feat: split daemonset resources into full/sensor profiles selected by…

charts/cortex-agent/Chart.yaml

@@ -5,7 +5,7 @@ description: Cortex XDR agent helm chart
 
 type: application
 
-version: 1.9.0
+version: 1.10.0
 
 appVersion: 1.0.0
 

charts/cortex-agent/README.md

@@ -16,6 +16,7 @@
 | 1.7.0         | >=7.5         | Bottlerocket support
 | 1.8.0         | >=7.5         | SELinux spc_t (Super Privileged Container) support
 | 1.9.0         | >=7.5         | Support external deployment secret
+| 1.10.0        | >=7.5         | `daemonset.resources` split into `full`/`sensor` profiles, automatically selected by `agent.sensorMode`
 
 ## Installing Cortex XDR helm chart
 
@@ -103,10 +104,38 @@ Even when using `--reuse-values` (which uses the values of the previous installa
 | `namespace.name`                       | Name of the namespace the agent resides on                                                                 | Since 1.6.0
 | `namespace.create`                     | Create/Don't create namespace for the agent                                                                | Since 1.6.0
 | `daemonset.selinuxOptionsSpcT`         | Set SELinux Options type to 'spc_t'                                                                        | Since 1.8.0
-| `agent.sensorMode`                     | Enable sensor mode for lightweight cloud-native deployments                                                | agent >= 9.3
+| `agent.sensorMode`                     | Enable sensor mode for lightweight cloud-native deployments. Also selects `daemonset.resources.sensor` over `daemonset.resources.full` | Since 1.10.0, agent >= 9.3
+| `daemonset.resources.full`             | Resource requests/limits used when `agent.sensorMode` is `false` (default)                                 | Since 1.10.0
+| `daemonset.resources.sensor`           | Resource requests/limits used when `agent.sensorMode` is `true`                                            | Since 1.10.0
 
 Note: Helm requires commas in arguments to be escaped.
 
+### Migration from chart < 1.10.0
+
+In 1.10.0 the `daemonset.resources` block was restructured. The previous shape:
+
+```yaml
+daemonset:
+  resources:
+    limits:    { memory: "2Gi", ephemeral-storage: "10Gi" }
+    requests:  { cpu: "200m", memory: "600Mi", ephemeral-storage: "5Gi" }
+```
+
+is now nested under a profile name:
+
+```yaml
+daemonset:
+  resources:
+    full:    # used when agent.sensorMode == false
+      limits:    { memory: "2Gi", ephemeral-storage: "10Gi" }
+      requests:  { cpu: "200m", memory: "600Mi", ephemeral-storage: "5Gi" }
+    sensor:  # used when agent.sensorMode == true
+      limits:    { cpu: "1000m", memory: "350Mi", ephemeral-storage: "10Gi" }
+      requests:  { cpu: "200m",  memory: "256Mi", ephemeral-storage: "5Gi" }
+```
+
+If you previously overrode `daemonset.resources.limits.*` or `daemonset.resources.requests.*`, you must move those overrides under `daemonset.resources.full.*` (and/or `daemonset.resources.sensor.*`) when upgrading. Overrides left at the old paths will be silently ignored.
+
 ## Uninstalling Cortex XDR helm chart
 
 ```

charts/cortex-agent/templates/_helpers.tpl

@@ -107,3 +107,16 @@ Specify the SELinux context options type
 {{- print "" -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Select the daemonset resources block based on agent.sensorMode.
+  sensorMode: false -> .Values.daemonset.resources.full
+  sensorMode: true  -> .Values.daemonset.resources.sensor
+*/}}
+{{- define "cortex-xdr.daemonsetResources" -}}
+{{- if .Values.agent.sensorMode -}}
+{{- toYaml .Values.daemonset.resources.sensor -}}
+{{- else -}}
+{{- toYaml .Values.daemonset.resources.full -}}
+{{- end -}}
+{{- end -}}

charts/cortex-agent/templates/daemonset.yaml

@@ -150,7 +150,7 @@ spec:
         {{- end }}
 
         resources:
-{{ toYaml .Values.daemonset.resources | indent 10 }}
+          {{- include "cortex-xdr.daemonsetResources" . | nindent 10 }}
 
       terminationGracePeriodSeconds: {{ .Values.daemonset.terminationGracePeriodSeconds }}
 

charts/cortex-agent/values.yaml

@@ -103,16 +103,30 @@ daemonset:
     # for autopilot
     url: ""
 
+  # Resource profiles for the cortex agent container.
+  # The profile used at runtime is selected by `agent.sensorMode`:
+  #   sensorMode: false -> resources.full   (default, full agent)
+  #   sensorMode: true  -> resources.sensor (lightweight cloud-native)
   # These values are the recommended values for cortex agent
   # and are not recommended to change!
   resources:
-    limits:
-      memory: "2Gi"
-      ephemeral-storage: "10Gi"
-    requests:
-      cpu: "200m"
-      memory: "600Mi"
-      ephemeral-storage: "5Gi"
+    full:
+      limits:
+        memory: "2Gi"
+        ephemeral-storage: "10Gi"
+      requests:
+        cpu: "200m"
+        memory: "600Mi"
+        ephemeral-storage: "5Gi"
+    sensor:
+      limits:
+        cpu: "1000m"
+        memory: "350Mi"
+        ephemeral-storage: "10Gi"
+      requests:
+        cpu: "200m"
+        memory: "256Mi"
+        ephemeral-storage: "5Gi"
   selinuxOptionsSpcT: false
 
 namespace: