Adjust elastic-agent roles to recommendations

elastic · Nov 11, 2024 · d748b58 · d748b58
1 parent ee0de26
commit d748b58
Show file tree

Hide file tree

Showing 4 changed files with 115 additions and 53 deletions.
diff --git a/config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml b/config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml
@@ -271,6 +271,7 @@ rules:
   - statefulsets
   - deployments
   - replicasets
+  - daemonsets
   verbs:
   - "get"
   - "list"
@@ -281,10 +282,23 @@ rules:
   - nodes/stats
   verbs:
   - get
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
 - apiGroups:
   - "batch"
   resources:
   - jobs
+  - cronjobs
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - "storage.k8s.io"
+  resources:
+  - storageclasses
   verbs:
   - "get"
   - "list"

diff --git a/config/recipes/elastic-agent/fleet-kubernetes-integration.yaml b/config/recipes/elastic-agent/fleet-kubernetes-integration.yaml
@@ -201,6 +201,7 @@ rules:
   - statefulsets
   - deployments
   - replicasets
+  - daemonsets
   verbs:
   - "get"
   - "list"
@@ -211,10 +212,23 @@ rules:
   - nodes/stats
   verbs:
   - get
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
 - apiGroups:
   - "batch"
   resources:
   - jobs
+  - cronjobs
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - "storage.k8s.io"
+  resources:
+  - storageclasses
   verbs:
   - "get"
   - "list"

diff --git a/config/recipes/elastic-agent/kubernetes-integration.yaml b/config/recipes/elastic-agent/kubernetes-integration.yaml
@@ -161,13 +161,33 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - "apps"
+  resources:
+  - statefulsets
+  - deployments
+  - replicasets
+  - daemonsets
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
 - apiGroups: ["batch"]
   resources:
   - jobs
+  - cronjobs
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - "storage.k8s.io"
+  resources:
+  - storageclasses
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
 ---
 apiVersion: v1
 kind: ServiceAccount

diff --git a/deploy/eck-stack/charts/eck-agent/values.yaml b/deploy/eck-stack/charts/eck-agent/values.yaml
@@ -127,57 +127,71 @@ clusterRoleBinding:
 clusterRole:
   name: elastic-agent
   rules:
-  - apiGroups: [""]
-    resources:
-    - pods
-    - nodes
-    - namespaces
-    - events
-    - services
-    - configmaps
-    verbs:
-    - get
-    - watch
-    - list
-  - apiGroups: ["coordination.k8s.io"]
-    resources:
-    - leases
-    verbs:
-    - get
-    - create
-    - update
-  - nonResourceURLs:
-    - "/metrics"
-    verbs:
-    - get
-  - apiGroups: ["extensions"]
-    resources:
-      - replicasets
-    verbs: 
-    - "get"
-    - "list"
-    - "watch"
-  - apiGroups:
-    - "apps"
-    resources:
-    - statefulsets
-    - deployments
+ - apiGroups: [""]
+  resources:
+  - pods
+  - nodes
+  - namespaces
+  - events
+  - services
+  - configmaps
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups: ["coordination.k8s.io"]
+  resources:
+  - leases
+  verbs:
+  - get
+  - create
+  - update
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
+- apiGroups: ["extensions"]
+  resources:
     - replicasets
-    verbs:
-    - "get"
-    - "list"
-    - "watch"
-  - apiGroups:
-    - ""
-    resources:
-    - nodes/stats
-    verbs:
-    - get
-  - apiGroups:
-    - "batch"
-    resources:
-    - jobs
-    verbs:
-    - "get"
-    - "list"
-    - "watch"
+  verbs: 
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - "apps"
+  resources:
+  - statefulsets
+  - deployments
+  - replicasets
+  - daemonsets
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - ""
+  resources:
+  - nodes/stats
+  verbs:
+  - get
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
+- apiGroups:
+  - "batch"
+  resources:
+  - jobs
+  - cronjobs
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:  
+  - "storage.k8s.io" 
+  resources:
+  - storageclasses
+  verbs:  
+  - "get"
+  - "list"
+  - "watch"