chore: unprivileged windows by default

Author: kondracek-nr

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ### enhancement
 - Add handling for fine-grained kubectl permissions @kondracek-nr [#1389](https://github.com/newrelic/nri-kubernetes/pull/1389)
+- Introduce HostProcess Windows containers and "privileged" mode support to collect host metrics on Windows nodes. Inherits global or chart-specific "privileged" setting by default, but also allows users to override this for their Windows nodes - see values.yaml. @kondracek-nr [#1361](https://github.com/newrelic/nri-kubernetes/pull/1361)
 
 ## v3.53.2 - 2026-02-09
 
@@ -29,7 +30,6 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### 🚀 Enhancements
 - Add kubelet initialization retry logic to handle certificate provisioning delays in managed Kubernetes environments (EKS/GKE). New config parameters `kubelet.config.initTimeout` (default: 180s) and `kubelet.config.initBackoff` (default: 5s) control retry behavior. Set `initTimeout: 0s` to disable retries and preserve legacy behavior. @NRhzhao [#1372](https://github.com/newrelic/nri-kubernetes/pull/1372)
 - Add pod priority and priorityClassName telemetry
-- Introduce HostProcess Windows containers and "privileged" mode support to collect host metrics on Windows nodes. Inherits global or chart-specific "privileged" setting by default, but also allows users to override this for their Windows nodes - see values.yaml. @kondracek-nr [#1361](https://github.com/newrelic/nri-kubernetes/pull/1361)
 
 ### ⛓️ Dependencies
 - Updated github.com/sirupsen/logrus to v1.9.4 - [Changelog 🔗](https://github.com/sirupsen/logrus/releases/tag/v1.9.4)

charts/newrelic-infrastructure/templates/NOTES.txt

@@ -31,6 +31,29 @@ plane pods by setting `controlPlane.hostNetwork: true`. Alternatively, you can d
 `controlPlane.enabled: false`.
 {{- end }}
 
+{{- if and .Values.enableWindows (include "nriKubernetes.windows.privileged" .) }}
+Warning:
+========
+
+Windows privileged mode is enabled (windows.privileged: true). The Windows kubelet DaemonSet will run as
+HostProcess containers, which execute directly on the Windows host with elevated privileges.
+
+HostProcess containers:
+  {{- if .Values.enableProcessMetrics }}
+  - Kubelet scraper runs as NT AUTHORITY\Local service
+  - Agent runs as NT AUTHORITY\SYSTEM (required for enableProcessMetrics: true)
+  {{- else }}
+  - Both containers run as NT AUTHORITY\Local service
+  {{- end }}
+  - Have full access to the host filesystem via CONTAINER_SANDBOX_MOUNT_POINT
+  - Require hostNetwork: true (pods use the host's network namespace)
+  - Are supported on Windows Server 2019 and later
+
+This mode provides full monitoring capabilities including {{ if .Values.enableProcessMetrics }}process metrics and {{ end }}network statistics, but requires
+administrative privileges on Windows nodes. If you need to run in a more restricted environment, set
+`windows.privileged: false` to use standard container isolation.
+{{- end }}
+
 {{- if and (include "newrelic.fargate" .) .Values.kubelet.affinity }}
 Warning:
 ========

charts/newrelic-infrastructure/templates/kubelet/_agent-config_helper.tpl

@@ -22,9 +22,7 @@ Auto-enable when enableProcessMetrics is true AND enableWindows is true, since W
 containers are inherently privileged and partial process visibility is less useful.
 Users can still override via kubelet.agentConfig.enable_elevated_process_priv if needed.
 */}}
-{{- if (get .Values "enableElevatedProcessPrivilege" | kindIs "bool") }}
-enable_elevated_process_priv: {{ .Values.enableElevatedProcessPrivilege }}
-{{- else if and (get .Values "enableProcessMetrics") (get .Values "enableWindows") }}
+{{- if and (get .Values "enableProcessMetrics") (get .Values "enableWindows") }}
 enable_elevated_process_priv: true
 {{- end }}
 {{- end -}}

charts/newrelic-infrastructure/templates/kubelet/daemonset-windows.yaml

@@ -144,8 +144,12 @@ spec:
             windowsOptions:
               {{- if include "nriKubernetes.windows.privileged" $ }}
               hostProcess: true
+              {{- if $.Values.enableProcessMetrics }}
               runAsUserName: "NT AUTHORITY\\SYSTEM"
               {{- else }}
+              runAsUserName: "NT AUTHORITY\\Local service"
+              {{- end }}
+              {{- else }}
               hostProcess: false
               runAsUserName: "ContainerUser"
               {{- end }}

charts/newrelic-infrastructure/tests/elevated_process_privilege_test.yaml

@@ -41,32 +41,6 @@ tests:
           path: data["newrelic-infra.yml"]
           pattern: "enable_elevated_process_priv: true"
 
-  - it: should respect explicit enableElevatedProcessPrivilege true setting
-    set:
-      cluster: test-cluster
-      licenseKey: test-key
-      kubelet.enabled: true
-      enableWindows: true
-      enableProcessMetrics: false
-      enableElevatedProcessPrivilege: true
-    asserts:
-      - matchRegex:
-          path: data["newrelic-infra.yml"]
-          pattern: "enable_elevated_process_priv: true"
-
-  - it: should respect explicit enableElevatedProcessPrivilege false setting
-    set:
-      cluster: test-cluster
-      licenseKey: test-key
-      kubelet.enabled: true
-      enableWindows: true
-      enableProcessMetrics: true
-      enableElevatedProcessPrivilege: false
-    asserts:
-      - matchRegex:
-          path: data["newrelic-infra.yml"]
-          pattern: "enable_elevated_process_priv: false"
-
   - it: should handle enableProcessMetrics as boolean true
     set:
       cluster: test-cluster

charts/newrelic-infrastructure/tests/hostNetwork_test.yaml

@@ -32,10 +32,9 @@ tests:
           path: spec.template.spec.hostNetwork
           value: false
         template: templates/kubelet/daemonset.yaml
-      - equal:
+      - isNull:
           path: spec.template.spec.hostNetwork
-          value: true  # Windows uses hostNetwork when privileged: true (default)
-        template: templates/kubelet/daemonset-windows.yaml
+        template: templates/kubelet/daemonset-windows.yaml  # Windows defaults to unprivileged mode (windows.privileged: false)
 
 
   - it: hostNetwork is false if nothing is set

charts/newrelic-infrastructure/tests/securityContext_test.yaml

@@ -237,6 +237,30 @@ tests:
         documentIndex: 1
         template: templates/kubelet/daemonset-windows.yaml
 
+  - it: Linux should default to privileged while Windows defaults to unprivileged
+    set:
+      licenseKey: test
+      cluster: test
+      enableWindows: true
+      # Note: privileged defaults to true, windows.privileged defaults to false
+    asserts:
+      # Linux kubelet agent container should run as root (privileged mode)
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.runAsUser
+          value: 0
+        template: templates/kubelet/daemonset.yaml
+      # Windows containers should be unprivileged by default
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.windowsOptions.hostProcess
+          value: false
+        documentIndex: 0
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.windowsOptions.hostProcess
+          value: false
+        documentIndex: 0
+        template: templates/kubelet/daemonset-windows.yaml
+
   - it: securityContext of linux containers not overwritten by windows defaults
     set:
       licenseKey: test

charts/newrelic-infrastructure/tests/windows_hostprocess_test.yaml

@@ -17,6 +17,8 @@ tests:
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - equal:
           path: spec.template.spec.containers[0].securityContext.windowsOptions.hostProcess
@@ -27,13 +29,16 @@ tests:
           value: true
         template: templates/kubelet/daemonset-windows.yaml
 
-  - it: should set correct user accounts in privileged mode
+  - it: should set correct user accounts in privileged mode with enableProcessMetrics
     set:
       licenseKey: test
       cluster: test
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      enableProcessMetrics: true
+      windows:
+        privileged: true
     asserts:
       - equal:
           path: spec.template.spec.containers[0].securityContext.windowsOptions.runAsUserName
@@ -44,13 +49,34 @@ tests:
           value: "NT AUTHORITY\\SYSTEM"
         template: templates/kubelet/daemonset-windows.yaml
 
+  - it: should use Local service for agent when privileged without enableProcessMetrics
+    set:
+      licenseKey: test
+      cluster: test
+      kubelet.enabled: true
+      enableWindows: true
+      privileged: true
+      windows:
+        privileged: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.windowsOptions.runAsUserName
+          value: "NT AUTHORITY\\Local service"
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.windowsOptions.runAsUserName
+          value: "NT AUTHORITY\\Local service"
+        template: templates/kubelet/daemonset-windows.yaml
+
   - it: should add PowerShell command with CONTAINER_SANDBOX_MOUNT_POINT for kubelet in privileged mode
     set:
       licenseKey: test
       cluster: test
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - equal:
           path: spec.template.spec.containers[0].command[0]
@@ -72,6 +98,8 @@ tests:
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - equal:
           path: spec.template.spec.containers[1].command[0]
@@ -93,6 +121,8 @@ tests:
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - equal:
           path: spec.template.spec.hostNetwork
@@ -106,6 +136,8 @@ tests:
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - equal:
           path: metadata.labels.mode
@@ -123,6 +155,8 @@ tests:
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - notContains:
           path: spec.template.spec.containers[1].env
@@ -137,6 +171,8 @@ tests:
       kubelet.enabled: true
       enableWindows: true
       privileged: true
+      windows:
+        privileged: true
     asserts:
       - notContains:
           path: spec.template.spec.containers[1].env
@@ -265,6 +301,67 @@ tests:
                 fieldPath: "status.hostIP"
         template: templates/kubelet/daemonset-windows.yaml
 
+  # Default behavior tests
+  - it: should use unprivileged mode for Windows by default (windows.privileged=false)
+    set:
+      licenseKey: test
+      cluster: test
+      kubelet.enabled: true
+      enableWindows: true
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.windowsOptions.hostProcess
+          value: false
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.windowsOptions.hostProcess
+          value: false
+        template: templates/kubelet/daemonset-windows.yaml
+      - isNull:
+          path: spec.template.spec.hostNetwork
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: metadata.labels.mode
+          value: unprivileged
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.metadata.labels.mode
+          value: unprivileged
+        template: templates/kubelet/daemonset-windows.yaml
+
+  - it: should use ContainerUser for both containers by default
+    set:
+      licenseKey: test
+      cluster: test
+      kubelet.enabled: true
+      enableWindows: true
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].securityContext.windowsOptions.runAsUserName
+          value: ContainerUser
+        template: templates/kubelet/daemonset-windows.yaml
+      - equal:
+          path: spec.template.spec.containers[1].securityContext.windowsOptions.runAsUserName
+          value: ContainerUser
+        template: templates/kubelet/daemonset-windows.yaml
+
+  - it: should set NRIA_OVERRIDE_HOST_ROOT to empty by default for Windows
+    set:
+      licenseKey: test
+      cluster: test
+      kubelet.enabled: true
+      enableWindows: true
+    documentIndex: 0
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[1].env
+          content:
+            name: NRIA_OVERRIDE_HOST_ROOT
+            value: ""
+        template: templates/kubelet/daemonset-windows.yaml
+
   # Windows-specific privileged override tests
   - it: should respect windows.privileged=false override when global privileged=true
     set:

charts/newrelic-infrastructure/values.yaml

@@ -90,8 +90,8 @@ windows:
   # When null, inherits from global 'privileged' setting.
   # Set to false to disable HostProcess mode on Windows while keeping Linux privileged.
   # HostProcess containers run directly on the Windows host (not in a container) and require hostNetwork: true.
-  # @default -- Inherits from `privileged` setting
-  privileged:
+  # @default -- `false`
+  privileged: false
 
 # -- Config that applies to all instances of the solution: kubelet, ksm, control plane and sidecars.
 # @default -- See `values.yaml`
@@ -665,16 +665,6 @@ integrations: {}
 # @default -- `false`
 enableProcessMetrics:
 
-# -- (bool) Enable elevated process privileges on Windows for enhanced process visibility.
-# When enabled on Windows, the agent requests SeDebugPrivilege which allows querying all system processes.
-# Only applies to Windows nodes. On Linux, this setting is ignored.
-# Automatically enabled when both enableProcessMetrics and enableWindows are true, since Windows HostProcess
-# containers are inherently privileged and complete process visibility is desired for monitoring.
-# Can be explicitly set to false via this setting or kubelet.agentConfig.enable_elevated_process_priv to override.
-# ref: https://docs.newrelic.com/docs/infrastructure/install-infrastructure-agent/configuration/infrastructure-agent-configuration-settings/#enable-elevated-process-priv
-# @default -- Auto-enabled when `enableProcessMetrics: true` and `enableWindows: true`
-enableElevatedProcessPrivilege:
-
 # Prefix nodes display name with cluster to reduce chances of collisions
 # prefixDisplayNameWithCluster: false