* [stable/datadog] Default external metrics provider port to 8443
In order to avoid issues with non-root users inside a container trying
to listen on port 443, from now on we're going to set the default port
for the external metrics provider in the DCA container to 8443.
Signed-off-by: Julio Greff <julio.greff@datadoghq.com>
* [stable/datadog] Document `clusterAgent.env`
Signed-off-by: Julio Greff <julio.greff@datadoghq.com>
* [stable/datadog] Bump version to 2.3.29
Signed-off-by: Julio Greff <julio.greff@datadoghq.com>
* add setting to enable the orchestrator explorer
Signed-off-by: Haissam Kaj <haissam@datadoghq.com>
* switch default to false
Signed-off-by: Haissam Kaj <haissam@datadoghq.com>
The goal is to implement runtime-compiled eBPF probes in system-probe
and collect the data to convert them in DataDog metrics in the agent.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] introduce dnsConfig values for the different containers
Signed-off-by: Oron Gola <oron.gola@perception-point.io>
* [stable/datadog] add dnsConfig default values to values.yaml
Signed-off-by: Oron Gola <oron.gola@perception-point.io>
* [stable/datadog] dnsConfig fix documentation and suggested default value
Signed-off-by: Oron Gola <oron.gola@perception-point.io>
* Add `DD_AC_INCLUDE` and `DD_AC_EXCLUDE` to all containers
* Add "Unix Domain Socket" support in trace-agent
* Add new parameter to specify the dogstatsd socket path on the host
* Fix typos in values.yaml
* Update "tags:" example in values.yaml
* Add rate_limit_queries_ metrics
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] Honor image pull policy setting in init containers
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Pass DD_CRI_SOCKET_PATH to the init container
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Bump version and fill changelog
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Revert "[stable/datadog] Revert "Mount the directory containing the CRI socket instead of the socket itself" (#21268)"
This reverts commit 6de689e7e4.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Explicitly set DOCKER_HOST
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Bump version and fill changelog
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datalog] Do not enable the `cri` check when running on a `docker` setup
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a check for the version of the image
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* fixup! [stable/datadog] Add a check for the version of the image
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Bump the version to highlight the non-backward compatible change
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Do not touch the docker named pipe for Windows
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add an `agents.image.tag.doNotCheckTag` parameter
to skip the compatibility check with the docker image version.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Do not use by default a “floating” tag
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Document the `agents.image.doNotCheckTag` parameter
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Fixing variables description in README and Migration documentation (#22031)
* Avoid volumes mount conflict between `system-probe` and `logs` volumes in the `agent`.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Move several EnvVars to `common-env-vars` to be accessible by the `trace-agent` #21991.
* Fix discrepancies migration-guide and readme reporded in #21806 and #21920.
* Fix EnvVars with integer value due to yaml. serialization, reported by #21853.
* Fix .Values.datadog.tags encoding, reported by #21663.
* Add Checksum to `xxx-cluster-agent-config` config map, reported by #21622 and contribution #21656.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] Change default value for processAgent.enabled to true to
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* Update chart version and add changelog note
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* [stable/datadog] Introduce processAgent.processCollection to correctly configure DD_PROCESS_AGENT_ENABLED
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* Change the default for processCollection to false in accordance with process agent settings
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* Update chart version
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* [stable/datadog] v2.0.0 cleaning and refactoring
* Remove Datadog agent deployment configuration.
* Cleanup resources labels, to fit with recommended labels.
* Cleanup useless or unused values parameters.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] cleanup refactor RBAC resources
* each component have its own RBAC configuration (create,configuration).
* container runtime socket update values configuration simplification.
* `nameOverride` `fullnameOverride` is now optional in values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update stable/datadog/ci values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [datadog] fix linter error
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [datadog] fix missing merge
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* refactor values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update value.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Add a table with the correspondence between the v1 and v2 parameters
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* templates: enable APM by default
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Leave apm.enabled setting but change default.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* DD_APM_NON_LOCAL_TRAFFIC=true when apm.enabled is true
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Enable hostPort binding 8126 by default when apm.enabled is true.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* values: make apm.enabled default to false
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Address PR comments.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* refactor dogstatsd parameters
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update after comments
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* fix dogstatsd parameters path
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update system-probe manifest after review
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update ci configuration and fix cluster-agent config
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* change cluster-agent probes endpoint
change the cluster-agent probes endpoint in order to be resilent if
never the datadog api is not reachable.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Fix several typo thanks to contributions
Include: #20460#20449
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* adding new approvers/reviewers
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] add resoures field for init-containers
Fixe: #20035
Include: #20461
Add the possibility to overwrite the resources associated to the
init-containers.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update after review
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* return error message if apiKey is not provided
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Mount the directory containing the CRI socket instead of the socket itself (#5)
This is to handle the cases where the docker daemon is restarted.
In this case, the docker daemon will recreate its docker socket and,
if the container bind-mounted directly the socket, the container would
still have access to the old socket instead of the one of the new docker
daemon.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
Co-authored-by: Lénaïc Huard <L3n41c@users.noreply.github.com>
Co-authored-by: Gabriel Aszalos <gabriel.aszalos@datadoghq.com>
* [stable/datadog] allow dogstatsd port to be variable
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* need to uncomment customAgentConfig
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* leave dogstatsd port empty in values.yaml
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* spacing for comments
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* need to leave dogstatsd_port uncommented
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* taking feedback, moving var around
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* fixing camelCase, and adding env var for statsd
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* bumping version with sign off
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* relocating the param in readme
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* [stable/datadog] Remove the seccomp profile for system-probe
The `system-probe` container currently has a specific seccomp profile.
This seccomp profile currently misses some syscalls that are necessary to
exec inside the container.
Concretely, attempting to exec inside the container produces this error:
```
$ kubectl exec -ti datadog-fswnc -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
bash: initialize_job_control: getpgrp failed: Operation not permitted
command terminated with exit code 1
```
If we add `setpgrp` to the seccomp profile, we get:
```
$ kubectl exec -ti datadog-kbg97 -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
I have no name!@datadog-kbg97:.$ exit
```
If we add `getcwd`, we get:
```
$ kubectl exec -ti datadog-7b7lf -c system-probe /bin/bash
I have no name!@datadog-7b7lf:/$ exit
```
If we add `geteuid` and `geteuid32`, we get:
```
$ kubectl exec -ti datadog-c42rb -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
/bin/bash: cannot set gid to -1: effective gid -1: Invalid argument
bash-5.0$ exit
```
If we get `getgid` and `getgid32`, we get:
```
$ kubectl exec -ti datadog-tp4qd -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
bash-5.0$ exit
```
etc.
If we compare the seccomp profile of `system-probe` with the
[default one](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json),
we see that a lot of syscalls that are missing are innocuous (`getcwd`) or might become useful one day (`inotify` family)
Some syscalls are added on purpose for the `system-probe` container like `bpf` or `perf_event_open` ones.
But those syscalls are part of the [default seccomp profile for containers that have the `SYS_ADMIN` capability](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json#L567-L594),
and the [`system-probe` container do have the `SYS_ADMIN` capability](https://github.com/helm/charts/blob/3907cebc7042f452506a7471f912d6d0c8380e51/stable/datadog/templates/container-system-probe.yaml#L7).
So, the `system-probe` specific seccomp profile is not necessary to have the `system-probe` container able to load eBPF programs.
Its removal has been tested on GKE, both with Ubuntu and with Container-Optimized OS
and both with docker and containerd.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Make the ad-hoc seccomp profile for system-probe an option
which is enabled by default to stick with the current behavior.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Allow use of any arbitrary seccomp profile
…for system-probe.
By default, it will create an ad-hoc one.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a CI test for seccomp profile override
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Update stable/datadog application to 6.13.0
* Bump the chart version to `1.33.0`
* Update the application version to `6.13.0`
* Update Kube-State-Metrics version to `1.7.2` with chart `2.2.3`
* Fix wrong indentation in kube-state-metrics parameters
* Document the possibility to overwrite KSM container resources
* Add ci/*-values.yaml files for CI validation
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* temporary remove stable/datadog/ci folder
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* add in comment example
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
Vincent Boulineau
Xavier Lucas
Lénaïc HuardandSychevIgor
Cedric Lamoriniere
Julio Greff
Haïssam Kaj
ento
Stanislav Petrashov
orong-pp
Matheus Weber da Conceição
AkiraFukushima
Pierre Guceski
Ivan Ilichev
Peter Rifel
Ofek Lev
Ivan Ilichev
John Pekcan
Ivan Sukhomlyn
Doug WinterandCedric Lamoriniere
Martin Gaida
Stefan Sedich
shangwang
Javi Polo
Ahmed Mezghani
farshad-hobsons
Joe Hohertz
Dennis Webb