diff --git a/mirrord-schema.json b/mirrord-schema.json index 0cebfb20ce9..1add0f98916 100644 --- a/mirrord-schema.json +++ b/mirrord-schema.json @@ -284,7 +284,7 @@ }, "disabled_capabilities": { "title": "agent.disabled_capabilities {#agent-disabled_capabilities}", - "description": "Disables specified Linux capabilities for the agent container. If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and `SYS_ADMIN`.", + "description": "Disables specified Linux capabilities for the agent container. If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and `SYS_ADMIN`.\n\nHas no effect when using the targetless mode, as targetless agent containers have no capabilities.", "type": [ "array", "null" @@ -423,7 +423,7 @@ }, "privileged": { "title": "agent.privileged {#agent-privileged}", - "description": "Run the mirror agent as privileged container. Defaults to `false`.\n\nMight be needed in strict environments such as Bottlerocket.", + "description": "Run the mirror agent as privileged container. Defaults to `false`.\n\nMight be needed in strict environments such as Bottlerocket.\n\nHas no effect when using the targetless mode, as targetless agent containers are never privileged.", "type": [ "boolean", "null" diff --git a/mirrord/config/configuration.md b/mirrord/config/configuration.md index 20d3dbc0e0e..57b5cd32900 100644 --- a/mirrord/config/configuration.md +++ b/mirrord/config/configuration.md @@ -196,6 +196,9 @@ Disables specified Linux capabilities for the agent container. If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and `SYS_ADMIN`. +Has no effect when using the targetless mode, +as targetless agent containers have no capabilities. + ### agent.dns {#agent-dns} ### agent.ephemeral {#agent-ephemeral} @@ -355,6 +358,9 @@ Defaults to `false`. Might be needed in strict environments such as Bottlerocket. +Has no effect when using the targetless mode, +as targetless agent containers are never privileged. + ### agent.resources {#agent-resources} Set pod resource reqirements. (not with ephemeral agents) diff --git a/mirrord/config/src/agent.rs b/mirrord/config/src/agent.rs index caf1d131a25..06f8126aa0a 100644 --- a/mirrord/config/src/agent.rs +++ b/mirrord/config/src/agent.rs @@ -236,6 +236,9 @@ pub struct AgentConfig { /// Disables specified Linux capabilities for the agent container. /// If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and /// `SYS_ADMIN`. + /// + /// Has no effect when using the targetless mode, + /// as targetless agent containers have no capabilities. pub disabled_capabilities: Option>, /// ### agent.tolerations {#agent-tolerations} @@ -291,6 +294,9 @@ pub struct AgentConfig { /// Defaults to `false`. /// /// Might be needed in strict environments such as Bottlerocket. + /// + /// Has no effect when using the targetless mode, + /// as targetless agent containers are never privileged. #[config(default = false)] pub privileged: bool,