Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: rootless k8s integration tests #5290

Merged
merged 3 commits into from
Aug 14, 2024
+10 −6
Merged

fix: rootless k8s integration tests #5290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b17b172
fix: remove redundant setcap on agentbeat
pkoutsovasilis Aug 13, 2024
616ed7d
fix: add required capabilities for rootless agent
pkoutsovasilis Aug 13, 2024
ec02980
fix: increase agent resources to prevent OOM restarts
pkoutsovasilis Aug 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,7 @@ RUN true && \
true

# Keep this after any chown command, chown resets any applied capabilities
RUN setcap =p {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/elastic-agent
RUN setcap cap_net_raw,cap_setuid+p {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/components/agentbeat && \
RUN setcap =p {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/elastic-agent && \
{{- if .linux_capabilities }}
# Since the beat is stored at the other end of a symlink we must follow the symlink first
# For security reasons setcap does not support symlinks. This is smart in the general case
Expand Down
13 changes: 9 additions & 4 deletions testing/integration/kubernetes_agent_standalone_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ import (
batchv1 "k8s.io/api/batch/v1"
corev1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
"k8s.io/apimachinery/pkg/api/resource"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/serializer"
Expand Down Expand Up @@ -122,18 +123,18 @@ func TestKubernetesAgentStandalone(t *testing.T) {
int64Ptr(1000), // elastic-agent uid
nil,
[]corev1.Capability{"ALL"},
[]corev1.Capability{"CHOWN", "SETPCAP"},
[]corev1.Capability{"CHOWN", "SETPCAP", "DAC_READ_SEARCH", "SYS_PTRACE"},
true,
"https://github.com/elastic/elastic-agent/issues/5275",
"",
},
{
"drop ALL add CHOWN, SETPCAP capabilities - rootless agent random uid:gid",
int64Ptr(500),
int64Ptr(500),
[]corev1.Capability{"ALL"},
[]corev1.Capability{"CHOWN", "SETPCAP", "DAC_READ_SEARCH"},
[]corev1.Capability{"CHOWN", "SETPCAP", "DAC_READ_SEARCH", "SYS_PTRACE"},
true,
"https://github.com/elastic/elastic-agent/issues/5275",
"",
},
}

Expand All @@ -160,6 +161,10 @@ func TestKubernetesAgentStandalone(t *testing.T) {
// as the image is already loaded by the kubernetes provisioner
container.ImagePullPolicy = "Never"

container.Resources.Limits = corev1.ResourceList{
corev1.ResourceMemory: resource.MustParse("800Mi"),
}

if tc.capabilitiesDrop != nil || tc.capabilitiesAdd != nil || tc.runUser != nil || tc.runGroup != nil {
// set security context
container.SecurityContext = &corev1.SecurityContext{
Expand Down