mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/newrelic-infrastructure] add a conditional value for installing the privileged/unprivileged version (#15944)
Signed-off-by: Daniel Fernandez <dfernandez@newrelic.com>
This commit is contained in:
Daniel Fernandez Arias
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
b41d7bcfaf
commit
ad185e5b8f
@@ -1,8 +1,8 @@
|
||||
apiVersion: v1
|
||||
description: A Helm chart to deploy the New Relic Infrastructure Agent as a DaemonSet
|
||||
name: newrelic-infrastructure
|
||||
version: 0.13.2
|
||||
appVersion: 1.9.0
|
||||
version: 0.13.3
|
||||
appVersion: 1.9.2
|
||||
home: https://hub.docker.com/r/newrelic/infrastructure-k8s/
|
||||
source:
|
||||
- https://github.com/kubernetes/kubernetes/tree/master/examples/newrelic-infrastructure
|
||||
|
||||
@@ -17,9 +17,10 @@ This chart will deploy the New Relic Infrastructure agent as a Daemonset.
|
||||
| `kubeStateMetricsTimeout` | Timeout for accessing kube-state-metrics in milliseconds. If not set the newrelic default is 5000 | |
|
||||
| `rbac.create` | Enable Role-based authentication | `true` |
|
||||
| `rbac.pspEnabled` | Enable pod security policy support | `false` |
|
||||
| `privileged` | Enable privileged mode. | `false` |
|
||||
| `image.name` | The container to pull. | `newrelic/infrastructure` |
|
||||
| `image.pullPolicy` | The pull policy. | `IfNotPresent` |
|
||||
| `image.tag` | The version of the container to pull. | `1.9.0` |
|
||||
| `image.tag` | The version of the container to pull. | `1.9.2` |
|
||||
| `resources` | Any resources you wish to assign to the pod. | See Resources below |
|
||||
| `verboseLog` | Should the agent log verbosely. (Boolean) | `false` |
|
||||
| `priorityClassName` | Scheduling priority of the pod | `nil` |
|
||||
@@ -48,4 +49,4 @@ The default set of resources assigned to the pods is shown below:
|
||||
|
||||
# Config file
|
||||
|
||||
If you wish to provide your own `newrelic.yml` you may do so under `config`. There are a few notable exceptions you should be aware of. Three options have been omitted because they are handled either by variables, or a secret. They are license_key, log_file and verbose.
|
||||
If you wish to provide your own `newrelic.yml` you may do so under `config`. There are a few notable exceptions you should be aware of. Some options have been omitted because they are handled either by variables, or a secret. They are display_name, license_key, log_file and verbose.
|
||||
|
||||
@@ -19,12 +19,22 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Generate mode label */}}
|
||||
{{- define "newrelic.mode" }}
|
||||
{{- if .Values.privileged -}}
|
||||
privileged
|
||||
{{- else -}}
|
||||
unprivileged
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Generate basic labels */}}
|
||||
{{- define "newrelic.labels" }}
|
||||
app: {{ template "newrelic.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
heritage: {{.Release.Service }}
|
||||
release: {{.Release.Name }}
|
||||
mode: {{ template "newrelic.mode" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
@@ -44,3 +54,14 @@ Create the name of the service account to use
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the image name depending on the "privileged" flag
|
||||
*/}}
|
||||
{{- define "newrelic.image" -}}
|
||||
{{- if .Values.privileged -}}
|
||||
"{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
{{- else -}}
|
||||
"{{ .Values.image.repository }}:{{ .Values.image.tag }}-unprivileged"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -23,14 +23,21 @@ spec:
|
||||
{{- if .Values.podLabels}}
|
||||
{{ toYaml .Values.podLabels }}
|
||||
{{- end }}
|
||||
mode: {{ template "newrelic.mode" . }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "newrelic.serviceAccountName" . }}
|
||||
containers:
|
||||
- name: {{ template "newrelic.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
image: {{ template "newrelic.image" . }}
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
securityContext:
|
||||
{{- if .Values.privileged }}
|
||||
privileged: true
|
||||
{{- else }}
|
||||
runAsUser: 1000 # nri-agent
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NRIA_LICENSE_KEY
|
||||
valueFrom:
|
||||
@@ -74,12 +81,17 @@ spec:
|
||||
- name: NRIA_LOG_FILE
|
||||
value: {{ .Values.logFile }}
|
||||
{{- end }}
|
||||
{{- if not .Values.privileged }}
|
||||
- name: "DISCOVERY_CACHE_DIR"
|
||||
value: "/tmp/nr-kubernetes"
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.config }}
|
||||
- name: config
|
||||
mountPath: /etc/newrelic-infra.yml
|
||||
subPath: newrelic-infra.yml
|
||||
{{- end }}
|
||||
{{- if .Values.privileged }}
|
||||
- name: dev
|
||||
mountPath: /dev
|
||||
- name: host-docker-socket
|
||||
@@ -89,23 +101,40 @@ spec:
|
||||
- name: host-volume
|
||||
mountPath: /host
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- mountPath: /var/db/newrelic-infra/data
|
||||
name: tmpfs-data
|
||||
- mountPath: /var/db/newrelic-infra/user_data
|
||||
name: tmpfs-user-data
|
||||
- mountPath: /tmp
|
||||
name: tmpfs-tmp
|
||||
{{- end }}
|
||||
{{- if .Values.resources }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.privileged }}
|
||||
- name: dev
|
||||
hostPath:
|
||||
path: /dev
|
||||
- name: host-docker-socket
|
||||
hostPath:
|
||||
path: /var/run/docker.sock
|
||||
path: /var/run/docker.sock
|
||||
- name: log
|
||||
hostPath:
|
||||
path: /var/log
|
||||
path: /var/log
|
||||
- name: host-volume
|
||||
hostPath:
|
||||
path: /
|
||||
path: /
|
||||
{{- else }}
|
||||
- name: tmpfs-data
|
||||
emptyDir: {}
|
||||
- name: tmpfs-user-data
|
||||
emptyDir: {}
|
||||
- name: tmpfs-tmp
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.config }}
|
||||
- name: config
|
||||
configMap:
|
||||
|
||||
@@ -20,7 +20,7 @@ verboseLog: false
|
||||
|
||||
image:
|
||||
repository: newrelic/infrastructure-k8s
|
||||
tag: 1.9.0
|
||||
tag: 1.9.2
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
resources:
|
||||
@@ -30,6 +30,8 @@ resources:
|
||||
cpu: 100m
|
||||
memory: 30M
|
||||
|
||||
privileged: true
|
||||
|
||||
rbac:
|
||||
# Specifies whether RBAC resources should be created
|
||||
create: true
|
||||
@@ -47,9 +49,9 @@ serviceAccount:
|
||||
# podLabels:
|
||||
|
||||
# If you wish to provide your own newrelic.yml file include it under config:
|
||||
# the sample config file is included here as an example. Three options have
|
||||
# the sample config file is included here as an example. Some options have
|
||||
# been omitted because they are handled either by variables, or a secret. They
|
||||
# are license_key, log_file and verbose.
|
||||
# are display_name, license_key, log_file and verbose.
|
||||
# config:
|
||||
#
|
||||
# New Relic Infrastructure configuration file
|
||||
@@ -59,14 +61,6 @@ serviceAccount:
|
||||
# will use the command line option to override any value set in this file.
|
||||
#
|
||||
|
||||
#
|
||||
# Option : display_name
|
||||
# Value : Hostname to replace the automatically generated hostname for
|
||||
# reporting.
|
||||
# Default: Automatically generated hostname
|
||||
#
|
||||
# display_name: new_name
|
||||
|
||||
#
|
||||
# Option : proxy
|
||||
# Value : Useful if your firewall rules require the agent to use a
|
||||
|
||||
Reference in New Issue
Block a user