377 lines
14 KiB
Cheetah
377 lines
14 KiB
Cheetah
---
|
|
# This file is generated by 'make generate-manifests'; DO NOT EDIT.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: gadget
|
|
---
|
|
# Source: gadget/templates/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: gadget
|
|
namespace: gadget
|
|
---
|
|
# Source: gadget/templates/configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: gadget
|
|
namespace: gadget
|
|
data:
|
|
config.yaml: |-
|
|
hook-mode: auto
|
|
fallback-pod-informer: true
|
|
events-buffer-length: 16384
|
|
containerd-socketpath: /run/containerd/containerd.sock
|
|
crio-socketpath: /run/crio/crio.sock
|
|
docker-socketpath: /run/docker.sock
|
|
podman-socketpath: /run/podman/podman.sock
|
|
operator:
|
|
oci:
|
|
verify-image: true
|
|
public-keys:
|
|
- |
|
|
-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoDOC0gYSxZTopenGmX3ZFvQ1DSfh
|
|
Ir4EKRt5jC+mXaJ7c7J+oREskYMn/SfZdRHNSOjLTZUMDm60zpXGhkFecg==
|
|
-----END PUBLIC KEY-----
|
|
allowed-gadgets:
|
|
[]
|
|
disallow-pulling: false
|
|
---
|
|
# Source: gadget/templates/clusterrole.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: gadget-cluster-role
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["nodes/proxy"]
|
|
verbs: ["get"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces", "nodes", "pods"]
|
|
verbs: ["get", "watch", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["services"]
|
|
# list is needed by network-policy gadget
|
|
# watch is needed by operators enriching with service informations
|
|
verbs: ["list", "watch"]
|
|
- apiGroups: ["gadget.kinvolk.io"]
|
|
resources: ["traces", "traces/status"]
|
|
# For traces, we need all rights on them as we define this resource.
|
|
verbs: ["delete", "deletecollection", "get", "list", "patch", "create", "update", "watch"]
|
|
- apiGroups: ["*"]
|
|
resources: ["deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs", "replicationcontrollers"]
|
|
# Required to retrieve the owner references used by the seccomp gadget.
|
|
verbs: ["get"]
|
|
- apiGroups: ["security-profiles-operator.x-k8s.io"]
|
|
resources: ["seccompprofiles"]
|
|
# Required for integration with the Kubernetes Security Profiles Operator
|
|
verbs: ["list", "watch", "create"]
|
|
- apiGroups: ["security.openshift.io"]
|
|
# It is necessary to use the 'privileged' security context constraints to be
|
|
# able mount host directories as volumes, use the host networking, among others.
|
|
# This will be used only when running on OpenShift:
|
|
# https://docs.openshift.com/container-platform/4.9/authentication/managing-security-context-constraints.html#default-sccs_configuring-internal-oauth
|
|
resources: ["securitycontextconstraints"]
|
|
resourceNames: ["privileged"]
|
|
verbs: ["use"]
|
|
---
|
|
# Source: gadget/templates/clusterrolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: gadget-cluster-role-binding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: gadget-cluster-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: gadget
|
|
namespace: gadget
|
|
---
|
|
# Source: gadget/templates/role.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: gadget-role
|
|
namespace: gadget
|
|
rules:
|
|
- apiGroups: [ "" ]
|
|
resources: [ "secrets" ]
|
|
# get secrets is needed for retrieving pull secret.
|
|
verbs: [ "get" ]
|
|
---
|
|
# Source: gadget/templates/rolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: gadget-role-binding
|
|
namespace: gadget
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: gadget-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: gadget
|
|
---
|
|
# Source: gadget/templates/daemonset.yaml
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
labels:
|
|
k8s-app: gadget
|
|
name: gadget
|
|
namespace: gadget
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: gadget
|
|
template:
|
|
metadata:
|
|
labels:
|
|
k8s-app: gadget
|
|
annotations:
|
|
# We need to set gadget container as unconfined so it is able to write
|
|
# /sys/fs/bpf as well as /sys/kernel/debug/tracing.
|
|
# Otherwise, we can have error like:
|
|
# "failed to create server failed to create folder for pinning bpf maps: mkdir /sys/fs/bpf/gadget: permission denied"
|
|
# (For reference, see: https://github.com/inspektor-gadget/inspektor-gadget/runs/3966318270?check_suite_focus=true#step:20:221)
|
|
container.apparmor.security.beta.kubernetes.io/gadget: "unconfined"
|
|
inspektor-gadget.kinvolk.io/option-hook-mode: "auto"
|
|
# keep aligned with values in pkg/operators/prometheus/prometheus.go
|
|
prometheus.io/scrape: "true"
|
|
prometheus.io/port: "2223"
|
|
prometheus.io/path: "/metrics"
|
|
spec:
|
|
serviceAccount: gadget
|
|
hostPID: false
|
|
hostNetwork: false
|
|
containers:
|
|
- name: gadget
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
image: {{.CustomRegistries.InspektorGadget | default .ImageRepository | default .Registries.InspektorGadget }}{{.Images.InspektorGadget}}
|
|
imagePullPolicy: Always
|
|
command: [ "/entrypoint" ]
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command:
|
|
- "/cleanup"
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/gadgettracermanager
|
|
- -liveness
|
|
periodSeconds: 5
|
|
timeoutSeconds: 2
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/gadgettracermanager
|
|
- -liveness
|
|
periodSeconds: 5
|
|
timeoutSeconds: 2
|
|
env:
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: GADGET_POD_UID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.uid
|
|
- name: GADGET_IMAGE
|
|
value: "ghcr.io/inspektor-gadget/inspektor-gadget"
|
|
- name: INSPEKTOR_GADGET_VERSION
|
|
value: "latest"
|
|
- name: INSPEKTOR_GADGET_OPTION_HOOK_MODE
|
|
value: "auto"
|
|
- name: INSPEKTOR_GADGET_OPTION_FALLBACK_POD_INFORMER
|
|
value: "true"
|
|
- name: HOST_ROOT
|
|
value: "/host"
|
|
- name: IG_EXPERIMENTAL
|
|
value: "false"
|
|
- name: EVENTS_BUFFER_LENGTH
|
|
value: "16384"
|
|
- name: GADGET_TRACER_MANAGER_LOG_LEVEL
|
|
value: "info"
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
# With hostPID/hostNetwork/privileged [1] set to false, we need to set appropriate
|
|
# SELinux context [2] to be able to mount host directories with correct permissions.
|
|
# This option is ignored if hostPID/hostNetwork/privileged is set to true or SELinux isn't enabled.
|
|
# See:
|
|
# 1 - https://github.com/cri-o/cri-o/blob/v1.27.0/server/sandbox_run_linux.go#L537
|
|
# 2 - https://github.com/cri-o/cri-o/blob/v1.27.0/server/container_create_linux.go#L310
|
|
seLinuxOptions:
|
|
type: "spc_t"
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
# We need CAP_SYS_ADMIN for gadgettracermanager due to several
|
|
# syscalls:
|
|
# - bpf(): It often checks if SYS_ADMIN is set, among others
|
|
# there:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/kernel/bpf/syscall.c#L2602
|
|
# - perf_event_open(): The kernel checks if CAP_PERFMON or
|
|
# CAP_SYS_ADMIN is set:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/kernel/events/core.c#L12406-L12409
|
|
# - fanotify_init(): CAP_SYS_ADMIN is required to use all the
|
|
# functionalities offered by fanotify:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/fs/notify/fanotify/fanotify_user.c#L1404
|
|
# - fanotify_mark(): This capability is required to setup mount
|
|
# or filesystem marks:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/fs/notify/fanotify/fanotify_user.c#L1745-L1754
|
|
# - mount(): We need this capability to modify the caller
|
|
# namespace:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/fs/namespace.c#L1844-L1846
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/fs/namespace.c#L3609
|
|
# - setns(): SYS_ADMIN is needed to install various namespace:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5ba9292eda36fd8e3c11f35ee065c/kernel/nsproxy.c#L574
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/kernel/cgroup/namespace.c#L103-L105
|
|
- SYS_ADMIN
|
|
|
|
# We need this capability to get addresses from /proc/kallsyms.
|
|
# Without it, addresses displayed when reading this file will be
|
|
# 0.
|
|
# Indeed, the socket-enricher needs to get the socket_file_ops
|
|
# to work correctly:
|
|
# https://github.com/inspektor-gadget/inspektor-gadget/blob/69692d54d951/pkg/gadgets/internal/socketenricher/tracer.go#L75
|
|
- SYSLOG
|
|
|
|
# Accessing some procfs files such as /proc/$pid/ns/mnt
|
|
# requires ptrace capability:
|
|
# https://github.com/inspektor-gadget/inspektor-gadget/blob/3c51ff5e9f5b/pkg/utils/host/namespaces.go#L65
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/fs/proc/namespaces.c#L58
|
|
- SYS_PTRACE
|
|
|
|
# Needed by RemoveMemlock in gadgettracermanager:
|
|
# https://github.com/inspektor-gadget/inspektor-gadget/blob/f2b9826fc4ae046415cdee30ee4a25322fd3f0c0/pkg/gadgettracermanager/gadgettracermanager.go#L258
|
|
- SYS_RESOURCE
|
|
|
|
# Needed by mmap() called by gadgettracermanager:
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/mm/mmap.c#L1281
|
|
# https://github.com/torvalds/linux/blob/c42d9eeef8e5/mm/mmap.c#L1161-L1162
|
|
- IPC_LOCK
|
|
|
|
# Needed by gadgets that open a raw sock like dns and snisnoop:
|
|
# https://github.com/inspektor-gadget/inspektor-gadget/blob/3c51ff5e9f5b/gadgets/trace_dns/program.bpf.c#L365-L366
|
|
- NET_RAW
|
|
|
|
# Needed to attach qdiscs and filters to network interfaces. See createClsActQdisc()
|
|
# and addTCFilter() in pkg/gadgets/internal/tcnetworktracer/tc.go
|
|
- NET_ADMIN
|
|
volumeMounts:
|
|
- mountPath: /host/bin
|
|
name: bin
|
|
readOnly: true
|
|
# We need to have read/write as we write NRI and OCI config files
|
|
# here.
|
|
- mountPath: /host/etc
|
|
name: etc
|
|
readOnly: false
|
|
# We need to have read/write as we write NRI and OCI binaries here.
|
|
- mountPath: /host/opt
|
|
name: opt
|
|
readOnly: false
|
|
- mountPath: /host/usr
|
|
name: usr
|
|
readOnly: true
|
|
- mountPath: /host/run
|
|
name: run
|
|
readOnly: true
|
|
- mountPath: /host/var
|
|
name: var
|
|
readOnly: true
|
|
# WARNING Despite mounting host proc as readonly, it is possible to
|
|
# write host file system using symlinks under /host/proc. The
|
|
# following command, ran from gadget pod, will result in writing to
|
|
# the host filesystem:
|
|
# touch /host/proc/1/root/foobar
|
|
# This limitation comes from Inspektor Gadget needing to be run as
|
|
# unconfined with regard to AppArmor and having the SYS_PTRACE
|
|
# capability.
|
|
- mountPath: /host/proc
|
|
name: proc
|
|
readOnly: true
|
|
- mountPath: /run
|
|
name: run
|
|
- mountPath: /sys/kernel/debug
|
|
name: debugfs
|
|
- mountPath: /sys/fs/cgroup
|
|
name: cgroup
|
|
readOnly: true
|
|
- mountPath: /sys/fs/bpf
|
|
name: bpffs
|
|
# We need to add a dedicated volume to store OCI image otherwise it
|
|
# will fail as the container root filesystem is read only.
|
|
# For this, we use an emptyDir without size limit.
|
|
- mountPath: /var/lib/ig
|
|
name: oci
|
|
- mountPath: /etc/ig
|
|
name: config
|
|
readOnly: true
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
affinity:
|
|
{}
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
operator: Exists
|
|
- effect: NoExecute
|
|
operator: Exists
|
|
volumes:
|
|
# /bin is needed to find runc.
|
|
- name: bin
|
|
hostPath:
|
|
path: /bin
|
|
# /etc is needed for several reasons:
|
|
# 1. entrypoint needs /etc/os-release to print information.
|
|
# 2. entrypoint needs /etc/nri to handle NRI hooks
|
|
# 3. entrypoint needs /etc/containers/oci to handle OCI hooks.
|
|
- name: etc
|
|
hostPath:
|
|
path: /etc
|
|
# /opt is needed for several reasons:
|
|
# 1. entrypoint needs /opt/nri to handle NRI hooks.
|
|
# 2. entrypoint needs /opt/hooks/oci to handle OCI hooks.
|
|
- name: opt
|
|
hostPath:
|
|
path: /opt
|
|
# /usr is needed to find runc.
|
|
- name: usr
|
|
hostPath:
|
|
path: /usr
|
|
- name: proc
|
|
hostPath:
|
|
path: /proc
|
|
- name: run
|
|
hostPath:
|
|
path: /run
|
|
# /var is needed by container-hook to fanoitfy mark certain directories
|
|
# e.g. needed in case of docker runtime on minikube (driver=kvm2)
|
|
- name: var
|
|
hostPath:
|
|
path: /var
|
|
- name: cgroup
|
|
hostPath:
|
|
path: /sys/fs/cgroup
|
|
- name: bpffs
|
|
hostPath:
|
|
path: /sys/fs/bpf
|
|
- name: debugfs
|
|
hostPath:
|
|
path: /sys/kernel/debug
|
|
- name: oci
|
|
emptyDir:
|
|
- name: config
|
|
configMap:
|
|
name: gadget
|
|
defaultMode: 0o400
|