# helm_charts_system-probe-configmap.yaml
{{- if .Values.datadog.systemProbe.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "datadog.fullname" . }}-system-probe-config
  namespace: {{ $.Release.Namespace }}
  labels:
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    app.kubernetes.io/name: "{{ template "datadog.fullname" . }}"
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
data:
  system-probe.yaml: |
    system_probe_config:
      enabled: {{ $.Values.datadog.systemProbe.enabled }}
      debug_port:  {{ $.Values.datadog.systemProbe.debugPort }}
      sysprobe_socket: /var/run/sysprobe/sysprobe.sock
      enable_conntrack: {{ $.Values.datadog.systemProbe.enableConntrack }}
      bpf_debug: {{ $.Values.datadog.systemProbe.bpfDebug }}
      enable_tcp_queue_length: {{ $.Values.datadog.systemProbe.enableTCPQueueLength }}
      enable_oom_kill: {{ $.Values.datadog.systemProbe.enableOOMKill }}
      collect_dns_stats: {{ $.Values.datadog.systemProbe.collectDNSStats }}

{{- if eq .Values.datadog.systemProbe.seccomp "localhost/system-probe" }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "datadog.fullname" . }}-security
  namespace: {{ $.Release.Namespace }}
  labels:
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    app.kubernetes.io/name: "{{ template "datadog.fullname" . }}"
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
data:
  system-probe-seccomp.json: |
    {
      "defaultAction": "SCMP_ACT_ERRNO",
      "syscalls": [
        {
          "names": [
            "accept4",
            "access",
            "arch_prctl",
            "bind",
            "bpf",
            "brk",
            "capget",
            "capset",
            "chdir",
            "clock_gettime",
            "clone",
            "close",
            "connect",
            "copy_file_range",
            "creat",
            "dup",
            "dup2",
            "dup3",
            "epoll_create",
            "epoll_create1",
            "epoll_ctl",
            "epoll_ctl_old",
            "epoll_pwait",
            "epoll_wait",
            "epoll_wait",
            "epoll_wait_old",
            "execve",
            "execveat",
            "exit",
            "exit_group",
            "fchmod",
            "fchmodat",
            "fchown",
            "fchown32",
            "fchownat",
            "fcntl",
            "fcntl64",
            "fstat",
            "fstat64",
            "fstatfs",
            "fsync",
            "futex",
            "getcwd",
            "getdents",
            "getdents64",
            "getegid",
            "geteuid",
            "getgid",
            "getpeername",
            "getpid",
            "getppid",
            "getpriority",
            "getrandom",
            "getresgid",
            "getresgid32",
            "getresuid",
            "getresuid32",
            "getrlimit",
            "getrusage",
            "getsid",
            "getsockname",
            "getsockopt",
            "gettid",
            "gettimeofday",
            "getuid",
            "getxattr",
            "ioctl",
            "ipc",
            "listen",
            "lseek",
            "lstat",
            "lstat64",
            "madvise",
            "mkdir",
            "mkdirat",
            "mmap",
            "mmap2",
            "mprotect",
            "mremap",
            "munmap",
            "nanosleep",
            "newfstatat",
            "open",
            "openat",
            "pause",
            "perf_event_open",
            "pipe",
            "pipe2",
            "poll",
            "ppoll",
            "prctl",
            "pread64",
            "prlimit64",
            "pselect6",
            "read",
            "readlink",
            "readlinkat",
            "recvfrom",
            "recvmmsg",
            "recvmsg",
            "rename",
            "restart_syscall",
            "rmdir",
            "rt_sigaction",
            "rt_sigpending",
            "rt_sigprocmask",
            "rt_sigqueueinfo",
            "rt_sigreturn",
            "rt_sigsuspend",
            "rt_sigtimedwait",
            "rt_tgsigqueueinfo",
            "sched_getaffinity",
            "sched_yield",
            "seccomp",
            "select",
            "semtimedop",
            "send",
            "sendmmsg",
            "sendmsg",
            "sendto",
            "set_robust_list",
            "set_tid_address",
            "setgid",
            "setgid32",
            "setgroups",
            "setgroups32",
            "setns",
            "setrlimit",
            "setsid",
            "setsidaccept4",
            "setsockopt",
            "setuid",
            "setuid32",
            "sigaltstack",
            "socket",
            "socketcall",
            "socketpair",
            "stat",
            "stat64",
            "statfs",
            "sysinfo",
            "umask",
            "uname",
            "unlink",
            "unlinkat",
            "wait4",
            "waitid",
            "waitpid",
            "write"
          ],
          "action": "SCMP_ACT_ALLOW",
          "args": null
        },
        {
          "names": [
            "setns"
          ],
          "action": "SCMP_ACT_ALLOW",
          "args": [
            {
              "index": 1,
              "value": 1073741824,
              "valueTwo": 0,
              "op": "SCMP_CMP_EQ"
            }
          ],
          "comment": "",
          "includes": {},
          "excludes": {}
        }
      ]
    }
{{- end }}
{{- end }}