Skip to content

Commit 7ef1fe3

Browse files
aureleoulesaureleoules
committed
Do not mount /etc/passwd on Talos nodes
1 parent 54ed549 commit 7ef1fe3

File tree

6 files changed

+52
-27
lines changed

6 files changed

+52
-27
lines changed

‎internal/controller/datadogagent/feature/cspm/feature.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -297,10 +297,12 @@ func (f *cspmFeature) ManageNodeAgent(managers feature.PodTemplateManagers, prov
297297
volMountMgr.AddVolumeMountToContainer(&cgroupsVolMount, apicommon.SecurityAgentContainerName)
298298
VolMgr.AddVolume(&cgroupsVol)
299299

300-
// passwd volume mount
301-
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
302-
volMountMgr.AddVolumeMountToContainer(&passwdVolMount, apicommon.SecurityAgentContainerName)
303-
VolMgr.AddVolume(&passwdVol)
300+
if provider != kubernetes.TalosProvider {
301+
// passwd volume mount
302+
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
303+
volMountMgr.AddVolumeMountToContainer(&passwdVolMount, apicommon.SecurityAgentContainerName)
304+
VolMgr.AddVolume(&passwdVol)
305+
}
304306

305307
// procdir volume mount
306308
procdirVol, procdirVolMount := volume.GetVolumes(common.ProcdirVolumeName, common.ProcdirHostPath, common.ProcdirMountPath, true)

‎internal/controller/datadogagent/feature/cws/feature.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -283,10 +283,12 @@ func (f *cwsFeature) ManageNodeAgent(managers feature.PodTemplateManagers, provi
283283
volMountMgr.AddVolumeMountToContainer(&procdirVolMount, apicommon.SystemProbeContainerName)
284284
volMgr.AddVolume(&procdirVol)
285285

286-
// passwd volume mount
287-
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
288-
volMountMgr.AddVolumeMountToContainer(&passwdVolMount, apicommon.SystemProbeContainerName)
289-
volMgr.AddVolume(&passwdVol)
286+
if provider != kubernetes.TalosProvider {
287+
// passwd volume mount
288+
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
289+
volMountMgr.AddVolumeMountToContainer(&passwdVolMount, apicommon.SystemProbeContainerName)
290+
volMgr.AddVolume(&passwdVol)
291+
}
290292

291293
// group volume mount
292294
groupVol, groupVolMount := volume.GetVolumes(common.GroupVolumeName, common.GroupHostPath, common.GroupMountPath, true)

‎internal/controller/datadogagent/feature/liveprocess/feature.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/DataDog/datadog-operator/internal/controller/datadogagent/feature"
1616
featutils "github.com/DataDog/datadog-operator/internal/controller/datadogagent/feature/utils"
1717
"github.com/DataDog/datadog-operator/internal/controller/datadogagent/object/volume"
18+
"github.com/DataDog/datadog-operator/pkg/kubernetes"
1819
)
1920

2021
func init() {
@@ -117,10 +118,12 @@ func (f *liveProcessFeature) ManageNodeAgent(managers feature.PodTemplateManager
117118

118119
func (f *liveProcessFeature) manageNodeAgent(agentContainerName apicommon.AgentContainerName, managers feature.PodTemplateManagers, provider string) error {
119120

120-
// passwd volume mount
121-
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
122-
managers.VolumeMount().AddVolumeMountToContainer(&passwdVolMount, agentContainerName)
123-
managers.Volume().AddVolume(&passwdVol)
121+
if provider != kubernetes.TalosProvider {
122+
// passwd volume mount
123+
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
124+
managers.VolumeMount().AddVolumeMountToContainer(&passwdVolMount, agentContainerName)
125+
managers.Volume().AddVolume(&passwdVol)
126+
}
124127

125128
// cgroups volume mount
126129
cgroupsVol, cgroupsVolMount := volume.GetVolumes(common.CgroupsVolumeName, common.CgroupsHostPath, common.CgroupsMountPath, true)

‎internal/controller/datadogagent/feature/processdiscovery/feature.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/DataDog/datadog-operator/internal/controller/datadogagent/feature"
1616
featutils "github.com/DataDog/datadog-operator/internal/controller/datadogagent/feature/utils"
1717
"github.com/DataDog/datadog-operator/internal/controller/datadogagent/object/volume"
18+
"github.com/DataDog/datadog-operator/pkg/kubernetes"
1819
)
1920

2021
func init() {
@@ -96,9 +97,11 @@ func (p processDiscoveryFeature) ManageSingleContainerNodeAgent(managers feature
9697

9798
func (p processDiscoveryFeature) manageNodeAgent(agentContainerName apicommon.AgentContainerName, managers feature.PodTemplateManagers, provider string) error {
9899
// passwd volume mount
99-
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
100-
managers.VolumeMount().AddVolumeMountToContainer(&passwdVolMount, agentContainerName)
101-
managers.Volume().AddVolume(&passwdVol)
100+
if provider != kubernetes.TalosProvider {
101+
passwdVol, passwdVolMount := volume.GetVolumes(common.PasswdVolumeName, common.PasswdHostPath, common.PasswdMountPath, true)
102+
managers.VolumeMount().AddVolumeMountToContainer(&passwdVolMount, agentContainerName)
103+
managers.Volume().AddVolume(&passwdVol)
104+
}
102105

103106
// cgroups volume mount
104107
cgroupsVol, cgroupsVolMount := volume.GetVolumes(common.CgroupsVolumeName, common.CgroupsHostPath, common.CgroupsMountPath, true)

‎pkg/kubernetes/provider.go‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ const (
2222
// DefaultProvider Default provider name
2323
DefaultProvider = "default"
2424

25+
TalosProvider = "talos"
26+
2527
// GKE provider types: https://cloud.google.com/kubernetes-engine/docs/concepts/node-images#available_node_images
2628
// GKECosType is the Container-Optimized OS node image offered by GKE
2729
GKECosType = "cos"
@@ -39,16 +41,20 @@ var providerValueAllowlist = map[string]struct{}{
3941
}
4042

4143
// determineProvider creates a Provider based on a map of labels
42-
func determineProvider(labels map[string]string) string {
43-
if len(labels) > 0 {
44+
func determineProvider(node *corev1.Node) string {
45+
if len(node.Labels) > 0 {
4446
// GKE
45-
if val, ok := labels[GKEProviderLabel]; ok {
47+
if val, ok := node.Labels[GKEProviderLabel]; ok {
4648
if provider := generateValidProviderName(GKECloudProvider, val); provider != "" {
4749
return provider
4850
}
4951
}
5052
}
5153

54+
if strings.Contains(node.Status.NodeInfo.OSImage, "Talos") {
55+
return TalosProvider
56+
}
57+
5258
return DefaultProvider
5359
}
5460

@@ -183,7 +189,7 @@ func GetAgentNameWithProvider(overrideDSName, provider string) string {
183189
func GetProviderListFromNodeList(nodeList []corev1.Node, logger logr.Logger) map[string]struct{} {
184190
providerList := make(map[string]struct{})
185191
for _, node := range nodeList {
186-
provider := determineProvider(node.Labels)
192+
provider := determineProvider(&node)
187193
if _, ok := providerList[provider]; !ok {
188194
providerList[provider] = struct{}{}
189195
logger.V(1).Info("New provider detected", "provider", provider)

‎pkg/kubernetes/provider_test.go‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
"github.com/stretchr/testify/assert"
1212
corev1 "k8s.io/api/core/v1"
13+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1314
)
1415

1516
var (
@@ -20,34 +21,42 @@ var (
2021
func Test_determineProvider(t *testing.T) {
2122
tests := []struct {
2223
name string
23-
labels map[string]string
24+
node corev1.Node
2425
provider string
2526
}{
2627
{
2728
name: "random provider",
28-
labels: map[string]string{
29-
"foo": "bar",
29+
node: corev1.Node{
30+
ObjectMeta: metav1.ObjectMeta{
31+
Labels: map[string]string{
32+
"foo": "bar",
33+
},
34+
},
3035
},
3136
provider: defaultProvider,
3237
},
3338
{
3439
name: "empty labels",
35-
labels: map[string]string{},
40+
node: corev1.Node{},
3641
provider: defaultProvider,
3742
},
3843
{
3944
name: "gke provider",
40-
labels: map[string]string{
41-
"foo": "bar",
42-
GKEProviderLabel: GKECosType,
45+
node: corev1.Node{
46+
ObjectMeta: metav1.ObjectMeta{
47+
Labels: map[string]string{
48+
"foo": "bar",
49+
GKEProviderLabel: GKECosType,
50+
},
51+
},
4352
},
4453
provider: generateValidProviderName(GKECloudProvider, GKECosType),
4554
},
4655
}
4756

4857
for _, tt := range tests {
4958
t.Run(tt.name, func(t *testing.T) {
50-
p := determineProvider(tt.labels)
59+
p := determineProvider(&tt.node)
5160
assert.Equal(t, tt.provider, p)
5261
})
5362
}

0 commit comments

Comments
 (0)