Skip to content

Improve config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml with drop capabilities #8811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
barkbay wants to merge 1 commit into from
+17 −0
Closed

Improve config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml with drop capabilities #8811

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,23 @@ spec:
spec:
serviceAccountName: fleet-server
automountServiceAccountToken: true
## Uncomment the following lines to run fleet-server with restricted privileges and drop capabilities.
Copy link
Copy Markdown
Contributor Author

@barkbay barkbay Sep 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 things I'm not sure:

  1. Should it be the default in this recipe? (Said differently, should we remove the #?)
  2. Do we want to apply the same changes to the Agents below? I think we don't as it could break some packages which may require some capabilities to run correctly?

Copy link
Copy Markdown
Member

@pchila pchila Sep 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a managed elastic-agent, the important bits are:

  • have the CONFIG_PATH and the STATE_PATH being writable and persisted across restarts (hence the 2 env vars below)
  • the -c /etc/agent/elastic-agent.yml which will cause the config file to be copied in the state path and used allowing for some initial config injection from secrets/config maps.

The securityContext part is optional and depends on how locked down the user wants the agent containers to be and it's more a case-by-case choice so I would leave that commented and let the user be stricter if he needs to be.

The changes I mentioned above need to be replicated to the elastic-agent Agent as well.

# containers:
# - name: agent
# securityContext:
# allowPrivilegeEscalation: false
# readOnlyRootFilesystem: true
# capabilities:
# drop: ["ALL"]
# env:
# - name: STATE_PATH
# value: /usr/share/elastic-agent/state
# - name: CONFIG_PATH
# value: /usr/share/elastic-agent/state
# args:
# - -e
# - -c
# - /etc/agent/elastic-agent.yml
---
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
Expand Down