[Backport v1.28] never let PodTemplateSpec rewrite Host Profiler seccomp init container#3145
Conversation
#3135) * never let podtemplate rewrite host profiler seccomp init container * skip host Profiler container & initContainer image overrides * remove mention of host profiler being bundled in agent image * Align host profiler seccomp image overrides --------- Co-authored-by: levan-m <[email protected]> Co-authored-by: Nayef Ghattas <[email protected]> (cherry picked from commit 68e2ee9)
dd-octo-sts
Bot
added
qa/skip-qa
backport
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8db0790a41
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // Experimental image overrides are applied after ManageNodeAgent, so mirror their image | ||
| // resolution here to keep the seccomp profile and init container aligned with the final | ||
| // host-profiler container image. | ||
| hostProfilerImage := resolveHostProfilerImage(o.owner, hostProfilerContainer.Image) |
There was a problem hiding this comment.
Here hostProfilerContainer.Image is still the pre-spec.override.nodeAgent.image value because component overrides run after ManageNodeAgent. When a deployment pins the node-agent image to a private/full registry and uses the experimental host-profiler override with name/tag, this resolves the seccomp profile/init image from the default registry instead of the overridden registry; the host-profiler container is also skipped by the later image rewrite, so the pod pulls the wrong host-profiler image in private-registry setups. Please apply the effective node-agent image override before resolving, or otherwise carry its registry into this base image.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
I think that's alright, we don't need to cover this edge case 👍
This comment has been minimized.
This comment has been minimized.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## v1.28 #3145 +/- ##
==========================================
- Coverage 43.37% 43.34% -0.04%
==========================================
Files 352 352
Lines 30105 30099 -6
==========================================
- Hits 13059 13045 -14
- Misses 16173 16181 +8
Partials 873 873
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
4 participants
Backport 68e2ee9 from #3135.
What does this PR do?
Fixes
host-profiler-seccomp-setupinit container using the wrong image.override.PodTemplateSpecrewrites all init container images tospec.override.nodeAgent.image, buthost-profiler-seccomp-setupmust use the profiler image to copy its seccomp profile, which the agent image doesn't have.The fix skips
host-profiler-seccomp-setupin the init container rewrite loop.Reverts the workaround introduced in [Host Profiler] Remove seccomp configmap and use profile baked into image #3061 (
resolveHostProfilerImagereadingspec.override.nodeAgent.image), which was trying to keep the hash and init container image consistent with each other around the wrong image.Motivation
host-profiler-seccomp-setupwas failing on nightly because it was running from the agent image and trying to copy a file that doesn't exist there.Additional Notes
Anything else we should know when reviewing?
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
On test cluster using main:
spec.override.nodeAgent.imageRepeated these steps with fix included to confirm.
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel