Skip to content

Remove docs and unit tests surrounding running agent as non-root #8931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Remove docs and unit tests surrounding running agent as non-root #8931

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e9f61e1
Remove docs and unit tests surrounding running agent as non-root
naemono Nov 24, 2025
c26e9fd
Remove recipe
naemono Nov 24, 2025
4c26d80
Add additional notes to the example and add back the recipe.
naemono Nov 26, 2025
dbd92ee
Adjust wording.
naemono Dec 1, 2025
89615f9
Merge branch 'main' into update-agent-run-as-root-8.16
naemono Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions config/recipes/elastic-agent/README.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,6 @@ Deploys two Elasticsearch clusters and two Kibana instances together with single

Deploys Elastic Agent as a DaemonSet in Fleet mode with System and Kubernetes integrations enabled. System integration collects syslog logs, auth logs and system metrics (for CPU, I/O, filesystem, memory, network, process and others). Kubernetes integrations collects API server, Container, Event, Node, Pod, Volume and system metrics.

===== System and Kubernetes integrations running as non-root - `fleet-kubernetes-integration-nonroot.yaml`

The provided example is functionally identical to the previous section but runs the Elastic Agent processes (both the Elastic Agent running as the Fleet server and the Elastic Agent connected to Fleet) as a non-root user by utilizing a DaemonSet to ensure directory and file permissions. *Note* The DaemonSet itself must run as root to set up permissions and ECK >= 2.10.0 is required.

===== Custom logs integration with autodiscover - `fleet-custom-logs-integration.yaml`

Deploys Elastic Agent as a DaemonSet in Fleet mode with Custom Logs integration enabled. Collects logs from all Pods in the `default` namespace using autodiscover feature.
Expand Down
325 changes: 0 additions & 325 deletions config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml
View file
Open in desktop

This file was deleted.

12 changes: 8 additions & 4 deletions config/recipes/elastic-agent/fleet-kubernetes-integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,10 @@ spec:
spec:
serviceAccountName: fleet-server
automountServiceAccountToken: true
securityContext:
runAsUser: 0
# Since Elastic Agent v8.16.0, the runAsUser: 0 is not needed
# as Agent chowns the data directory to the container user id.
# securityContext:
# runAsUser: 0
---
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
Expand Down Expand Up @@ -114,8 +116,10 @@ spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
automountServiceAccountToken: true
securityContext:
runAsUser: 0
# Since Elastic Agent v8.16.0, the runAsUser: 0 is not needed
# as Agent chowns the data directory to the container user id.
# securityContext:
# runAsUser: 0
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Expand Down
Loading
Loading