nr-ebpf-agent kernel-header-installer crashes on Bottlerocket EKS Auto nodes

[dancashTT]

Description

The kernel-header-installer init container in the nr-ebpf-agent chart crashes on Bottlerocket EKS Auto nodes, causing the entire nri-bundle helm release to fail with "context deadline exceeded".

Root Cause

The installer script at charts/nr-ebpf-agent/templates/nr-ebpf-agent-kernel-header-configmap.yaml (line 11-15) does:

set -e
...
if [ -f /host/etc/os-release ]; then
  . /host/etc/os-release

On Bottlerocket EKS Auto nodes, /etc/os-release contains an unquoted value with spaces:

VENDOR_NAME=EKS Auto Mode

When bash sources this file, it interprets VENDOR_NAME=EKS Auto Mode as "set VENDOR_NAME=EKS, then execute command Auto with argument Mode". Since Auto is not a command, it fails, and set -e causes the script to exit immediately.

The script never reaches the Bottlerocket-specific code path at line ~237 because it crashes at the source line first.

Error Output

/host/etc/os-release: line 8: Auto: command not found

All nr-ebpf-agent pods enter Init:CrashLoopBackOff.

Environment

• Kubernetes: EKS v1.33.8
• Nodes: Bottlerocket (EKS Auto, Standard) 2026.5.4
• Kernel: 6.12.79
• Chart versions tested: nri-bundle 6.0.47 and 7.0.10 (both affected)

Suggested Fix

Replace the direct sourcing of os-release with selective extraction of only the needed variables:

eval "$(grep -E '^(ID|VERSION_ID|VARIANT_ID|BUILD_ID|VARIANT)=' /host/etc/os-release | sed 's/=\(.*\)/="\1"/')"

This re-quotes all values before eval, preventing unquoted spaces from being interpreted as commands.

Note: I am also opening an AWS support ticket for the missing quotes on VENDOR_NAME in Bottlerocket's os-release file, but the script should handle this defensively regardless.

Workaround

Currently there is no helm value to disable or skip the kernel-header-installer init container. The only workaround is to disable the entire eBPF agent (nr-ebpf-agent.enabled: false), which is not ideal since Bottlerocket nodes do have BTF available at /sys/kernel/btf/vmlinux and the agent could run fine in CO-RE mode without kernel headers.

A kernelHeaderInstaller.enabled helm value would be a useful addition for environments where BTF is available and kernel headers are unnecessary.