Skip to content

Commit 10bec93

Browse files
movencemovence
authored
add SYS_ADMIN capabilities to DCGM (#217)
1 parent 13f1eff commit 10bec93

3 files changed

Lines changed: 168 additions & 0 deletions

File tree

‎charts/amazon-cloudwatch-observability/crds/cloudwatch.aws.amazon.com_dcgmexporters.yaml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,167 @@ spec:
5555
spec:
5656
description: DcgmExporterSpec defines the desired state of DcgmExporter.
5757
properties:
58+
securityContext:
59+
description: "SecurityContext configures the container security context
60+
for the amazon-cloudwatch-agent container. \n In deployment, daemonset,
61+
or statefulset mode, this controls the security context settings
62+
for the primary application container. \n In sidecar mode, this
63+
controls the security context for the injected sidecar container."
64+
properties:
65+
allowPrivilegeEscalation:
66+
description: 'AllowPrivilegeEscalation controls whether a process
67+
can gain more privileges than its parent process. This bool
68+
directly controls if the no_new_privs flag will be set on the
69+
container process. AllowPrivilegeEscalation is true always when
70+
the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN
71+
Note that this field cannot be set when spec.os.name is windows.'
72+
type: boolean
73+
capabilities:
74+
description: The capabilities to add/drop when running containers.
75+
Defaults to the default set of capabilities granted by the container
76+
runtime. Note that this field cannot be set when spec.os.name
77+
is windows.
78+
properties:
79+
add:
80+
description: Added capabilities
81+
items:
82+
description: Capability represent POSIX capabilities type
83+
type: string
84+
type: array
85+
drop:
86+
description: Removed capabilities
87+
items:
88+
description: Capability represent POSIX capabilities type
89+
type: string
90+
type: array
91+
type: object
92+
privileged:
93+
description: Run container in privileged mode. Processes in privileged
94+
containers are essentially equivalent to root on the host. Defaults
95+
to false. Note that this field cannot be set when spec.os.name
96+
is windows.
97+
type: boolean
98+
procMount:
99+
description: procMount denotes the type of proc mount to use for
100+
the containers. The default is DefaultProcMount which uses the
101+
container runtime defaults for readonly paths and masked paths.
102+
This requires the ProcMountType feature flag to be enabled.
103+
Note that this field cannot be set when spec.os.name is windows.
104+
type: string
105+
readOnlyRootFilesystem:
106+
description: Whether this container has a read-only root filesystem.
107+
Default is false. Note that this field cannot be set when spec.os.name
108+
is windows.
109+
type: boolean
110+
runAsGroup:
111+
description: The GID to run the entrypoint of the container process.
112+
Uses runtime default if unset. May also be set in PodSecurityContext. If
113+
set in both SecurityContext and PodSecurityContext, the value
114+
specified in SecurityContext takes precedence. Note that this
115+
field cannot be set when spec.os.name is windows.
116+
format: int64
117+
type: integer
118+
runAsNonRoot:
119+
description: Indicates that the container must run as a non-root
120+
user. If true, the Kubelet will validate the image at runtime
121+
to ensure that it does not run as UID 0 (root) and fail to start
122+
the container if it does. If unset or false, no such validation
123+
will be performed. May also be set in PodSecurityContext. If
124+
set in both SecurityContext and PodSecurityContext, the value
125+
specified in SecurityContext takes precedence.
126+
type: boolean
127+
runAsUser:
128+
description: The UID to run the entrypoint of the container process.
129+
Defaults to user specified in image metadata if unspecified.
130+
May also be set in PodSecurityContext. If set in both SecurityContext
131+
and PodSecurityContext, the value specified in SecurityContext
132+
takes precedence. Note that this field cannot be set when spec.os.name
133+
is windows.
134+
format: int64
135+
type: integer
136+
seLinuxOptions:
137+
description: The SELinux context to be applied to the container.
138+
If unspecified, the container runtime will allocate a random
139+
SELinux context for each container. May also be set in PodSecurityContext. If
140+
set in both SecurityContext and PodSecurityContext, the value
141+
specified in SecurityContext takes precedence. Note that this
142+
field cannot be set when spec.os.name is windows.
143+
properties:
144+
level:
145+
description: Level is SELinux level label that applies to
146+
the container.
147+
type: string
148+
role:
149+
description: Role is a SELinux role label that applies to
150+
the container.
151+
type: string
152+
type:
153+
description: Type is a SELinux type label that applies to
154+
the container.
155+
type: string
156+
user:
157+
description: User is a SELinux user label that applies to
158+
the container.
159+
type: string
160+
type: object
161+
seccompProfile:
162+
description: The seccomp options to use by this container. If
163+
seccomp options are provided at both the pod & container level,
164+
the container options override the pod options. Note that this
165+
field cannot be set when spec.os.name is windows.
166+
properties:
167+
localhostProfile:
168+
description: localhostProfile indicates a profile defined
169+
in a file on the node should be used. The profile must be
170+
preconfigured on the node to work. Must be a descending
171+
path, relative to the kubelet's configured seccomp profile
172+
location. Must be set if type is "Localhost". Must NOT be
173+
set for any other type.
174+
type: string
175+
type:
176+
description: "type indicates which kind of seccomp profile
177+
will be applied. Valid options are: \n Localhost - a profile
178+
defined in a file on the node should be used. RuntimeDefault
179+
- the container runtime default profile should be used.
180+
Unconfined - no profile should be applied."
181+
type: string
182+
required:
183+
- type
184+
type: object
185+
windowsOptions:
186+
description: The Windows specific settings applied to all containers.
187+
If unspecified, the options from the PodSecurityContext will
188+
be used. If set in both SecurityContext and PodSecurityContext,
189+
the value specified in SecurityContext takes precedence. Note
190+
that this field cannot be set when spec.os.name is linux.
191+
properties:
192+
gmsaCredentialSpec:
193+
description: GMSACredentialSpec is where the GMSA admission
194+
webhook (https://github.com/kubernetes-sigs/windows-gmsa)
195+
inlines the contents of the GMSA credential spec named by
196+
the GMSACredentialSpecName field.
197+
type: string
198+
gmsaCredentialSpecName:
199+
description: GMSACredentialSpecName is the name of the GMSA
200+
credential spec to use.
201+
type: string
202+
hostProcess:
203+
description: HostProcess determines if a container should
204+
be run as a 'Host Process' container. All of a Pod's containers
205+
must have the same effective HostProcess value (it is not
206+
allowed to have a mix of HostProcess containers and non-HostProcess
207+
containers). In addition, if HostProcess is true then HostNetwork
208+
must also be set to true.
209+
type: boolean
210+
runAsUserName:
211+
description: The UserName in Windows to run the entrypoint
212+
of the container process. Defaults to the user specified
213+
in image metadata if unspecified. May also be set in PodSecurityContext.
214+
If set in both SecurityContext and PodSecurityContext, the
215+
value specified in SecurityContext takes precedence.
216+
type: string
217+
type: object
218+
type: object
58219
affinity:
59220
description: If specified, indicates the pod's scheduling constraints
60221
properties:

‎charts/amazon-cloudwatch-observability/templates/linux/dcgm-exporter-daemonset.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ spec:
1818
{{- with .Values.dcgmExporter.resources }}
1919
resources: {{- toYaml . | nindent 4}}
2020
{{- end }}
21+
{{- with .Values.dcgmExporter.securityContext }}
22+
securityContext: {{- toYaml . | nindent 4 }}
23+
{{- end }}
2124
env:
2225
- name: "DCGM_EXPORTER_KUBERNETES"
2326
value: "true"

‎charts/amazon-cloudwatch-observability/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1364,6 +1364,10 @@ dcgmExporter:
13641364
kubeletPath: /var/lib/kubelet/pod-resources
13651365
serviceAccount:
13661366
name: # override exporter service account name
1367+
securityContext:
1368+
capabilities:
1369+
add:
1370+
- SYS_ADMIN
13671371
affinity:
13681372
nodeAffinity:
13691373
requiredDuringSchedulingIgnoredDuringExecution:

0 commit comments

Comments
 (0)