diff --git a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet index 0a6620922896..ce8feefb9dd3 100644 --- a/production/tanka/grafana-agent/v1/lib/integrations.libsonnet +++ b/production/tanka/grafana-agent/v1/lib/integrations.libsonnet @@ -9,25 +9,24 @@ local container = k.core.v1.container; // https://github.com/grafana/agent/blob/main/docs/configuration-reference.md#integrations_config withIntegrations(integrations):: { assert std.objectHasAll(self, '_mode') : ||| - withLokiConfig must be merged with the result of calling new. + withIntegrations must be merged with the result of calling new. |||, _integrations:: integrations, }, - // TODO(rfratto): only enable this when node_exporter is used. integrationsMixin:: { container+:: container.mixin.securityContext.withPrivileged(true) + container.mixin.securityContext.withRunAsUser(0), - local controller = self.agent._controller, - agent+:: + local controller = self._controller, + agent+: // procfs, sysfs, rotfs k.util.hostVolumeMount('proc', '/proc', '/host/proc', readOnly=true) + k.util.hostVolumeMount('sys', '/sys', '/host/sys', readOnly=true) + k.util.hostVolumeMount('root', '/', '/host/root', readOnly=true) + - controller.mixin.spec.template.spec.withHostPid(true) + + controller.mixin.spec.template.spec.withHostPID(true) + controller.mixin.spec.template.spec.withHostNetwork(true), }, } diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet index a42703855bd8..d2f5a508b38b 100644 --- a/production/tanka/grafana-agent/v1/main.libsonnet +++ b/production/tanka/grafana-agent/v1/main.libsonnet @@ -124,6 +124,8 @@ local service = k.core.v1.service; else {}, } + ( if has_loki_config then $.lokiPermissionsMixin else {} + ) + ( + if has_integrations && std.objectHas(this._integrations, 'node_exporter') then $.integrationsMixin else {} ), agent_etc: if std.length(etc_instances) > 0 then