[SBOM] Use container runtime snapshotter by default on EKS and GKE

charts/datadog/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Datadog changelog
 
+## 3.75.1
+
+* Use container runtime snapshotter by default on EKS and GKE.
+
 ## 3.75.0
 
 * Set default `Agent` and `Cluster-Agent` version to `7.58.0`.

charts/datadog/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: datadog
-version: 3.75.0
+version: 3.75.1
 appVersion: "7"
 description: Datadog Agent
 keywords:

charts/datadog/README.md

@@ -1,6 +1,6 @@
 # Datadog
 
-![Version: 3.75.0](https://img.shields.io/badge/Version-3.75.0-informational?style=flat-square) ![AppVersion: 7](https://img.shields.io/badge/AppVersion-7-informational?style=flat-square)
+![Version: 3.75.1](https://img.shields.io/badge/Version-3.75.1-informational?style=flat-square) ![AppVersion: 7](https://img.shields.io/badge/AppVersion-7-informational?style=flat-square)
 
 [Datadog](https://www.datadoghq.com/) is a hosted infrastructure monitoring platform. This chart adds the Datadog Agent to all nodes in your cluster via a DaemonSet. It also optionally depends on the [kube-state-metrics chart](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-state-metrics). For more information about monitoring Kubernetes with Datadog, please refer to the [Datadog documentation website](https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/).
 

charts/datadog/templates/_container-agent.yaml

@@ -3,7 +3,7 @@
   image: "{{ include "image-path" (dict "root" .Values "image" .Values.agents.image) }}"
   imagePullPolicy: {{ .Values.agents.image.pullPolicy }}
   command: ["agent", "run"]
-{{ include "generate-security-context" (dict "securityContext" .Values.agents.containers.agent.securityContext "targetSystem" .Values.targetSystem "seccomp" "" "kubeversion" .Capabilities.KubeVersion.Version "sysAdmin" .Values.datadog.sbom.containerImage.uncompressedLayersSupport) | indent 2 }}
+{{ include "generate-security-context" (dict "securityContext" .Values.agents.containers.agent.securityContext "targetSystem" .Values.targetSystem "seccomp" "" "kubeversion" .Capabilities.KubeVersion.Version "sysAdmin" (and (eq (include "should-support-discard-uncompressed-layers" .) "true") (not .Values.datadog.sbom.containerImage.overlayFSDirectScan))) | indent 2 }}
   resources:
 {{ toYaml .Values.agents.containers.agent.resources | indent 4 }}
   ports:
@@ -177,11 +177,10 @@
     - name: DD_SBOM_CONTAINER_IMAGE_ENABLED
       value: "true"
     {{- end }}
-    {{- if .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
+    {{- if eq (include "should-support-discard-uncompressed-layers" .) "true" }}
     - name: DD_SBOM_CONTAINER_IMAGE_USE_MOUNT
       value: "true"
     {{- end }}
-
     {{- if .Values.datadog.sbom.host.enabled }}
     - name: DD_SBOM_HOST_ENABLED
       value: "true"
@@ -276,7 +275,7 @@
       readOnly: true
     {{- end }}
     {{- end }}
-    {{- if .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
+    {{- if eq (include "should-support-discard-uncompressed-layers" .) "true" }}
     - name: host-containerd-dir
       mountPath: /host/var/lib/containerd
       readOnly: true

charts/datadog/templates/_daemonset-volumes-linux.yaml

@@ -147,7 +147,7 @@
     path: /
   name: hostroot
 {{- end }}
-{{- if .Values.datadog.sbom.containerImage.uncompressedLayersSupport }}
+{{- if (eq (include "should-support-discard-uncompressed-layers" .) "true") }}
 - hostPath:
     path: /var/lib/containerd
   name: host-containerd-dir

charts/datadog/templates/_helpers.tpl

@@ -930,6 +930,20 @@ Create RBACs for custom resources
   {{- end -}}
 {{- end -}}
 
+{{/*
+  Return true if container runtime is known to discard uncompressed layers
+*/}}
+{{- define "should-support-discard-uncompressed-layers" -}}
+  {{- if or .Values.datadog.sbom.containerImage.uncompressedLayersSupport .Values.datadog.sbom.containerImage.overlayFSDirectScan (and .Values.datadog.sbom.containerImage.enabled (or (contains "-gke." .Capabilities.KubeVersion.GitVersion) (contains "-eks-" .Capabilities.KubeVersion.GitVersion))) -}}
+    {{- if not (eq (include "should-enable-container-image-collection" .) "true") -}}
+      {{- fail "Container runtime support has to be enabled for SBOM collection to work. Please enable it using `datadog.containerRuntimeSupport.enabled`." -}}
+    {{- end -}}
+    true
+  {{- else -}}
+    false
+  {{- end -}}
+{{- end -}}
+
 {{/*
   Return true if language detection feature is enabled
 */}}