add logging to seccomp profile hash name and fallback warning message

Author: theomagellan

charts/datadog/templates/_helpers.tpl

@@ -301,7 +301,7 @@ Return the seccomp profile filename for the host-profiler, scoped to the image r
 to avoid races when multiple host-profiler versions coexist on the same node.
 */}}
 {{- define "host-profiler-seccomp-name" -}}
-host-profiler-{{ include "ddot-ebpf-image" . | sha256sum | trunc 8 }}
+host-profiler-{{ include "ddot-ebpf-image" . | sha256sum | trunc 8 }}{{- if .Values.datadog.hostProfiler.loggingSeccomp }}-logging{{- end }}
 {{- end -}}
 
 {{/*

charts/datadog/templates/_host-profiler-init.yaml

@@ -6,10 +6,9 @@
   {{- $dst := printf "/host%s/%s" .Values.datadog.hostProfiler.seccompRoot (include "host-profiler-seccomp-name" .) }}
   command:
   {{- if .Values.datadog.hostProfiler.loggingSeccomp }}
-  # Prefer the logging profile, falling back to the default if the image predates it.
   - sh
   - -c
-  - if [ -f /etc/dd-host-profiler/logging-seccomp.json ]; then cp /etc/dd-host-profiler/logging-seccomp.json {{ $dst }}; else cp /etc/dd-host-profiler/seccomp.json {{ $dst }}; fi
+  - "if [ -f /etc/dd-host-profiler/logging-seccomp.json ]; then cp /etc/dd-host-profiler/logging-seccomp.json {{ $dst }}; else echo 'WARNING: logging-seccomp.json not found in image, falling back to default seccomp profile'; cp /etc/dd-host-profiler/seccomp.json {{ $dst }}; fi"
   {{- else }}
   - cp
   - /etc/dd-host-profiler/seccomp.json

test/datadog/host_profiler_test.go

@@ -138,15 +138,18 @@ func TestHostProfilerLoggingSeccomp(t *testing.T) {
 	overrides := copyMap(hostProfilerBaseOverrides)
 	overrides["datadog.hostProfiler.loggingSeccomp"] = "true"
 	ds := renderHostProfilerDaemonSet(t, overrides)
+
 	initContainer, ok := getContainer(t, ds.Spec.Template.Spec.InitContainers, "host-profiler-seccomp-setup")
 	require.True(t, ok)
-
-	// Prefer the logging profile, falling back to the default if the image predates it.
 	cmd := strings.Join(initContainer.Command, " ")
-	assert.Contains(t, cmd, "if [ -f /etc/dd-host-profiler/logging-seccomp.json ]",
-		"init container should guard the logging profile copy; command: %v", initContainer.Command)
 	assert.Contains(t, cmd, "cp /etc/dd-host-profiler/logging-seccomp.json")
-	assert.Contains(t, cmd, "cp /etc/dd-host-profiler/seccomp.json", "should fall back to the default profile")
+	assert.Contains(t, cmd, "cp /etc/dd-host-profiler/seccomp.json")
+	assert.Contains(t, cmd, "WARNING: logging-seccomp.json not found in image, falling back to default seccomp profile")
+
+	hpContainer, ok := getContainer(t, ds.Spec.Template.Spec.Containers, "host-profiler")
+	require.True(t, ok)
+	require.NotNil(t, hpContainer.SecurityContext.SeccompProfile)
+	assert.Regexp(t, `^host-profiler-[0-9a-f]{8}-logging$`, *hpContainer.SecurityContext.SeccompProfile.LocalhostProfile)
 }
 
 func containsString(slice []string, s string) bool {