mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/datadog] Add PSP and SCC (#22529)
* [stable/datadog] Add PSP and SCC Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com> * update after review Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
This commit is contained in:
Cedric Lamoriniere
@@ -1,5 +1,9 @@
|
||||
# Datadog changelog
|
||||
|
||||
## 2.3.23
|
||||
|
||||
* Add the possibility to create a `PodSecurityPolicy` or a `SecurityContextConstraints` (Openshift) for the Agent's Daemonset Pods.
|
||||
|
||||
## 2.3.22
|
||||
|
||||
* Remove duplicate imagePullSecrets
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: datadog
|
||||
version: 2.3.22
|
||||
version: 2.3.23
|
||||
appVersion: "7"
|
||||
description: Datadog Agent
|
||||
keywords:
|
||||
|
||||
@@ -370,7 +370,14 @@ helm install --name <RELEASE_NAME> \
|
||||
| `agents.customAgentConfig` | Specify custom contents for the datadog agent config (datadog.yaml). Note the `agents.useConfigMap` parameter needs to be set to `true` for this parameter to be taken into account. | `{}` |
|
||||
| `agents.updateStrategy` | Which update strategy to deploy the daemonset | RollingUpdate with 10% maxUnavailable |
|
||||
| `agents.volumes` | Additional volumes for the daemonset or deployment | `nil` |
|
||||
| `agents.volumeMounts` | Additional volumeMounts for the daemonset or deployment | `nil` |
|
||||
| `agents.volumeMounts` | Additional volumeMounts for the daemonset or deployment | `nil` |
|
||||
| `agents.podSecurity.podSecurityPolicy.create` | If true, create a PodSecurityPolicy resource for the Agent's Pods | `False` |
|
||||
| `agents.podSecurity.securityContextConstraints.create` | If true, create a SecurityContextConstraints resource for the Agent's Pods | `False` |
|
||||
| `agents.podSecurity.privileged` | If true, allowed privileged containers | `False` |
|
||||
| `agents.podSecurity.capabilites` | list of allowed capabilities | `[SYS_ADMIN, SYS_RESOURCE, SYS_ADMIN, IPC_LOCK]`|
|
||||
| `agents.podSecurity.volumes` | list of allowed volumes types | `[configMap,downwardAPI,emptyDir,ostPath,secret]`|
|
||||
| `agents.podSecurity.seccompProfiles` | List of allowed seccomp profiles | `["*"]` |
|
||||
| `agents.podSecurity.apparmorProfiles` | List of allowed apparmor profiles | `["*"]` |
|
||||
| `datadog.leaderElection` | Enable the leader Election feature | `false` |
|
||||
| `datadog.leaderLeaseDuration` | The duration for which a leader stays elected. | 60 sec, 15 if Cluster Checks enabled |
|
||||
| `datadog.collectEvents` | Enable Kubernetes event collection. Requires leader election. | `false` |
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
# Empty values file for testing default parameters.
|
||||
datadog:
|
||||
apiKey: "00000000000000000000000000000000"
|
||||
appKey: "0000000000000000000000000000000000000000"
|
||||
|
||||
agents:
|
||||
podSecurity:
|
||||
podSecurityPolicy:
|
||||
create: true
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if .Values.agents.podSecurity.podSecurityPolicy.create}}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "datadog.fullname" . }}
|
||||
labels:
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
|
||||
app.kubernetes.io/name: "{{ template "datadog.fullname" . }}"
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: {{ join "," .Values.agents.podSecurity.seccompProfiles | quote }}
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: {{ join "," .Values.agents.podSecurity.apparmorProfiles | quote }}
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: "runtime/default"
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: "runtime/default"
|
||||
spec:
|
||||
privileged: {{ .Values.agents.podSecurity.privileged }}
|
||||
hostNetwork: {{ .Values.agents.useHostNetwork }}
|
||||
hostPID: {{ .Values.datadog.dogstatsd.useHostPID }}
|
||||
allowedCapabilities:
|
||||
{{ toYaml .Values.agents.podSecurity.capabilites | indent 4 }}
|
||||
volumes:
|
||||
{{ toYaml .Values.agents.podSecurity.volumes | indent 4 }}
|
||||
fsGroup:
|
||||
rule: RunAsAny
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
{{ toYaml .Values.datadog.securityContext | indent 4 }}
|
||||
supplementalGroups:
|
||||
rule: RunAsAny
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- if .Values.agents.podSecurity.securityContextConstraints.create }}
|
||||
kind: SecurityContextConstraints
|
||||
apiVersion: security.openshift.io/v1
|
||||
metadata:
|
||||
name: {{ template "datadog.fullname" . }}
|
||||
labels:
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
|
||||
app.kubernetes.io/name: "{{ template "datadog.fullname" . }}"
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
users:
|
||||
- system:serviceaccount:{{ .Release.Namespace }}:{{ template "datadog.fullname" . }}
|
||||
priority: 10
|
||||
# Allow host ports for dsd / trace intake
|
||||
+allowHostPorts: {{ or .Values.datadog.dogstatsd.useHostPort .Values.datadog.apm.enabled }}
|
||||
# Allow host PID for dogstatsd origin detection
|
||||
allowHostPID: {{ .Values.datadog.dogstatsd.useHostPID }}
|
||||
# Allow host network for the CRIO check to reach Prometheus through localhost
|
||||
allowHostNetwork: {{ .Values.agents.useHostNetwork }}
|
||||
# Allow hostPath for docker / process metrics
|
||||
volumes:
|
||||
{{ toYaml .Values.agents.podSecurity.volumes | indent 2 }}
|
||||
# Use the `spc_t` selinux type to access the
|
||||
# docker/cri socket + proc and cgroup stats
|
||||
seLinuxContext:
|
||||
{{ toYaml .Values.datadog.securityContext | indent 2 }}
|
||||
# system-probe requires some specific seccomp and capabilities
|
||||
seccompProfiles:
|
||||
{{ toYaml .Values.agents.podSecurity.seccompProfiles | indent 2 }}
|
||||
allowedCapabilities:
|
||||
{{ toYaml .Values.agents.podSecurity.capabilites | indent 2 }}
|
||||
#
|
||||
# The rest is copied from restricted SCC
|
||||
#
|
||||
allowHostDirVolumePlugin: true
|
||||
allowHostIPC: false
|
||||
allowPrivilegedContainer: {{ .Values.agents.podSecurity.privileged }}
|
||||
allowedFlexVolumes: []
|
||||
defaultAddCapabilities: []
|
||||
fsGroup:
|
||||
type: MustRunAs
|
||||
readOnlyRootFilesystem: false
|
||||
runAsUser:
|
||||
type: RunAsAny
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
# If your environment restricts user access to the Docker socket or journald (for logging)
|
||||
# create or use an existing group that has access and add the GID to
|
||||
# the lines below (also remove the previous line, `type: RunAsAny`)
|
||||
# type: MustRunAs
|
||||
# ranges:
|
||||
# - min: <min-group-ID>
|
||||
# - max: <max-group-ID>
|
||||
requiredDropCapabilities: []
|
||||
{{- end }}
|
||||
+74
-13
@@ -47,12 +47,13 @@ datadog:
|
||||
## You can modify the security context used to run the containers by
|
||||
## modifying the label type below:
|
||||
#
|
||||
securityContext: {}
|
||||
# seLinuxOptions:
|
||||
# user: system_u
|
||||
# role: system_r
|
||||
# type: spc_t
|
||||
# level: s0
|
||||
securityContext:
|
||||
rule: MustRunAs
|
||||
seLinuxOptions:
|
||||
user: "system_u"
|
||||
role: "system_r"
|
||||
type: "spc_t"
|
||||
level: "s0"
|
||||
|
||||
## @param clusterName - string - optional
|
||||
## Set a unique cluster name to allow scoping hosts and Cluster Checks easily
|
||||
@@ -172,30 +173,30 @@ datadog:
|
||||
## WARNING: Make sure that hosts using this are properly firewalled otherwise
|
||||
## metrics and traces are accepted from any host able to connect to this host.
|
||||
#
|
||||
useHostPort: # true
|
||||
useHostPort: false
|
||||
|
||||
## @param useHostPID - boolean - optional
|
||||
## Run the agent in the host's PID namespace. This is required for Dogstatsd origin
|
||||
## detection to work. See https://docs.datadoghq.com/developers/dogstatsd/unix_socket/
|
||||
#
|
||||
useHostPID: # true
|
||||
useHostPID: false
|
||||
|
||||
## @param nonLocalTraffic - boolean - optional - default: false
|
||||
## Enable this to make each node accept non-local statsd traffic.
|
||||
## ref: https://github.com/DataDog/docker-dd-agent#environment-variables
|
||||
#
|
||||
nonLocalTraffic: # false
|
||||
nonLocalTraffic: false
|
||||
|
||||
## @param collectEvents - boolean - optional - default: false
|
||||
## Enables this to start event collection from the kubernetes API
|
||||
## ref: https://docs.datadoghq.com/agent/kubernetes/event_collection/
|
||||
#
|
||||
collectEvents: # false
|
||||
collectEvents: false
|
||||
|
||||
## @param leaderElection - boolean - optional - default: false
|
||||
## Enables leader election mechanism for event collection.
|
||||
#
|
||||
leaderElection: # false
|
||||
leaderElection: false
|
||||
|
||||
## @param leaderLeaseDuration - integer - optional - default: 60
|
||||
## Set the lease time for leader election in second.
|
||||
@@ -216,7 +217,7 @@ datadog:
|
||||
## Enable this to allow log collection for all containers.
|
||||
## ref: https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/#log-collection-setup
|
||||
#
|
||||
containerCollectAll: # false
|
||||
containerCollectAll: false
|
||||
|
||||
## @param containerUseFiles - boolean - optional - default: true
|
||||
## Collect logs from files in /var/log/pods instead of using container runtime API.
|
||||
@@ -665,6 +666,66 @@ agents:
|
||||
#
|
||||
serviceAccountName: default
|
||||
|
||||
## @param podSecurity - object - optional
|
||||
## Provide Daemonset PodSecurityPolicy configuration
|
||||
podSecurity:
|
||||
|
||||
## @param podSecurityPolicy - object - required
|
||||
## Provide Daemonset PodSecurityPolicy configuration
|
||||
podSecurityPolicy:
|
||||
|
||||
## @param created - boolean - optional
|
||||
## If true, create a PodSecurityPolicy resource for Agent pods
|
||||
#
|
||||
create: false
|
||||
|
||||
## @param securityContextConstraints - object - required
|
||||
## Provide Daemonset securityContextConstraints configuration
|
||||
securityContextConstraints:
|
||||
|
||||
## @param created - boolean - optional
|
||||
## If true, create a SecurityContextConstraints resource for Agent pods
|
||||
#
|
||||
create: false
|
||||
|
||||
## @param privileged - boolean - optional
|
||||
## If true, Allow to run privileged containers
|
||||
#
|
||||
privileged: false
|
||||
|
||||
## @param capabilites - list - optional
|
||||
## Allowed capabilites
|
||||
#
|
||||
capabilites:
|
||||
- SYS_ADMIN
|
||||
- SYS_RESOURCE
|
||||
- SYS_PTRACE
|
||||
- NET_ADMIN
|
||||
- IPC_LOCK
|
||||
|
||||
## @param volumes - list - optional
|
||||
## Allowed volumes types
|
||||
#
|
||||
volumes:
|
||||
- configMap
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- hostPath
|
||||
- secret
|
||||
|
||||
## @param seccompProfiles - list - optional
|
||||
## Allowed seccomp profiles
|
||||
#
|
||||
seccompProfiles:
|
||||
- "runtime/default"
|
||||
- "localhost/system-probe"
|
||||
|
||||
## @param apparmorProfiles - list - optional
|
||||
## Allowed apparmor profiles
|
||||
#
|
||||
apparmorProfiles:
|
||||
- "runtime/default"
|
||||
|
||||
containers:
|
||||
agent:
|
||||
## @param env - list - required
|
||||
@@ -840,7 +901,7 @@ agents:
|
||||
## WARNING: Make sure that hosts using this are properly firewalled otherwise
|
||||
## metrics and traces are accepted from any host able to connect to this host.
|
||||
#
|
||||
useHostNetwork: # true
|
||||
useHostNetwork: false
|
||||
|
||||
## @param dnsConfig - list of objects - optional
|
||||
## specify dns configuration options for datadog cluster agent containers e.g ndots
|
||||
|
||||
Reference in New Issue
Block a user