[PROF-15317] allow helm to use logging seccomp - #2775
Conversation
github-actions
Bot
added
the
chart/datadog
theomagellan
changed the title
|
theomagellan
added
the
datadog/minor-version
66017fb to
789ac42
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d18ea42a9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Prefer the logging profile, falling back to the default if the image predates it. | ||
| - sh | ||
| - -c | ||
| - if [ -f /etc/dd-host-profiler/logging-seccomp.json ]; then cp /etc/dd-host-profiler/logging-seccomp.json {{ $dst }}; else cp /etc/dd-host-profiler/seccomp.json {{ $dst }}; fi |
There was a problem hiding this comment.
When two host-profiler DaemonSets on the same node use the same image but different datadog.hostProfiler.loggingSeccomp settings, this copies different profile contents to the same $dst; host-profiler-seccomp-name only hashes ddot-ebpf-image (charts/datadog/templates/_helpers.tpl:304). The last init container to write the file can change the profile that a concurrently starting pod loads, so a pod can run with the default profile despite requesting the logging profile, or the reverse. The profile filename should include the logging/default variant as well as the image.
Useful? React with 👍 / 👎.
8d18ea4 to
3921e9d
Compare
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: queued
mergequeue-status: in_progress
and removed
mergequeue-status: queued
labels
|
PR Shepherd is now watching this PR: fixing basic CI failures, rebasing when it falls behind, and re-queueing after transient merge-queue failures. To disable it, add the If you have any questions, reach the team in #ai-devx-flow. |
a7de1da to
7d61dff
Compare
82adf5b to
97e9c28
Compare
|
/ddci trigger |
|
View all feedbacks in Devflow UI.
Tasks sourcing running asynchronously in workflow devflow:f64be5c5-df83-4bd1-ad56-60a87efa8157_44:019faec9-9a83-76c2-bb98-2825a9e83280 under run id 019faec9-a34a-7e09-80ee-7cf4ee41f1f4 |
8ce473c to
ce97f21
Compare
- bump version for datadog to 3.233.0 (minor-version) - update changelog for datadog with version 3.233.0 - update readme for datadog
5c44856
into
main
5 participants
What this PR does / why we need it:
Introduces a new boolean setting to let customers enable a seccomp profile that logs denials.
Which issue this PR fixes
(optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close that issue when PR gets merged)Special notes for your reviewer:
Checklist
[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]
<chartName>/minor-version,<chartName>/patch-version, or<chartName>/no-version-bump)datadogordatadog-operatorchart or value changes, update the test baselines (run:make update-test-baselines)datadogchart changes, received ✅ from a member of your teamGitHub CI takes care of the below, but are still required:
.github/helm-docs.sh)CHANGELOG.mdhas been updatedREADME.md