Removing privileged flag on the node-agent Pod

[slashben]

PR Type:

Refactoring

---

PR Description:

This PR removes the privileged: true flag from the node-agent pod and adds specific capabilities to the security context of the pod. It also adds an annotation to allow the node-agent to run on kernels with AppArmor. The changes are based on similar modifications in the Inspektor Gadget project and have been tested on Ubuntu (minikube) and GCP with Linux 5.15.

---

PR Main Files Walkthrough:

files:

charts/kubescape-operator/templates/node-agent/daemonset.yaml: Removed the privileged: true flag from the security context of the node-agent pod and added specific capabilities. Also added an annotation to allow the node-agent to run on kernels with AppArmor.
charts/kubescape-operator/values.yaml: No significant changes, just a minor formatting adjustment.

---

User Description:

Overview

As per popular request I am removing the privileged: true flag on the node-agent.

It is based on this PR and this commit in inspektor gadget.

It was tested on Ubuntu (minikube) and GCP with Linux 5.15

[codiumai-pr-agent-free]

PR Analysis

• 🎯 Main theme: Removing privileged flag on the node-agent Pod
• 📝 PR summary: This PR removes the privileged: true flag from the node-agent pod and adds specific capabilities to the security context of the pod. It also adds an annotation to allow the node-agent to run on kernels with AppArmor. The changes are based on similar modifications in the Inspektor Gadget project.
• 📌 Type of PR: Refactoring
• 🧪 Relevant tests added: No
• ⏱️ Estimated effort to review [1-5]: 2, because the PR is straightforward and only involves changes to the security context of the node-agent pod.
• 🔒 Security concerns: No security concerns found

PR Feedback

• 💡 General suggestions: The PR looks good overall. The removal of the privileged: true flag and the addition of specific capabilities is a good move towards least privilege. However, it would be beneficial to add tests to ensure that the node-agent pod functions as expected with these changes.

• 🤖 Code feedback:

  • relevant file: charts/kubescape-operator/templates/node-agent/daemonset.yaml
    suggestion: Consider adding a comment explaining why these specific capabilities are needed for the node-agent pod. This will help future developers understand the security requirements of the pod. [medium]
    relevant line: - SYS_ADMIN

How to use

To invoke the PR-Agent, add a comment using one of the following commands:
/review [-i]: Request a review of your Pull Request. For an incremental review, which only considers changes since the last review, include the '-i' option.
/describe: Modify the PR title and description based on the contents of the PR.
/improve [--extended]: Suggest improvements to the code in the PR. Extended mode employs several calls, and provides a more thorough feedback.
/ask <QUESTION>: Pose a question about the PR.
/update_changelog: Update the changelog based on the PR's contents.

To edit any configuration parameter from configuration.toml, add --config_path=new_value
For example: /review --pr_reviewer.extra_instructions="focus on the file: ..."
To list the possible configuration parameters, use the /config command.