Switch to always run in hostPID namespace

It is no longer feasable to run kvisor with `hostPID: false`, as various
features depend on this (e.g. the translation for container related PIDs).
Hence the option to configure it via the helm chart has been removed.

Additionally, the mount of the hosts `/proc` directory has also been
dropped, as it is no longer required.

charts/kvisor/templates/agent.yaml

@@ -44,7 +44,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "kvisor.agent.serviceAccountName" . }}
-      hostPID: {{ .Values.agent.hostPID }}
+      hostPID: true
       hostNetwork: {{ .Values.agent.hostNetwork }}
       securityContext:
         {{- toYaml .Values.agent.podSecurityContext | nindent 8 }}
@@ -109,9 +109,6 @@ spec:
             failureThreshold: 12
             periodSeconds: 10
           volumeMounts:
-            - name: host-proc
-              mountPath: "/hostproc"
-              readOnly: true
             - name: cgroups
               mountPath: "/cgroups"
               readOnly: true
@@ -144,10 +141,6 @@ spec:
         - name: etc-os-release
           hostPath:
             path: /etc/os-release
-        - name: host-proc
-          hostPath:
-            path: /proc
-            type: Directory
         - name: debugfs
           hostPath:
             path: /sys/kernel/debug

charts/kvisor/values.yaml

@@ -50,7 +50,6 @@ agent:
     # If not set and create is true, a name is generated using the fullname template
     name: ""
 
-  hostPID: true
   hostNetwork: false
 
   updateStrategy:

cmd/agent/daemon/app/app.go

@@ -47,7 +47,6 @@ type Config struct {
 	IngestorAddr                      string
 	ContainerdSockPath                string
 	HostCgroupsDir                    string
-	HostProcDir                       string
 	TCPSampleOutputMinDurationSeconds int
 	HTTPListenPort                    int
 	State                             state.Config
@@ -225,7 +224,7 @@ func (a *App) Run(ctx context.Context) error {
 		return fmt.Errorf("apply policy: %w", err)
 	}
 
-	netStatsReader := netstats.NewReader(a.cfg.HostProcDir)
+	netStatsReader := netstats.NewReader(proc.Path)
 
 	nodeName, found := os.LookupEnv("NODE_NAME")
 	if !found {

cmd/agent/daemon/daemon.go

@@ -31,7 +31,6 @@ var (
 	eventsQueueSize              = pflag.Int("events-queue-size", 65536, "Events batch size")
 	httpListenPort               = pflag.Int("http-listen-port", 6061, "server listen port")
 	pyroscopeAddr                = pflag.String("pyroscope-addr", "", "Enable pyroscope tracing")
-	hostProcDir                  = pflag.String("host-proc-dir", "/hostproc", "Host /proc directory name mounted to container")
 	hostCgroupsDir               = pflag.String("host-cgroups", "/cgroups", "Host /sys/fs/cgroups directory name mounted to container")
 	containerStatsScrapeInterval = pflag.Duration("container-stats-scrape-interval", 60*time.Second, "Container resources scrape interval")
 
@@ -93,7 +92,6 @@ func NewCommand(version string) *cobra.Command {
 				IngestorAddr:                      *ingestorAddr,
 				ContainerdSockPath:                *containerdSockPath,
 				HostCgroupsDir:                    *hostCgroupsDir,
-				HostProcDir:                       *hostProcDir,
 				TCPSampleOutputMinDurationSeconds: *bpfTCPSampleSeconds,
 				HTTPListenPort:                    *httpListenPort,
 				State: state.Config{

pkg/proc/proc.go

@@ -12,6 +12,9 @@ import (
 	"github.com/samber/lo"
 )
 
+// Path to proc filesystem.
+const Path = "/proc"
+
 func GetFS() ProcFS {
 	// DirFS guarantees to return a fs.StatFS, fs.ReadFileFS and fs.ReadDirFS implementation, hence we can simply cast it here
 	return os.DirFS("/proc").(ProcFS)