Skip to content

Conversation

@naemono
Copy link
Contributor

@naemono naemono commented Nov 24, 2025

Since v8.16 Elastic Agent doesn't need the daemonset to adjust directory permissions when running as non-root. This removes/adjusts the documentation to make this more clear. It also removes the e2e test.

image

Testing

  • Applied fleet-kubernetes-integration.yaml in the default namespace and everything came up without issues (see screenshot)
  • Verified volume uses hostPath:
      volumes:
      - hostPath:
          path: /var/lib/elastic-agent/default/elastic-agent/state
          type: DirectoryOrCreate
        name: agent-data

This will be paired with a documentation PR as well, fyi.

@prodsecmachine
Copy link
Collaborator

prodsecmachine commented Nov 24, 2025

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@botelastic botelastic bot added the triage label Nov 24, 2025
Signed-off-by: Michael Montgomery <[email protected]>
@naemono naemono requested review from barkbay, Copilot, kvalliyurnatt, pebrc, pkoutsovasilis and rhr323 and removed request for pebrc November 24, 2025 21:57
@naemono naemono added >enhancement Enhancement of existing functionality >docs Documentation labels Nov 24, 2025
@botelastic botelastic bot removed the triage label Nov 24, 2025
@naemono naemono marked this pull request as ready for review November 24, 2025 21:58
@naemono naemono changed the title WIP: Remove docs and unit tests surrounding running agent as non-root Remove docs and unit tests surrounding running agent as non-root Nov 24, 2025
Copilot finished reviewing on behalf of naemono November 24, 2025 21:59
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request removes obsolete documentation and testing infrastructure for running Elastic Agent as non-root, as this functionality is now natively supported in Elastic Agent v8.16.0 and later without requiring special DaemonSet configuration.

Key Changes:

  • Removed the dedicated non-root recipe file and its associated end-to-end test
  • Simplified test helper code by removing non-root specific DaemonSet mutation logic
  • Updated main recipe file to document that runAsUser: 0 is no longer required since v8.16.0

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
test/e2e/test/helper/yaml.go Removed maybeMutateForAgentNonRootTests function and fleet outputs configuration logic that was only needed for non-root testing; simplified DaemonSet handling
test/e2e/agent/recipes_test.go Removed TestFleetKubernetesNonRootIntegrationRecipe test function that validated the non-root configuration
config/recipes/elastic-agent/fleet-kubernetes-integration.yaml Added explanatory comments indicating that runAsUser: 0 is no longer needed since v8.16.0
config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml Deleted entire recipe file that demonstrated non-root setup with DaemonSet for permission management
config/recipes/elastic-agent/README.asciidoc Removed documentation section about the non-root integration recipe

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>docs Documentation >enhancement Enhancement of existing functionality

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants