* Datadog: remove hard coded names
* The new system-probe container and config used hard coded CongigMap
names meaning only one installation is possible per cluster and
namespace.
Signed-off-by: Matt Klich <matt@elementalvoid.com>
* bump version
Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
* [stable/rethinkdb] stateful migrate api version from depreciated, add required selector
Signed-off-by: Jacob Dent <jdent@tacyarg.com>
* [stable/rethinkdb] deployment migrate api version from depreciated, add required selector
Signed-off-by: Jacob Dent <jdent@tacyarg.com>
* [stable/rethinkdb] bump minor version
Signed-off-by: Jacob Dent <jdent@tacyarg.com>
* changing the flag podLabels to extraLabels in order to change also the Deployment resource
Signed-off-by: Thiago Dias <nullck@gmail.com>
* rolling back podLabels and adding extraLabels in all the others resources
Signed-off-by: Thiago Dias <nullck@gmail.com>
* bumping the version to 5.3.0
Signed-off-by: Thiago Dias <nullck@gmail.com>
* [stable/prometheus-blackbox-exporter] Able to mount extra secrets into the Pod, for example certificates.
Signed-off-by: Hung Do <hdo@infodation.nl>
* [stable/prometheus-blackbox-exporter] Able to mount extra configmaps
Signed-off-by: Hung Do <hdo@infodation.nl>
* [stable/prometheus-blackbox-exporter] Bump up minor version and configmap and secret variables are on par with each other
Signed-off-by: Hung Do <hdo@infodation.nl>
* [stable/prometheus-blackbox-exporter] Improved configmap/secrets examples in the values.yaml
Signed-off-by: Hung Do <hdo@infodation.nl>
* [stable/pomerium] Added the extra values that are needed to pass helm lint --strict
Signed-off-by: Alexios Polyzos <a.polyzos@thebeat.co>
* [stable/pomerium] Added the extra variables to the Pomerium configuration list
Signed-off-by: Alexios Polyzos <a.polyzos@thebeat.co>
* [stable/pomerium] Bump chart version
Signed-off-by: Alexios Polyzos <a.polyzos@thebeat.co>
* [stable/pomerium] Default name overrides to empty string
Signed-off-by: Alexios Polyzos <a.polyzos@thebeat.co>
* fix the logic to determine master node.
When container was recreated or restart or other conditions, pod is not bing removed, then the master node may becomes a coordinator .
This commit add a condition to check if master ip equals the ip of pod itself. If master ip equals the ip of pod itself, it is master node.
fix https://github.com/helm/charts/issues/17550
Signed-off-by: fuyuan.chu <fuyuan.chu@daocloud.io>
* fix unexpected new line
Signed-off-by: fuyuan.chu <fuyuan.chu@daocloud.io>
* Add resource limits to sysctlImage
Signed-off-by: Bob Violier <bob@violier.eu>
* Fix description in README
Signed-off-by: Bob Violier <bob@violier.eu>
* [incubator/zookeeper] Removing extraneous ending curly brace from the zookeeper service template
Signed-off-by: Vishnu Pradeep <vishnu.pradeep.kumar@gmail.com>
* [incubator/zookeeper] Bumping up the zookeeper chart version to 2.1.2
Signed-off-by: Vishnu Pradeep <vishnu.pradeep.kumar@gmail.com>
The cluster name parameter has been introduced to disambiguate nodes
having the same name in different clusters.
Cluster names are, for ex., used to build hostnames and must therefore
comply with some rules.
We enforce here the same rules as the ones enforced by GKE:
https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#Cluster.FIELDS.name
The DataDog agent itself is already checking the validity of cluster names since
DataDog/datadog-agent#4492.
The goal of this change in the helm chart is to catch issues as early as possible because
having a clear error message from helm is smarter than having to dig in the logs of
a failing agent.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Remove the seccomp profile for system-probe
The `system-probe` container currently has a specific seccomp profile.
This seccomp profile currently misses some syscalls that are necessary to
exec inside the container.
Concretely, attempting to exec inside the container produces this error:
```
$ kubectl exec -ti datadog-fswnc -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
bash: initialize_job_control: getpgrp failed: Operation not permitted
command terminated with exit code 1
```
If we add `setpgrp` to the seccomp profile, we get:
```
$ kubectl exec -ti datadog-kbg97 -c system-probe /bin/bash
shell-init: error retrieving current directory: getcwd: cannot access parent directories: Operation not permitted
I have no name!@datadog-kbg97:.$ exit
```
If we add `getcwd`, we get:
```
$ kubectl exec -ti datadog-7b7lf -c system-probe /bin/bash
I have no name!@datadog-7b7lf:/$ exit
```
If we add `geteuid` and `geteuid32`, we get:
```
$ kubectl exec -ti datadog-c42rb -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
/bin/bash: cannot set gid to -1: effective gid -1: Invalid argument
bash-5.0$ exit
```
If we get `getgid` and `getgid32`, we get:
```
$ kubectl exec -ti datadog-tp4qd -c system-probe /bin/bash
/bin/bash: cannot set uid to -1: effective uid 0: Invalid argument
bash-5.0$ exit
```
etc.
If we compare the seccomp profile of `system-probe` with the
[default one](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json),
we see that a lot of syscalls that are missing are innocuous (`getcwd`) or might become useful one day (`inotify` family)
Some syscalls are added on purpose for the `system-probe` container like `bpf` or `perf_event_open` ones.
But those syscalls are part of the [default seccomp profile for containers that have the `SYS_ADMIN` capability](https://github.com/moby/moby/blob/4b0371fb36a958589319ab7c501ff4bc22645cfa/profiles/seccomp/default.json#L567-L594),
and the [`system-probe` container do have the `SYS_ADMIN` capability](https://github.com/helm/charts/blob/3907cebc7042f452506a7471f912d6d0c8380e51/stable/datadog/templates/container-system-probe.yaml#L7).
So, the `system-probe` specific seccomp profile is not necessary to have the `system-probe` container able to load eBPF programs.
Its removal has been tested on GKE, both with Ubuntu and with Container-Optimized OS
and both with docker and containerd.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* Make the ad-hoc seccomp profile for system-probe an option
which is enabled by default to stick with the current behavior.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Allow use of any arbitrary seccomp profile
…for system-probe.
By default, it will create an ad-hoc one.
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* [stable/datadog] Add a CI test for seccomp profile override
Signed-off-by: Lénaïc Huard <lenaic.huard@datadoghq.com>
* adds loadBalancerSourceRanges to service
Signed-off-by: Dennis Webb <dennis@bluesentryit.com>
* [stable/kube2iam] adds loadBalancerSourceRanges to values-production.yaml
Signed-off-by: Dennis Webb <dennis@bluesentryit.com>
* Configure parse-dashboard to form Urls with HTTPS protocol
Signed-off-by: darteaga <darteaga@bitnami.com>
* remove reasignaments in helpers
Signed-off-by: darteaga <darteaga@bitnami.com>
add notifications service
set services.catalog.cycle_timers.notifications to 0 when Enterprise notifications service is enabled
update chart & app version
Signed-off-by: Brady Todhunter <bradyt@anchore.com>
Add scrape annotations when metrics are exposed with native
prometheusPlugin but no prometheus operator is deployed.
Signed-off-by: Matej Hasul <matej.hasul@gooddata.com>
* Upgrade k8s integration and add new configuration
Signed-off-by: Douglas Camata <dcamata@newrelic.com>
* Add etcd mtls configuration env vars to the passthrough
Signed-off-by: Douglas Camata <dcamata@newrelic.com>
* Fix typo
Signed-off-by: Douglas Camata <dcamata@newrelic.com>
* Fix README.md persistence.enabled value
The default value defined in the values.yaml file is set to true.
Signed-off-by: Ralf Strobel <github@stro-bel.de>
* Update Chart.yaml
Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
Matt Klich
Jacob D
Grace Do
Peter Rifel
Thiago Dias de Francisco
Mikko Kokkonen
Lénaïc Huard
Terentio
Travis Groth
Alejandro Escobar
Chufuyuan
Josh Dolitsky
Bitnami Bot
Ato Araki
WTPascoe
Cees-Jan Kiewiet
Bob Violier
Dave Henderson
Taras Yatsurak
Chandan Sagar Pradhan
Ashish Amarnath
Stefan Sedich
Vishnu Pradeep
Damien Duportal
Dennis Webb
Ivan Sukhomlyn
Daniel Arteaga
Ferenc HERNADI
Kyeong-mi Kim
Zsolt Szeberenyi
Celene
Brady Todhunter
matejhasul
Marcin Żbik
Cedric Lamoriniere
Krishnan Parthasarathi
Rafael Ríos Saavedra
Douglas Camata
Néstor Salceda
Ralf Strobel
Jesse Millar