chore: allow overriding privilged for windows

Author: kondracek-nr

CHANGELOG.md

@@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ## Unreleased
 
 ### enhancement
-- Introduce HostProcess Windows containers and "privileged" mode support to collect host metrics on Windows nodes. @kondracek-nr [#1361](https://github.com/newrelic/nri-kubernetes/pull/1361)
+- Introduce HostProcess Windows containers and "privileged" mode support to collect host metrics on Windows nodes. Inherits global or chart-specific "privileged" setting by default, but also allows users to override this for their Windows nodes - see values.yaml. @kondracek-nr [#1361](https://github.com/newrelic/nri-kubernetes/pull/1361)
 
 ## v3.51.1 - 2025-12-15
 

charts/newrelic-infrastructure/templates/_helpers.tpl

@@ -132,6 +132,22 @@ readOnlyRootFilesystem: true
 {{- end -}}
 {{- end -}}
 
+{{/*
+Windows-specific privileged mode check.
+Returns the privileged mode for Windows nodes, checking windows.privileged first,
+then falling back to the global privileged setting.
+Outputs "true" when privileged, outputs nothing (empty string) when unprivileged.
+*/}}
+{{- define "nriKubernetes.windows.privileged" -}}
+{{- if kindIs "bool" .Values.windows.privileged -}}
+    {{- if .Values.windows.privileged -}}
+        {{- .Values.windows.privileged -}}
+    {{- end -}}
+{{- else -}}
+    {{- include "nriKubernetes.privileged" . -}}
+{{- end -}}
+{{- end -}}
+
 {{- /* Windows image string processing */ -}}
 {{- /* Windows Agent is more complicated because of how we've set up agent build automation. */ -}}
 {{- /* This may be simplified once infrastructure-bundle accommodates Windows. */ -}}

charts/newrelic-infrastructure/templates/kubelet/daemonset-windows.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: {{ $.Release.Namespace }}
   labels:
     kubernetes.io/os: windows
-    {{- if include "nriKubernetes.privileged" $ }}
+    {{- if include "nriKubernetes.windows.privileged" $ }}
     mode: privileged
     {{- else }}
     mode: unprivileged
@@ -39,7 +39,7 @@ spec:
         {{- end }}
       labels:
         app.kubernetes.io/component: kubelet
-        {{- if include "nriKubernetes.privileged" $ }}
+        {{- if include "nriKubernetes.windows.privileged" $ }}
         mode: privileged
         {{- else }}
         mode: unprivileged
@@ -61,7 +61,7 @@ spec:
       priorityClassName: {{ . }}
       {{- end }}
       serviceAccountName: {{ include "newrelic.common.serviceAccount.name" $ }}
-      {{- if include "nriKubernetes.privileged" $ }}
+      {{- if include "nriKubernetes.windows.privileged" $ }}
       hostNetwork: true
       {{- end }}
 
@@ -76,15 +76,15 @@ spec:
           image: {{ default (include "nriKubernetes.windowsIntegrationImage" $) .integrationImage }}
           {{- end }}
           imagePullPolicy: {{ $.Values.images.windowsIntegration.pullPolicy }}
-          {{- if include "nriKubernetes.privileged" $ }}
+          {{- if include "nriKubernetes.windows.privileged" $ }}
           command:
             - "powershell.exe"
             - "-Command"
             - "& $env:CONTAINER_SANDBOX_MOUNT_POINT\\app\\nri-kubernetes.exe"
           {{- end }}
           securityContext:
             windowsOptions:
-              {{- if include "nriKubernetes.privileged" $ }}
+              {{- if include "nriKubernetes.windows.privileged" $ }}
               hostProcess: true
               runAsUserName: "NT AUTHORITY\\Local service"
               {{- else }}
@@ -134,15 +134,15 @@ spec:
           image: {{ default (include "nriKubernetes.windowsAgentImage" $) .integrationImage }}
           {{- end }}
           imagePullPolicy: {{ $.Values.images.windowsAgent.pullPolicy }}
-          {{- if include "nriKubernetes.privileged" $ }}
+          {{- if include "nriKubernetes.windows.privileged" $ }}
           command:
             - "powershell.exe"
             - "-Command"
             - "$env:CONTAINER_SANDBOX_MOUNT_POINT\\start.ps1"
           {{- end }}
           securityContext:
             windowsOptions:
-              {{- if include "nriKubernetes.privileged" $ }}
+              {{- if include "nriKubernetes.windows.privileged" $ }}
               hostProcess: true
               runAsUserName: "NT AUTHORITY\\SYSTEM"
               {{- else }}
@@ -173,7 +173,7 @@ spec:
             # Override NRIA_OVERRIDE_HOST_ROOT to empty if unprivileged. This must be done as an env var as the
             # `k8s-events-forwarder` and `infrastructure-bundle` images ship this very same env var set to /host.
             # Windows runs in unprivileged mode when privileged is set to false.
-            {{- if not (include "nriKubernetes.privileged" $) }}
+            {{- if not (include "nriKubernetes.windows.privileged" $) }}
             - name: "NRIA_OVERRIDE_HOST_ROOT"
               value: ""
             {{- end }}
@@ -203,7 +203,7 @@ spec:
               value: "CLUSTER_NAME"
 
             {{- /* Needed for autodiscovery when hostNetwork=false (unprivileged mode) */}}
-            {{- if not (include "nriKubernetes.privileged" $) }}
+            {{- if not (include "nriKubernetes.windows.privileged" $) }}
             - name: "NRIA_HOST"
               valueFrom:
                 fieldRef:

charts/newrelic-infrastructure/tests/windows_hostprocess_test.yaml

@@ -265,6 +265,62 @@ tests:
                 fieldPath: "status.hostIP"
         template: templates/kubelet/daemonset-windows.yaml
 
+  # Windows-specific privileged override tests
+  - it: should respect windows.privileged=false override when global privileged=true
+    set:
+      licenseKey: test
+      cluster: test
+      kubelet.enabled: true
+      enableWindows: true
+      privileged: true
+      windows:
+        privileged: false
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.windowsOptions.hostProcess
+          value: false
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.windowsOptions.hostProcess
+          value: false
+        template: templates/kubelet/daemonset-windows.yaml
+      - isNull:
+          path: spec.template.spec.hostNetwork
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: metadata.labels.mode
+          value: unprivileged
+        template: templates/kubelet/daemonset-windows.yaml
+
+  - it: should respect windows.privileged=true override when global privileged=false
+    set:
+      licenseKey: test
+      cluster: test
+      kubelet.enabled: true
+      enableWindows: true
+      privileged: false
+      windows:
+        privileged: true
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.windowsOptions.hostProcess
+          value: true
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.windowsOptions.hostProcess
+          value: true
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: metadata.labels.mode
+          value: privileged
+        template: templates/kubelet/daemonset-windows.yaml
+
   # Common tests
   - it: should set Windows OS spec
     set:

charts/newrelic-infrastructure/values.yaml

@@ -84,6 +84,15 @@ windowsOsList:
     # @ignored
     integrationImage: ""
 
+# Windows-specific configuration
+windows:
+  # -- (bool) Override privileged mode for Windows nodes.
+  # When null, inherits from global 'privileged' setting.
+  # Set to false to disable HostProcess mode on Windows while keeping Linux privileged.
+  # HostProcess containers run directly on the Windows host (not in a container) and require hostNetwork: true.
+  # @default -- Inherits from `privileged` setting
+  privileged:
+
 # -- Config that applies to all instances of the solution: kubelet, ksm, control plane and sidecars.
 # @default -- See `values.yaml`
 common: