New feature: allow configuring security context on cluster agent about datadog-operator HOT 2 CLOSED

Hi @praseodym,

Thanks for opening this issue, I'm adding this issue to our backlog.

IMO the cluster-agent doesn't require to run as root. So if we can apply by default the proper level of permission to the cluster-agent container it should also solve the issue.

could you share with us, what will be the security context that you want to apply to the cluster-agent?

from datadog-operator.

The cluster agent runs as root by default, the image doesn't specify that it should run as another user:

$ docker run --rm -it --entrypoint /bin/id gcr.io/datadoghq/cluster-agent:1.13.1
uid=0(root) gid=0(root) groups=0(root)

To fix that I'd need to set the securityContext.runAsUser property to the correct uid. If the image does need to run as root, I'd need to set securityContext.runAsNonRoot to false.

Another solution would be to update the cluster agent Docker image to use a numeric uid greater than 0 (i.e. non-root) as its USER. It needs to be numeric because usernames can resolve to uid 0, and kubelet explictly checks this.

from datadog-operator.