stable/prometheus: run as nobody (#12175)

if in a k8s-cluster a psp disallow running containers as root, this

PR will enable the security-context as default for
* alertmanager
* prometheus
* kube-state-metrics
* pushgateway

also add the missing network policy for pushgateway

Signed-off-by: Mario Constanti <github@constanti.de>

stable/prometheus/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: prometheus
-version: 8.14.3
+version: 8.15.0
 appVersion: 2.11.1
 description: Prometheus is a monitoring system and time series database.
 home: https://prometheus.io/

stable/prometheus/templates/pushgateway-networkpolicy.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.pushgateway.enabled .Values.networkPolicy.enabled -}}
+apiVersion: {{ template "prometheus.networkPolicy.apiVersion" . }}
+kind: NetworkPolicy
+metadata:
+  name: {{ template "prometheus.pushgateway.fullname" . }}
+  labels:
+    {{- include "prometheus.pushgateway.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "prometheus.pushgateway.matchLabels" . | nindent 6 }}
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            {{- include "prometheus.server.matchLabels" . | nindent 12 }}
+    - ports:
+      - port: 9091
+{{- end -}}

stable/prometheus/templates/server-deployment.yaml

@@ -37,20 +37,6 @@ spec:
       schedulerName: "{{ .Values.server.schedulerName }}"
 {{- end }}
       serviceAccountName: {{ template "prometheus.serviceAccountName.server" . }}
-      {{- if .Values.initChownData.enabled }}
-      initContainers:
-      - name: "{{ .Values.initChownData.name }}"
-        image: "{{ .Values.initChownData.image.repository }}:{{ .Values.initChownData.image.tag }}"
-        imagePullPolicy: "{{ .Values.initChownData.image.pullPolicy }}"
-        resources:
-{{ toYaml .Values.initChownData.resources | indent 10 }}
-        # 65534 is the nobody user that prometheus uses.
-        command: ["chown", "-R", "65534:65534", "{{ .Values.server.persistentVolume.mountPath }}"]
-        volumeMounts:
-        - name: storage-volume
-          mountPath: {{ .Values.server.persistentVolume.mountPath }}
-          subPath: "{{ .Values.server.persistentVolume.subPath }}"
-      {{- end }}
       containers:
         - name: {{ template "prometheus.name" . }}-{{ .Values.server.name }}-{{ .Values.configmapReload.name }}
           image: "{{ .Values.configmapReload.image.repository }}:{{ .Values.configmapReload.image.tag }}"
@@ -151,7 +137,6 @@ spec:
       {{- if .Values.server.sidecarContainers }}
       {{- toYaml .Values.server.sidecarContainers | nindent 8 }}
       {{- end }}
-
     {{- if .Values.imagePullSecrets }}
       imagePullSecrets:
        {{ toYaml .Values.imagePullSecrets | indent 2 }}

stable/prometheus/templates/server-statefulset.yaml

@@ -42,20 +42,6 @@ spec:
       schedulerName: "{{ .Values.server.schedulerName }}"
 {{- end }}
       serviceAccountName: {{ template "prometheus.serviceAccountName.server" . }}
-      {{- if .Values.initChownData.enabled }}
-      initContainers:
-      - name: "{{ .Values.initChownData.name }}"
-        image: "{{ .Values.initChownData.image.repository }}:{{ .Values.initChownData.image.tag }}"
-        imagePullPolicy: "{{ .Values.initChownData.image.pullPolicy }}"
-        resources:
-{{ toYaml .Values.initChownData.resources | indent 10 }}
-        # 65534 is the nobody user that prometheus uses.
-        command: ["chown", "-R", "65534:65534", "{{ .Values.server.persistentVolume.mountPath }}"]
-        volumeMounts:
-        - name: storage-volume
-          mountPath: {{ .Values.server.persistentVolume.mountPath }}
-          subPath: "{{ .Values.server.persistentVolume.subPath }}"
-      {{- end }}
       containers:
         - name: {{ template "prometheus.name" . }}-{{ .Values.server.name }}-{{ .Values.configmapReload.name }}
           image: "{{ .Values.configmapReload.image.repository }}:{{ .Values.configmapReload.image.tag }}"

stable/prometheus/values.yaml

@@ -229,7 +229,11 @@ alertmanager:
 
   ## Security context to be added to alertmanager pods
   ##
-  securityContext: {}
+  securityContext:
+    runAsUser: 65534
+    runAsNonRoot: true
+    runAsGroup: 65534
+    fsGroup: 65534
 
   service:
     annotations: {}
@@ -289,28 +293,6 @@ configmapReload:
   ##
   resources: {}
 
-initChownData:
-  ## If false, data ownership will not be reset at startup
-  ## This allows the prometheus-server to be run with an arbitrary user
-  ##
-  enabled: true
-
-  ## initChownData container name
-  ##
-  name: init-chown-data
-
-  ## initChownData container image
-  ##
-  image:
-    repository: busybox
-    tag: latest
-    pullPolicy: IfNotPresent
-
-  ## initChownData resource requests and limits
-  ## Ref: http://kubernetes.io/docs/user-guide/compute-resources/
-  ##
-  resources: {}
-
 kubeStateMetrics:
   ## If false, kube-state-metrics will not be installed
   ##
@@ -371,7 +353,9 @@ kubeStateMetrics:
 
   ## Security context to be added to kube-state-metrics pods
   ##
-  securityContext: {}
+  securityContext:
+    runAsUser: 65534
+    runAsNonRoot: true
 
   service:
     annotations:
@@ -771,7 +755,11 @@ server:
 
   ## Security context to be added to server pods
   ##
-  securityContext: {}
+  securityContext:
+    runAsUser: 65534
+    runAsNonRoot: true
+    runAsGroup: 65534
+    fsGroup: 65534
 
   service:
     annotations: {}
@@ -885,7 +873,9 @@ pushgateway:
 
   ## Security context to be added to push-gateway pods
   ##
-  securityContext: {}
+  securityContext:
+    runAsUser: 65534
+    runAsNonRoot: true
 
   service:
     annotations: