---
# Source: datadog/templates/secret-api-key.yaml
apiVersion: v1
kind: Secret
metadata:
  name: datadog
  namespace: default
  labels: {}
type: Opaque
data:
  api-key: PUT_YOUR_BASE64_ENCODED_API_KEY_HERE
---
# Source: datadog/templates/cluster-agent-confd-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: datadog-cluster-agent-confd
  namespace: default
  labels: {}
  annotations: {}
data:
  kubernetes_state_core.yaml.default: |-
    init_config:
    instances:
      - collectors:
        - secrets
        - configmaps
        - nodes
        - pods
        - services
        - resourcequotas
        - replicationcontrollers
        - limitranges
        - persistentvolumeclaims
        - persistentvolumes
        - namespaces
        - endpoints
        - daemonsets
        - deployments
        - replicasets
        - statefulsets
        - cronjobs
        - jobs
        - horizontalpodautoscalers
        - poddisruptionbudgets
        - storageclasses
        - volumeattachments
        - ingresses
        labels_as_tags:
          {}
        annotations_as_tags:
          {}
  kubernetes_apiserver.yaml: |-
    init_config:
    instances:
      -
        filtering_enabled: false
        unbundle_events: false
---
# Source: datadog/templates/install_info-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: datadog-installinfo
  namespace: default
  labels: {}
  annotations: {}
data:
  install_info: |
    ---
    install_method:
      tool: kubernetes sample manifests
      tool_version: kubernetes sample manifests
      installer_version: kubernetes sample manifests
---
# Source: datadog/templates/kpi-telemetry-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: datadog-kpi-telemetry-configmap
  namespace: default
  labels: {}
data:
  install_type: k8s_manual
  install_id: "0dc4bdee-2306-47b8-9a54-51e5cb7a124e"
  install_time: "1740515777"
---
# Source: datadog/templates/system-probe-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: datadog-system-probe-config
  namespace: default
  labels: {}
data:
  system-probe.yaml: "system_probe_config:\n  enabled: true\n  debug_port:  0\n  sysprobe_socket: /var/run/sysprobe/sysprobe.sock\n  enable_conntrack: true\n  bpf_debug: false\n  enable_tcp_queue_length: false\n  enable_oom_kill: false\n  collect_dns_stats: true\n  max_tracked_connections: 131072\n  conntrack_max_state_size: 131072\n  runtime_compiler_output_dir: /var/tmp/datadog-agent/system-probe/build\n  kernel_header_download_dir: /var/tmp/datadog-agent/system-probe/kernel-headers\n  apt_config_dir: /host/etc/apt\n  yum_repos_dir: /host/etc/yum.repos.d\n  zypper_repos_dir: /host/etc/zypp/repos.d\n  btf_path: \nnetwork_config:\n  enabled: true\n  conntrack_init_timeout: 10s\nservice_monitoring_config:\n  enabled: false\ngpu_monitoring:\n  enabled: false\n  configure_cgroup_perms: false\nruntime_security_config:\n  enabled: false\n  fim_enabled: false\n  use_secruntime_track: true\n  socket: /var/run/sysprobe/runtime-security.sock\n  policies:\n    dir: /etc/datadog-agent/runtime-security.d\n  syscall_monitor:\n    enabled: false\n  network:\n    enabled: true\n  remote_configuration:\n    enabled: false \n  activity_dump:\n    enabled: true\n    traced_cgroups_count: 3\n    cgroup_dump_timeout: 20\n    cgroup_wait_list_size:  0\n    path_merge:\n      enabled: false\n\n  security_profile:\n    enabled: true\n    anomaly_detection:\n      enabled: true\n    auto_suppression:\n      enabled: true\n"
---
# Source: datadog/templates/system-probe-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: datadog-security
  namespace: default
  labels: {}
data:
  system-probe-seccomp.json: |
    {
      "defaultAction": "SCMP_ACT_ERRNO",
      "syscalls": [
        {
          "names": [
            "accept4",
            "access",
            "arch_prctl",
            "bind",
            "bpf",
            "brk",
            "capget",
            "capset",
            "chdir",
            "chmod",
            "clock_gettime",
            "clone",
            "clone3",
            "close",
            "connect",
            "copy_file_range",
            "creat",
            "dup",
            "dup2",
            "dup3",
            "epoll_create",
            "epoll_create1",
            "epoll_ctl",
            "epoll_ctl_old",
            "epoll_pwait",
            "epoll_wait",
            "epoll_wait_old",
            "eventfd",
            "eventfd2",
            "execve",
            "execveat",
            "exit",
            "exit_group",
            "faccessat",
            "faccessat2",
            "fchmod",
            "fchmodat",
            "fchown",
            "fchown32",
            "fchownat",
            "fcntl",
            "fcntl64",
            "flock",
            "fstat",
            "fstat64",
            "fstatfs",
            "fsync",
            "futex",
            "futimens",
            "getcwd",
            "getdents",
            "getdents64",
            "getegid",
            "geteuid",
            "getgid",
            "getgroups",
            "getpeername",
            "getpgrp",
            "getpid",
            "getppid",
            "getpriority",
            "getrandom",
            "getresgid",
            "getresgid32",
            "getresuid",
            "getresuid32",
            "getrlimit",
            "getrusage",
            "getsid",
            "getsockname",
            "getsockopt",
            "gettid",
            "gettimeofday",
            "getuid",
            "getxattr",
            "inotify_add_watch",
            "inotify_init",
            "inotify_init1",
            "inotify_rm_watch",
            "ioctl",
            "ipc",
            "listen",
            "lseek",
            "lstat",
            "lstat64",
            "madvise",
            "memfd_create",
            "mkdir",
            "mkdirat",
            "mmap",
            "mmap2",
            "mprotect",
            "mremap",
            "munmap",
            "nanosleep",
            "newfstatat",
            "open",
            "openat",
            "openat2",
            "pause",
            "perf_event_open",
            "pipe",
            "pipe2",
            "poll",
            "ppoll",
            "prctl",
            "pread64",
            "prlimit64",
            "pselect6",
            "read",
            "readlink",
            "readlinkat",
            "recvfrom",
            "recvmmsg",
            "recvmsg",
            "rename",
            "renameat",
            "renameat2",
            "restart_syscall",
            "rmdir",
            "rseq",
            "rt_sigaction",
            "rt_sigpending",
            "rt_sigprocmask",
            "rt_sigqueueinfo",
            "rt_sigreturn",
            "rt_sigsuspend",
            "rt_sigtimedwait",
            "rt_tgsigqueueinfo",
            "sched_getaffinity",
            "sched_yield",
            "seccomp",
            "select",
            "semtimedop",
            "send",
            "sendmmsg",
            "sendmsg",
            "sendto",
            "set_robust_list",
            "set_tid_address",
            "setgid",
            "setgid32",
            "setgroups",
            "setgroups32",
            "setitimer",
            "setns",
            "setpgid",
            "setrlimit",
            "setsid",
            "setsidaccept4",
            "setsockopt",
            "setuid",
            "setuid32",
            "sigaltstack",
            "socket",
            "socketcall",
            "socketpair",
            "stat",
            "stat64",
            "statfs",
            "statx",
            "symlinkat",
            "sysinfo",
            "tgkill",
            "umask",
            "uname",
            "unlink",
            "unlinkat",
            "utime",
            "utimensat",
            "utimes",
            "wait4",
            "waitid",
            "waitpid",
            "write"
          ],
          "action": "SCMP_ACT_ALLOW",
          "args": null
        },
        {
          "names": [
            "setns"
          ],
          "action": "SCMP_ACT_ALLOW",
          "args": [
            {
              "index": 1,
              "value": 1073741824,
              "valueTwo": 0,
              "op": "SCMP_CMP_EQ"
            }
          ],
          "comment": "",
          "includes": {},
          "excludes": {}
        },
        {
          "names": [
            "kill"
          ],
          "action": "SCMP_ACT_ALLOW",
          "args": [
            {
              "index": 1,
              "value": 0,
              "op": "SCMP_CMP_EQ"
            }
          ],
          "comment": "allow process detection via kill",
          "includes": {},
          "excludes": {}
        }
      ]
    }
---
# Source: datadog/templates/kube-state-metrics-core-rbac.yaml
apiVersion: "rbac.authorization.k8s.io/v1"
kind: ClusterRole
metadata:
  labels: {}
  name: datadog-ksm-core
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
      - configmaps
      - nodes
      - pods
      - services
      - resourcequotas
      - replicationcontrollers
      - limitranges
      - persistentvolumeclaims
      - persistentvolumes
      - namespaces
      - endpoints
      - events
    verbs:
      - list
      - watch
  - apiGroups:
      - extensions
    resources:
      - daemonsets
      - deployments
      - replicasets
    verbs:
      - list
      - watch
  - apiGroups:
      - apps
    resources:
      - statefulsets
      - daemonsets
      - deployments
      - replicasets
    verbs:
      - list
      - watch
  - apiGroups:
      - batch
    resources:
      - cronjobs
      - jobs
    verbs:
      - list
      - watch
  - apiGroups:
      - autoscaling
    resources:
      - horizontalpodautoscalers
    verbs:
      - list
      - watch
  - apiGroups:
      - policy
    resources:
      - poddisruptionbudgets
    verbs:
      - list
      - watch
  - apiGroups:
      - storage.k8s.io
    resources:
      - storageclasses
      - volumeattachments
    verbs:
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
    verbs:
      - list
      - watch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - list
      - watch
---
# Source: datadog/templates/kube-state-metrics-core-rbac.yaml
apiVersion: "rbac.authorization.k8s.io/v1"
kind: ClusterRoleBinding
metadata:
  labels: {}
  name: datadog-ksm-core
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: datadog-ksm-core
subjects:
  - kind: ServiceAccount
    name: datadog-cluster-agent
    namespace: default
---
# Source: datadog/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: datadog
  namespace: default
  labels: {}
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: datadog
  template:
    metadata:
      labels:
        admission.datadoghq.com/enabled: "false"
        app: datadog
      name: datadog
      annotations:
        container.apparmor.security.beta.kubernetes.io/system-probe: unconfined
    spec:
      securityContext:
        runAsUser: 0
      hostPID: true
      containers:
        - name: agent
          image: "gcr.io/datadoghq/agent:7.63.0"
          imagePullPolicy: IfNotPresent
          command: ["agent", "run"]
          resources: {}
          ports:
            - containerPort: 8125
              name: dogstatsdport
              protocol: UDP
          env:
            - name: DD_API_KEY
              valueFrom:
                secretKeyRef:
                  name: "datadog"
                  key: api-key
            - name: DD_REMOTE_CONFIGURATION_ENABLED
              value: "true"
            - name: DD_AUTH_TOKEN_FILE_PATH
              value: /etc/datadog-agent/auth/token
            - name: KUBERNETES
              value: "yes"
            - name: DD_LANGUAGE_DETECTION_ENABLED
              value: "false"
            - name: DD_LANGUAGE_DETECTION_REPORTING_ENABLED
              value: "false"
            - name: DD_KUBERNETES_KUBELET_HOST
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: DD_OTLP_CONFIG_LOGS_ENABLED
              value: "false"
            - name: DD_PROCESS_CONFIG_PROCESS_COLLECTION_ENABLED
              value: "false"
            - name: DD_PROCESS_CONFIG_CONTAINER_COLLECTION_ENABLED
              value: "true"
            - name: DD_PROCESS_AGENT_DISCOVERY_ENABLED
              value: "true"
            - name: DD_STRIP_PROCESS_ARGS
              value: "false"
            - name: DD_PROCESS_CONFIG_RUN_IN_CORE_AGENT_ENABLED
              value: "true"
            - name: DD_LOG_LEVEL
              value: "INFO"
            - name: DD_DOGSTATSD_PORT
              value: "8125"
            - name: DD_DOGSTATSD_NON_LOCAL_TRAFFIC
              value: "true"
            - name: DD_DOGSTATSD_TAG_CARDINALITY
              value: "low"
            - name: DD_LEADER_ELECTION
              value: "true"
            - name: DD_LEADER_ELECTION_DEFAULT_RESOURCE
              value: "configmap"
            - name: DD_COLLECT_KUBERNETES_EVENTS
              value: "true"
            - name: DD_APM_ENABLED
              value: "false"
            - name: DD_LOGS_ENABLED
              value: "false"
            - name: DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL
              value: "false"
            - name: DD_LOGS_CONFIG_K8S_CONTAINER_USE_FILE
              value: "true"
            - name: DD_LOGS_CONFIG_AUTO_MULTI_LINE_DETECTION
              value: "false"
            - name: DD_HEALTH_PORT
              value: "5555"
            - name: DD_DOGSTATSD_SOCKET
              value: "/var/run/datadog/dsd.socket"
            - name: DD_IGNORE_AUTOCONF
              value: "kubernetes_state"
            - name: DD_CONTAINER_LIFECYCLE_ENABLED
              value: "true"
            - name: DD_ORCHESTRATOR_EXPLORER_ENABLED
              value: "false"
            - name: DD_EXPVAR_PORT
              value: "6000"
            - name: DD_COMPLIANCE_CONFIG_ENABLED
              value: "false"
            - name: DD_CONTAINER_IMAGE_ENABLED
              value: "true"
            - name: DD_KUBELET_CORE_CHECK_ENABLED
              value: "true"
          volumeMounts:
            - name: logdatadog
              mountPath: /var/log/datadog
              readOnly: false # Need RW to write logs
            - name: installinfo
              subPath: install_info
              mountPath: /etc/datadog-agent/install_info
              readOnly: true
            - name: tmpdir
              mountPath: /tmp
              readOnly: false # Need RW to write to /tmp directory
            - name: os-release-file
              mountPath: /host/etc/os-release
              readOnly: true
            - name: config
              mountPath: /etc/datadog-agent
              readOnly: false # Need RW to mount to config path
            - name: auth-token
              mountPath: /etc/datadog-agent/auth
              readOnly: false # Need RW to write auth token
            - name: runtimesocketdir
              mountPath: /host/var/run
              mountPropagation: None
              readOnly: true
            - name: dsdsocket
              mountPath: /var/run/datadog
              readOnly: false
            - name: sysprobe-socket-dir
              mountPath: /var/run/sysprobe
              readOnly: true
            - name: sysprobe-config
              mountPath: /etc/datadog-agent/system-probe.yaml
              subPath: system-probe.yaml
              readOnly: true
            - name: procdir
              mountPath: /host/proc
              mountPropagation: None
              readOnly: true
            - name: cgroups
              mountPath: /host/sys/fs/cgroup
              mountPropagation: None
              readOnly: true
            - name: passwd
              mountPath: /etc/passwd
              readOnly: true
          livenessProbe:
            failureThreshold: 6
            httpGet:
              path: /live
              port: 5555
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            failureThreshold: 6
            httpGet:
              path: /ready
              port: 5555
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          startupProbe:
            failureThreshold: 6
            httpGet:
              path: /startup
              port: 5555
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
        - name: process-agent
          image: "gcr.io/datadoghq/agent:7.63.0"
          imagePullPolicy: IfNotPresent
          command: ["process-agent", "--cfgpath=/etc/datadog-agent/datadog.yaml"]
          resources: {}
          env:
            - name: DD_API_KEY
              valueFrom:
                secretKeyRef:
                  name: "datadog"
                  key: api-key
            - name: DD_REMOTE_CONFIGURATION_ENABLED
              value: "true"
            - name: DD_AUTH_TOKEN_FILE_PATH
              value: /etc/datadog-agent/auth/token
            - name: KUBERNETES
              value: "yes"
            - name: DD_LANGUAGE_DETECTION_ENABLED
              value: "false"
            - name: DD_LANGUAGE_DETECTION_REPORTING_ENABLED
              value: "false"
            - name: DD_KUBERNETES_KUBELET_HOST
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: DD_OTLP_CONFIG_LOGS_ENABLED
              value: "false"
            - name: DD_CLUSTER_AGENT_ENABLED
              value: "false"
            - name: DD_PROCESS_CONFIG_PROCESS_COLLECTION_ENABLED
              value: "false"
            - name: DD_PROCESS_CONFIG_CONTAINER_COLLECTION_ENABLED
              value: "true"
            - name: DD_PROCESS_AGENT_DISCOVERY_ENABLED
              value: "true"
            - name: DD_STRIP_PROCESS_ARGS
              value: "false"
            - name: DD_PROCESS_CONFIG_RUN_IN_CORE_AGENT_ENABLED
              value: "true"
            - name: DD_LOG_LEVEL
              value: "INFO"
            - name: DD_SYSTEM_PROBE_ENABLED
              value: "true"
            - name: DD_SYSTEM_PROBE_NETWORK_ENABLED
              value: "true"
            - name: DD_DOGSTATSD_SOCKET
              value: "/var/run/datadog/dsd.socket"
            - name: DD_ORCHESTRATOR_EXPLORER_ENABLED
              value: "false"
          volumeMounts:
            - name: config
              mountPath: /etc/datadog-agent
              readOnly: true
            - name: logdatadog
              mountPath: /var/log/datadog
              readOnly: false # Need RW to write logs
            - name: auth-token
              mountPath: /etc/datadog-agent/auth
              readOnly: true
            - name: dsdsocket
              mountPath: /var/run/datadog
              readOnly: false # Need RW for UDS DSD socket
            - name: tmpdir
              mountPath: /tmp
              readOnly: false # Need RW to write to tmp directory
            - name: os-release-file
              mountPath: /host/etc/os-release
              readOnly: true
            - name: runtimesocketdir
              mountPath: /host/var/run
              mountPropagation: None
              readOnly: true
            - name: cgroups
              mountPath: /host/sys/fs/cgroup
              mountPropagation: None
              readOnly: true
            - name: passwd
              mountPath: /etc/passwd
              readOnly: true
            - name: procdir
              mountPath: /host/proc
              mountPropagation: None
              readOnly: true
            - name: sysprobe-socket-dir
              mountPath: /var/run/sysprobe
              readOnly: true
            - name: sysprobe-config
              mountPath: /etc/datadog-agent/system-probe.yaml
              subPath: system-probe.yaml
              readOnly: true
        - name: system-probe
          image: "gcr.io/datadoghq/agent:7.63.0"
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - SYS_ADMIN
                - SYS_RESOURCE
                - SYS_PTRACE
                - NET_ADMIN
                - NET_BROADCAST
                - NET_RAW
                - IPC_LOCK
                - CHOWN
                - DAC_READ_SEARCH
            privileged: false
            seccompProfile:
              type: Localhost
              localhostProfile: system-probe
          command: ["/opt/datadog-agent/embedded/bin/system-probe", "--config=/etc/datadog-agent/system-probe.yaml"]
          env:
            - name: DD_API_KEY
              valueFrom:
                secretKeyRef:
                  name: "datadog"
                  key: api-key
            - name: DD_REMOTE_CONFIGURATION_ENABLED
              value: "true"
            - name: DD_AUTH_TOKEN_FILE_PATH
              value: /etc/datadog-agent/auth/token
            - name: KUBERNETES
              value: "yes"
            - name: DD_LANGUAGE_DETECTION_ENABLED
              value: "false"
            - name: DD_LANGUAGE_DETECTION_REPORTING_ENABLED
              value: "false"
            - name: DD_KUBERNETES_KUBELET_HOST
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: DD_OTLP_CONFIG_LOGS_ENABLED
              value: "false"
            - name: DD_LOG_LEVEL
              value: "INFO"
          resources: {}
          volumeMounts:
            - name: auth-token
              mountPath: /etc/datadog-agent/auth
              readOnly: true
            - name: logdatadog
              mountPath: /var/log/datadog
              readOnly: false # Need RW to write logs
            - name: tmpdir
              mountPath: /tmp
              readOnly: false # Need RW for tmp directory to instantiate self tests
            - name: debugfs
              mountPath: /sys/kernel/debug
              mountPropagation: None
              readOnly: false # Need RW for kprobe_events
            - name: bpffs
              mountPath: /sys/fs/bpf
              mountPropagation: None
              readOnly: true
            - name: config
              mountPath: /etc/datadog-agent
              readOnly: true
            - name: sysprobe-config
              mountPath: /etc/datadog-agent/system-probe.yaml
              subPath: system-probe.yaml
              readOnly: true
            - name: sysprobe-socket-dir
              mountPath: /var/run/sysprobe
              readOnly: false # Need RW for sys-probe socket
            - name: procdir
              mountPath: /host/proc
              mountPropagation: None
              readOnly: true
            - name: cgroups
              mountPath: /host/sys/fs/cgroup
              mountPropagation: None
              readOnly: true
            - name: os-release-file
              mountPath: /host/etc/os-release
              readOnly: true
            - name: etc-redhat-release
              mountPath: /host/etc/redhat-release
              readOnly: true
            - name: etc-fedora-release
              mountPath: /host/etc/fedora-release
              readOnly: true
            - name: etc-lsb-release
              mountPath: /host/etc/lsb-release
              readOnly: true
      initContainers:
        - name: init-volume
          image: "gcr.io/datadoghq/agent:7.63.0"
          imagePullPolicy: IfNotPresent
          command: ["bash", "-c"]
          args:
            - cp -r /etc/datadog-agent /opt
          volumeMounts:
            - name: config
              mountPath: /opt/datadog-agent
              readOnly: false # Need RW for config path
          resources: {}
        - name: init-config
          image: "gcr.io/datadoghq/agent:7.63.0"
          imagePullPolicy: IfNotPresent
          command:
            - bash
            - -c
          args:
            - for script in $(find /etc/cont-init.d/ -type f -name '*.sh' | sort) ; do bash $script ; done
          volumeMounts:
            - name: config
              mountPath: /etc/datadog-agent
              readOnly: false # Need RW for config path
            - name: logdatadog
              mountPath: /var/log/datadog
              readOnly: false # Need RW to write logs
            - name: procdir
              mountPath: /host/proc
              mountPropagation: None
              readOnly: true
            - name: runtimesocketdir
              mountPath: /host/var/run
              mountPropagation: None
              readOnly: true
            - name: sysprobe-config
              mountPath: /etc/datadog-agent/system-probe.yaml
              subPath: system-probe.yaml
              readOnly: true
          env:
            - name: DD_API_KEY
              valueFrom:
                secretKeyRef:
                  name: "datadog"
                  key: api-key
            - name: DD_REMOTE_CONFIGURATION_ENABLED
              value: "true"
            - name: DD_AUTH_TOKEN_FILE_PATH
              value: /etc/datadog-agent/auth/token
            - name: KUBERNETES
              value: "yes"
            - name: DD_LANGUAGE_DETECTION_ENABLED
              value: "false"
            - name: DD_LANGUAGE_DETECTION_REPORTING_ENABLED
              value: "false"
            - name: DD_KUBERNETES_KUBELET_HOST
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: DD_OTLP_CONFIG_LOGS_ENABLED
              value: "false"
            - name: DD_LEADER_ELECTION
              value: "true"
            - name: DD_LEADER_ELECTION_DEFAULT_RESOURCE
              value: "configmap"
          resources: {}
        - name: seccomp-setup
          image: "gcr.io/datadoghq/agent:7.63.0"
          imagePullPolicy: IfNotPresent
          command:
            - cp
            - /etc/config/system-probe-seccomp.json
            - /host/var/lib/kubelet/seccomp/system-probe
          volumeMounts:
            - name: datadog-agent-security
              mountPath: /etc/config
              readOnly: true
            - name: seccomp-root
              mountPath: /host/var/lib/kubelet/seccomp
              mountPropagation: None
              readOnly: false # Need RW for seccomp-root
          resources: {}
      volumes:
        - name: auth-token
          emptyDir: {}
        - name: installinfo
          configMap:
            name: datadog-installinfo
        - name: config
          emptyDir: {}
        - name: logdatadog
          emptyDir: {}
        - name: tmpdir
          emptyDir: {}
        - name: s6-run
          emptyDir: {}
        - hostPath:
            path: /proc
          name: procdir
        - hostPath:
            path: /sys/fs/cgroup
          name: cgroups
        - hostPath:
            path: /etc/os-release
          name: os-release-file
        - hostPath:
            path: /etc/redhat-release
          name: etc-redhat-release
        - hostPath:
            path: /etc/fedora-release
          name: etc-fedora-release
        - hostPath:
            path: /etc/lsb-release
          name: etc-lsb-release
        - hostPath:
            path: /etc/system-release
          name: etc-system-release
        - hostPath:
            path: /var/run/datadog/
            type: DirectoryOrCreate
          name: dsdsocket
        - name: sysprobe-config
          configMap:
            name: datadog-system-probe-config
        - name: datadog-agent-security
          configMap:
            name: datadog-security
        - hostPath:
            path: /var/lib/kubelet/seccomp
          name: seccomp-root
        - hostPath:
            path: /sys/kernel/debug
          name: debugfs
        - hostPath:
            path: /sys/fs/bpf
          name: bpffs
        - name: sysprobe-socket-dir
          emptyDir: {}
        - hostPath:
            path: /etc/passwd
          name: passwd
        - hostPath:
            path: /var/run
          name: runtimesocketdir
      tolerations:
      affinity: {}
      serviceAccountName: "datadog-agent"
      nodeSelector:
        kubernetes.io/os: linux
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 10%
    type: RollingUpdate
