Use PodResources mount as a path instead of file (#1674)

* Use folder instead of file mount * Fix test * PodResourcesSocketDir->PodResourcesSocketPath * remove unused function from merge * nits + generate --------- Co-authored-by: Timothée Bavelier <[email protected]>
DataDog · Feb 13, 2025 · ba5e92f · ba5e92f
1 parent 91095b8
commit ba5e92f
Show file tree

Hide file tree

Showing 8 changed files with 36 additions and 44 deletions.
diff --git a/api/datadoghq/v2alpha1/datadogagent_types.go b/api/datadoghq/v2alpha1/datadogagent_types.go
@@ -1092,10 +1092,10 @@ type KubeletConfig struct {
 	// +optional
 	AgentCAPath string `json:"agentCAPath,omitempty"`
 
-	// PodResourcesSocket is the path to the pod resources socket, to be used to read pod resource assignments
-	// Default: `/var/lib/kubelet/pod-resources/kubelet.sock`
+	// PodResourcesSocketPath is the host path where the pod resources socket is stored.
+	// Default: `/var/lib/kubelet/pod-resources/`
 	// +optional
-	PodResourcesSocket string `json:"podResourcesSocket,omitempty"`
+	PodResourcesSocketPath string `json:"podResourcesSocketPath,omitempty"`
 }
 
 // HostPortConfig contains host port configuration.

diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents.yaml b/config/crd/bases/v1/datadoghq.com_datadogagents.yaml
@@ -2158,10 +2158,10 @@ spec:
                         hostCAPath:
                           description: HostCAPath is the host path where the kubelet CA certificate is stored.
                           type: string
-                        podResourcesSocket:
+                        podResourcesSocketPath:
                           description: |-
-                            PodResourcesSocket is the path to the pod resources socket, to be used to read pod resource assignments
-                            Default: `/var/lib/kubelet/pod-resources/kubelet.sock`
+                            PodResourcesSocketPath is the host path where the pod resources socket is stored.
+                            Default: `/var/lib/kubelet/pod-resources/`
                           type: string
                         tlsVerify:
                           description: |-

diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json
@@ -2311,8 +2311,8 @@
                   "description": "HostCAPath is the host path where the kubelet CA certificate is stored.",
                   "type": "string"
                 },
-                "podResourcesSocket": {
-                  "description": "PodResourcesSocket is the path to the pod resources socket, to be used to read pod resource assignments\nDefault: `/var/lib/kubelet/pod-resources/kubelet.sock`",
+                "podResourcesSocketPath": {
+                  "description": "PodResourcesSocketPath is the host path where the pod resources socket is stored.\nDefault: `/var/lib/kubelet/pod-resources/`",
                   "type": "string"
                 },
                 "tlsVerify": {

diff --git a/docs/configuration.v2alpha1.md b/docs/configuration.v2alpha1.md
@@ -229,7 +229,7 @@ spec:
 | global.kubelet.host.secretKeyRef.name | Of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
 | global.kubelet.host.secretKeyRef.optional | Specify whether the Secret or its key must be defined |
 | global.kubelet.hostCAPath | HostCAPath is the host path where the kubelet CA certificate is stored. |
-| global.kubelet.podResourcesSocket | PodResourcesSocket is the path to the pod resources socket, to be used to read pod resource assignments Default: `/var/lib/kubelet/pod-resources/kubelet.sock` |
+| global.kubelet.podResourcesSocketPath | PodResourcesSocketPath is the host path where the pod resources socket is stored. Default: `/var/lib/kubelet/pod-resources/` |
 | global.kubelet.tlsVerify | TLSVerify toggles kubelet TLS verification. Default: true |
 | global.kubernetesResourcesAnnotationsAsTags | Provide a mapping of Kubernetes Resource Groups to annotations mapping to Datadog Tags. <KUBERNETES_RESOURCE_GROUP>: 		<KUBERNETES_ANNOTATION>: <DATADOG_TAG_KEY> KUBERNETES_RESOURCE_GROUP should be in the form `{resource}.{group}` or `{resource}` (example: deployments.apps, pods) |
 | global.kubernetesResourcesLabelsAsTags | Provide a mapping of Kubernetes Resource Groups to labels mapping to Datadog Tags. <KUBERNETES_RESOURCE_GROUP>: 		<KUBERNETES_LABEL>: <DATADOG_TAG_KEY> KUBERNETES_RESOURCE_GROUP should be in the form `{resource}.{group}` or `{resource}` (example: deployments.apps, pods) |

diff --git a/internal/controller/datadogagent/defaults/datadogagent_default.go b/internal/controller/datadogagent/defaults/datadogagent_default.go
@@ -116,7 +116,7 @@ const (
 
 	// defaultKubeletAgentCAPath            = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
 	// defaultKubeletAgentCAPathHostPathSet = "/var/run/host-kubelet-ca.crt"
-	defaultKubeletPodResourcesSocket = "/var/lib/kubelet/pod-resources/kubelet.sock"
+	defaultKubeletPodResourcesSocketDir = "/var/lib/kubelet/pod-resources/"
 
 	defaultContainerStrategy = v2alpha1.OptimizedContainerStrategy
 
@@ -198,8 +198,8 @@ func defaultGlobalConfig(ddaSpec *v2alpha1.DatadogAgentSpec) {
 		ddaSpec.Global.Kubelet = &v2alpha1.KubeletConfig{}
 	}
 
-	if ddaSpec.Global.Kubelet.PodResourcesSocket == "" {
-		ddaSpec.Global.Kubelet.PodResourcesSocket = defaultKubeletPodResourcesSocket
+	if ddaSpec.Global.Kubelet.PodResourcesSocketPath == "" {
+		ddaSpec.Global.Kubelet.PodResourcesSocketPath = defaultKubeletPodResourcesSocketDir
 	}
 
 	apiutils.DefaultBooleanIfUnset(&ddaSpec.Global.RunProcessChecksInCoreAgent, defaultRunProcessChecksInCoreAgent)

diff --git a/internal/controller/datadogagent/override/global.go b/internal/controller/datadogagent/override/global.go
@@ -8,6 +8,7 @@ package override
 import (
 	"encoding/json"
 	"fmt"
+	"path"
 	"path/filepath"
 	"strconv"
 
@@ -285,13 +286,13 @@ func applyGlobalSettings(logger logr.Logger, manager feature.PodTemplateManagers
 					Value: agentCAPath,
 				})
 			}
-			if config.Kubelet.PodResourcesSocket != "" {
+			if config.Kubelet.PodResourcesSocketPath != "" {
 				manager.EnvVar().AddEnvVar(&corev1.EnvVar{
 					Name:  DDKubernetesPodResourcesSocket,
-					Value: config.Kubelet.PodResourcesSocket,
+					Value: path.Join(config.Kubelet.PodResourcesSocketPath, "kubelet.sock"),
 				})
 
-				podResourcesVol, podResourcesMount := volume.GetVolumes(common.KubeletPodResourcesVolumeName, config.Kubelet.PodResourcesSocket, config.Kubelet.PodResourcesSocket, false)
+				podResourcesVol, podResourcesMount := volume.GetVolumes(common.KubeletPodResourcesVolumeName, config.Kubelet.PodResourcesSocketPath, config.Kubelet.PodResourcesSocketPath, false)
 				if singleContainerStrategyEnabled {
 					manager.VolumeMount().AddVolumeMountToContainers(
 						&podResourcesMount,

diff --git a/internal/controller/datadogagent/override/global_test.go b/internal/controller/datadogagent/override/global_test.go
@@ -32,16 +32,17 @@ import (
 )
 
 const (
-	hostCAPath           = "/host/ca/path/ca.crt"
-	agentCAPath          = "/agent/ca/path/ca.crt"
-	podResourcesSocket   = "/var/lib/kubelet/pod-resources/kubelet.sock"
-	dockerSocketPath     = "/docker/socket/path/docker.sock"
-	secretBackendCommand = "foo.sh"
-	secretBackendArgs    = "bar baz"
-	secretBackendTimeout = 60
-	ddaName              = "datadog"
-	ddaNamespace         = "system"
-	secretNamespace      = "postgres"
+	hostCAPath            = "/host/ca/path/ca.crt"
+	agentCAPath           = "/agent/ca/path/ca.crt"
+	podResourcesSocketDir = "/var/lib/kubelet/pod-resources/"
+	podResourcesSocket    = podResourcesSocketDir + "kubelet.sock"
+	dockerSocketPath      = "/docker/socket/path/docker.sock"
+	secretBackendCommand  = "foo.sh"
+	secretBackendArgs     = "bar baz"
+	secretBackendTimeout  = 60
+	ddaName               = "datadog"
+	ddaNamespace          = "system"
+	secretNamespace       = "postgres"
 )
 
 var secretNames = []string{"db-username", "db-password"}
@@ -69,7 +70,7 @@ func TestNodeAgentComponenGlobalSettings(t *testing.T) {
 			name:                           "Kubelet volume configured",
 			singleContainerStrategyEnabled: false,
 			dda: testutils.NewDatadogAgentBuilder().
-				WithGlobalKubeletConfig(hostCAPath, agentCAPath, true, podResourcesSocket).
+				WithGlobalKubeletConfig(hostCAPath, agentCAPath, true, podResourcesSocketDir).
 				WithGlobalDockerSocketPath(dockerSocketPath).
 				BuildWithDefaults(),
 			wantEnvVars: getExpectedEnvVars([]*corev1.EnvVar{
@@ -98,7 +99,7 @@ func TestNodeAgentComponenGlobalSettings(t *testing.T) {
 			name:                           "Kubelet volume configured",
 			singleContainerStrategyEnabled: true,
 			dda: testutils.NewDatadogAgentBuilder().
-				WithGlobalKubeletConfig(hostCAPath, agentCAPath, true, podResourcesSocket).
+				WithGlobalKubeletConfig(hostCAPath, agentCAPath, true, podResourcesSocketDir).
 				WithGlobalDockerSocketPath(dockerSocketPath).
 				BuildWithDefaults(),
 			wantEnvVars: getExpectedEnvVars([]*corev1.EnvVar{
@@ -341,7 +342,7 @@ func getExpectedVolumes(configs ...volumeConfig) []*corev1.Volume {
 			Name: common.KubeletPodResourcesVolumeName,
 			VolumeSource: corev1.VolumeSource{
 				HostPath: &corev1.HostPathVolumeSource{
-					Path: podResourcesSocket,
+					Path: podResourcesSocketDir,
 				},
 			},
 		})
@@ -361,16 +362,6 @@ func getExpectedVolumes(configs ...volumeConfig) []*corev1.Volume {
 	return volumes
 }
 
-func getDefaultVolumeMounts() []*corev1.VolumeMount {
-	return []*corev1.VolumeMount{
-		{
-			Name:      common.KubeletPodResourcesVolumeName,
-			MountPath: podResourcesSocket,
-			ReadOnly:  false,
-		},
-	}
-}
-
 func getExpectedVolumeMounts(configs ...volumeConfig) []*corev1.VolumeMount {
 	mounts := []*corev1.VolumeMount{}
 
@@ -385,7 +376,7 @@ func getExpectedVolumeMounts(configs ...volumeConfig) []*corev1.VolumeMount {
 	if slices.Contains(configs, defaultVolumes) {
 		mounts = append(mounts, &corev1.VolumeMount{
 			Name:      common.KubeletPodResourcesVolumeName,
-			MountPath: podResourcesSocket,
+			MountPath: podResourcesSocketDir,
 			ReadOnly:  false,
 		})
 	}

diff --git a/pkg/testutils/builder.go b/pkg/testutils/builder.go
@@ -838,12 +838,12 @@ func (builder *DatadogAgentBuilder) WithHelmCheckValuesAsTags(valuesAsTags map[s
 
 // Global Kubelet
 
-func (builder *DatadogAgentBuilder) WithGlobalKubeletConfig(hostCAPath, agentCAPath string, tlsVerify bool, podResourcesSocket string) *DatadogAgentBuilder {
+func (builder *DatadogAgentBuilder) WithGlobalKubeletConfig(hostCAPath, agentCAPath string, tlsVerify bool, podResourcesSocketDir string) *DatadogAgentBuilder {
 	builder.datadogAgent.Spec.Global.Kubelet = &v2alpha1.KubeletConfig{
-		TLSVerify:          apiutils.NewBoolPointer(tlsVerify),
-		HostCAPath:         hostCAPath,
-		AgentCAPath:        agentCAPath,
-		PodResourcesSocket: podResourcesSocket,
+		TLSVerify:              apiutils.NewBoolPointer(tlsVerify),
+		HostCAPath:             hostCAPath,
+		AgentCAPath:            agentCAPath,
+		PodResourcesSocketPath: podResourcesSocketDir,
 	}
 	return builder
 }