Fix the type of bearer_token_auth

azure_iot_edge/datadog_checks/azure_iot_edge/data/conf.yaml.example

@@ -144,8 +144,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

crio/datadog_checks/crio/data/conf.yaml.example

@@ -139,8 +139,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

datadog_checks_dev/datadog_checks/dev/tooling/templates/configuration/instances/openmetrics_legacy_base.yaml

@@ -147,10 +147,13 @@
 - name: bearer_token_auth
   description: |
     If set to true, adds a bearer token authentication header.
+    If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
   value:
     example: false
-    type: boolean
+    anyOf:
+      - type: boolean
+      - type: string
 - name: bearer_token_path
   description: |
     The path to a Kubernetes service account bearer token file. Make sure the file exists and is mounted correctly.

datadog_cluster_agent/datadog_checks/datadog_cluster_agent/data/auto_conf.yaml

@@ -147,8 +147,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

datadog_cluster_agent/datadog_checks/datadog_cluster_agent/data/conf.yaml.example

@@ -139,8 +139,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

etcd/datadog_checks/etcd/data/conf.yaml.example

@@ -145,8 +145,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

external_dns/datadog_checks/external_dns/data/conf.yaml.example

@@ -139,8 +139,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

gitlab/datadog_checks/gitlab/data/conf.yaml.example

@@ -110,8 +110,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

gitlab_runner/datadog_checks/gitlab_runner/data/conf.yaml.example

@@ -193,8 +193,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

haproxy/datadog_checks/haproxy/data/conf.yaml.example

@@ -286,8 +286,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

kube_apiserver_metrics/datadog_checks/kube_apiserver_metrics/config_models/instance.py

@@ -1,4 +1,4 @@
-# (C) Datadog, Inc. 2021-present
+# (C) Datadog, Inc. 2022-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
 
@@ -69,7 +69,7 @@ class Config:
     aws_host: Optional[str]
     aws_region: Optional[str]
     aws_service: Optional[str]
-    bearer_token_auth: Optional[bool]
+    bearer_token_auth: Optional[Union[bool, str]]
     bearer_token_path: Optional[str]
     connect_timeout: Optional[float]
     disable_generic_tags: Optional[bool]

kube_apiserver_metrics/datadog_checks/kube_apiserver_metrics/data/conf.yaml.example

@@ -146,8 +146,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: true
+    ## @param bearer_token_auth - boolean or string - optional - default: true
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: true

kube_controller_manager/datadog_checks/kube_controller_manager/data/conf.yaml.example

@@ -181,8 +181,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

kube_dns/datadog_checks/kube_dns/data/conf.yaml.example

@@ -139,8 +139,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

kube_metrics_server/datadog_checks/kube_metrics_server/data/conf.yaml.example

@@ -146,8 +146,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

kube_proxy/datadog_checks/kube_proxy/data/conf.yaml.example

@@ -139,8 +139,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

kube_scheduler/datadog_checks/kube_scheduler/config_models/defaults.py

@@ -1,4 +1,4 @@
-# (C) Datadog, Inc. 2021-present
+# (C) Datadog, Inc. 2022-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
 
@@ -51,7 +51,7 @@ def instance_aws_service(field, value):
 
 
 def instance_bearer_token_auth(field, value):
-    return False
+    return get_default_field_value(field, value)
 
 
 def instance_bearer_token_path(field, value):

kube_scheduler/datadog_checks/kube_scheduler/config_models/instance.py

@@ -1,4 +1,4 @@
-# (C) Datadog, Inc. 2021-present
+# (C) Datadog, Inc. 2022-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
 
@@ -69,7 +69,7 @@ class Config:
     aws_host: Optional[str]
     aws_region: Optional[str]
     aws_service: Optional[str]
-    bearer_token_auth: Optional[bool]
+    bearer_token_auth: Optional[Union[bool, str]]
     bearer_token_path: Optional[str]
     connect_timeout: Optional[float]
     disable_generic_tags: Optional[bool]

kube_scheduler/datadog_checks/kube_scheduler/data/conf.yaml.example

@@ -160,8 +160,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

nginx_ingress_controller/datadog_checks/nginx_ingress_controller/data/conf.yaml.example

@@ -147,8 +147,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false

scylla/datadog_checks/scylla/data/conf.yaml.example

@@ -156,8 +156,9 @@ instances:
     #
     # include_labels: []
 
-    ## @param bearer_token_auth - boolean - optional - default: false
+    ## @param bearer_token_auth - boolean or string - optional - default: false
     ## If set to true, adds a bearer token authentication header.
+    ## If set to 'tls_only', adds only a bearer token authentication header if the endpoint is secure https.
     ## Note: If bearer_token_path is not set, the default path is /var/run/secrets/kubernetes.io/serviceaccount/token.
     #
     # bearer_token_auth: false