OpenShift 3.3 using Privileged Pod

dd-agent.yaml.selector.sa

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: dd-agent
spec:
  selector:
    matchLabels:
      name: dd-agent
  template:
    metadata:
      labels:
        app: dd-agent
        name: dd-agent
      name: dd-agent
    spec:
      serviceAccount: dd
      nodeSelector:
        label: local
      containers:
      - image: datadog/agent:latest
        imagePullPolicy: Always
        name: dd-agent
        ports:
          - containerPort: 8125
            name: dogstatsdport
            protocol: UDP
        securityContext:
          privileged: true
        env:
          - name: DD_API_KEY
            value: <YOUR_API_KEY>
          - name: KUBERNETES
            value: "yes"
          # Uncomment this variable if the agent has issues reaching kubelet
          # - name: KUBERNETES_KUBELET_HOST
          #   valueFrom:
          #     fieldRef:
          #       fieldPath: status.hostIP  # Kubernetes >= 1.7
          #       # or
          #       # fieldPath: spec.nodeName  # Kubernetes < 1.7
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "250m"
        volumeMounts:
          - name: dockersocket
            mountPath: /var/run/docker.sock
          - name: procdir
            mountPath: /host/proc
            readOnly: true
          - name: cgroups
            mountPath: /host/sys/fs/cgroup
            readOnly: true
          - name: passwd
            mountPath: /etc/passwd
            readOnly: true
            #livenessProbe:
            # exec:
            #command:
            #- ./probe.sh
            #initialDelaySeconds: 15
            #periodSeconds: 5
      volumes:
        - hostPath:
            path: /var/run/docker.sock
          name: dockersocket
        - hostPath:
            path: /proc
          name: procdir
        - hostPath:
            path: /sys/fs/cgroup
          name: cgroups
        - hostPath:
            path: /etc/passwd
          name: passwd

Instructions

1. Follow these instructions to get a local dev environment setup. Note that the cli version needs to match the cluster version.

2. Bring a cluster up on Openshift 3.3 (there are other ways to do this):

   oc cluster up --image=registry.access.redhat.com/openshift3/ose --version=v3.3

3. Login as Admin:

   oc login -u system:admin

4. Label the node

   oc label node 192.168.65.2 label=local

5. Create a serviceaccount

   oc create serviceaccount dd

6. Add permissive policy to serviceaccount

   oc adm policy add-scc-to-user privileged system:serviceaccount:myproject:dd

7. Run Daemonset (as service account, with label selector, and as a privileged pod)

   oc create -f dd-agent.yaml.selector.sa