Release Notes - Helm
Updates to the Gremlin Helm chart.
-
New Permissions for
discovery.k8s.io/EndpointSlice: list, watch are now added to the Gremlin DaemonSet's ClusterRole when the chart value gremlin.features.discoverDestinationService.enabled=true is set. This enables automatic discovery of IP addresses for Istio/Envoy sidecar users via Linux Agent release 2.59.0
-
Fix Fixed two Secret objects that did not declare their namespace, leading to install issues when following installation documentation.
-
Fix Fix upgrade issue from `0.21.0` to `0.22.0` due to a ClusterRole rename.
-
New Added a flag
gremlin.features.discoverDestinationService.enabled to enable discovery of a destination service to resolve hostnames in a cluster configured with linkerd. This flag will allow gremlin to read the services within a cluster.
-
New The pod dns policy for the
gremlind Daemonset can now be configured with gremlin.dnsPolicy. This chart now installs this Daemonset with a dns policy of ClusterFirstWithHostNet.
-
FixFixed a regression released in 0.19.1 that failed to declare the
emptyDir volume type for the Gremlin DaemonSet's SecurityContextConstraints, preventing DaemonSet pods from launching.
-
FixFixed a regression released in 0.20.0 that improperly handled
gremlin.container.driver=any
- NewRemoved Runc container drivers from options. Will default to Linux drivers now.
- InfoAdded extra documentation for Bottlerocket.
- NewAdded configuration for accessing Argo Rollouts.
- NewAdded configuration for Chao namespaces to monitor.
- NewRemoved process collection setting, as this feature has been removed from the newer agent versions.
- Fix
gremlin.podSecurity.privileged is now properly used to set securityContext.privileged in the Gremlin Daemonset.
- NewThe Gremlin Daemonset now launches in the host's network and PID namespaces by default, allowing container attacks of all types and host-level network and state attack types to function as expected.
- NewRemoval of
/proc/sysrq host mount which previously facilitated host-level shutdown attacks. This is no longer needed with the Gremlin Daemonset running in the host's PID namespace.
- FixWhen installing Gremlin's SecurityContextConstraint on OpenShift, ensure the
openshift.io/required-scc is properly set.
- NewAdd a cluster role binding to grant permissions to read labels on Kubernetes nodes
- Fix Removed invalid fields from the SecurityContextConstraint installed when deploying to OpenShift
- Fix Removed references to the gremlin.process SELinux label, which cannot be used on OpenShift. See the OpenShift installation guide for more information.
- Fix Set the Gremlin daemonset's allowPrivilegeEscalation field based on the value set in values.yaml
- New introduced new options for
gremlin.container.driver value: linux, docker-linux, containerd-linux, crio-linux. These values are used to initialize a new container driver that does not need runc to deploy container attacks. These drivers provision attacks faster and with fewer system resources. See Declare Container Driver for more information. The new default value is linux.
- InfoEnabled DNS collection by default and disabled process collection by default.
- FixCorrectly reference cert paths when
gremlin.secret.managed=false.
- FixFixed a bug where Helm thought string fields were objects.
- NewThe Gremlin agent daemonset deployment now supports enabling DNS dependency collection by setting
gremlin.collect.dns. See gremlin/helm#90.
- NewThe Gremlin agent daemonset and the Chao agent deployment now support
priorityClassName by setting either gremlin.priorityClassName, chao.priorityClassName, or both. See gremlin/helm#89.
- New: AWS SSM Parameter Store or AWS Secrets Manager ARN values can now be supplied for secret inputs such as
gremlin.secret.teamSecret. See How to use config values stored in AWS - New: Introduced
gremlin.serviceAccount.annotations and chao.serviceAccount.annotations for supplying custom annotations to the service accounts managed by this chart. This is useful for passing annotations such as eks.amazonaws.com/role-arn. - New: Introduced
gremlin.extraEnv and chao.extraEnv for supplying custom environment variables to the Gremlin and Chao agents. - Info: Removed deprecated configuration values:
gremlin.client.secretName: please use gremlin.secret.namegremlin.client.certCreateSecret: please use gremlin.secret.managedgremlin.installK8sClient: please use: chao.create
- New: Helm chart now explicitly declares
DAC_READ_SEARCH, which is required to discover dependencies and run Certificate Expiry attacks. Most container runtimes already provide a superset of this capability (DAC_OVERRIDE) by default.
- New: Make gremlin.container.driver=any the new default, when set
gremlin.container.driver=any will attempt to mount all possible container driver paths, delegating to gremlin to pick the runtime. This option has served as the easiest way to get Gremlin up and running on containerized systems because you don't need to know or muck with container driver details.
- New: You can now add labels to the deployed Gremlin Pods using the
chao.podLabels and gremlin.podLabels parameters. See the Chart documentation for details.
- New: You can now specify SELinux options to apply to the Gremlin DaemonSet container securityContext using the
gremlin.podSecurity.seLinuxOptions parameter. See the Chart documentation for details.
