From 8655b15921983c742bc3e6750ffae6ca03c98b1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A9na=C3=AFc=20Huard?= Date: Wed, 24 Jun 2020 20:04:37 +0200 Subject: [PATCH] [stable/datadog] Mount kernel headers in system-probe container (#22686) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The goal is to implement runtime-compiled eBPF probes in system-probe and collect the data to convert them in DataDog metrics in the agent. Signed-off-by: Lénaïc Huard --- stable/datadog/CHANGELOG.md | 6 + stable/datadog/Chart.yaml | 2 +- stable/datadog/README.md | 318 +++++++++--------- stable/datadog/templates/container-agent.yaml | 9 +- .../templates/container-process-agent.yaml | 2 +- .../templates/container-system-probe.yaml | 8 +- .../templates/containers-init-linux.yaml | 5 + .../templates/daemonset-volumes-linux.yaml | 6 + .../templates/system-probe-configmap.yaml | 9 +- stable/datadog/values.yaml | 10 + 10 files changed, 207 insertions(+), 168 deletions(-) diff --git a/stable/datadog/CHANGELOG.md b/stable/datadog/CHANGELOG.md index 54ead74fd7..655a90a222 100644 --- a/stable/datadog/CHANGELOG.md +++ b/stable/datadog/CHANGELOG.md @@ -1,5 +1,11 @@ # Datadog changelog +## 2.3.15 + +* Mount kernel headers in system-probe container +* Fix the mount of the `system-probe` socket in core agent +* Add parameters to enable eBPF based checks + ## 2.3.14 * Allow overriding the `command` to run in the cluster-agent container diff --git a/stable/datadog/Chart.yaml b/stable/datadog/Chart.yaml index 173eec9abc..1a5e4b104a 100644 --- a/stable/datadog/Chart.yaml +++ b/stable/datadog/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: datadog -version: 2.3.14 +version: 2.3.15 appVersion: "7" description: Datadog Agent keywords: diff --git a/stable/datadog/README.md b/stable/datadog/README.md index ebe56599c4..775f5ec0d3 100644 --- a/stable/datadog/README.md +++ b/stable/datadog/README.md @@ -269,164 +269,166 @@ helm install --name \ stable/datadog ``` -| Parameter | Description | Default | -| ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | -| `targetSystem` | Target OS of this installation (supported: `linux`, `windows`) | `linux` | -| `datadog.apiKey` | Your Datadog API key | `nil` You must provide your own key | -| `datadog.apiKeyExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | -| `datadog.appKey` | Datadog APP key required to use metricsProvider | `nil` You must provide your own key | -| `datadog.appKeyExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | -| `agents.image.repository` | The image repository to pull from | `datadog/agent` | -| `agents.image.tag` | The image tag to pull | `7.19.0` | -| `agents.image.doNotCheckTag` | By default, the helm chart will check that the version provided in `agents.image.tag` is superior to the minimal version requested by the chart. If `doNotCheckTag` is explicitly set to `true`, this check is skipped. This is useful for custom tags that are not respecting semantic versioning. | `false` | -| `agents.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `agents.image.pullSecrets` | Image pull secrets | `nil` | -| `nameOverride` | Override name of app | `""` | -| `fullnameOverride` | Override full name of app | `""` | -| `agents.rbac.create` | If true, create & use RBAC resources | `true` | -| `agents.rbac.serviceAccountName` | existing ServiceAccount to use (ignored if rbac.create=true) | `default` | -| `datadog.site` | Site ('datadoghq.com' or 'datadoghq.eu') | `nil` | -| `datadog.dd_url` | Datadog intake server | `nil` | -| `datadog.env` | Additional Datadog environment variables | `nil` | -| `datadog.logLevel` | Agent log verbosity (possible values: trace, debug, info, warn, error, critical, and off) | `INFO` | -| `datadog.logs.enabled` | Enable log collection | `nil` | -| `datadog.logs.containerCollectAll` | Collect logs from all containers | `nil` | -| `datadog.logs.containerCollectUsingFiles` | Collect container logs from files on disk instead of container runtime API | `true` | -| `datadog.apm.enabled` | Enable tracing from the host | `false` | -| `datadog.apm.port` | Used to override the default agent APM Port | `8126` | -| `datadog.apm.useSocketVolume` | Enable APM over Unix Domain Socket | `False` | -| `datadog.apm.socketPath` | Custom path to the socket, has to be located in the `/var/run/datadog/` folder path | `/var/run/datadog/apm.socket` | -| `datadog.apm.hostPath` | host directory that contains the trace-agent socket path | `/var/run/datadog/` | -| `datadog.clusterChecks.enabled` | Enable Cluster Checks on both the Cluster Agent and the Agent daemonset | `false` | -| `datadog.processAgent.enabled` | Enable live process and container monitoring agent. Possible values: `true` enable process-agent, `false` disable process-agent | `true` | -| `datadog.processAgent.processCollection` | Enable live process collection. Possible values: `true` enable process collection, `false` disable process collection | `false` | -| `datadog.checksd` | Additional custom checks as python code | `nil` | -| `datadog.confd` | Additional check configurations (static and Autodiscovery) | `nil` | -| `datadog.dockerSocketPath` | Path to the docker socket | `/var/run/docker.sock` | -| `datadog.criSocketPath` | Path to the container runtime socket (default is Docker runtime) | `nil` | -| `datadog.tags` | Set host tags | `nil` | -| `datadog.dogstatsd.originDetection` | Enable origin detection for container tagging | `False` | -| `datadog.dogstatsd.port` | Used to override the default agent DogStatsD Port | `8125` | -| `datadog.dogstatsd.useHostPID` | If true, use the host's PID namespace | `nil` | -| `datadog.dogstatsd.useHostPort` | If true, use the same ports for both host and container | `nil` | -| `datadog.dogstatsd.nonLocalTraffic` | Enable statsd reporting from any external ip | `False` | -| `datadog.dogstatsd.useSocketVolume` | Enable dogstatsd over Unix Domain Socket | `False` | -| `datadog.dogstatsd.socketPath` | Custom path to the socket, has to be located in the `/var/run/datadog/` folder path | `/var/run/datadog/dsd.socket` | -| `datadog.dogstatsd.hostPath` | host directory that contains the dogstatsd socket | `/var/run/datadog/` | -| `datadog.nodeLabelsAsTags` | Kubernetes Node Labels to Datadog Tags mapping | `nil` | -| `datadog.podAnnotationsAsTags` | Kubernetes Annotations to Datadog Tags mapping | `nil` | -| `datadog.podLabelsAsTags` | Kubernetes Labels to Datadog Tags mapping | `nil` | -| `datadog.securityContext` | Allows you to overwrite the default securityContext applied to the container | `nil` | -| `datadog.acInclude` | Include containers based on image name | `nil` | -| `datadog.acExclude` | Exclude containers based on image name | `nil` | -| `datadog.systemProbe.enabled` | enable system probe collection | `false` | -| `datadog.systemProbe.seccomp` | Apply an ad-hoc seccomp profile to system-probe to restrict its privileges | `localhost/system-probe` | -| `datadog.systemProbe.seccompRoot` | Seccomp root directory for system-probe | `/var/lib/kubelet/seccomp` | -| `datadog.systemProbe.debugPort` | The port to expose pprof and expvar for system-probe agent, it is not enabled if the value is set to 0 | `0` | -| `datadog.systemProbe.enableConntrack` | If true, system-probe connects to the netlink/conntrack subsystem to add NAT information to connection data. Ref: http://conntrack-tools.netfilter.org/ | `true` | -| `datadog.systemProbe.bpfDebug` | If true, system-probe writes debug logs to /sys/kernel/debug/tracing/trace_pipe | `false` | -| `datadog.systemProbe.apparmor` | Apparmor profile for system-probe | `unconfined` | -| `agents.podAnnotations` | Annotations to add to the DaemonSet's Pods | `nil` | -| `agents.podLabels` | labels to add to each pod | `nil` | -| `agents.tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `nil` | -| `agents.nodeSelector` | Node selectors | `nil` | -| `agents.affinity` | Node affinities | `nil` | -| `agents.useHostNetwork` | If true, use the host's network | `nil` | -| `agents.dnsConfig` | If set, configure dnsConfig options in datadog agent containers | `nil` | -| `agents.containers.agent.env` | Additional list of environment variables to use in the agent container | `nil` | -| `agents.containers.agent.logLevel` | Agent log verbosity | `INFO` | -| `agents.containers.agent.resources.limits.cpu` | CPU resource limits for the agent container | `200m` | -| `agents.containers.agent.resources.requests.cpu` | CPU resource requests for the agent container | `200m` | -| `agents.containers.agent.resources.limits.memory` | Memory resource limits for the agent container | `256Mi` | -| `agents.containers.agent.resources.requests.memory` | Memory resource requests for the agent container | `256Mi` | -| `agents.containers.agent.livenessProbe` | Overrides the default liveness probe | http check on /live with port 5555 | -| `agents.containers.agent.readinessProbe` | Overrides the default readiness probe | http check on /ready with port 5555 | -| `agents.containers.processAgent.env` | Additional list of environment variables to use in the process-agent container | `nil` | -| `agents.containers.processAgent.logLevel` | Process agent log verbosity | `INFO` | -| `agents.containers.processAgent.resources.limits.cpu` | CPU resource limits for the process-agent container | `100m` | -| `agents.containers.processAgent.resources.requests.cpu` | CPU resource requests for the process-agent container | `100m` | -| `agents.containers.processAgent.resources.limits.memory` | Memory resource limits for the process-agent container | `200Mi` | -| `agents.containers.processAgent.resources.requests.memory` | Memory resource requests for the process-agent container | `200Mi` | -| `agents.containers.traceAgent.env` | Additional list of environment variables to use in the trace-agent container | `nil` | -| `agents.containers.traceAgent.logLevel` | Trace agent log verbosity | `INFO` | -| `agents.containers.traceAgent.resources.limits.cpu` | CPU resource limits for the trace-agent container | `100m` | -| `agents.containers.traceAgent.resources.requests.cpu` | CPU resource requests for the trace-agent container | `100m` | -| `agents.containers.traceAgent.resources.limits.memory` | Memory resource limits for the trace-agent container | `200Mi` | -| `agents.containers.traceAgent.resources.requests.memory` | Memory resource requests for the trace-agent container | `200Mi` | -| `agents.containers.systemProbe.env` | Additional list of environment variables to use in the system-probe container | `nil` | -| `agents.containers.systemProbe.logLevel` | System probe log verbosity | `INFO` | -| `agents.containers.systemProbe.resources.limits.cpu` | CPU resource limits for the system-probe container | `100m` | -| `agents.containers.systemProbe.resources.requests.cpu` | CPU resource requests for the system-probe container | `100m` | -| `agents.containers.systemProbe.resources.limits.memory` | Memory resource limits for the system-probe container | `200Mi` | -| `agents.containers.systemProbe.resources.requests.memory` | Memory resource requests for the system-probe container | `200Mi` | -| `agents.containers.initContainers.resources.limits.cpu` | CPU resource limits for the init containers container | `200m` | -| `agents.containers.initContainers.resources.requests.cpu` | CPU resource requests for the init containers container | `200m` | -| `agents.containers.initContainers.resources.limits.memory` | Memory resource limits for the init containers container | `256Mi` | -| `agents.containers.initContainers.resources.requests.memory` | Memory resource requests for the init containers container | `256Mi` | -| `agents.priorityClassName` | Which Priority Class to associate with the daemonset | `nil` | -| `agents.useConfigMap` | Configures a configmap to provide the agent configuration. Use this in combination with the `agent.customAgentConfig` parameter. | `false` | -| `agents.customAgentConfig` | Specify custom contents for the datadog agent config (datadog.yaml). Note the `agent.useConfigMap` parameter needs to be set to `true` for this parameter to be taken into account. | `{}` | -| `agents.updateStrategy` | Which update strategy to deploy the daemonset | RollingUpdate with 10% maxUnavailable | -| `agents.volumes` | Additional volumes for the daemonset or deployment | `nil` | -| `agents.volumeMounts` | Additional volumeMounts for the daemonset or deployment | `nil` | -| `datadog.leaderElection` | Enable the leader Election feature | `false` | -| `datadog.leaderLeaseDuration` | The duration for which a leader stays elected. | 60 sec, 15 if Cluster Checks enabled | -| `datadog.collectEvents` | Enable Kubernetes event collection. Requires leader election. | `false` | -| `datadog.kubeStateMetricsEnabled` | If true, create kube-state-metrics | `true` | -| `clusterAgent.enabled` | Use the cluster-agent for cluster metrics (Kubernetes 1.10+ only) | `false` | -| `clusterAgent.token` | A cluster-internal secret for agent-to-agent communication. Must be 32+ characters a-zA-Z | Generates a random value | -| `clusterAgent.tokenExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | -| `clusterAgent.image.repository` | The image repository for the cluster-agent | `datadog/cluster-agent` | -| `clusterAgent.image.tag` | The image tag to pull | `1.2.0` | -| `clusterAgent.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `clusterAgent.image.pullSecrets` | Image pull secrets | `nil` | -| `clusterAgent.command` | Override the default command to run in the container | `nil` | -| `clusterAgent.rbac.create` | If true, create & use RBAC resources for cluster agent's pods | `true` | -| `clusterAgent.rbac.serviceAccount` | existing ServiceAccount to use (ignored if rbac.create=true) for cluster agent's pods | `default` | -| `clusterAgent.metricsProvider.enabled` | Enable Datadog metrics as a source for HPA scaling | `false` | -| `clusterAgent.metricsProvider.service.type` | The type of service to use for the clusterAgent metrics server | `ClusterIP` | -| `clusterAgent.metricsProvider.service.port` | The port for service to use for the clusterAgent metrics server | `443` . | -| `clusterAgent.confd` | Additional check configurations (static and Autodiscovery) | `nil` | -| `clusterAgent.podAnnotations` | Annotations to add to the Cluster Agent Pod(s) | `nil` | -| `clusterAgent.podLabels` | Labels to add to the Cluster Agent Pod(s) | `nil` | -| `clusterAgent.createPodDisruptionBudget` | Enable a pod disruption budget to apply to the Cluster Agent pods | `false` | -| `clusterAgent.priorityClassName` | Name of the priorityClass to apply to the Cluster Agent | `nil` | -| `clusterAgent.nodeSelector` | Node selectors to apply to the Cluster Agent deployment | `nil` | -| `clusterAgent.affinity` | Node affinities to apply to the Cluster Agent deployment | `nil` | -| `clusterAgent.resources.requests.cpu` | CPU resource requests | `200m` | -| `clusterAgent.resources.limits.cpu` | CPU resource limits | `200m` | -| `clusterAgent.resources.requests.memory` | Memory resource requests | `256Mi` | -| `clusterAgent.resources.limits.memory` | Memory resource limits | `256Mi` | -| `clusterAgent.tolerations` | List of node taints to tolerate | `[]` | -| `clusterAgent.healthPort` | Overrides the default health port used by the liveness and readiness endpoint | `5555` | -| `clusterAgent.livenessProbe` | Overrides the default liveness probe | `http check on /live with port 5555` | -| `clusterAgent.readinessProbe` | Overrides the default readiness probe | `http check on /ready with port 5555` | -| `clusterAgent.strategy` | Which update strategy to deploy the cluster-agent | RollingUpdate with 0 maxUnavailable, 1 maxSurge | -| `clusterAgent.useHostNetwork` | If true, use the host's network | `nil` | -| `clusterAgent.dnsConfig` | If set, configure dnsConfig options in datadog cluster agent containers | `nil` | -| `clusterAgent.volumes` | Additional volumes for the cluster-agent deployment | `nil` | -| `clusterAgent.volumeMounts` | Additional volumeMounts for the cluster-agent deployment | `nil` | -| `clusterChecksRunner.enabled` | Enable Datadog agent deployment dedicated for running Cluster Checks. It allows having different resources (Request/Limit) for Cluster Checks agent pods. | `false` | -| `clusterChecksRunner.env` | Additional Datadog environment variables for Cluster Checks Deployment | `nil` | -| `clusterChecksRunner.createPodDisruptionBudget` | Enable a pod disruption budget to apply to the Cluster Checks pods | `false` | -| `clusterChecksRunner.resources.requests.cpu` | CPU resource requests | `200m` | -| `clusterChecksRunner.resources.limits.cpu` | CPU resource limits | `200m` | -| `clusterChecksRunner.resources.requests.memory` | Memory resource requests | `256Mi` | -| `clusterChecksRunner.resources.limits.memory` | Memory resource limits | `256Mi` | -| `clusterChecksRunner.nodeSelector` | Node selectors | `nil` | -| `clusterChecksRunner.tolerations` | List of node taints to tolerate | `nil` | -| `clusterChecksRunner.affinity` | Node affinities | avoid running pods on the same node | -| `clusterChecksRunner.livenessProbe` | Overrides the default liveness probe | http check on /live with port 5555 | -| `clusterChecksRunner.readinessProbe` | Overrides the default readiness probe | http check on /ready with port 5555 | -| `clusterChecksRunner.rbac.create` | If true, create & use RBAC resources for clusterchecks agent's pods | `true` | -| `clusterChecksRunner.rbac.dedicated` | If true, use dedicated RBAC resources for clusterchecks agent's pods | `false` | -| `clusterChecksRunner.rbac.serviceAccount` | existing ServiceAccount to use (ignored if rbac.create=true) for clusterchecks agent's pods | `default` | -| `clusterChecksRunner.strategy` | Which update strategy to deploy the Cluster Checks Deployment | RollingUpdate with 0 maxUnavailable, 1 maxSurge | -| `clusterChecksRunner.dnsConfig` | If set, configure dnsConfig options in datadog cluster agent clusterChecks containers | `nil` | -| `kube-state-metrics.rbac.create` | If true, create & use RBAC resources for kube-state-metrics | `true` | -| `kube-state-metrics.serviceAccount.create` | If true, create & use serviceAccount | `true` | -| `kube-state-metrics.serviceAccount.name` | If not set & create is true, use template fullname | | -| `kube-state-metrics.resources` | Overwrite the default kube-state-metrics container resources (Optional) | | +| Parameter | Description | Default | +| ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | +| `targetSystem` | Target OS of this installation (supported: `linux`, `windows`) | `linux` | +| `datadog.apiKey` | Your Datadog API key | `nil` You must provide your own key | +| `datadog.apiKeyExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | +| `datadog.appKey` | Datadog APP key required to use metricsProvider | `nil` You must provide your own key | +| `datadog.appKeyExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | +| `agents.image.repository` | The image repository to pull from | `datadog/agent` | +| `agents.image.tag` | The image tag to pull | `7.19.0` | +| `agents.image.doNotCheckTag` | By default, the helm chart will check that the version provided in `agents.image.tag` is superior to the minimal version requested by the chart. If `doNotCheckTag` is explicitly set to `true`, this check is skipped. This is useful for custom tags that are not respecting semantic versioning. | `false` | +| `agents.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `agents.image.pullSecrets` | Image pull secrets | `nil` | +| `nameOverride` | Override name of app | `""` | +| `fullnameOverride` | Override full name of app | `""` | +| `agents.rbac.create` | If true, create & use RBAC resources | `true` | +| `agents.rbac.serviceAccountName` | existing ServiceAccount to use (ignored if rbac.create=true) | `default` | +| `datadog.site` | Site ('datadoghq.com' or 'datadoghq.eu') | `nil` | +| `datadog.dd_url` | Datadog intake server | `nil` | +| `datadog.env` | Additional Datadog environment variables | `nil` | +| `datadog.logLevel` | Agent log verbosity (possible values: trace, debug, info, warn, error, critical, and off) | `INFO` | +| `datadog.logs.enabled` | Enable log collection | `nil` | +| `datadog.logs.containerCollectAll` | Collect logs from all containers | `nil` | +| `datadog.logs.containerCollectUsingFiles` | Collect container logs from files on disk instead of container runtime API | `true` | +| `datadog.apm.enabled` | Enable tracing from the host | `false` | +| `datadog.apm.port` | Used to override the default agent APM Port | `8126` | +| `datadog.apm.useSocketVolume` | Enable APM over Unix Domain Socket | `False` | +| `datadog.apm.socketPath` | Custom path to the socket, has to be located in the `/var/run/datadog/` folder path | `/var/run/datadog/apm.socket` | +| `datadog.apm.hostPath` | host directory that contains the trace-agent socket path | `/var/run/datadog/` | +| `datadog.clusterChecks.enabled` | Enable Cluster Checks on both the Cluster Agent and the Agent daemonset | `false` | +| `datadog.processAgent.enabled` | Enable live process and container monitoring agent. Possible values: `true` enable process-agent, `false` disable process-agent | `true` | +| `datadog.processAgent.processCollection` | Enable live process collection. Possible values: `true` enable process collection, `false` disable process collection | `false` | +| `datadog.checksd` | Additional custom checks as python code | `nil` | +| `datadog.confd` | Additional check configurations (static and Autodiscovery) | `nil` | +| `datadog.dockerSocketPath` | Path to the docker socket | `/var/run/docker.sock` | +| `datadog.criSocketPath` | Path to the container runtime socket (default is Docker runtime) | `nil` | +| `datadog.tags` | Set host tags | `nil` | +| `datadog.dogstatsd.originDetection` | Enable origin detection for container tagging | `False` | +| `datadog.dogstatsd.port` | Used to override the default agent DogStatsD Port | `8125` | +| `datadog.dogstatsd.useHostPID` | If true, use the host's PID namespace | `nil` | +| `datadog.dogstatsd.useHostPort` | If true, use the same ports for both host and container | `nil` | +| `datadog.dogstatsd.nonLocalTraffic` | Enable statsd reporting from any external ip | `False` | +| `datadog.dogstatsd.useSocketVolume` | Enable dogstatsd over Unix Domain Socket | `False` | +| `datadog.dogstatsd.socketPath` | Custom path to the socket, has to be located in the `/var/run/datadog/` folder path | `/var/run/datadog/dsd.socket` | +| `datadog.dogstatsd.hostPath` | host directory that contains the dogstatsd socket | `/var/run/datadog/` | +| `datadog.nodeLabelsAsTags` | Kubernetes Node Labels to Datadog Tags mapping | `nil` | +| `datadog.podAnnotationsAsTags` | Kubernetes Annotations to Datadog Tags mapping | `nil` | +| `datadog.podLabelsAsTags` | Kubernetes Labels to Datadog Tags mapping | `nil` | +| `datadog.securityContext` | Allows you to overwrite the default securityContext applied to the container | `nil` | +| `datadog.acInclude` | Include containers based on image name | `nil` | +| `datadog.acExclude` | Exclude containers based on image name | `nil` | +| `datadog.systemProbe.enabled` | enable system probe collection | `false` | +| `datadog.systemProbe.seccomp` | Apply an ad-hoc seccomp profile to system-probe to restrict its privileges | `localhost/system-probe` | +| `datadog.systemProbe.seccompRoot` | Seccomp root directory for system-probe | `/var/lib/kubelet/seccomp` | +| `datadog.systemProbe.debugPort` | The port to expose pprof and expvar for system-probe agent, it is not enabled if the value is set to 0 | `0` | +| `datadog.systemProbe.enableConntrack` | If true, system-probe connects to the netlink/conntrack subsystem to add NAT information to connection data. Ref: http://conntrack-tools.netfilter.org/ | `true` | +| `datadog.systemProbe.bpfDebug` | If true, system-probe writes debug logs to /sys/kernel/debug/tracing/trace_pipe | `false` | +| `datadog.systemProbe.apparmor` | Apparmor profile for system-probe | `unconfined` | +| `datadog.systemProbe.enableTCPQueueLength | Enable the TCP queue length eBPF-based check | `false` | +| `datadog.systemProbe.enableOOMKill` | Enable the OOM kill eBPF-based check | `false` | +| `agents.podAnnotations` | Annotations to add to the DaemonSet's Pods | `nil` | +| `agents.podLabels` | labels to add to each pod | `nil` | +| `agents.tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `nil` | +| `agents.nodeSelector` | Node selectors | `nil` | +| `agents.affinity` | Node affinities | `nil` | +| `agents.useHostNetwork` | If true, use the host's network | `nil` | +| `agents.dnsConfig` | If set, configure dnsConfig options in datadog agent containers | `nil` | +| `agents.containers.agent.env` | Additional list of environment variables to use in the agent container | `nil` | +| `agents.containers.agent.logLevel` | Agent log verbosity | `INFO` | +| `agents.containers.agent.resources.limits.cpu` | CPU resource limits for the agent container | `200m` | +| `agents.containers.agent.resources.requests.cpu` | CPU resource requests for the agent container | `200m` | +| `agents.containers.agent.resources.limits.memory` | Memory resource limits for the agent container | `256Mi` | +| `agents.containers.agent.resources.requests.memory` | Memory resource requests for the agent container | `256Mi` | +| `agents.containers.agent.livenessProbe` | Overrides the default liveness probe | http check on /live with port 5555 | +| `agents.containers.agent.readinessProbe` | Overrides the default readiness probe | http check on /ready with port 5555 | +| `agents.containers.processAgent.env` | Additional list of environment variables to use in the process-agent container | `nil` | +| `agents.containers.processAgent.logLevel` | Process agent log verbosity | `INFO` | +| `agents.containers.processAgent.resources.limits.cpu` | CPU resource limits for the process-agent container | `100m` | +| `agents.containers.processAgent.resources.requests.cpu` | CPU resource requests for the process-agent container | `100m` | +| `agents.containers.processAgent.resources.limits.memory` | Memory resource limits for the process-agent container | `200Mi` | +| `agents.containers.processAgent.resources.requests.memory` | Memory resource requests for the process-agent container | `200Mi` | +| `agents.containers.traceAgent.env` | Additional list of environment variables to use in the trace-agent container | `nil` | +| `agents.containers.traceAgent.logLevel` | Trace agent log verbosity | `INFO` | +| `agents.containers.traceAgent.resources.limits.cpu` | CPU resource limits for the trace-agent container | `100m` | +| `agents.containers.traceAgent.resources.requests.cpu` | CPU resource requests for the trace-agent container | `100m` | +| `agents.containers.traceAgent.resources.limits.memory` | Memory resource limits for the trace-agent container | `200Mi` | +| `agents.containers.traceAgent.resources.requests.memory` | Memory resource requests for the trace-agent container | `200Mi` | +| `agents.containers.systemProbe.env` | Additional list of environment variables to use in the system-probe container | `nil` | +| `agents.containers.systemProbe.logLevel` | System probe log verbosity | `INFO` | +| `agents.containers.systemProbe.resources.limits.cpu` | CPU resource limits for the system-probe container | `100m` | +| `agents.containers.systemProbe.resources.requests.cpu` | CPU resource requests for the system-probe container | `100m` | +| `agents.containers.systemProbe.resources.limits.memory` | Memory resource limits for the system-probe container | `200Mi` | +| `agents.containers.systemProbe.resources.requests.memory` | Memory resource requests for the system-probe container | `200Mi` | +| `agents.containers.initContainers.resources.limits.cpu` | CPU resource limits for the init containers container | `200m` | +| `agents.containers.initContainers.resources.requests.cpu` | CPU resource requests for the init containers container | `200m` | +| `agents.containers.initContainers.resources.limits.memory` | Memory resource limits for the init containers container | `256Mi` | +| `agents.containers.initContainers.resources.requests.memory` | Memory resource requests for the init containers container | `256Mi` | +| `agents.priorityClassName` | Which Priority Class to associate with the daemonset | `nil` | +| `agents.useConfigMap` | Configures a configmap to provide the agent configuration. Use this in combination with the `agent.customAgentConfig` parameter. | `false` | +| `agents.customAgentConfig` | Specify custom contents for the datadog agent config (datadog.yaml). Note the `agent.useConfigMap` parameter needs to be set to `true` for this parameter to be taken into account. | `{}` | +| `agents.updateStrategy` | Which update strategy to deploy the daemonset | RollingUpdate with 10% maxUnavailable | +| `agents.volumes` | Additional volumes for the daemonset or deployment | `nil` | +| `agents.volumeMounts` | Additional volumeMounts for the daemonset or deployment | `nil` | +| `datadog.leaderElection` | Enable the leader Election feature | `false` | +| `datadog.leaderLeaseDuration` | The duration for which a leader stays elected. | 60 sec, 15 if Cluster Checks enabled | +| `datadog.collectEvents` | Enable Kubernetes event collection. Requires leader election. | `false` | +| `datadog.kubeStateMetricsEnabled` | If true, create kube-state-metrics | `true` | +| `clusterAgent.enabled` | Use the cluster-agent for cluster metrics (Kubernetes 1.10+ only) | `false` | +| `clusterAgent.token` | A cluster-internal secret for agent-to-agent communication. Must be 32+ characters a-zA-Z | Generates a random value | +| `clusterAgent.tokenExistingSecret` | If set, use the secret with a provided name instead of creating a new one | `nil` | +| `clusterAgent.image.repository` | The image repository for the cluster-agent | `datadog/cluster-agent` | +| `clusterAgent.image.tag` | The image tag to pull | `1.2.0` | +| `clusterAgent.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `clusterAgent.image.pullSecrets` | Image pull secrets | `nil` | +| `clusterAgent.command` | Override the default command to run in the container | `nil` | +| `clusterAgent.rbac.create` | If true, create & use RBAC resources for cluster agent's pods | `true` | +| `clusterAgent.rbac.serviceAccount` | existing ServiceAccount to use (ignored if rbac.create=true) for cluster agent's pods | `default` | +| `clusterAgent.metricsProvider.enabled` | Enable Datadog metrics as a source for HPA scaling | `false` | +| `clusterAgent.metricsProvider.service.type` | The type of service to use for the clusterAgent metrics server | `ClusterIP` | +| `clusterAgent.metricsProvider.service.port` | The port for service to use for the clusterAgent metrics server | `443` . | +| `clusterAgent.confd` | Additional check configurations (static and Autodiscovery) | `nil` | +| `clusterAgent.podAnnotations` | Annotations to add to the Cluster Agent Pod(s) | `nil` | +| `clusterAgent.podLabels` | Labels to add to the Cluster Agent Pod(s) | `nil` | +| `clusterAgent.createPodDisruptionBudget` | Enable a pod disruption budget to apply to the Cluster Agent pods | `false` | +| `clusterAgent.priorityClassName` | Name of the priorityClass to apply to the Cluster Agent | `nil` | +| `clusterAgent.nodeSelector` | Node selectors to apply to the Cluster Agent deployment | `nil` | +| `clusterAgent.affinity` | Node affinities to apply to the Cluster Agent deployment | `nil` | +| `clusterAgent.resources.requests.cpu` | CPU resource requests | `200m` | +| `clusterAgent.resources.limits.cpu` | CPU resource limits | `200m` | +| `clusterAgent.resources.requests.memory` | Memory resource requests | `256Mi` | +| `clusterAgent.resources.limits.memory` | Memory resource limits | `256Mi` | +| `clusterAgent.tolerations` | List of node taints to tolerate | `[]` | +| `clusterAgent.healthPort` | Overrides the default health port used by the liveness and readiness endpoint | `5555` | +| `clusterAgent.livenessProbe` | Overrides the default liveness probe | `http check on /live with port 5555` | +| `clusterAgent.readinessProbe` | Overrides the default readiness probe | `http check on /ready with port 5555` | +| `clusterAgent.strategy` | Which update strategy to deploy the cluster-agent | RollingUpdate with 0 maxUnavailable, 1 maxSurge | +| `clusterAgent.useHostNetwork` | If true, use the host's network | `nil` | +| `clusterAgent.dnsConfig` | If set, configure dnsConfig options in datadog cluster agent containers | `nil` | +| `clusterAgent.volumes` | Additional volumes for the cluster-agent deployment | `nil` | +| `clusterAgent.volumeMounts` | Additional volumeMounts for the cluster-agent deployment | `nil` | +| `clusterChecksRunner.enabled` | Enable Datadog agent deployment dedicated for running Cluster Checks. It allows having different resources (Request/Limit) for Cluster Checks agent pods. | `false` | +| `clusterChecksRunner.env` | Additional Datadog environment variables for Cluster Checks Deployment | `nil` | +| `clusterChecksRunner.createPodDisruptionBudget` | Enable a pod disruption budget to apply to the Cluster Checks pods | `false` | +| `clusterChecksRunner.resources.requests.cpu` | CPU resource requests | `200m` | +| `clusterChecksRunner.resources.limits.cpu` | CPU resource limits | `200m` | +| `clusterChecksRunner.resources.requests.memory` | Memory resource requests | `256Mi` | +| `clusterChecksRunner.resources.limits.memory` | Memory resource limits | `256Mi` | +| `clusterChecksRunner.nodeSelector` | Node selectors | `nil` | +| `clusterChecksRunner.tolerations` | List of node taints to tolerate | `nil` | +| `clusterChecksRunner.affinity` | Node affinities | avoid running pods on the same node | +| `clusterChecksRunner.livenessProbe` | Overrides the default liveness probe | http check on /live with port 5555 | +| `clusterChecksRunner.readinessProbe` | Overrides the default readiness probe | http check on /ready with port 5555 | +| `clusterChecksRunner.rbac.create` | If true, create & use RBAC resources for clusterchecks agent's pods | `true` | +| `clusterChecksRunner.rbac.dedicated` | If true, use dedicated RBAC resources for clusterchecks agent's pods | `false` | +| `clusterChecksRunner.rbac.serviceAccount` | existing ServiceAccount to use (ignored if rbac.create=true) for clusterchecks agent's pods | `default` | +| `clusterChecksRunner.strategy` | Which update strategy to deploy the Cluster Checks Deployment | RollingUpdate with 0 maxUnavailable, 1 maxSurge | +| `clusterChecksRunner.dnsConfig` | If set, configure dnsConfig options in datadog cluster agent clusterChecks containers | `nil` | +| `kube-state-metrics.rbac.create` | If true, create & use RBAC resources for kube-state-metrics | `true` | +| `kube-state-metrics.serviceAccount.create` | If true, create & use serviceAccount | `true` | +| `kube-state-metrics.serviceAccount.name` | If not set & create is true, use template fullname | | +| `kube-state-metrics.resources` | Overwrite the default kube-state-metrics container resources (Optional) | | ## Configuration options for Windows deployments diff --git a/stable/datadog/templates/container-agent.yaml b/stable/datadog/templates/container-agent.yaml index e2fa3bcff0..7bd1a06561 100644 --- a/stable/datadog/templates/container-agent.yaml +++ b/stable/datadog/templates/container-agent.yaml @@ -79,10 +79,6 @@ value: "clusterchecks endpointschecks" {{- end }} {{- end }} - {{- if .Values.datadog.systemProbe.enabled }} - - name: SYSTEM_PROBE_CONFIG_SYSPROBE_SOCKET - value: /sysprobe/var/run - {{- end }} {{- range $value := .Values.agents.containers.agent.env }} - name: {{ $value.name }} value: {{ $value.value | quote }} @@ -111,8 +107,11 @@ {{- end }} {{- if .Values.datadog.systemProbe.enabled }} - name: sysprobe-socket-dir - mountPath: /sysprobe/var/run + mountPath: /var/run/sysprobe readOnly: true + - name: sysprobe-config + mountPath: /etc/datadog-agent/system-probe.yaml + subPath: system-probe.yaml {{- end }} - name: procdir mountPath: /host/proc diff --git a/stable/datadog/templates/container-process-agent.yaml b/stable/datadog/templates/container-process-agent.yaml index 519efdd0ff..62edabbe1a 100644 --- a/stable/datadog/templates/container-process-agent.yaml +++ b/stable/datadog/templates/container-process-agent.yaml @@ -54,7 +54,7 @@ readOnly: true {{- if .Values.datadog.systemProbe.enabled }} - name: sysprobe-socket-dir - mountPath: /opt/datadog-agent/run + mountPath: /var/run/sysprobe readOnly: true {{- end }} {{- end }} diff --git a/stable/datadog/templates/container-system-probe.yaml b/stable/datadog/templates/container-system-probe.yaml index a20d9c387f..ea766cac24 100644 --- a/stable/datadog/templates/container-system-probe.yaml +++ b/stable/datadog/templates/container-system-probe.yaml @@ -21,8 +21,14 @@ - name: sysprobe-config mountPath: /etc/datadog-agent - name: sysprobe-socket-dir - mountPath: /opt/datadog-agent/run + mountPath: /var/run/sysprobe - name: procdir mountPath: /host/proc readOnly: true + - name: modules + mountPath: /lib/modules + readOnly: true + - name: src + mountPath: /usr/src + readOnly: true {{- end -}} diff --git a/stable/datadog/templates/containers-init-linux.yaml b/stable/datadog/templates/containers-init-linux.yaml index bd17281e22..bfb0ef1ea2 100644 --- a/stable/datadog/templates/containers-init-linux.yaml +++ b/stable/datadog/templates/containers-init-linux.yaml @@ -35,6 +35,11 @@ - name: runtimesocketdir mountPath: {{ print "/host/" (dir (include "datadog.dockerOrCriSocketPath" .)) | clean }} readOnly: true + {{- if .Values.datadog.systemProbe.enabled }} + - name: sysprobe-config + mountPath: /etc/datadog-agent/system-probe.yaml + subPath: system-probe.yaml + {{- end }} env: {{- include "containers-common-env" . | nindent 4 }} {{- if and (not .Values.clusterAgent.enabled) .Values.datadog.leaderElection }} diff --git a/stable/datadog/templates/daemonset-volumes-linux.yaml b/stable/datadog/templates/daemonset-volumes-linux.yaml index c7f6f76f0f..17529c31bf 100644 --- a/stable/datadog/templates/daemonset-volumes-linux.yaml +++ b/stable/datadog/templates/daemonset-volumes-linux.yaml @@ -41,6 +41,12 @@ name: debugfs - name: sysprobe-socket-dir emptyDir: {} +- hostPath: + path: /lib/modules + name: modules +- hostPath: + path: /usr/src + name: src {{- end }} {{- if or .Values.datadog.processAgent.enabled .Values.datadog.systemProbe.enabled }} - hostPath: diff --git a/stable/datadog/templates/system-probe-configmap.yaml b/stable/datadog/templates/system-probe-configmap.yaml index 65fc6d26f3..60b6212ac9 100644 --- a/stable/datadog/templates/system-probe-configmap.yaml +++ b/stable/datadog/templates/system-probe-configmap.yaml @@ -15,9 +15,11 @@ data: system_probe_config: enabled: {{ $.Values.datadog.systemProbe.enabled }} debug_port: {{ $.Values.datadog.systemProbe.debugPort }} - sysprobe_socket: /opt/datadog-agent/run/sysprobe.sock - enable_conntrack : {{ $.Values.datadog.systemProbe.enableConntrack }} + sysprobe_socket: /var/run/sysprobe/sysprobe.sock + enable_conntrack: {{ $.Values.datadog.systemProbe.enableConntrack }} bpf_debug: {{ $.Values.datadog.systemProbe.bpfDebug }} + enable_tcp_queue_length: {{ $.Values.datadog.systemProbe.enableTCPQueueLength }} + enable_oom_kill: {{ $.Values.datadog.systemProbe.enableOOMKill }} {{- if eq .Values.datadog.systemProbe.seccomp "localhost/system-probe" }} --- @@ -111,11 +113,13 @@ data: "lseek", "lstat", "lstat64", + "madvise", "mkdir", "mkdirat", "mmap", "mmap2", "mprotect", + "mremap", "munmap", "nanosleep", "newfstatat", @@ -128,6 +132,7 @@ data: "poll", "ppoll", "prctl", + "pread64", "prlimit64", "pselect6", "read", diff --git a/stable/datadog/values.yaml b/stable/datadog/values.yaml index 5692ce7888..2f54f07b52 100644 --- a/stable/datadog/values.yaml +++ b/stable/datadog/values.yaml @@ -361,6 +361,16 @@ datadog: # apparmor: unconfined + ## @param enableTCPQueueLength - boolean - optional + ## Enable the TCP queue length eBPF-based check + # + enableTCPQueueLength: false + + ## @param enableOOMKill - boolean - optional + ## Enable the OOM kill eBPF-based check + # + enableOOMKill: false + ## @param clusterAgent - object - required ## This is the Datadog Cluster Agent implementation that handles cluster-wide ## metrics more cleanly, separates concerns for better rbac, and implements