fix: remove unnecessary code from charts

Author: Torkel Hoge

install/helm/Chart.yaml

@@ -77,7 +77,7 @@ dependencies:
     tags: [cs-lib]
 
 annotations:
-  runtime-monitor.tetragon: quay.io/cilium/tetragon:v1.5.0
+  runtime-monitor.tetragon: quay.io/cilium/tetragon:v1.7.0
   postgresql: postgres:17.5
   postgresql.metrics: quay.io/prometheuscommunity/postgres-exporter:v0.17.1
   redis: redis:8.0.2

runtime-monitor/.helm/templates/_container_tetragon.tpl

@@ -1,7 +1,7 @@
 {{- define "container.tetragon" -}}
 - name: {{ include "container.tetragon.name" . }}
   securityContext:
-    {{- toYaml .Values.tetragon.containerSecurityContext | nindent 4 }}
+    {{- toYaml .Values.tetragon.securityContext | nindent 4 }}
   image: {{ include "common.cs.image" (dict "context" . "image" .Values.tetragon.image) }}
   imagePullPolicy: {{ .Values.image.pullPolicy }}
   terminationMessagePolicy: FallbackToLogsOnError
@@ -34,8 +34,6 @@
       name: bpf-maps
     - mountPath: "/var/run/cilium"
       name: cilium-run
-    - mountPath: "/var/run/tetragon"
-      name: tetragon-run
     - mountPath: {{ .Values.exportDirectory }}
       name: export-logs
     - mountPath: "/procRoot"
@@ -60,7 +58,6 @@
       mountPath: {{ .mountPath }}
       readOnly: {{ .readOnly }}
 {{- end }}
-    {{- include "tetragon.volumemounts.extra" . | nindent 4 }}
   env:
     - name: NODE_NAME
       valueFrom:

runtime-monitor/.helm/templates/_extensions.tpl

@@ -1,67 +1,17 @@
 {{/*
-Resources names
+Create chart name and version as used by the chart label.
 */}}
-{{- define "tetragon.name" -}}
-{{- default .Release.Name .Values.tetragon.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- define "tetragon.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{- define "tetragon.configMapName" -}}
-{{- printf "%s-config" (include "tetragon.name" .) | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "tetragon.clusterRole" -}}
-{{- include "tetragon.name" . }}
-{{- end }}
-
-{{- define "tetragon.role" -}}
-{{- include "tetragon.name" . }}
-{{- end }}
-
-{{- define "tetragon-operator.name" -}}
-{{- default (printf "%s-operator" .Release.Name) .Values.tetragonOperator.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "tetragon-operator.clusterRole" -}}
-{{- include "tetragon-operator.name" . }}
-{{- end }}
-
-{{- define "tetragon-operator.roleBindingName" -}}
-{{- printf "%s-rolebinding" (include "tetragon-operator.name" .) | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "tetragon-operator.configMapName" -}}
-{{- printf "%s-config" (include "tetragon-operator.name" .) | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "tetragon-rthooks.name" -}}
-{{- default (printf "%s-rthooks" .Release.Name) .Values.rthooks.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-
 {{/*
 Common labels
 */}}
-{{- define "commonLabels" -}}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/part-of: {{ .Chart.Name }}
-{{- end }}
-
 {{- define "tetragon.labels" -}}
+helm.sh/chart: {{ include "tetragon.chart" . }}
 {{ include "tetragon.selectorLabels" . }}
-{{ include "commonLabels" . }}
-app.kubernetes.io/component: agent
-{{- end }}
-{{- define "tetragon-operator.labels" -}}
-{{ include "tetragon-operator.selectorLabels" . }}
-{{ include "commonLabels" . }}
-app.kubernetes.io/component: operator
-{{- end }}
-{{- define "tetragon-rthooks.labels" -}}
-{{ include "tetragon-rthooks.selectorLabels" . }}
-{{ include "commonLabels" . }}
-app.kubernetes.io/component: rthooks
+app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 
 {{/*
@@ -71,72 +21,15 @@ Selector labels
 app.kubernetes.io/name: {{ .Chart.Name }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
-{{- define "tetragon-operator.selectorLabels" -}}
-app.kubernetes.io/name: "tetragon-operator"
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-{{- define "tetragon-rthooks.selectorLabels" -}}
-app.kubernetes.io/name: "tetragon-rthooks"
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{- define "container.export.stdout.name" -}}
-{{- print "export-stdout" -}}
-{{- end }}
 
 {{- define "container.tetragon.name" -}}
 {{- print "tetragon" -}}
 {{- end }}
 
-{{/*
-ServiceAccounts
-*/}}
-{{- define "tetragon.serviceAccount" -}}
-{{- if .Values.serviceAccount.name -}}
-{{- printf "%s" .Values.serviceAccount.name -}}
-{{- else -}}
-{{- include "tetragon.name" . -}}
-{{- end -}}
-{{- end }}
-
-{{- define "tetragon-operator.serviceAccount" -}}
-{{- if .Values.tetragonOperator.serviceAccount.name -}}
-{{- printf  "%s" .Values.tetragonOperator.serviceAccount.name -}}
-{{- else -}}
-{{- printf  "%s-service-account" (include "tetragon-operator.name" .) -}}
-{{- end -}}
-{{- end }}
-
 {{- define "container.tetragonOCIHookSetup.installPath" -}}
 {{- print "/hostInstall" -}}
 {{- end }}
 
 {{- define "container.tetragonOCIHookSetup.hooksPath" -}}
 {{- print "/hostHooks" -}}
 {{- end }}
-
-{{/*
-Runtime-hooks
-*/}}
-
-{{- define "rthooksInterface" -}}
-{{ $iface := .Values.rthooks.interface }}
-{{- if (eq $iface "oci-hooks") -}}
-	oci-hooks
-{{- else if (eq $iface "nri-hook") -}}
-	nri-hook
-{{- else -}}
-{{- end -}}
-{{- end }}
-
-{{/*
-rthooks affinity: when rthooks.affinity is explicitly set (including {}),
-use it as-is. Otherwise fall back to the top-level .Values.affinity.
-*/}}
-{{- define "tetragon-rthooks.affinity" -}}
-{{- if hasKey .Values.rthooks "affinity" -}}
-{{- toYaml .Values.rthooks.affinity -}}
-{{- else -}}
-{{- toYaml .Values.affinity -}}
-{{- end -}}
-{{- end }}

runtime-monitor/.helm/templates/_helpers.tpl

@@ -37,5 +37,4 @@ rules:
       - get
       - list
       - watch
-  {{- include "clusterrole.extra" . | nindent 2 }}
 {{- end }}

runtime-monitor/.helm/templates/clusterrole.yaml

@@ -24,18 +24,13 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "common.serviceAccountName" . }}
-      {{- with .Values.podSecurityContext }}
+      {{- if (.Values.podSecurityContext).enabled }}
       securityContext:
-        {{- toYaml . | nindent 8 }}
+        {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
-      initContainers:
-      {{- include "initcontainers.extra" . | nindent 6 }}
       containers:
         {{- include "common.cs.container.app" . | nindent 8 -}}
         {{- include "container.tetragon" . | nindent 8 -}}
-        {{- if eq (include "common.cs.logger.enabled" .) "true" -}}
-        {{- include "common.cs.container.logger" . | nindent 8 -}}
-        {{- end -}}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -56,10 +51,6 @@ spec:
         hostPath:
           path: /var/run/cilium
           type: DirectoryOrCreate
-      - name: tetragon-run
-        hostPath:
-          path: /var/run/tetragon
-          type: DirectoryOrCreate
       - name: export-logs
         hostPath:
           path: {{ .Values.exportDirectory }}

runtime-monitor/.helm/templates/daemonset.yaml

@@ -17,7 +17,7 @@ data:
   debug: {{ .Values.tetragon.debug | quote }}
   enable-process-cred: {{ .Values.tetragon.enableProcessCred | quote }}
   enable-process-ns: {{ .Values.tetragon.enableProcessNs | quote }}
-  enable-ancestors: {{ .Values.tetragon.processAncestors.enabled | quote }}
+  enable-ancestors: {{ .Values.tetragon.processAncestors.enabled }}
   process-cache-size: {{ .Values.tetragon.processCacheSize | quote }}
 {{- if .Values.tetragon.exportFilename }}
   export-filename: {{ .Values.exportDirectory}}/{{ .Values.tetragon.exportFilename }}
@@ -79,7 +79,6 @@ data:
 {{- end }}
   event-cache-retries: {{ .Values.tetragon.eventCacheRetries | quote }}
   event-cache-retry-delay: {{ .Values.tetragon.eventCacheRetryDelay | quote }}
-  {{- include "configmap.extra" . | nindent 2 }}
 {{- if .Values.tetragon.enableKeepSensorsOnExit }}
   keep-sensors-on-exit: "true"
   release-pinned-bpf: "false"
@@ -91,4 +90,3 @@ data:
 {{- end }}
   enable-cgidmap: {{ .Values.tetragon.cgidmap.enabled | quote }}
   enable-pod-annotations: {{ .Values.tetragon.podAnnotations.enabled | default "false" | quote }}
-  use-perf-ring-buffer: {{ .Values.tetragon.usePerfRingBuffer | default "false" | quote }}