Rahul Roshan Kachchap
ba434f0d33
The auditd helm chart daemonset does not mount host filesystem paths
into the container. File watch rules (-w /etc/kubernetes/...) fail
with 'No such file or directory' because the watched paths do not
exist inside the container's mount namespace, even with privileged
mode enabled.
Add a new 'extraHostPathMounts' values.yaml parameter that allows
users to specify arbitrary host paths to mount into the auditd
container via helm overrides. Each entry supports name, hostPath,
mountPath, readOnly (default: true), and type (default: Directory).
This is user-configurable — any host path needed for file watch
rules can be added without rebuilding the chart.
Example usage:
system helm-override-update auditd auditd kube-system --values overrides.yaml
Where overrides.yaml contains:
extraHostPathMounts:
- name: etc-kubernetes
hostPath: /etc/kubernetes
mountPath: /etc/kubernetes
readOnly: true
type: Directory
Test Plan:
PASS: helm install auditd chart with extraHostPathMounts
override for /etc/kubernetes — pod starts Running,
no errors in logs.
PASS: auditctl -l inside container confirms all 3 file watch rules
loaded (-w /etc/kubernetes/admin.conf, kubelet.conf, pki).
PASS: /etc/kubernetes/admin.conf visible and readable inside the
container via the hostPath volume mount.
PASS: Volume mount is readOnly — write attempts from inside
container return EROFS (read-only filesystem).
PASS: Audit events captured in /var/log/audit/audit.log with
correct keys (CFG_k8s_critical, CFG_k8s_pki). Verified
CONFIG_CHANGE (rule-add) and SYSCALL events present.
PASS: Removing extraHostPathMounts override and re-applying
reverts the daemonset to its original state.
Closes-Bug: 2162546
Change-Id: I06b1a46c0ae6a6022d26a5dcdfa22e61fb089a53
Signed-off-by: Rahul Roshan Kachchap <RahulRoshan.Kachchap@windriver.com>