feat(agent) add option to override security.openshift.io/v1 API presence

sysdiglabs · Nov 21, 2024 · 5eb4c30 · 5eb4c30
1 parent 90814b7
commit 5eb4c30
Show file tree

Hide file tree

Showing 6 changed files with 21 additions and 3 deletions.
diff --git a/charts/agent/Chart.yaml b/charts/agent/Chart.yaml
@@ -30,4 +30,4 @@ sources:
 - https://app.sysdigcloud.com/#/settings/user
 - https://github.com/draios/sysdig
 type: application
-version: 1.31.0
+version: 1.31.1
diff --git a/charts/agent/README.md b/charts/agent/README.md
@@ -97,6 +97,9 @@ The following table lists the configurable parameters of the Sysdig chart and th
 | `global.gke.autopilot`                                  | If true, overrides the agent configuration to run on GKE Autopilot clusters.                                                                                                             | `false`                                                                                                   |
 | `global.image.pullSecrets`                              | Global pull secrets.                                                                                                                                                                     | <code>[]</code>                                                                                           |
 | `global.image.pullPolicy`                               | Global pull policy.                                                                                                                                                                      | <code>`IfNotPresent`</code>                                                                               |
+
+| hasAPISecurityOpenshiftV1Override                       | Overrides `security.openshift.io/v1` API detection                                                                                                                                       | `false`                                                                                                    |
+
 | `namespace`                                             | Overrides the global namespace setting and release namespace for components.                                                                                                             | `""`                                                                                                      |
 | `image.registry`                                        | Sysdig Agent image registry.                                                                                                                                                             | `quay.io`                                                                                                 |
 | `image.repository`                                      | Sets the image repository to pull the agent image from.                                                                                                                                  | `sysdig/agent`                                                                                            |

diff --git a/charts/agent/templates/securitycontextconstraint.yaml b/charts/agent/templates/securitycontextconstraint.yaml
@@ -1,4 +1,5 @@
-{{- if and .Values.scc.create (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
+{{- $hasAPISecurityOpenshiftV1 := default (.Capabilities.APIVersions.Has "security.openshift.io/v1") .Values.hasAPISecurityOpenshiftV1Override }}
+{{- if and .Values.scc.create ($hasAPISecurityOpenshiftV1) }}
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:

diff --git a/charts/agent/tests/security_context_constraints_test.yaml b/charts/agent/tests/security_context_constraints_test.yaml
@@ -139,3 +139,14 @@ tests:
       - equal:
           path: allowHostPorts
           value: true
+
+  - it: Testing that SCS is created when security.openshift.io/v1 api are overridden
+    set:
+      scc:
+        create: true
+      hasAPISecurityOpenshiftV1Override: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: SecurityContextConstraints
diff --git a/charts/agent/values.yaml b/charts/agent/values.yaml
@@ -404,3 +404,6 @@ tests:
     tag: 1.31.2
 # Allow to modify DNS policy
 dnsPolicy: null
+# Overrides `security.openshift.io/v1` API detection
+# useful while using "helm template" and to generate security context constraints
+hasAPISecurityOpenshiftV1Override: false
diff --git a/charts/sysdig-deploy/Chart.yaml b/charts/sysdig-deploy/Chart.yaml
@@ -26,7 +26,7 @@ dependencies:
   - name: agent
     # repository: https://charts.sysdig.com
     repository: file://../agent
-    version: ~1.31.0
+    version: ~1.31.1
     alias: agent
     condition: agent.enabled
   - name: common