diff --git a/docs/content/en/docs/reference/helm-chart.md b/docs/content/en/docs/reference/helm-chart.md index a263e87c437..a651c6da920 100644 --- a/docs/content/en/docs/reference/helm-chart.md +++ b/docs/content/en/docs/reference/helm-chart.md @@ -46,7 +46,7 @@ To use [the values available](#values), with `helm install` or `helm upgrade`, u | podLabelsOverride | object | `{}` | | | podSecurityContext | object | `{}` | | | priorityClassName | string | `""` | | -| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"priorityClassName":"","resources":{},"securityContext":{"privileged":true}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | +| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"podSecurityContext":{"privileged":true},"priorityClassName":"","resources":{}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | | rthooks.annotations | object | `{}` | Annotations for the Tetragon rthooks daemonset | | rthooks.enabled | bool | `false` | Enable the Tetragon rthooks daemonset | | rthooks.extraHookArgs | object | `{}` | extra args to pass to tetragon-oci-hook | @@ -61,9 +61,9 @@ To use [the values available](#values), with `helm install` or `helm upgrade`, u | rthooks.ociHooks | object | `{"hooksPath":"/usr/share/containers/oci/hooks.d"}` | configuration for "oci-hooks" interface | | rthooks.ociHooks.hooksPath | string | `"/usr/share/containers/oci/hooks.d"` | directory to install .json file for running the hook | | rthooks.podAnnotations | object | `{}` | Pod annotations for the Tetrargon rthooks pod | +| rthooks.podSecurityContext | object | `{"privileged":true}` | security context for the Tetrargon rthooks pod | | rthooks.priorityClassName | string | `""` | priorityClassName for the Tetrargon rthooks pod | | rthooks.resources | object | `{}` | resources for the the oci-hook-setup init container | -| rthooks.securityContext | object | `{"privileged":true}` | security context for the Tetrargon rthooks pod | | selectorLabelsOverride | object | `{}` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | diff --git a/install/kubernetes/tetragon/README.md b/install/kubernetes/tetragon/README.md index 94104cc735a..f7fe426418f 100644 --- a/install/kubernetes/tetragon/README.md +++ b/install/kubernetes/tetragon/README.md @@ -28,7 +28,7 @@ Helm chart for Tetragon | podLabelsOverride | object | `{}` | | | podSecurityContext | object | `{}` | | | priorityClassName | string | `""` | | -| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"priorityClassName":"","resources":{},"securityContext":{"privileged":true}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | +| rthooks | object | `{"annotations":{},"enabled":false,"extraHookArgs":{},"extraLabels":{},"extraVolumeMounts":[],"failAllowNamespaces":"","image":{"override":null,"repository":"quay.io/cilium/tetragon-rthooks","tag":"v0.2"},"installDir":"/opt/tetragon","interface":"","nriHook":{"nriSocket":"/var/run/nri/nri.sock"},"ociHooks":{"hooksPath":"/usr/share/containers/oci/hooks.d"},"podAnnotations":{},"podSecurityContext":{"privileged":true},"priorityClassName":"","resources":{}}` | Method for installing Tetagon rthooks (tetragon-rthooks) daemonset The tetragon-rthooks daemonset is responsible for installing run-time hooks on the host. See: https://tetragon.io/docs/concepts/runtime-hooks | | rthooks.annotations | object | `{}` | Annotations for the Tetragon rthooks daemonset | | rthooks.enabled | bool | `false` | Enable the Tetragon rthooks daemonset | | rthooks.extraHookArgs | object | `{}` | extra args to pass to tetragon-oci-hook | @@ -43,9 +43,9 @@ Helm chart for Tetragon | rthooks.ociHooks | object | `{"hooksPath":"/usr/share/containers/oci/hooks.d"}` | configuration for "oci-hooks" interface | | rthooks.ociHooks.hooksPath | string | `"/usr/share/containers/oci/hooks.d"` | directory to install .json file for running the hook | | rthooks.podAnnotations | object | `{}` | Pod annotations for the Tetrargon rthooks pod | +| rthooks.podSecurityContext | object | `{"privileged":true}` | security context for the Tetrargon rthooks pod | | rthooks.priorityClassName | string | `""` | priorityClassName for the Tetrargon rthooks pod | | rthooks.resources | object | `{}` | resources for the the oci-hook-setup init container | -| rthooks.securityContext | object | `{"privileged":true}` | security context for the Tetrargon rthooks pod | | selectorLabelsOverride | object | `{}` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | diff --git a/install/kubernetes/tetragon/templates/_container_rthooks.tpl b/install/kubernetes/tetragon/templates/_container_rthooks.tpl index 38d7f021e60..d8911076204 100644 --- a/install/kubernetes/tetragon/templates/_container_rthooks.tpl +++ b/install/kubernetes/tetragon/templates/_container_rthooks.tpl @@ -1,7 +1,5 @@ {{- define "container.tetragon-rthooks" -}} - name: tetragon-rthooks - securityContext: - {{- toYaml .Values.rthooks.securityContext | nindent 4 }} image: "{{ if .Values.rthooks.image.override }}{{ .Values.rthooks.image.override }}{{ else }}{{ .Values.rthooks.image.repository }}:{{ .Values.rthooks.image.tag }}{{ end }}" terminationMessagePolicy: FallbackToLogsOnError imagePullPolicy: {{ .Values.imagePullPolicy }} diff --git a/install/kubernetes/tetragon/values.yaml b/install/kubernetes/tetragon/values.yaml index 91cc8aa6266..efd4e0e963c 100644 --- a/install/kubernetes/tetragon/values.yaml +++ b/install/kubernetes/tetragon/values.yaml @@ -366,7 +366,7 @@ rthooks: # -- priorityClassName for the Tetrargon rthooks pod priorityClassName: "" # -- security context for the Tetrargon rthooks pod - securityContext: + podSecurityContext: privileged: true # -- installDir is the host location where the tetragon-oci-hook binary will be installed installDir: "/opt/tetragon"