From ad185e5b8fb929efc3618ad96ecdd0840bf45e6c Mon Sep 17 00:00:00 2001 From: Daniel Fernandez Arias Date: Mon, 29 Jul 2019 17:59:54 +0200 Subject: [PATCH] [stable/newrelic-infrastructure] add a conditional value for installing the privileged/unprivileged version (#15944) Signed-off-by: Daniel Fernandez --- stable/newrelic-infrastructure/Chart.yaml | 4 +- stable/newrelic-infrastructure/README.md | 5 ++- .../templates/_helpers.tpl | 21 +++++++++++ .../templates/daemonset.yaml | 37 +++++++++++++++++-- stable/newrelic-infrastructure/values.yaml | 16 +++----- 5 files changed, 64 insertions(+), 19 deletions(-) diff --git a/stable/newrelic-infrastructure/Chart.yaml b/stable/newrelic-infrastructure/Chart.yaml index 1b30988c8f..7e175cd153 100644 --- a/stable/newrelic-infrastructure/Chart.yaml +++ b/stable/newrelic-infrastructure/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 description: A Helm chart to deploy the New Relic Infrastructure Agent as a DaemonSet name: newrelic-infrastructure -version: 0.13.2 -appVersion: 1.9.0 +version: 0.13.3 +appVersion: 1.9.2 home: https://hub.docker.com/r/newrelic/infrastructure-k8s/ source: - https://github.com/kubernetes/kubernetes/tree/master/examples/newrelic-infrastructure diff --git a/stable/newrelic-infrastructure/README.md b/stable/newrelic-infrastructure/README.md index da39f48926..2ca6ead561 100644 --- a/stable/newrelic-infrastructure/README.md +++ b/stable/newrelic-infrastructure/README.md @@ -17,9 +17,10 @@ This chart will deploy the New Relic Infrastructure agent as a Daemonset. | `kubeStateMetricsTimeout` | Timeout for accessing kube-state-metrics in milliseconds. If not set the newrelic default is 5000 | | | `rbac.create` | Enable Role-based authentication | `true` | | `rbac.pspEnabled` | Enable pod security policy support | `false` | +| `privileged` | Enable privileged mode. | `false` | | `image.name` | The container to pull. | `newrelic/infrastructure` | | `image.pullPolicy` | The pull policy. | `IfNotPresent` | -| `image.tag` | The version of the container to pull. | `1.9.0` | +| `image.tag` | The version of the container to pull. | `1.9.2` | | `resources` | Any resources you wish to assign to the pod. | See Resources below | | `verboseLog` | Should the agent log verbosely. (Boolean) | `false` | | `priorityClassName` | Scheduling priority of the pod | `nil` | @@ -48,4 +49,4 @@ The default set of resources assigned to the pods is shown below: # Config file -If you wish to provide your own `newrelic.yml` you may do so under `config`. There are a few notable exceptions you should be aware of. Three options have been omitted because they are handled either by variables, or a secret. They are license_key, log_file and verbose. +If you wish to provide your own `newrelic.yml` you may do so under `config`. There are a few notable exceptions you should be aware of. Some options have been omitted because they are handled either by variables, or a secret. They are display_name, license_key, log_file and verbose. diff --git a/stable/newrelic-infrastructure/templates/_helpers.tpl b/stable/newrelic-infrastructure/templates/_helpers.tpl index 7e06ebb659..ad428443d8 100644 --- a/stable/newrelic-infrastructure/templates/_helpers.tpl +++ b/stable/newrelic-infrastructure/templates/_helpers.tpl @@ -19,12 +19,22 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- end -}} {{- end -}} +{{/* Generate mode label */}} +{{- define "newrelic.mode" }} +{{- if .Values.privileged -}} +privileged +{{- else -}} +unprivileged +{{- end }} +{{- end -}} + {{/* Generate basic labels */}} {{- define "newrelic.labels" }} app: {{ template "newrelic.name" . }} chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} heritage: {{.Release.Service }} release: {{.Release.Name }} +mode: {{ template "newrelic.mode" . }} {{- end }} {{/* @@ -44,3 +54,14 @@ Create the name of the service account to use {{ default "default" .Values.serviceAccount.name }} {{- end -}} {{- end -}} + +{{/* +Create the image name depending on the "privileged" flag +*/}} +{{- define "newrelic.image" -}} +{{- if .Values.privileged -}} +"{{ .Values.image.repository }}:{{ .Values.image.tag }}" +{{- else -}} +"{{ .Values.image.repository }}:{{ .Values.image.tag }}-unprivileged" +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/stable/newrelic-infrastructure/templates/daemonset.yaml b/stable/newrelic-infrastructure/templates/daemonset.yaml index 95cf9c13c5..e9d5a8b616 100644 --- a/stable/newrelic-infrastructure/templates/daemonset.yaml +++ b/stable/newrelic-infrastructure/templates/daemonset.yaml @@ -23,14 +23,21 @@ spec: {{- if .Values.podLabels}} {{ toYaml .Values.podLabels }} {{- end }} + mode: {{ template "newrelic.mode" . }} spec: serviceAccountName: {{ template "newrelic.serviceAccountName" . }} containers: - name: {{ template "newrelic.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + image: {{ template "newrelic.image" . }} imagePullPolicy: "{{ .Values.image.pullPolicy }}" securityContext: + {{- if .Values.privileged }} privileged: true + {{- else }} + runAsUser: 1000 # nri-agent + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + {{- end }} env: - name: NRIA_LICENSE_KEY valueFrom: @@ -74,12 +81,17 @@ spec: - name: NRIA_LOG_FILE value: {{ .Values.logFile }} {{- end }} + {{- if not .Values.privileged }} + - name: "DISCOVERY_CACHE_DIR" + value: "/tmp/nr-kubernetes" + {{- end }} volumeMounts: {{- if .Values.config }} - name: config mountPath: /etc/newrelic-infra.yml subPath: newrelic-infra.yml {{- end }} + {{- if .Values.privileged }} - name: dev mountPath: /dev - name: host-docker-socket @@ -89,23 +101,40 @@ spec: - name: host-volume mountPath: /host readOnly: true + {{- else }} + - mountPath: /var/db/newrelic-infra/data + name: tmpfs-data + - mountPath: /var/db/newrelic-infra/user_data + name: tmpfs-user-data + - mountPath: /tmp + name: tmpfs-tmp + {{- end }} {{- if .Values.resources }} resources: {{ toYaml .Values.resources | indent 12 }} {{- end }} volumes: + {{- if .Values.privileged }} - name: dev hostPath: path: /dev - name: host-docker-socket hostPath: - path: /var/run/docker.sock + path: /var/run/docker.sock - name: log hostPath: - path: /var/log + path: /var/log - name: host-volume hostPath: - path: / + path: / + {{- else }} + - name: tmpfs-data + emptyDir: {} + - name: tmpfs-user-data + emptyDir: {} + - name: tmpfs-tmp + emptyDir: {} + {{- end }} {{- if .Values.config }} - name: config configMap: diff --git a/stable/newrelic-infrastructure/values.yaml b/stable/newrelic-infrastructure/values.yaml index 6aeb6a723e..d12dff2fce 100644 --- a/stable/newrelic-infrastructure/values.yaml +++ b/stable/newrelic-infrastructure/values.yaml @@ -20,7 +20,7 @@ verboseLog: false image: repository: newrelic/infrastructure-k8s - tag: 1.9.0 + tag: 1.9.2 pullPolicy: IfNotPresent resources: @@ -30,6 +30,8 @@ resources: cpu: 100m memory: 30M +privileged: true + rbac: # Specifies whether RBAC resources should be created create: true @@ -47,9 +49,9 @@ serviceAccount: # podLabels: # If you wish to provide your own newrelic.yml file include it under config: -# the sample config file is included here as an example. Three options have +# the sample config file is included here as an example. Some options have # been omitted because they are handled either by variables, or a secret. They -# are license_key, log_file and verbose. +# are display_name, license_key, log_file and verbose. # config: # # New Relic Infrastructure configuration file @@ -59,14 +61,6 @@ serviceAccount: # will use the command line option to override any value set in this file. # - # - # Option : display_name - # Value : Hostname to replace the automatically generated hostname for - # reporting. - # Default: Automatically generated hostname - # - # display_name: new_name - # # Option : proxy # Value : Useful if your firewall rules require the agent to use a