[PROF-14068] Remove privileges for host-profiler#2953
[PROF-14068] Remove privileges for host-profiler#2953theomagellan wants to merge 6 commits intomainfrom
Conversation
- favor a list of capabilities - seccomp profile - support for custom apparmor profile
theomagellan
force-pushed
the
theomagellan/unprivileged-host-profiler
branch
from
5504b59 to
be37a57
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #2953 +/- ##
==========================================
+ Coverage 40.91% 42.59% +1.67%
==========================================
Files 324 344 +20
Lines 28743 32581 +3838
==========================================
+ Hits 11760 13877 +2117
- Misses 16129 17754 +1625
- Partials 854 950 +96
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 66 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
|
🎯 Code Coverage (details) 🔗 Commit SHA: 8236c6a | Docs | Datadog PR Page | Give us feedback! |
theomagellan
force-pushed
the
theomagellan/unprivileged-host-profiler
branch
from
5516604 to
b23d2c1
Compare
theomagellan
force-pushed
the
theomagellan/unprivileged-host-profiler
branch
from
b23d2c1 to
87b1df2
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87b1df2f66
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7847cf22fa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| managers.SecurityContext().AddCapabilitiesToContainer(agent.DefaultCapabilitiesForHostProfiler(), apicommon.HostProfiler) | ||
|
|
||
| // AppArmor annotation | ||
| managers.Annotation().AddAnnotation(common.AppArmorAnnotationKey+"/"+string(apicommon.HostProfiler), "unconfined") |
There was a problem hiding this comment.
AppArmor: Do we want to expose a setting to override the "unconfined" ? I'm not familiar with how someone would override this.
| @@ -76,7 +76,7 @@ func (rc *RequiredComponent) IsConfigured() bool { | |||
| // IsPrivileged checks whether component requires privileged access. | |||
| func (rc *RequiredComponent) IsPrivileged() bool { | |||
There was a problem hiding this comment.
NIT, we are no longer privileged, so this could be slightly confusing 😄
3 participants
What does this PR do?
This PR mirrors DataDog/helm-charts#2586 for
datadog-operator:privileges: trueand replaces by list of capabilitiesintake.profile.%s: profiling intakesourcemap-intake.%s: symbol intakeotlp.%s: OTLP metrics intakeMotivation
https://datadoghq.atlassian.net/browse/REVIEW-85?focusedCommentId=3201542
Additional Notes
Anything else we should know when reviewing?
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
Tested on a cluster with the host-profiler feature enabled via
agent.datadoghq.com/host-profiler-enabled: "true"annotation on the DDA.Profiles for both supported architectures can be found here
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel