Skip to content

Add KILL capability to CSPM container#2931

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits into
mainfrom
lebauce/cspm-kill-capability
Apr 28, 2026
Merged

Add KILL capability to CSPM container#2931
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits into
mainfrom
lebauce/cspm-kill-capability

Conversation

@lebauce

@lebauce lebauce commented Apr 24, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Add KILL capability to either the security-agent or system-probe container.

Motivation

The OSCAP wrapper makes use of the kill signal, causing it not to be killed properly.

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

  • Agent: vX.Y.Z
  • Cluster Agent: vX.Y.Z

Describe your test plan

Write there any instructions and details you may have to test your PR.

Checklist

  • PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
  • PR has a milestone or the qa/skip-qa label
  • All commits are signed (see: signing commits)

@lebauce
lebauce requested a review from a team April 24, 2026 12:38
@lebauce
lebauce requested a review from a team as a code owner April 24, 2026 12:38
@codecov-commenter

codecov-commenter commented Apr 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.86%. Comparing base (0dcbf67) to head (19b9cca).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #2931      +/-   ##
==========================================
+ Coverage   40.69%   40.86%   +0.16%     
==========================================
  Files         321      324       +3     
  Lines       28413    29122     +709     
==========================================
+ Hits        11563    11900     +337     
- Misses      16015    16364     +349     
- Partials      835      858      +23
Flag Coverage Δ
unittests 40.86% <100.00%> (+0.16%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...controller/datadogagent/component/agent/default.go 44.07% <100.00%> (+0.46%) ⬆️
...al/controller/datadogagent/feature/cspm/feature.go 76.43% <100.00%> (+0.12%) ⬆️

... and 13 files with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0dcbf67...19b9cca. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@datadog-prod-us1-5

datadog-prod-us1-5 Bot commented Apr 24, 2026 •
edited by datadog-official Bot
Loading

Copy link
Copy Markdown

Code Coverage

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 40.93% (+0.12%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 19b9cca | Docs | Datadog PR Page | Give us feedback!

@lebauce
lebauce force-pushed the lebauce/cspm-kill-capability branch from 226061c to 5a66bbd Compare April 24, 2026 14:12
@lebauce lebauce added the bug Something isn't working label Apr 24, 2026
@lebauce lebauce added this to the v1.26.0 milestone Apr 24, 2026
@tbavelier tbavelier modified the milestones: v1.26.0, v1.27.0 Apr 27, 2026
tbavelier
tbavelier requested changes Apr 27, 2026
View reviewed changes

@tbavelier tbavelier left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm overall, one nit
Evnetually, we would need each feature to manage the seccomp profile instead of the change in default.go, but that's out of scope here

Comment thread internal/controller/datadogagent/component/agent/default.go Outdated
@lebauce
lebauce requested a review from tbavelier April 27, 2026 23:30
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot merged commit c08166e into main Apr 28, 2026
53 checks passed
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot deleted the lebauce/cspm-kill-capability branch April 28, 2026 08:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spikat spikat spikat approved these changes
@tbavelier tbavelier tbavelier approved these changes

Assignees

No one assigned

Labels

bug Something isn't working mergequeue-status: done team/agent-security team/container-platform

Projects

None yet

Milestone

v1.27.0

Development

Successfully merging this pull request may close these issues.

4 participants

@lebauce @codecov-commenter @spikat @tbavelier