" .Values.licenseKey | b64enc | quote }}
   {{- end }}
+  {{- if .Values.namespaceLicenseKeys }}
+  NAMESPACE_LICENSE_KEY_MAP: {{ .Values.namespaceLicenseKeys | toJson | b64enc }}
+  {{- end }}

charts/nr-ebpf-agent/values.yaml

@@ -7,6 +7,17 @@ licenseKey: ""
 customSecretName: ""
 # -- In case you don't want to have the license key in your values, this allows you to point to which secret key is the license key located. Can be configured also with `global.customSecretLicenseKey`
 customSecretLicenseKey: ""
+# -- Map of K8s namespace to New Relic license key for multi-account OTEL export routing.
+# -- Namespaces not in the map fall back to the global licenseKey.
+# -- Example:
+# -- namespaceLicenseKeys:
+# --   team-a: "NRAK-aaa..."
+# --   team-b: "NRAK-bbb..."
+namespaceLicenseKeys: {}
+# -- Reference to a pre-existing Kubernetes secret containing NAMESPACE_LICENSE_KEY_MAP.
+# -- Use this instead of namespaceLicenseKeys to avoid storing license keys in values.yaml.
+# -- The secret must contain a key named NAMESPACE_LICENSE_KEY_MAP with a JSON-encoded namespace-to-license-key map.
+customSecretNamespaceLicenseKeys: ""
 # -- If using a customSecretLicenseKey, you must supply your region "US"/"EU". Otherwise, leave this value as an empty string.
 region: ""
 # -- Custom OTLP endpoint URL. When set, this takes precedence over the region-based static endpoints.