If the `datadog.securityContext` value is set to `nil` instead of `{}`
when a user want to remove the default `securityContext`, helm is not
able to generate the Daemonset manifest.
To support this configuration we have change how we test the value.
With the new `{{ if ...}}` check we don't check the second comparison
if the first already return false.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Add `DD_AC_INCLUDE` and `DD_AC_EXCLUDE` to all containers
* Add "Unix Domain Socket" support in trace-agent
* Add new parameter to specify the dogstatsd socket path on the host
* Fix typos in values.yaml
* Update "tags:" example in values.yaml
* Add rate_limit_queries_ metrics
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] v2.0.0 cleaning and refactoring
* Remove Datadog agent deployment configuration.
* Cleanup resources labels, to fit with recommended labels.
* Cleanup useless or unused values parameters.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] cleanup refactor RBAC resources
* each component have its own RBAC configuration (create,configuration).
* container runtime socket update values configuration simplification.
* `nameOverride` `fullnameOverride` is now optional in values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update stable/datadog/ci values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [datadog] fix linter error
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [datadog] fix missing merge
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* refactor values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update value.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Add a table with the correspondence between the v1 and v2 parameters
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* templates: enable APM by default
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Leave apm.enabled setting but change default.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* DD_APM_NON_LOCAL_TRAFFIC=true when apm.enabled is true
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Enable hostPort binding 8126 by default when apm.enabled is true.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* values: make apm.enabled default to false
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Address PR comments.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* refactor dogstatsd parameters
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update after comments
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* fix dogstatsd parameters path
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update system-probe manifest after review
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update ci configuration and fix cluster-agent config
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* change cluster-agent probes endpoint
change the cluster-agent probes endpoint in order to be resilent if
never the datadog api is not reachable.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Fix several typo thanks to contributions
Include: #20460#20449
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* adding new approvers/reviewers
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] add resoures field for init-containers
Fixe: #20035
Include: #20461
Add the possibility to overwrite the resources associated to the
init-containers.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update after review
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* return error message if apiKey is not provided
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Mount the directory containing the CRI socket instead of the socket itself (#5)
This is to handle the cases where the docker daemon is restarted.
In this case, the docker daemon will recreate its docker socket and,
if the container bind-mounted directly the socket, the container would
still have access to the old socket instead of the one of the new docker
daemon.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
Co-authored-by: Lénaïc Huard <L3n41c@users.noreply.github.com>
Co-authored-by: Gabriel Aszalos <gabriel.aszalos@datadoghq.com>
* [stable/datadog] Remove the seccomp profile for system-probe
The `system-probe` container currently has a specific seccomp profile.
This seccomp profile currently misses some syscalls that are necessary to
exec inside the container.
Concretely, attempting to exec inside the container produces this error:
```
$ kubectl exec -ti datadog-fswnc -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
bash: initialize_job_control: getpgrp failed: Operation not permitted
command terminated with exit code 1
```
If we add `setpgrp` to the seccomp profile, we get:
```
$ kubectl exec -ti datadog-kbg97 -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
I have no name!@datadog-kbg97:.$ exit
```
If we add `getcwd`, we get:
```
$ kubectl exec -ti datadog-7b7lf -c system-probe /bin/bash
I have no name!@datadog-7b7lf:/$ exit
```
If we add `geteuid` and `geteuid32`, we get:
```
$ kubectl exec -ti datadog-c42rb -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
/bin/bash: cannot set gid to -1: effective gid -1: Invalid argument
bash-5.0$ exit
```
If we get `getgid` and `getgid32`, we get:
```
$ kubectl exec -ti datadog-tp4qd -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
bash-5.0$ exit
```
etc.
If we compare the seccomp profile of `system-probe` with the
[default one](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json),
we see that a lot of syscalls that are missing are innocuous (`getcwd`) or might become useful one day (`inotify` family)
Some syscalls are added on purpose for the `system-probe` container like `bpf` or `perf_event_open` ones.
But those syscalls are part of the [default seccomp profile for containers that have the `SYS_ADMIN` capability](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json#L567-L594),
and the [`system-probe` container do have the `SYS_ADMIN` capability](https://github.com/helm/charts/blob/3907cebc7042f452506a7471f912d6d0c8380e51/stable/datadog/templates/container-system-probe.yaml#L7).
So, the `system-probe` specific seccomp profile is not necessary to have the `system-probe` container able to load eBPF programs.
Its removal has been tested on GKE, both with Ubuntu and with Container-Optimized OS
and both with docker and containerd.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Make the ad-hoc seccomp profile for system-probe an option
which is enabled by default to stick with the current behavior.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Allow use of any arbitrary seccomp profile
…for system-probe.
By default, it will create an ad-hoc one.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a CI test for seccomp profile override
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
Cedric Lamoriniere
ento
Ahmed Mezghani
Ivan IlichevandCedric Lamoriniere
Ivan Ilichev