[Host Profiler][PROF-15459] Add annotation to deploy as dd-agent - #3430
theomagellan wants to merge 3 commits into
Conversation
a96daa0 to
72093ce
Compare
|
🎯 Code Coverage (details) 🔗 Commit SHA: beae41c | Docs | View more details | Give us feedback! |
72093ce to
755a9c8
Compare
755a9c8 to
f30710a
Compare
theomagellan
changed the title
theomagellan
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f30710a80d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| sc.RunAsUser = ptr.To(common.DDAgentID) | ||
| sc.RunAsGroup = ptr.To(common.DDAgentID) |
There was a problem hiding this comment.
When agent.datadoghq.com/host-profiler-non-root-enabled is enabled, this sets the numeric UID/GID but leaves securityContext.runAsNonRoot unset, contrary to the behavior documented in docs/host_profiler.md. Clusters with admission policies that require an explicit runAsNonRoot: true declaration can therefore reject the generated pod despite this opt-in annotation; set sc.RunAsNonRoot alongside the UID and GID.
Useful? React with 👍 / 👎.
| HostProfilerSELinuxTypeAnnotation = "agent.datadoghq.com/host-profiler-selinux-type" | ||
| EnableKSMApiServerCacheAnnotation = "agent.datadoghq.com/ksm-use-apiserver-cache" | ||
| HostProfilerSELinuxTypeAnnotation = "agent.datadoghq.com/host-profiler-selinux-type" | ||
| HostProfilerRunAsNonRootAnnotation = "agent.datadoghq.com/host-profiler-non-root-enabled" |
There was a problem hiding this comment.
nit: keep the same naming pattern as other bool annotations
| HostProfilerRunAsNonRootAnnotation = "agent.datadoghq.com/host-profiler-non-root-enabled" | |
| EnableHostProfilerNonRootAnnotation = "agent.datadoghq.com/host-profiler-non-root-enabled" |
|
|
||
| // This file tracks constants used in features, component default code | ||
|
|
||
| const DDAgentID int64 = 100 |
There was a problem hiding this comment.
nit: add a short comment describing what is this constant
| const DDAgentID int64 = 100 | |
| const DDAgentUserID int64 = 100 |
| // of the DDA-level annotation. | ||
| imageOverrideAnnotationKey := fmt.Sprintf("%s/%s", experimental.ExperimentalAnnotationPrefix, experimental.ExperimentalImageOverrideConfigSubkey) | ||
| for _, annotationKey := range []string{featureutils.EnableHostProfilerAnnotation, featureutils.EnableHostProfilerSeccompAnnotation, featureutils.EnableHostProfilerLoggingSeccompAnnotation, featureutils.HostProfilerSELinuxTypeAnnotation, imageOverrideAnnotationKey} { | ||
| for _, annotationKey := range []string{featureutils.EnableHostProfilerAnnotation, featureutils.EnableHostProfilerSeccompAnnotation, featureutils.EnableHostProfilerLoggingSeccompAnnotation, featureutils.HostProfilerRunAsNonRootAnnotation, featureutils.HostProfilerSELinuxTypeAnnotation, imageOverrideAnnotationKey} { |
There was a problem hiding this comment.
nit: add the new key to Test_setProfileDDAIMeta
This branch has not been deployed
3 participants
What does this PR do?
Adds
agent.datadoghq.com/host-profiler-non-root-enabledannotation to allow operator users to easily enable the profiler run as non root (dd-agent UID/GID)Supports DataDog/datadog-agent#54004
Motivation
Additional Notes
This should be enabled by default at a later point once most host profiler images include the necessary changes.
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
Write there any instructions and details you may have to test your PR.
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel