fix(clusterchecksrunner): preserve packaged conf.d assets (e.g. SNMP … - #3374
Conversation
…profiles) on CLC runners (CONS-8516)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0301eb3f53
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // cluster checks such as the SNMP check autodetect profiles. | ||
| copyCheckAssetsCmd = `set -euo pipefail | ||
| if [ -d /etc/datadog-agent/conf.d ]; then | ||
| cp -a /etc/datadog-agent/conf.d/. ` + common.RmCorechecksConfdInitPath + `/ |
There was a problem hiding this comment.
When the Cluster Checks Runner is forced to run as a non-root UID—such as under an OpenShift restricted SCC or a pod-level securityContext.runAsUser override—this init container exits here and blocks the Deployment. cp --help defines -a as -dR --preserve=all, so copying the root-owned image directory attempts to preserve ownership and directory timestamps; a non-root reproduction returns Operation not permitted, and set -e prevents the runner from starting. Copy the assets recursively without preserving privileged attributes.
Useful? React with 👍 / 👎.
|
🎯 Code Coverage (details) 🔗 Commit SHA: ba28f38 | Docs | View more details | Give us feedback! |
The patch-coverage gate computes per-package coverage (go test ./... without -coverpkg), so GetVolumeMountForRmCorechecksInit and the edited remove-corechecks volume helpers in the common package registered as 0% even though a clusterchecksrunner test exercises them. Add a common-package test that covers these helpers directly.
cp -a (= --preserve=all) tries to preserve the root ownership of the image's packaged conf.d. When the runner is forced to run as a non-root UID (OpenShift restricted SCC, or a securityContext.runAsUser override), that fails with "Operation not permitted" and, under set -e, blocks the pod from starting. Use cp -RL to copy recursively without preserving privileged attributes so the assets are owned by the runtime user.
| name: checksd | ||
| readOnly: true | ||
| - args: | ||
| - |- |
There was a problem hiding this comment.
This will lead to errors when simply upgrading on GKE Autopilot so first allowlist needs to be updated.
There was a problem hiding this comment.
@levan-m The init-copy-check-assets init container only lands on the cluster-checks-runner Deployment, not the node agent DaemonSet. That Deployment sets no host namespaces, so it doesn't match the datadog-datadog-daemonset-exemption allowlist's hostPID: true criteria, and there's no CLC-runner WorkloadAllowlist. The CLC runner already runs a bash init-config init container on Autopilot today; this new one is the same shape (agent image, readOnlyRootFilesystem, allowPrivilegeEscalation: false, emptyDir only), so it should run under Autopilot's default policy without an exemption. Did you have a specific rule in mind that it would trip, or a cluster where you saw the rejection? Happy to add it to the allowlist + bump the synchronizer version if you can confirm it's actually required.
There was a problem hiding this comment.
sorry, somehow assumed with was daemonset. Deployments aren't affected by allowlist.
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: removed
and removed
mergequeue-status: waiting
labels
levan-m
added
mergequeue-status: waiting
and removed
qa/skip-qa
mergequeue-status: removed
labels
2 participants
…profiles) on CLC runners (CONS-8516)
What does this PR do?
Adds an init container to the cluster-checks-runner that seeds the conf.d overlay with the agent image's packaged check assets (e.g. SNMP default_profiles), then removes only *.yaml.default so default core checks still don't run. This preserves out-of-the-box profiles on Operator CLC runners—aligning with Helm #1594—so SNMP/NDM cluster checks can autodetect profiles without a manual init-container workaround.
Motivation
https://datadoghq.atlassian.net/browse/CONS-8516
Additional Notes
Manually tested -
Ran the patched operator locally (go run ./cmd/main.go) against a minikube cluster and applied a DatadogAgent with features.clusterChecks.useClusterChecksRunners: true plus an SNMP cluster check via clusterAgent.extraConfd. On the resulting cluster-checks-runner pod I confirmed the new init-copy-check-assets init container ran and that /etc/datadog-agent/conf.d/snmp.d/default_profiles is now populated (e.g. _arista.yaml, _aruba-base.yaml, …), while find /etc/datadog-agent/conf.d -name '*.yaml.default' returns 0 — so packaged profiles are preserved and default core checks are still pruned. In agent status, the previous profile errors (failed to read profile dir … no such file or directory / no profiles found for sysObjectID) are gone; the SNMP check now proceeds past profile autodetection and only fails on device reachability (request timeout), which is expected since there's no real SNMP device at the test IP. This confirms the fix restores OOTB SNMP profiles on Operator CLC runners. Unit tests and the render golden files were also updated and pass.
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
Write there any instructions and details you may have to test your PR.
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel