Add global.vsock with full/system-probe modes (system-probe <=> micro VM VSock)#3186
Add global.vsock with full/system-probe modes (system-probe <=> micro VM VSock)#3186lebauce wants to merge 1 commit into
Conversation
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 77087447f9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| managers.EnvVar().AddEnvVarToContainers(containersForEnvVars, &corev1.EnvVar{ | ||
| Name: DDRuntimeSecurityConfigEventGRPCServer, | ||
| Value: "security-agent", | ||
| Value: "vsock:5020", |
There was a problem hiding this comment.
When global.useVSock is enabled for CWS, this writes DD_RUNTIME_SECURITY_CONFIG_EVENT_GRPC_SERVER=vsock:5020. That Agent setting selects which Agent process sends runtime-security events and activity dumps (for example security-agent or system-probe); the vsock:5020 address is not a valid process selector. In micro-VM CWS deployments this leaves the host system-probe configured with an invalid event sender, so events forwarded from the guest can fail to be delivered as intended.
Useful? React with 👍 / 👎.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3186 +/- ##
==========================================
+ Coverage 44.03% 44.14% +0.10%
==========================================
Files 377 378 +1
Lines 30713 30758 +45
==========================================
+ Hits 13525 13578 +53
+ Misses 16300 16294 -6
+ Partials 888 886 -2
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
lebauce
changed the title
lebauce
force-pushed
the
lebauce/vsock-for-microvm-only
branch
2 times, most recently
from
8c93eb7 to
6f416b8
Compare
…VM VSock)
Introduces a real global.vsock configuration section so that scoping VSock to
the system-probe <=> micro VM channel is opt-in, while keeping the legacy
"everything over VSock" behavior available and backward compatible.
Configuration:
global:
vsock:
enabled: true # turns VSock on
mode: SystemProbe # "full" (default) or "system-probe"
- Full (default): all Agent components communicate over VSock. Reproduces the
legacy useVSock behavior (DD_VSOCK_ADDR=host, remote agent registry disabled,
host auth volume on the node agent, and the CWS runtime-security channel over
VSock with SOCKET=vsock:5020 and EVENT_GRPC_SERVER=security-agent on all CWS
containers).
- SystemProbe: VSock is scoped to the host system-probe only. It hosts a remote
runtime-security event server over VSock so the system-probe inside a micro VM
can forward events to it (system-probe container: EVENT_GRPC_SERVER=system-probe,
SOCKET=vsock:5020); the core and security agents keep the regular unix socket.
This matches the agent's event_grpc_server="system-probe" branch, documented as
the remote event server for remote system-probes in micro VMs via vsock. The
event_grpc_server config is a process-role selector; the vsock address belongs
on the socket config.
global.useVSock is kept, deprecated, and maps to vsock.enabled with the Full
mode. When the vsock section is set, useVSock is ignored. Resolution is
centralized in GlobalConfig.GetVSockConfig(), consumed by both the global
node-agent code and the CWS feature.
SystemProbe mode requires features.cws.directSendFromSystemProbe when CWS is
enabled, since the host system-probe no longer exposes the unix socket the
security-agent connects to; this is enforced by ValidateDatadogAgent.
Regenerates deepcopy, CRDs, and docs.
lebauce
force-pushed
the
lebauce/vsock-for-microvm-only
branch
from
6f416b8 to
616fc8b
Compare
lebauce
changed the title
3 participants
What
Introduces a real
global.vsockconfiguration section so that scoping VSock to the system-probe ⇄ micro VM channel is opt-in, while keeping the legacy "everything over VSock" behavior available and backward compatible.Configuration
full(default) — all Agent components communicate over VSock. Reproduces the legacyuseVSockbehavior:DD_VSOCK_ADDR=host,DD_REMOTE_AGENT_REGISTRY_ENABLED=false, the host auth volume on the node agent, and the CWS runtime-security channel over VSock (DD_RUNTIME_SECURITY_CONFIG_SOCKET=vsock:5020,DD_RUNTIME_SECURITY_CONFIG_EVENT_GRPC_SERVER=security-agent) on all CWS containers.system-probe— VSock is scoped to the host system-probe only. It hosts a remote runtime-security event server over VSock so the system-probe inside a micro VM can forward events to it:DD_RUNTIME_SECURITY_CONFIG_EVENT_GRPC_SERVER=system-probe,DD_RUNTIME_SECURITY_CONFIG_SOCKET=vsock:5020/var/run/sysprobe/runtime-security.sock)This matches the agent's own
event_grpc_server="system-probe"branch inpkg/security/module/cws.go, documented as the remote event server "for remote system-probes (e.g., in micro VMs via vsock)".event_grpc_serveris a process-role selector; thevsock:address belongs onsocket.Backward compatibility
global.useVSockis kept, marked deprecated, and maps tovsock.enabledwith theFullmode.global.vsocksection is set,useVSockis ignored.GlobalConfig.GetVSockConfig(), consumed by both the global node-agent code and the CWS feature.Changes
datadogagent_types.go): addedVSock *VSockConfigtoGlobalConfig, theVSockConfigstruct (Enabled,Mode), and theVSockModeenum (Full/SystemProbe); deprecatedUseVSock.vsock.go:GlobalConfig.GetVSockConfig()resolver with the back-compat precedence.global/agent.go: full-mode VSock env vars / auth volume gated onenabled && mode == Full.cws/feature.go: CWS runtime-security env vars branch on the VSock mode, with the address onsocketand the role onevent_grpc_server.useVSock,vsock.enabled(Full default), andSystemProbemode; CWS test covers Full (deprecateduseVSock) and SystemProbe modes.🤖 Generated with Claude Code