Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to use containerd snapshotter to generate SBOMs #1290

Merged
merged 7 commits into from
Jan 12, 2024
Merged

Add option to use containerd snapshotter to generate SBOMs #1290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4fbc92f
Add option to use containerd snapshotter to generate SBOMs
lebauce Jan 11, 2024
59712b1
Bump datadog chart version
lebauce Jan 11, 2024
0eb307f
Move SYS_ADMIN logic to generate-security-context
lebauce Jan 11, 2024
daad8c7
Update documentation with SYS_ADMIN capability
lebauce Jan 11, 2024
11fedcd
Set apparmor profile when applicable
lebauce Jan 11, 2024
c42168e
Add example in datadog/ci
lebauce Jan 11, 2024
3ab20a4
Fix linter
lebauce Jan 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion charts/datadog/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
# Datadog changelog

## 3.50.5

* Add option to use containerd snapshotter to generate SBOMs.

## 3.50.4

* Mount host files for proper OS detection in SBOMs.
Expand All @@ -8,7 +12,7 @@

* Set default `Agent` and `Cluster-Agent` version to `7.50.3`.

# 3.50.2
## 3.50.2

* Support automatic registry selection based on `datadog.site` on GKE Autopilot.

Expand Down
2 changes: 1 addition & 1 deletion charts/datadog/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
apiVersion: v1
name: datadog
version: 3.50.4
version: 3.50.5
appVersion: "7"
description: Datadog Agent
keywords:
Expand Down
3 changes: 2 additions & 1 deletion charts/datadog/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Datadog

![Version: 3.50.4](https://img.shields.io/badge/Version-3.50.4-informational?style=flat-square) ![AppVersion: 7](https://img.shields.io/badge/AppVersion-7-informational?style=flat-square)
![Version: 3.50.5](https://img.shields.io/badge/Version-3.50.5-informational?style=flat-square) ![AppVersion: 7](https://img.shields.io/badge/AppVersion-7-informational?style=flat-square)

[Datadog](https://www.datadoghq.com/) is a hosted infrastructure monitoring platform. This chart adds the Datadog Agent to all nodes in your cluster via a DaemonSet. It also optionally depends on the [kube-state-metrics chart](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-state-metrics). For more information about monitoring Kubernetes with Datadog, please refer to the [Datadog documentation website](https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/).

Expand Down Expand Up @@ -761,6 +761,7 @@ helm install <RELEASE_NAME> \
| datadog.prometheusScrape.version | int | `2` | Version of the openmetrics check to schedule by default. |
| datadog.remoteConfiguration.enabled | bool | `true` | Set to true to enable remote configuration. Consider using remoteConfiguration.enabled instead |
| datadog.sbom.containerImage.enabled | bool | `false` | Enable SBOM collection for container images |
| datadog.sbom.containerImage.uncompressedLayersSupport | bool | `false` | Use container runtime snapshotter This should be set to true when using EKS, GKE or if containerd is configured to discard uncompressed layers. This feature will cause the SYS_ADMIN capability to be added to the Agent container. |
| datadog.sbom.host.enabled | bool | `false` | Enable SBOM collection for host filesystems |
| datadog.secretAnnotations | object | `{}` | |
| datadog.secretBackend.arguments | string | `nil` | Configure the secret backend command arguments (space-separated strings). |
Expand Down
8 changes: 8 additions & 0 deletions charts/datadog/ci/agent-sbom-snapshotter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
datadog:
apiKey: "00000000000000000000000000000000"
appKey: "0000000000000000000000000000000000000000"
site: datadoghq.eu
sbom:
containerImage:
enabled: true
uncompressedLayersSupport: true
11 changes: 10 additions & 1 deletion charts/datadog/templates/_container-agent.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
image: "{{ include "image-path" (dict "root" .Values "image" .Values.agents.image) }}"
imagePullPolicy: {{ .Values.agents.image.pullPolicy }}
command: ["agent", "run"]
{{ include "generate-security-context" (dict "securityContext" .Values.agents.containers.agent.securityContext "targetSystem" .Values.targetSystem "seccomp" "" "kubeversion" .Capabilities.KubeVersion.Version) | indent 2 }}
{{ include "generate-security-context" (dict "securityContext" .Values.agents.containers.agent.securityContext "targetSystem" .Values.targetSystem "seccomp" "" "kubeversion" .Capabilities.KubeVersion.Version "sysAdmin" .Values.datadog.sbom.containerImage.uncompressedLayersSupport) | indent 2 }}
resources:
{{ toYaml .Values.agents.containers.agent.resources | indent 4 }}
ports:
Expand Down Expand Up @@ -171,6 +171,10 @@
- name: DD_SBOM_CONTAINER_IMAGE_ENABLED
value: "true"
{{- end }}
{{- if .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
- name: DD_SBOM_CONTAINER_IMAGE_USE_MOUNT
value: "true"
{{- end }}
{{- if .Values.datadog.sbom.host.enabled }}
- name: DD_SBOM_HOST_ENABLED
value: "true"
Expand Down Expand Up @@ -254,6 +258,11 @@
readOnly: true
{{- end }}
{{- end }}
{{- if .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
- name: host-containerd-dir
mountPath: /host/var/lib/containerd
readOnly: true
{{- end }}
{{- if .Values.datadog.sbom.host.enabled }}
- name: host-apk-dir
mountPath: /host/var/lib/apk
Expand Down
5 changes: 5 additions & 0 deletions charts/datadog/templates/_daemonset-volumes-linux.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,11 @@
path: /
name: hostroot
{{- end }}
{{- if .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
- hostPath:
path: /var/lib/containerd
name: host-containerd-dir
{{- end }}
{{- if .Values.datadog.sbom.host.enabled }}
- hostPath:
path: /var/lib/apk
Expand Down
8 changes: 8 additions & 0 deletions charts/datadog/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -755,7 +755,12 @@ securityContext:
{{- end -}}
{{- else }}
securityContext:
{{- if .sysAdmin }}
{{- $capabilities := dict "capabilities" (dict "add" (list "SYS_ADMIN")) }}
{{ toYaml (merge $capabilities .securityContext) | indent 2 }}
{{- else }}
{{ toYaml .securityContext | indent 2 }}
{{- end -}}
{{- if and .seccomp .kubeversion (semverCompare ">=1.19.0" .kubeversion) }}
seccompProfile:
{{- if hasPrefix "localhost/" .seccomp }}
Expand All @@ -770,6 +775,9 @@ securityContext:
{{- end }}
{{- end -}}
{{- end -}}
{{- else if .sysAdmin }}
securityContext:
{{ toYaml (dict "capabilities" (dict "add" (list "SYS_ADMIN"))) | indent 2 }}
{{- end -}}
{{- end -}}

Expand Down
5 changes: 4 additions & 1 deletion charts/datadog/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@ spec:
container.seccomp.security.alpha.kubernetes.io/system-probe: {{ .Values.datadog.systemProbe.seccomp }}
{{- end }}
{{- end }}
{{- if and .Values.agents.podSecurity.apparmor.enabled .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
container.apparmor.security.beta.kubernetes.io/agent: unconfined
{{- end }}
{{- if .Values.agents.podAnnotations }}
{{ tpl (toYaml .Values.agents.podAnnotations) . | indent 8 }}
{{- end }}
Expand All @@ -66,7 +69,7 @@ spec:
shareProcessNamespace: {{ .Values.agents.shareProcessNamespace }}
{{- end }}
{{- if .Values.datadog.securityContext -}}
{{ include "generate-security-context" (dict "securityContext" .Values.datadog.securityContext "targetSystem" .Values.targetSystem "seccomp" "" "kubeversion" .Capabilities.KubeVersion.Version) | nindent 6 }}
{{ include "generate-security-context" (dict "securityContext" .Values.datadog.securityContext "targetSystem" .Values.targetSystem "seccomp" "" "kubeversion" .Capabilities.KubeVersion.Version ) | nindent 6 }}
{{- else if or .Values.agents.podSecurity.podSecurityPolicy.create .Values.agents.podSecurity.securityContextConstraints.create -}}
{{- if .Values.agents.podSecurity.securityContext }}
{{- if .Values.agents.podSecurity.securityContext.seLinuxOptions }}
Expand Down
6 changes: 6 additions & 0 deletions charts/datadog/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -706,6 +706,12 @@ datadog:
# datadog.sbom.containerImage.enabled -- Enable SBOM collection for container images
enabled: false

# datadog.sbom.containerImage.uncompressedLayersSupport -- Use container runtime snapshotter
# This should be set to true when using EKS, GKE or if containerd is configured to
# discard uncompressed layers.
clamoriniere marked this conversation as resolved.
Show resolved Hide resolved
# This feature will cause the SYS_ADMIN capability to be added to the Agent container.
uncompressedLayersSupport: false
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like the option name does not exactly represent what it does. Using mount has different facets (more performant, more permissions, etc.) and perhaps in the future we'll have another way to support uncompressed layers while still offering the mount option.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is intended: the idea of this flag is more to make the feature work in the case of discarded layers. This will allow us to more to a better solution in the future. Naming it mountImages would make the migration more complex as we wouldn't know if the feature was specifically request or if it's because it was used as a workaround.
Does it make sense ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It makes sense to have a dedicated uncompressedLayersSupport that activates useMount. What does not make sense is that useMount does not exist.

I know we did not advertise this option before, but I believe it should have its own existence and we could put in the docstring that uncompressedLayersSupport implies useMount, with the proper explanation on useMount

Copy link
Collaborator

@clamoriniere clamoriniere Jan 12, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lets continue this discussion about the useMount option or equivalent for another PR, and merge this one. so we can provide an easy configuration for users already


host:
# datadog.sbom.host.enabled -- Enable SBOM collection for host filesystems
enabled: false
Expand Down
Loading