* Add resource limits to sysctlImage
Signed-off-by: Bob Violier <bob@violier.eu>
* Fix description in README
Signed-off-by: Bob Violier <bob@violier.eu>
* [incubator/zookeeper] Removing extraneous ending curly brace from the zookeeper service template
Signed-off-by: Vishnu Pradeep <vishnu.pradeep.kumar@gmail.com>
* [incubator/zookeeper] Bumping up the zookeeper chart version to 2.1.2
Signed-off-by: Vishnu Pradeep <vishnu.pradeep.kumar@gmail.com>
The cluster name parameter has been introduced to disambiguate nodes
having the same name in different clusters.
Cluster names are, for ex., used to build hostnames and must therefore
comply with some rules.
We enforce here the same rules as the ones enforced by GKE:
https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#Cluster.FIELDS.name
The DataDog agent itself is already checking the validity of cluster names since
DataDog/datadog-agent#4492.
The goal of this change in the helm chart is to catch issues as early as possible because
having a clear error message from helm is smarter than having to dig in the logs of
a failing agent.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Remove the seccomp profile for system-probe
The `system-probe` container currently has a specific seccomp profile.
This seccomp profile currently misses some syscalls that are necessary to
exec inside the container.
Concretely, attempting to exec inside the container produces this error:
```
$ kubectl exec -ti datadog-fswnc -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
bash: initialize_job_control: getpgrp failed: Operation not permitted
command terminated with exit code 1
```
If we add `setpgrp` to the seccomp profile, we get:
```
$ kubectl exec -ti datadog-kbg97 -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
I have no name!@datadog-kbg97:.$ exit
```
If we add `getcwd`, we get:
```
$ kubectl exec -ti datadog-7b7lf -c system-probe /bin/bash
I have no name!@datadog-7b7lf:/$ exit
```
If we add `geteuid` and `geteuid32`, we get:
```
$ kubectl exec -ti datadog-c42rb -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
/bin/bash: cannot set gid to -1: effective gid -1: Invalid argument
bash-5.0$ exit
```
If we get `getgid` and `getgid32`, we get:
```
$ kubectl exec -ti datadog-tp4qd -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
bash-5.0$ exit
```
etc.
If we compare the seccomp profile of `system-probe` with the
[default one](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json),
we see that a lot of syscalls that are missing are innocuous (`getcwd`) or might become useful one day (`inotify` family)
Some syscalls are added on purpose for the `system-probe` container like `bpf` or `perf_event_open` ones.
But those syscalls are part of the [default seccomp profile for containers that have the `SYS_ADMIN` capability](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json#L567-L594),
and the [`system-probe` container do have the `SYS_ADMIN` capability](https://github.com/helm/charts/blob/3907cebc7042f452506a7471f912d6d0c8380e51/stable/datadog/templates/container-system-probe.yaml#L7).
So, the `system-probe` specific seccomp profile is not necessary to have the `system-probe` container able to load eBPF programs.
Its removal has been tested on GKE, both with Ubuntu and with Container-Optimized OS
and both with docker and containerd.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Make the ad-hoc seccomp profile for system-probe an option
which is enabled by default to stick with the current behavior.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Allow use of any arbitrary seccomp profile
…for system-probe.
By default, it will create an ad-hoc one.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a CI test for seccomp profile override
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* adds loadBalancerSourceRanges to service
Signed-off-by: Dennis Webb <dennis@bluesentryit.com>
* [stable/kube2iam] adds loadBalancerSourceRanges to values-production.yaml
Signed-off-by: Dennis Webb <dennis@bluesentryit.com>
* Configure parse-dashboard to form Urls with HTTPS protocol
Signed-off-by: darteaga <darteaga@bitnami.com>
* remove reasignaments in helpers
Signed-off-by: darteaga <darteaga@bitnami.com>
add notifications service
set services.catalog.cycle_timers.notifications to 0 when Enterprise notifications service is enabled
update chart & app version
Signed-off-by: Brady Todhunter <bradyt@anchore.com>
Add scrape annotations when metrics are exposed with native
prometheusPlugin but no prometheus operator is deployed.
Signed-off-by: Matej Hasul <matej.hasul@gooddata.com>
* Upgrade k8s integration and add new configuration
Signed-off-by: Douglas Camata <dcamata@newrelic.com>
* Add etcd mtls configuration env vars to the passthrough
Signed-off-by: Douglas Camata <dcamata@newrelic.com>
* Fix typo
Signed-off-by: Douglas Camata <dcamata@newrelic.com>
* Fix README.md persistence.enabled value
The default value defined in the values.yaml file is set to true.
Signed-off-by: Ralf Strobel <github@stro-bel.de>
* Update Chart.yaml
Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
* [incubator/jaeger] Added support for setting the KEYSPACE environment variable in cassandra schema creation
Signed-off-by: Steffen Folman Qvistgaard <folman@tdc.dk>
* [incubator/jaeger] Added support for setting the KEYSPACE environment variable in cassandra schema creation
Signed-off-by: Steffen Folman Qvistgaard <folman@tdc.dk>
* [stable/redmine] Add JSON Schema & standardize ingress configuration
Signed-off-by: juan131 <juan@bitnami.com>
* '-databaseType' as a string
Signed-off-by: juan131 <juan@bitnami.com>
* Support both ways to setup ingress deprecating previous one
Signed-off-by: juan131 <juan@bitnami.com>
* Bump minor version
Signed-off-by: juan131 <juan@bitnami.com>
* Fix issue with databaseType
Signed-off-by: juan131 <juan@bitnami.com>
* Rebase from master and bump version
Signed-off-by: juan131 <juan@bitnami.com>
* Bump major version
Signed-off-by: juan131 <juan@bitnami.com>
* [stable/postgresql] Prefix port names with protocol
Signed-off-by: Tom Brouws <tom@weave.nl>
* Bump chart major version & add disclaimer to README
Signed-off-by: Tom Brouws <tom@weave.nl>
* [stable/atlantis] Fix typo in orgWhitelist var
orgWhitelist in README.md has a capital L, where it should be lowercase.
Signed-off-by: Liam Nattrass <liam.d.nattrass+git@gmail.com>
* bump chart version
Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
* [stable/weave-scope] Fix compatibility with k8s 1.16 for weave-scope-frontend
Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
* [stable/weave-scope] Bump weave-scope to 1.12.0 and bump chart version consistently
Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
* bump chart versions
Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
Bitnami Bot
Ato Araki
WTPascoe
Cees-Jan Kiewiet
Bob Violier
Dave Henderson
Taras Yatsurak
Chandan Sagar Pradhan
Ashish Amarnath
Stefan Sedich
Vishnu Pradeep
Lénaïc Huard
Damien Duportal
Dennis Webb
Ivan Sukhomlyn
Daniel Arteaga
Ferenc HERNADI
Kyeong-mi Kim
Zsolt Szeberenyi
Celene
Brady Todhunter
matejhasul
Marcin Żbik
Peter Rifel
Cedric Lamoriniere
Krishnan Parthasarathi
Rafael Ríos Saavedra
Douglas Camata
Néstor Salceda
Ralf Strobel
Jesse Millar
Patrick East
Juan Ariza Toledano
Steffen F. Qvistgaard
Flynn
Tom Brouws
Evin Callahan
Leo Q
lnattrass
onokatio(おのかちお)
Bastian Hofmann
Paul Czarkowski