Skip to content

Commit 0435131

Browse files
aliciascottjhgilbert
aliciascott
and
jhgilbert
authored
[DOCS-6979] updates to CSM troubleshooting vulnerabilities and moving page (DataDog#21233)
* updates to CSM vulnerabilities and moving page * updating Operator version * further clarification on envar * Apply suggestions from code review Co-authored-by: jhgilbert <jen.gilbert@datadoghq.com> --------- Co-authored-by: jhgilbert <jen.gilbert@datadoghq.com>
1 parent a08787e commit 0435131

File tree

8 files changed

+42
-12
lines changed

8 files changed

+42
-12
lines changed

‎config/_default/menus/menus.en.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3546,11 +3546,6 @@ main:
35463546
parent: csm
35473547
identifier: vulnerabilities
35483548
weight: 18
3549-
- name: Troubleshooting
3550-
url: security/vulnerabilities/troubleshooting
3551-
parent: vulnerabilities
3552-
identifier: vulnerabilities_troubleshooting
3553-
weight: 101
35543549
- name: Default Detection Rules
35553550
url: security/default_rules/#cat-cloud-security-management
35563551
parent: csm
@@ -3581,6 +3576,11 @@ main:
35813576
parent: csm
35823577
identifier: csm_troubleshooting
35833578
weight: 30
3579+
- name: Vulnerabilities
3580+
url: security/cloud_security_management/troubleshooting/vulnerabilities/
3581+
parent: csm_troubleshooting
3582+
identifier: csm_troubleshooting_vulnerabilities
3583+
weight: 301
35843584
- name: Application Security Management
35853585
url: security/application_security/
35863586
parent: security_platform_heading

‎content/en/infrastructure/containers/container_images.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ The following instructions enable the container image metadata collection and [S
4040

4141
**Note**: The CSM Vulnerabilities feature is not available for AWS Fargate or Windows environments.
4242

43+
4344
{{< tabs >}}
4445
{{% tab "Kubernetes (Helm)" %}}
4546

@@ -59,7 +60,8 @@ datadog:
5960
6061
{{% tab "Kubernetes (Operator)" %}}
6162
62-
Add the following to the spec section of your `values.yaml` file:
63+
Image collection is enabled by default with Datadog Operator version `>= 1.3.0`.</br>
64+
Or, add the following to the spec section of your `values.yaml` file:
6365

6466
```yaml
6567
apiVersion: datadoghq.com/v2alpha1

‎content/en/security/cloud_security_management/setup/csm_enterprise.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,8 @@ datadog:
426426

427427
{{% tab "Kubernetes (Operator)" %}}
428428

429-
Add the following to the spec section of your `values.yaml` file:
429+
Image collection is enabled by default with Datadog Operator version `>= 1.3.0`.</br>
430+
Or, add the following to the spec section of your `values.yaml` file:
430431

431432
```yaml
432433
apiVersion: datadoghq.com/v2alpha1

‎content/en/security/cloud_security_management/setup/csm_pro.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ datadog:
7878
7979
{{% tab "Kubernetes (Operator)" %}}
8080
81-
Add the following to the spec section of your `values.yaml` file:
81+
Image collection is enabled by default with Datadog Operator version `>= 1.3.0`.</br>
82+
Or, add the following to the spec section of your `values.yaml` file:
8283

8384
```yaml
8485
apiVersion: datadoghq.com/v2alpha1

‎content/en/security/cloud_security_management/troubleshooting.md renamed to ‎content/en/security/cloud_security_management/troubleshooting/_index.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ kind: documentation
44
aliases:
55
- /security_platform/cloud_workload_security/troubleshooting/
66
- /security_platform/cloud_security_management/troubleshooting/
7+
- /security/cloud_security_management/troubleshooting/
8+
further_reading:
9+
- link: "/security/cloud_security_management/troubleshooting/vulnerabilities"
10+
tag: "Documentation"
11+
text: "Troubleshooting CSM Vulnerabilities"
712
---
813

914
## Security Agent flare
@@ -76,5 +81,8 @@ datadog:
7681
```bash
7782
DD_RUNTIME_SECURITY_CONFIG_NETWORK_ENABLED=false
7883
```
84+
## Further Reading
85+
86+
{{< partial name="whats-next/whats-next.html" >}}
7987

8088
[1]: /agent/troubleshooting/send_a_flare/?tab=agentv6v7

‎content/en/security/vulnerabilities/troubleshooting.md renamed to ‎content/en/security/cloud_security_management/troubleshooting/vulnerabilities.md

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
title: Troubleshooting Cloud Security Management Vulnerabilities
33
kind: documentation
4+
aliases:
5+
- /security/vulnerabilities/troubleshooting/
46
further_reading:
57
- link: "/security/cloud_security_management/setup/csm_pro/?tab=aws#configure-the-agent-for-containers"
68
tag: "Documentation"
@@ -32,25 +34,31 @@ Ensure all the [prerequisites][5] are met for CSM Vulnerabilities:
3234
| Component | Version/Requirement |
3335
| ------------------------ | ----------------------------------------|
3436
| [Helm Chart][6] | v3.49.6 or later (Kubernetes only) |
35-
| [containerd][7] | v1.5.6 or later (Kubernetes and hosts only)|
37+
| [containerd][7] | v1.5.6 or later (Kubernetes and hosts only)|</br>
3638

3739
CSM Vulnerabilities is **not** available for the following environments:
3840

3941
- Windows
4042
- AWS Fargate
4143
- CRI-O runtime
44+
- podman runtime
4245

4346
## Error messages
4447

4548
### Disk space requirements
4649

47-
Ensure your free disk space is equal to the size of your largest container image. This space is needed for the Datadog Agent to scan the container image for vulnerabilities.
50+
Ensure your free disk space is equal to the size of your largest container image. This space is needed for the Datadog Agent to scan the container image for vulnerabilities (1 GB by default).
4851

4952
The resulting error appears as:
5053
```sh
5154
Error: failed to check current disk usage: not enough disk space to safely collect sbom, 192108482560 available, 1073741824000 required
5255
```
5356

57+
Workaround:
58+
59+
- Increase the available disk space to at least 1 GB. If your images are larger than 1 GB, increase your disk space accordingly.
60+
- If all of your images are smaller than 1 GB, you can decrease the default Agent request disk space with the environment variable: `DD_SBOM_CONTAINER_IMAGE_MIN_AVAILABLE_DISK` (default value 1GB).
61+
5462
### Uncompressed container image layers
5563

5664
The SBOM scan only works with uncompressed container image layers. Certain Kubernetes distributions (such as AWS EKS, minikube, and kind), configure their container runtime to discard the uncompressed layers, causing the scan to fail.

‎layouts/shortcodes/csm-prereqs-enterprise.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,12 @@ CSM Threats supports the following Linux distributions:
2828
| [Helm Chart][103] | v3.49.6 or later (Kubernetes only) |
2929
| [containerd][104] | v1.5.6 or later (Kubernetes and hosts only)|
3030

31-
**Note**: CSM Vulnerabilities is not available for CRI-O runtime, Windows, or AWS Fargate environments.
31+
**Note**: CSM Vulnerabilities is **not** available for the following environments:
32+
33+
- Windows
34+
- AWS Fargate
35+
- CRI-O runtime
36+
- podman runtime
3237

3338
### CSM Identity Risks
3439

‎layouts/shortcodes/csm-prereqs-pro.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,12 @@ Datadog Agent `7.46` or later installed on your hosts or containers.
77
| [Helm Chart][102] | v3.49.6 or later (Kubernetes only) |
88
| [containerd][103] | v1.5.6 or later (Kubernetes and hosts only)|
99

10-
**Note**: CSM Vulnerabilities is not available for CRI-O runtime, Windows, or AWS Fargate environments.
10+
**Note**: CSM Vulnerabilities is **not** available for the following environments:
11+
12+
- Windows
13+
- AWS Fargate
14+
- CRI-O runtime
15+
- podman runtime
1116

1217
[102]: /containers/kubernetes/installation/?tab=helm
1318
[103]: https://kubernetes.io/docs/tasks/administer-cluster/migrating-from-dockershim/find-out-runtime-you-use/

0 commit comments

Comments
 (0)