Add host volume mounts and NET_RAW capability to PAR container by matt-dz · Pull Request #2799 · DataDog/datadog-operator

matt-dz · 2026-03-23T18:08:46Z

Summary

Mount /var/log, /etc/os-release, and /proc from the host into the Private Action Runner container under /host as read-only volumes
Add NET_RAW capability to the PAR container SecurityContext for network operations
All volumes, mounts, and capabilities are managed via the PAR feature's ManageNodeAgent(), following the established feature pattern
Host volume constants are scoped to the PAR package as unexported values

Test plan

TestVolumesForAgent — verifies base agent volumes are unchanged (no PAR leakage)
TestPrivateActionRunnerContainer — verifies default container definition
Test_privateActionRunnerFeature_ManageNodeAgent — verifies host volumes, mounts (read-only), and NET_RAW capability are added via feature managers

🤖 Generated with Claude Code

Mount /var/log, /etc/os-release, and /proc from the host into the PAR container under /host as read-only volumes. This enables the PAR to inspect host-level logs, OS information, and process data. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1d03dfaee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

internal/controller/datadogagent/component/agent/default.go

Move host-varlog and host-osrelease volumes from the base volumesForAgent list into a conditional block gated on PrivateActionRunnerContainerName, mirroring the existing SystemProbe pattern. This prevents unused HostPath volumes from being added to every Agent pod, which can cause admission failures in environments enforcing HostPath allowlists. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.

matt-dz · 2026-03-24T14:17:56Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector · 2026-03-24T14:28:33Z

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

The Private Action Runner container needs the NET_RAW capability to perform network operations on the host. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tbavelier

I ddin't review in depth but that's not the right approach. It should be done as part of the feature code (feature/par), e.g. you can see how it's done for logcollection feature and other features. They should be responsible to manage the volume and mounts

Volumes, mounts, and capabilities should be managed by the feature system, not hardcoded in component defaults. This moves host volume mounts (/proc, /etc/os-release, /var/log) and the NET_RAW capability from default.go into the PAR feature's ManageNodeAgent(), following the same pattern used by logcollection, npm, and other features. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The SystemProbeOSReleaseDirVolumeName constants are semantically tied to system-probe despite being general-purpose. Add generic aliases (HostOSReleaseVolumeName, HostOSReleaseHostPath, HostOSReleaseMountPath) and use them in PAR feature code and volume helpers so that privateactionrunner does not reference system-probe constants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Define HostOSRelease constants with their own literal values instead of aliasing the SystemProbe variants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Host volume constants (varlog, os-release, proc) are only used by the PAR feature, so they belong in the PAR package as unexported constants. Remove the now-unused GetVolumeForHostVarLog, GetVolumeMountForHostVarLog, GetVolumeForOSRelease, GetVolumeMountForOSRelease helpers and their corresponding exported constants from common. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

matt-dz · 2026-03-24T16:18:56Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector · 2026-03-24T16:29:22Z

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codecov-commenter · 2026-03-25T09:05:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.73%. Comparing base (e0fbfce) to head (5049ab9).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2799      +/-   ##
==========================================
+ Coverage   38.69%   38.73%   +0.04%     
==========================================
  Files         311      311              
  Lines       26971    27017      +46     
==========================================
+ Hits        10437    10466      +29     
- Misses      15756    15773      +17     
  Partials      778      778

Flag	Coverage Δ
unittests	`38.73% <100.00%> (+0.04%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...atadogagent/feature/privateactionrunner/feature.go	`74.86% <100.00%> (+1.92%)`	⬆️

... and 1 file with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e0fbfce...5049ab9. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tbavelier

Apart from the comments, lgtm

internal/controller/datadogagent/feature/privateactionrunner/const.go

internal/controller/datadogagent/feature/privateactionrunner/feature.go

The procdir and os-release volume constants already exist in common/const.go. Remove the duplicates from PAR's const.go and reference the common ones directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace loop-based volume addition with individual volume.GetVolumes() calls per volume, matching the pattern used by npm and other features for better readability. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

matt-dz · 2026-03-25T14:01:16Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-03-25T14:01:20Z

View all feedbacks in Devflow UI.

2026-03-25 14:01:20 UTC ℹ️ Start processing command /merge

2026-03-25 14:01:24 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 2h (p90).

2026-03-25 15:25:03 UTC ℹ️ MergeQueue: This merge request was already merged

This pull request was merged directly.

* Add host volume mounts to Private Action Runner container Mount /var/log, /etc/os-release, and /proc from the host into the PAR container under /host as read-only volumes. This enables the PAR to inspect host-level logs, OS information, and process data. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add PAR host volumes only when PAR container is required Move host-varlog and host-osrelease volumes from the base volumesForAgent list into a conditional block gated on PrivateActionRunnerContainerName, mirroring the existing SystemProbe pattern. This prevents unused HostPath volumes from being added to every Agent pod, which can cause admission failures in environments enforcing HostPath allowlists. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * style: format files * Add NET_RAW capability to PAR container The Private Action Runner container needs the NET_RAW capability to perform network operations on the host. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Move PAR host volumes, mounts, and NET_RAW to feature code Volumes, mounts, and capabilities should be managed by the feature system, not hardcoded in component defaults. This moves host volume mounts (/proc, /etc/os-release, /var/log) and the NET_RAW capability from default.go into the PAR feature's ManageNodeAgent(), following the same pattern used by logcollection, npm, and other features. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add generic HostOSRelease aliases for os-release volume constants The SystemProbeOSReleaseDirVolumeName constants are semantically tied to system-probe despite being general-purpose. Add generic aliases (HostOSReleaseVolumeName, HostOSReleaseHostPath, HostOSReleaseMountPath) and use them in PAR feature code and volume helpers so that privateactionrunner does not reference system-probe constants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use standalone values for HostOSRelease constants Define HostOSRelease constants with their own literal values instead of aliasing the SystemProbe variants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Move host volume constants to PAR package, remove unused common helpers Host volume constants (varlog, os-release, proc) are only used by the PAR feature, so they belong in the PAR package as unexported constants. Remove the now-unused GetVolumeForHostVarLog, GetVolumeMountForHostVarLog, GetVolumeForOSRelease, GetVolumeMountForOSRelease helpers and their corresponding exported constants from common. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * revert const.go * Reuse existing common constants for procdir and os-release volumes The procdir and os-release volume constants already exist in common/const.go. Remove the duplicates from PAR's const.go and reference the common ones directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add host volumes individually instead of loop Replace loop-based volume addition with individual volume.GetVolumes() calls per volume, matching the pattern used by npm and other features for better readability. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Timothée Bavelier <97530782+tbavelier@users.noreply.github.com> (cherry picked from commit 8c060c4)

#2828) * Add host volume mounts to Private Action Runner container Mount /var/log, /etc/os-release, and /proc from the host into the PAR container under /host as read-only volumes. This enables the PAR to inspect host-level logs, OS information, and process data. * Add PAR host volumes only when PAR container is required Move host-varlog and host-osrelease volumes from the base volumesForAgent list into a conditional block gated on PrivateActionRunnerContainerName, mirroring the existing SystemProbe pattern. This prevents unused HostPath volumes from being added to every Agent pod, which can cause admission failures in environments enforcing HostPath allowlists. * style: format files * Add NET_RAW capability to PAR container The Private Action Runner container needs the NET_RAW capability to perform network operations on the host. * Move PAR host volumes, mounts, and NET_RAW to feature code Volumes, mounts, and capabilities should be managed by the feature system, not hardcoded in component defaults. This moves host volume mounts (/proc, /etc/os-release, /var/log) and the NET_RAW capability from default.go into the PAR feature's ManageNodeAgent(), following the same pattern used by logcollection, npm, and other features. * Add generic HostOSRelease aliases for os-release volume constants The SystemProbeOSReleaseDirVolumeName constants are semantically tied to system-probe despite being general-purpose. Add generic aliases (HostOSReleaseVolumeName, HostOSReleaseHostPath, HostOSReleaseMountPath) and use them in PAR feature code and volume helpers so that privateactionrunner does not reference system-probe constants. * Use standalone values for HostOSRelease constants Define HostOSRelease constants with their own literal values instead of aliasing the SystemProbe variants. * Move host volume constants to PAR package, remove unused common helpers Host volume constants (varlog, os-release, proc) are only used by the PAR feature, so they belong in the PAR package as unexported constants. Remove the now-unused GetVolumeForHostVarLog, GetVolumeMountForHostVarLog, GetVolumeForOSRelease, GetVolumeMountForOSRelease helpers and their corresponding exported constants from common. * revert const.go * Reuse existing common constants for procdir and os-release volumes The procdir and os-release volume constants already exist in common/const.go. Remove the duplicates from PAR's const.go and reference the common ones directly. * Add host volumes individually instead of loop Replace loop-based volume addition with individual volume.GetVolumes() calls per volume, matching the pattern used by npm and other features for better readability. --------- (cherry picked from commit 8c060c4) Co-authored-by: Matthew DeGuzman <91019033+matt-dz@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Timothée Bavelier <97530782+tbavelier@users.noreply.github.com> Co-authored-by: levan-m <116471169+levan-m@users.noreply.github.com>

matt-dz added the refactoring label Mar 23, 2026

matt-dz marked this pull request as ready for review March 24, 2026 13:23

matt-dz requested a review from a team March 24, 2026 13:23

matt-dz changed the title ~~Add host volume mounts to PAR container~~ Add host volume mounts to private action runner Mar 24, 2026

AlexandreYang previously approved these changes Mar 24, 2026

View reviewed changes

chatgpt-codex-connector bot reviewed Mar 24, 2026

View reviewed changes

internal/controller/datadogagent/component/agent/default.go Outdated Show resolved Hide resolved

matt-dz marked this pull request as draft March 24, 2026 14:04

matt-dz marked this pull request as ready for review March 24, 2026 14:30

matt-dz requested a review from AlexandreYang March 24, 2026 14:30

matt-dz and others added 2 commits March 24, 2026 10:39

style: format files

d713889

Add NET_RAW capability to PAR container

0dd21ec

The Private Action Runner container needs the NET_RAW capability to perform network operations on the host. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

matt-dz changed the title ~~Add host volume mounts to private action runner~~ Add host volume mounts and NET_RAW capability to PAR container Mar 24, 2026

tbavelier requested changes Mar 24, 2026

View reviewed changes

matt-dz requested a review from a team as a code owner March 24, 2026 16:00

matt-dz requested a review from Madhu-TV March 24, 2026 16:00

matt-dz and others added 4 commits March 24, 2026 12:06

Use standalone values for HostOSRelease constants

3efe470

Define HostOSRelease constants with their own literal values instead of aliasing the SystemProbe variants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

revert const.go

56418b5

matt-dz requested a review from tbavelier March 24, 2026 16:17

merchristK approved these changes Mar 24, 2026

View reviewed changes

Merge branch 'main' into matt-dz/add-par-mounts

4bfe7ac

github-actions bot added the team/action-platform label Mar 25, 2026

tbavelier added this to the v1.26.0 milestone Mar 25, 2026

tbavelier requested changes Mar 25, 2026

View reviewed changes

matt-dz and others added 2 commits March 25, 2026 09:10

Add host volumes individually instead of loop

5049ab9

Replace loop-based volume addition with individual volume.GetVolumes() calls per volume, matching the pattern used by npm and other features for better readability. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

matt-dz requested a review from tbavelier March 25, 2026 13:14

tbavelier approved these changes Mar 25, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: queued labels Mar 25, 2026

levan-m merged commit 8c060c4 into main Mar 25, 2026
38 checks passed

levan-m deleted the matt-dz/add-par-mounts branch March 25, 2026 15:24

levan-m modified the milestones: v1.26.0, v1.25.0 Mar 25, 2026

gh-worker-dd-devflow-36fce6 bot added mergequeue-status: done and removed mergequeue-status: in_progress labels Mar 25, 2026

levan-m added the backport/v1.25 label Mar 25, 2026

dd-octo-sts bot mentioned this pull request Mar 25, 2026

[Backport v1.25] Add host volume mounts and NET_RAW capability to PAR container #2828

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add host volume mounts and NET_RAW capability to PAR container#2799

Add host volume mounts and NET_RAW capability to PAR container#2799
levan-m merged 12 commits intomainfrom
matt-dz/add-par-mounts

matt-dz commented Mar 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

matt-dz commented Mar 24, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 24, 2026

Uh oh!

tbavelier left a comment

Uh oh!

matt-dz commented Mar 24, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 24, 2026

Uh oh!

codecov-commenter commented Mar 25, 2026 •

edited

Loading

Uh oh!

tbavelier left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matt-dz commented Mar 25, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

matt-dz commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

matt-dz commented Mar 24, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 24, 2026

Uh oh!

tbavelier left a comment

Choose a reason for hiding this comment

Uh oh!

matt-dz commented Mar 24, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 24, 2026

Uh oh!

codecov-commenter commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tbavelier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matt-dz commented Mar 25, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

matt-dz commented Mar 23, 2026 •

edited

Loading

codecov-commenter commented Mar 25, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Mar 25, 2026 •

edited

Loading