daemonset.yaml

{{- if .Values.daemonset.enabled }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ include "nrKubernetesOtel.daemonset.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "newrelic.common.labels" . | nindent 4 }}
spec:
  selector:
    matchLabels:
      {{- include "newrelic.common.labels.selectorLabels" . | nindent 6 }}
      component: daemonset
  template:
    metadata:
      labels:
        {{- include "newrelic.common.labels.podLabels" . | nindent 8 }}
        component: daemonset
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/daemonset-configmap.yaml") . | sha256sum }}
        {{- with .Values.daemonset.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with include "newrelic.common.images.renderPullSecrets" ( dict "pullSecrets" (list .Values.images.pullSecrets) "context" .) }}
      imagePullSecrets:
        {{- . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "newrelic.common.serviceAccount.name" . }}
      {{- with include "nrKubernetesOtel.daemonset.securityContext.pod" . }}
      securityContext:
        {{- . | nindent 8 }}
      {{- end }}
      {{- with include "newrelic.common.priorityClassName" . }}
      priorityClassName: {{ . }}
      {{- end }}
      {{- with include "newrelic.common.dnsConfig" . }}
      dnsConfig:
        {{- . | nindent 8 }}
      {{- end }}
      initContainers:
        - name: get-cpu-allocatable
          image: {{ include "newrelic.common.images.image" ( dict "imageRoot" .Values.images.kubectl "context" .) }}
          imagePullPolicy: {{ .Values.images.kubectl.pullPolicy }}
          command:
            - sh
            - -c
            - |
              NODE_NAME=$(echo $KUBE_NODE_NAME)
              echo "Node Name: $KUBE_NODE_NAME"

              export NODE_CPU_ALLOCATABLE=$(kubectl get node $NODE_NAME -o jsonpath='{.status.allocatable.cpu}')

              if [[ -z "NODE_CPU_ALLOCATABLE" ]] || [[ "NODE_CPU_ALLOCATABLE" == "0" ]]; then
                echo "Could not retrieve CPU allocatable for node $NODE_NAME"
                exit 1
              fi

              # Convert milliCPU values to plain CPU values
              if [[ $NODE_CPU_ALLOCATABLE == *m ]]; then
                # Strip the 'm' and convert the milliCPUs to CPUs
                export NODE_CPU_ALLOCATABLE=$(awk "BEGIN {print ${NODE_CPU_ALLOCATABLE%?} / 1000}")
              fi

              export NODE_MEMORY_ALLOCATABLE=$(kubectl get node $NODE_NAME -o jsonpath='{.status.allocatable.memory}' | awk '
                /Ki$/ {printf "%.0f\n", $1 * 1024; next}
                /Mi$/ {printf "%.0f\n", $1 * 1024^2; next}
                /Gi$/ {printf "%.0f\n", $1 * 1024^3; next}
                /m$/  {printf "%.0f\n", $1 / 1000; next}
                {print $1}
              ')

              if [[ -z "NODE_MEMORY_ALLOCATABLE" ]] || [[ "NODE_MEMORY_ALLOCATABLE" == "0" ]]; then
                echo "Could not retrieve Memory allocatable for node $NODE_NAME"
                exit 1
              fi

              echo "NODE_CPU_ALLOCATABLE : $NODE_CPU_ALLOCATABLE"
              echo "NODE_MEMORY_ALLOCATABLE : $NODE_MEMORY_ALLOCATABLE"
              cp /temp-config/daemonset-config.yaml /final-config
              yq -i '(.processors.metricsgeneration/calculate_percentage.rules[] | select(.name == "node.cpu.usage.percentage").scale_by) = env(NODE_CPU_ALLOCATABLE)' /final-config/daemonset-config.yaml
              yq -i '(.processors.metricsgeneration/calculate_percentage.rules[] | select(.name == "node.memory.usage.percentage").scale_by) = env(NODE_MEMORY_ALLOCATABLE)' /final-config/daemonset-config.yaml
              cat /final-config/daemonset-config.yaml
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
          resources:
            {{- toYaml .Values.daemonset.resources | nindent 12 }}
          volumeMounts:
            - name: daemonset-config
              mountPath: /temp-config
            - name: final-daemonset-config
              mountPath: /final-config
        {{- if .Values.enable_atp }}
        # Fix permissions for ATP persistent storage
        # ATP needs to write adaptiveprocess.db to /var/lib/nrdot-collector
        # hostPath volumes are created as root:root, but main container runs as user 1001
        - name: fix-atp-storage-permissions
          image: {{ include "newrelic.common.images.image" ( dict "imageRoot" .Values.images.kubectl "context" .) }}
          imagePullPolicy: {{ .Values.images.kubectl.pullPolicy }}
          securityContext:
            runAsUser: 0  # Must run as root to chown directories
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
              add:
                - CHOWN  # Only capability needed
                - DAC_OVERRIDE  # Needed to override file permissions
          command:
            - sh
            - -c
            - |
              echo "Fixing permissions for ATP storage directory..."
              # Ensure directory exists (idempotent)
              mkdir -p /var/lib/nrdot-collector
              # Change ownership to user 1001 (main container user)
              chown -R 1001:1001 /var/lib/nrdot-collector
              # Set appropriate permissions (owner can read/write/execute)
              chmod -R 755 /var/lib/nrdot-collector
              echo "Permissions fixed successfully"
              ls -la /var/lib/ | grep nrdot-collector
          volumeMounts:
            - name: nrdot-data-storage
              mountPath: /var/lib/nrdot-collector
        {{- end }}
      containers:
        - name: otel-collector-daemonset
          {{- with include "nrKubernetesOtel.daemonset.securityContext.container" . }}
          securityContext:
            {{- . | nindent 12 }}
          {{- end }}
          image: {{ include "nrKubernetesOtel.images.collector.image" . }}
          imagePullPolicy: {{ include "nrKubernetesOtel.images.collector.imagePullPolicy" . }}
          args:
            {{- include "nrKubernetesOtel.daemonset.args" . | nindent 12 }}
          resources:
            {{- toYaml .Values.daemonset.resources | nindent 12 }}
          {{- with .Values.daemonset.envsFrom }}
          envFrom:
            {{- . | toYaml | nindent 12 }}
          {{- end }}
          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_UID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            {{- if include "newrelic.common.openShift" . }}
            # probably fixed on newer version hostmetrics receiver
            # Work around for open /mounts error: https://github.com/open-telemetry/opentelemetry-collector-contrib/issues/35990
            - name: HOST_PROC_MOUNTINFO
              value: ""
            {{- end }}
            - name: OTEL_RESOURCE_ATTRIBUTES
              value: service.instance.id=$(POD_NAME),k8s.pod.uid=$(POD_UID)
            - name: NR_LICENSE_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ include "newrelic.common.license.secretName" . }}
                  key: {{ include "newrelic.common.license.secretKeyName" . }}
          {{- if include "newrelic.common.proxy" . }}
            - name: http_proxy
              value: "{{- include "newrelic.common.proxy" . }}"
            - name: https_proxy
              value: "{{- include "newrelic.common.proxy" . }}"
          {{- end }}
            {{- with .Values.daemonset.envs }}
            {{- . | toYaml | nindent 12 }}
            {{- end }}
          volumeMounts:
            {{- if not ( include "newrelic.common.gkeAutopilot" . ) }}
            - name: host-fs
              mountPath: /hostfs
              readOnly: true
            {{- end }}
            - name: varlogpods
              mountPath: /var/log/pods
              readOnly: true
            - name: final-daemonset-config
              mountPath: /config
            {{- if .Values.enable_atp }}
            # ATP requires persistent storage to maintain state across restarts (thresholds, history).
            # This hostPath volume ensures ATP data survives pod restarts on the same node.
            - name: nrdot-data-storage
              mountPath: /var/lib/nrdot-collector
            {{- end }}
            {{- with .Values.daemonset.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
      volumes:
        {{- if not (include "newrelic.common.gkeAutopilot" .) }}
        - name: host-fs
          hostPath:
            path: /
        {{- end }}
        - name: varlogpods
          hostPath:
            path: /var/log/pods
        - name: final-daemonset-config
          emptyDir: {}
        - name: daemonset-config
          configMap:
            name: {{ include "nrKubernetesOtel.daemonset.configMap.fullname" . }}
        {{- if .Values.enable_atp }}
        # ATP storage volume: Uses hostPath to persist adaptive telemetry processor state.
        # DirectoryOrCreate ensures the directory is created if it doesn't exist.
        # Data persists across pod restarts but is node-specific (DaemonSet behavior).
        - name: nrdot-data-storage
          hostPath:
            path: /var/lib/nrdot-collector
            type: DirectoryOrCreate
        {{- end }}
        {{- with .Values.daemonset.extraVolumes }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- with include "nrKubernetesOtel.daemonset.nodeSelector" . }}
      nodeSelector:
        {{- . | nindent 8 }}
      {{- end }}
      {{- with include "nrKubernetesOtel.daemonset.affinity" . }}
      affinity:
        {{- . | nindent 8 }}
      {{- end }}
      {{- with include "nrKubernetesOtel.daemonset.tolerations" . }}
      tolerations:
        {{- . | nindent 8 }}
      {{- end }}
{{- end }}