Skip to content

Commit d07372b

Browse files
michele-mangilimichele-mangili
committed
feat(node-analyzer/runtime-scanner): added configurable size for ephemeralVolumeRequestStorage when specifying a storageClassName
1 parent f69856a commit d07372b

File tree

6 files changed

+137
-7
lines changed

6 files changed

+137
-7
lines changed

‎charts/node-analyzer/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: node-analyzer
33
description: Sysdig Node Analyzer
44
# currently matching Sysdig's appVersion 1.14.34
5-
version: 1.36.11
5+
version: 1.37.0
66
appVersion: 12.9.2
77
keywords:
88
- monitoring

‎charts/node-analyzer/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ The following table lists the configurable parameters of the Sysdig Node Analyze
220220
| `nodeAnalyzer.runtimeScanner.deploy` | Deploys the Runtime Scanner. | `false` |
221221
| `nodeAnalyzer.runtimeScanner.extraMounts` | Specifies a container engine custom socket path (docker, containerd, CRI-O). | |
222222
| `nodeAnalyzer.runtimeScanner.storageClassName` | Specifies the Runtime Scanner storage class to use instead of emptyDir for ephemeral storage. | `` |
223+
| `nodeAnalyzer.runtimeScanner.ephemeralVolumeRequestStorage` | Specifies the size of the ephemeral storage volume to be used by the Runtime Scanner when the storageClassName is provided. | `4Gi` |
223224
| `nodeAnalyzer.runtimeScanner.image.repository` | Specifies the image repository to pull the Runtime Scanner from. | `sysdig/vuln-runtime-scanner` |
224225
| `nodeAnalyzer.runtimeScanner.image.tag` | Specifies the image tag to pull the Runtime Scanner. | `1.8.4` |
225226
| `nodeAnalyzer.runtimeScanner.image.digest` | Specifies the image digest to pull. | ` ` |

‎charts/node-analyzer/templates/daemonset-node-analyzer.yaml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -114,9 +114,7 @@ spec:
114114
storageClassName: {{ .Values.nodeAnalyzer.runtimeScanner.storageClassName }}
115115
resources:
116116
requests:
117-
storage: {{ index .Values.nodeAnalyzer.runtimeScanner.resources.requests "ephemeral-storage" }}
118-
limits:
119-
storage: {{ index .Values.nodeAnalyzer.runtimeScanner.resources.limits "ephemeral-storage" }}
117+
storage: {{ .Values.nodeAnalyzer.runtimeScanner.ephemeralVolumeRequestStorage }}
120118
{{- else }}
121119
emptyDir: {}
122120
{{- end }}
@@ -683,7 +681,18 @@ spec:
683681
securityContext:
684682
privileged: true
685683
resources:
686-
{{ toYaml .Values.nodeAnalyzer.runtimeScanner.resources | indent 10 }}
684+
requests:
685+
cpu: {{ .Values.nodeAnalyzer.runtimeScanner.resources.requests.cpu }}
686+
memory: {{ .Values.nodeAnalyzer.runtimeScanner.resources.requests.memory }}
687+
{{- if not .Values.nodeAnalyzer.runtimeScanner.storageClassName }}
688+
ephemeral-storage: {{ index .Values.nodeAnalyzer.runtimeScanner.resources.requests "ephemeral-storage" | quote }}
689+
{{- end }}
690+
limits:
691+
cpu: {{ .Values.nodeAnalyzer.runtimeScanner.resources.limits.cpu }}
692+
memory: {{ .Values.nodeAnalyzer.runtimeScanner.resources.limits.memory }}
693+
{{- if not .Values.nodeAnalyzer.runtimeScanner.storageClassName }}
694+
ephemeral-storage: {{ index .Values.nodeAnalyzer.runtimeScanner.resources.limits "ephemeral-storage" | quote }}
695+
{{- end }}
687696
# Custom volume mount here
688697
env:
689698
- name: TMPDIR

‎charts/node-analyzer/tests/runtimescanner_test.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,3 +172,115 @@ tests:
172172
path: spec.template.spec.containers[?(@.name == "sysdig-runtime-scanner")].env[?(@.name == "EVE_ENABLED")]
173173
- isNotNull:
174174
path: spec.template.spec.containers[?(@.name == "sysdig-runtime-scanner")].env[?(@.name == "EVE_INTEGRATION_ENABLED")]
175+
176+
- it: "sets runtime-scanner requests/limits and volumes correctly when the storageClassName is not provided"
177+
set:
178+
secure.vulnerabilityManagement.newEngineOnly: true
179+
global:
180+
clusterConfig:
181+
name: "test"
182+
nodeAnalyzer:
183+
runtimeScanner:
184+
deploy: true
185+
resources:
186+
requests:
187+
cpu: 123m
188+
memory: 456Mi
189+
ephemeral-storage: "69Gi"
190+
limits:
191+
cpu: 789m
192+
memory: 101112Mi
193+
ephemeral-storage: 420Gi
194+
templates:
195+
- ../templates/daemonset-node-analyzer.yaml
196+
asserts:
197+
- equal:
198+
path: "spec.template.spec.containers[1].name"
199+
value: "sysdig-runtime-scanner"
200+
- equal:
201+
path: "spec.template.spec.containers[1].resources.requests.cpu"
202+
value: "123m"
203+
- equal:
204+
path: "spec.template.spec.containers[1].resources.requests.memory"
205+
value: "456Mi"
206+
- equal:
207+
path: "spec.template.spec.containers[1].resources.requests.ephemeral-storage"
208+
value: "69Gi"
209+
- equal:
210+
path: "spec.template.spec.containers[1].resources.limits.cpu"
211+
value: "789m"
212+
- equal:
213+
path: "spec.template.spec.containers[1].resources.limits.memory"
214+
value: "101112Mi"
215+
- equal:
216+
path: "spec.template.spec.containers[1].resources.limits.ephemeral-storage"
217+
value: "420Gi"
218+
- equal:
219+
path: "spec.template.spec.volumes[7].name"
220+
value: "tmp-vol"
221+
- equal:
222+
path: "spec.template.spec.volumes[7].emptyDir"
223+
value: {}
224+
225+
- it: "sets runtime-scanner requests/limits and volumes correctly when the storageClassName is provided"
226+
set:
227+
secure.vulnerabilityManagement.newEngineOnly: true
228+
global:
229+
clusterConfig:
230+
name: "test"
231+
nodeAnalyzer:
232+
runtimeScanner:
233+
deploy: true
234+
storageClassName: "standard-rwo"
235+
ephemeralVolumeRequestStorage: "90Gi"
236+
resources:
237+
requests:
238+
cpu: 123m
239+
memory: 456Mi
240+
ephemeral-storage: "69Gi"
241+
limits:
242+
cpu: 789m
243+
memory: 101112Mi
244+
ephemeral-storage: 420Gi
245+
templates:
246+
- ../templates/daemonset-node-analyzer.yaml
247+
asserts:
248+
- equal:
249+
path: "spec.template.spec.containers[1].name"
250+
value: "sysdig-runtime-scanner"
251+
- equal:
252+
path: "spec.template.spec.containers[1].resources.requests.cpu"
253+
value: "123m"
254+
- equal:
255+
path: "spec.template.spec.containers[1].resources.requests.memory"
256+
value: "456Mi"
257+
- notExists:
258+
path: "spec.template.spec.containers[1].resources.requests.ephemeral-storage"
259+
- equal:
260+
path: "spec.template.spec.containers[1].resources.limits.cpu"
261+
value: "789m"
262+
- equal:
263+
path: "spec.template.spec.containers[1].resources.limits.memory"
264+
value: "101112Mi"
265+
- notExists:
266+
path: "spec.template.spec.containers[1].resources.limits.ephemeral-storage"
267+
- equal:
268+
path: "spec.template.spec.volumes[7].name"
269+
value: "tmp-vol"
270+
- notExists:
271+
path: "spec.template.spec.volumes[7].emptyDir"
272+
- equal:
273+
path: "spec.template.spec.volumes[7]"
274+
value:
275+
name: tmp-vol
276+
ephemeral:
277+
volumeClaimTemplate:
278+
metadata:
279+
labels:
280+
type: "standard-rwo"
281+
spec:
282+
accessModes: [ "ReadWriteOnce" ]
283+
storageClassName: "standard-rwo"
284+
resources:
285+
requests:
286+
storage: 90Gi

‎charts/node-analyzer/values.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,15 @@ nodeAnalyzer:
307307
httpProxy: null
308308
httpsProxy: null
309309
noProxy: null
310+
# If set, a PersistentVolumeClaim will be created to store temporary files for the runtime-scanner's ephemeral
311+
# storage using this StorageClass. The data stored in this volume is temporary and not intended for long-term
312+
# retention.
313+
# When specified, you must also set 'ephemeralVolumeRequestStorage' to define the requested storage size.
310314
storageClassName: null
315+
# Set the requested storage size for the ephemeral volumeClaimTemplate.
316+
# This value is used as the 'requests.storage' in the volumeClaimTemplate only when storageClassName is set.
317+
# Example: "4Gi"
318+
ephemeralVolumeRequestStorage: "4Gi"
311319
extraMounts: []
312320
# example for bottlerocket
313321
# extraMounts:

‎charts/sysdig-deploy/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: sysdig-deploy
33
description: A chart with various Sysdig components for Kubernetes
44
type: application
5-
version: 1.93.6
5+
version: 1.94.0
66
maintainers:
77
- name: AlbertoBarba
88
email: [email protected]
@@ -36,7 +36,7 @@ dependencies:
3636
- name: node-analyzer
3737
# repository: https://charts.sysdig.com
3838
repository: file://../node-analyzer
39-
version: ~1.36.11
39+
version: ~1.37.0
4040
alias: nodeAnalyzer
4141
condition: nodeAnalyzer.enabled
4242
- name: cluster-scanner

0 commit comments

Comments
 (0)