* [stable/datadog] Default external metrics provider port to 8443
In order to avoid issues with non-root users inside a container trying
to listen on port 443, from now on we're going to set the default port
for the external metrics provider in the DCA container to 8443.
Signed-off-by: Julio Greff <julio.greff@datadoghq.com>
* [stable/datadog] Document `clusterAgent.env`
Signed-off-by: Julio Greff <julio.greff@datadoghq.com>
* [stable/datadog] Bump version to 2.3.29
Signed-off-by: Julio Greff <julio.greff@datadoghq.com>
* [stable/datadog] add collectDNSStats option, remove selinux defaults
Adds collectDNSStats which enabled the system_probe.collect_dns_stats
flag. The flag is only rendered into system-probe.yaml if set to true.
This will allow the agent default to changed to true down the line
without requiring a chart bump.
Signed-off-by: Lee Avital <lee.avital@datadoghq.com>
* Update stable/datadog/templates/system-probe-configmap.yaml
Co-authored-by: Cedric Lamoriniere <cedric.lamoriniere@datadoghq.com>
Signed-off-by: Lee Avital <lee.avital@datadoghq.com>
Co-authored-by: Cedric Lamoriniere <cedric.lamoriniere@datadoghq.com>
* add setting to enable the orchestrator explorer
Signed-off-by: Haissam Kaj <haissam@datadoghq.com>
* switch default to false
Signed-off-by: Haissam Kaj <haissam@datadoghq.com>
The goal is to implement runtime-compiled eBPF probes in system-probe
and collect the data to convert them in DataDog metrics in the agent.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] introduce dnsConfig values for the different containers
Signed-off-by: Oron Gola <oron.gola@perception-point.io>
* [stable/datadog] add dnsConfig default values to values.yaml
Signed-off-by: Oron Gola <oron.gola@perception-point.io>
* [stable/datadog] dnsConfig fix documentation and suggested default value
Signed-off-by: Oron Gola <oron.gola@perception-point.io>
* Add `DD_AC_INCLUDE` and `DD_AC_EXCLUDE` to all containers
* Add "Unix Domain Socket" support in trace-agent
* Add new parameter to specify the dogstatsd socket path on the host
* Fix typos in values.yaml
* Update "tags:" example in values.yaml
* Add rate_limit_queries_ metrics
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Fix warning messages with Helm 2.x
Fixes warning messages like the below examples when using Helm 2.
```
Warning: Merging destination map for chart 'datadog'. The destination item 'confd' is a table and ignoring the source 'confd' as it has a non-table value of: <nil>
Warning: Merging destination map for chart 'datadog'. The destination item 'resources' is a table and ignoring the source 'resources' as it has a non-table value of: <nil>
```
Fixes#22428
Signed-off-by: Aditya Sundaramurthy <aditya.sundaramurthy@gmail.com>
* Bump chart version
Signed-off-by: Aditya Sundaramurthy <aditya.sundaramurthy@gmail.com>
* Updated changelog
Signed-off-by: Aditya Sundaramurthy <aditya.sundaramurthy@gmail.com>
* Bump chart version
Signed-off-by: Aditya Sundaramurthy <aditya.sundaramurthy@gmail.com>
* [stable/datadog] Honor image pull policy setting in init containers
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Pass DD_CRI_SOCKET_PATH to the init container
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Bump version and fill changelog
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Revert "[stable/datadog] Revert "Mount the directory containing the CRI socket instead of the socket itself" (#21268)"
This reverts commit 6de689e7e4.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Explicitly set DOCKER_HOST
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Bump version and fill changelog
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datalog] Do not enable the `cri` check when running on a `docker` setup
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a check for the version of the image
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* fixup! [stable/datadog] Add a check for the version of the image
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Bump the version to highlight the non-backward compatible change
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Do not touch the docker named pipe for Windows
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add an `agents.image.tag.doNotCheckTag` parameter
to skip the compatibility check with the docker image version.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Do not use by default a “floating” tag
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Document the `agents.image.doNotCheckTag` parameter
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Move several EnvVars to `common-env-vars` to be accessible by the `trace-agent` #21991.
* Fix discrepancies migration-guide and readme reporded in #21806 and #21920.
* Fix EnvVars with integer value due to yaml. serialization, reported by #21853.
* Fix .Values.datadog.tags encoding, reported by #21663.
* Add Checksum to `xxx-cluster-agent-config` config map, reported by #21622 and contribution #21656.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] Change default value for processAgent.enabled to true to
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* Update chart version and add changelog note
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* [stable/datadog] Introduce processAgent.processCollection to correctly configure DD_PROCESS_AGENT_ENABLED
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* Change the default for processCollection to false in accordance with process agent settings
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* Update chart version
Signed-off-by: Ivan Ilichev <ivan.ilichev@datadoghq.com>
* [stable/datadog] v2.0.0 cleaning and refactoring
* Remove Datadog agent deployment configuration.
* Cleanup resources labels, to fit with recommended labels.
* Cleanup useless or unused values parameters.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] cleanup refactor RBAC resources
* each component have its own RBAC configuration (create,configuration).
* container runtime socket update values configuration simplification.
* `nameOverride` `fullnameOverride` is now optional in values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update stable/datadog/ci values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [datadog] fix linter error
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [datadog] fix missing merge
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* refactor values.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update value.yaml
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Add a table with the correspondence between the v1 and v2 parameters
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* templates: enable APM by default
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Leave apm.enabled setting but change default.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* DD_APM_NON_LOCAL_TRAFFIC=true when apm.enabled is true
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Enable hostPort binding 8126 by default when apm.enabled is true.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* values: make apm.enabled default to false
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Address PR comments.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* refactor dogstatsd parameters
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update after comments
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* fix dogstatsd parameters path
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update system-probe manifest after review
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update ci configuration and fix cluster-agent config
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* change cluster-agent probes endpoint
change the cluster-agent probes endpoint in order to be resilent if
never the datadog api is not reachable.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Fix several typo thanks to contributions
Include: #20460#20449
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* adding new approvers/reviewers
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* [stable/datadog] add resoures field for init-containers
Fixe: #20035
Include: #20461
Add the possibility to overwrite the resources associated to the
init-containers.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* update after review
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* return error message if apiKey is not provided
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
* Mount the directory containing the CRI socket instead of the socket itself (#5)
This is to handle the cases where the docker daemon is restarted.
In this case, the docker daemon will recreate its docker socket and,
if the container bind-mounted directly the socket, the container would
still have access to the old socket instead of the one of the new docker
daemon.
Signed-off-by: cedric lamoriniere <cedric.lamoriniere@datadoghq.com>
Co-authored-by: Lénaïc Huard <L3n41c@users.noreply.github.com>
Co-authored-by: Gabriel Aszalos <gabriel.aszalos@datadoghq.com>
* [stable/datadog] allow dogstatsd port to be variable
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* need to uncomment customAgentConfig
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* leave dogstatsd port empty in values.yaml
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* spacing for comments
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* need to leave dogstatsd_port uncommented
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* taking feedback, moving var around
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* fixing camelCase, and adding env var for statsd
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* bumping version with sign off
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
* relocating the param in readme
Signed-off-by: John Pekcan <johnpekcan@gmail.com>
The cluster name parameter has been introduced to disambiguate nodes
having the same name in different clusters.
Cluster names are, for ex., used to build hostnames and must therefore
comply with some rules.
We enforce here the same rules as the ones enforced by GKE:
https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#Cluster.FIELDS.name
The DataDog agent itself is already checking the validity of cluster names since
DataDog/datadog-agent#4492.
The goal of this change in the helm chart is to catch issues as early as possible because
having a clear error message from helm is smarter than having to dig in the logs of
a failing agent.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Remove the seccomp profile for system-probe
The `system-probe` container currently has a specific seccomp profile.
This seccomp profile currently misses some syscalls that are necessary to
exec inside the container.
Concretely, attempting to exec inside the container produces this error:
```
$ kubectl exec -ti datadog-fswnc -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
bash: initialize_job_control: getpgrp failed: Operation not permitted
command terminated with exit code 1
```
If we add `setpgrp` to the seccomp profile, we get:
```
$ kubectl exec -ti datadog-kbg97 -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
I have no name!@datadog-kbg97:.$ exit
```
If we add `getcwd`, we get:
```
$ kubectl exec -ti datadog-7b7lf -c system-probe /bin/bash
I have no name!@datadog-7b7lf:/$ exit
```
If we add `geteuid` and `geteuid32`, we get:
```
$ kubectl exec -ti datadog-c42rb -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
/bin/bash: cannot set gid to -1: effective gid -1: Invalid argument
bash-5.0$ exit
```
If we get `getgid` and `getgid32`, we get:
```
$ kubectl exec -ti datadog-tp4qd -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
bash-5.0$ exit
```
etc.
If we compare the seccomp profile of `system-probe` with the
[default one](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json),
we see that a lot of syscalls that are missing are innocuous (`getcwd`) or might become useful one day (`inotify` family)
Some syscalls are added on purpose for the `system-probe` container like `bpf` or `perf_event_open` ones.
But those syscalls are part of the [default seccomp profile for containers that have the `SYS_ADMIN` capability](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json#L567-L594),
and the [`system-probe` container do have the `SYS_ADMIN` capability](https://github.com/helm/charts/blob/3907cebc7042f452506a7471f912d6d0c8380e51/stable/datadog/templates/container-system-probe.yaml#L7).
So, the `system-probe` specific seccomp profile is not necessary to have the `system-probe` container able to load eBPF programs.
Its removal has been tested on GKE, both with Ubuntu and with Container-Optimized OS
and both with docker and containerd.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Make the ad-hoc seccomp profile for system-probe an option
which is enabled by default to stick with the current behavior.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Allow use of any arbitrary seccomp profile
…for system-probe.
By default, it will create an ad-hoc one.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a CI test for seccomp profile override
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
Hasan Mahmood
Vincent Boulineau
Ahmed Mezghani
Cedric Lamoriniere
Julio Greff
Lee AvitalandCedric Lamoriniere
Haïssam Kaj
George Christou
ento
Stanislav Petrashov
orong-pp
AkiraFukushima
Aditya Sundaramurthy
Pierre Guceski
Ivan Ilichev
Gabriel Aszalos
Peter Rifel
MattTheCat
gml3ff
Xavier Lucas
Ivan Ilichev
John Pekcan
Ivan Sukhomlyn
Doug WinterandCedric Lamoriniere
Martin Gaida
shangwang