From 5ea694aa7246275448941e508c85de3d834eed96 Mon Sep 17 00:00:00 2001 From: Mario Constanti Date: Mon, 29 Jul 2019 11:19:54 +0200 Subject: [PATCH] stable/prometheus: run as nobody (#12175) if in a k8s-cluster a psp disallow running containers as root, this PR will enable the security-context as default for * alertmanager * prometheus * kube-state-metrics * pushgateway also add the missing network policy for pushgateway Signed-off-by: Mario Constanti --- stable/prometheus/Chart.yaml | 2 +- .../templates/pushgateway-networkpolicy.yaml | 19 +++++++++ .../templates/server-deployment.yaml | 15 ------- .../templates/server-statefulset.yaml | 14 ------- stable/prometheus/values.yaml | 42 +++++++------------ 5 files changed, 36 insertions(+), 56 deletions(-) create mode 100644 stable/prometheus/templates/pushgateway-networkpolicy.yaml diff --git a/stable/prometheus/Chart.yaml b/stable/prometheus/Chart.yaml index 79ced07794..06129e24ca 100755 --- a/stable/prometheus/Chart.yaml +++ b/stable/prometheus/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: prometheus -version: 8.14.3 +version: 8.15.0 appVersion: 2.11.1 description: Prometheus is a monitoring system and time series database. home: https://prometheus.io/ diff --git a/stable/prometheus/templates/pushgateway-networkpolicy.yaml b/stable/prometheus/templates/pushgateway-networkpolicy.yaml new file mode 100644 index 0000000000..e8f6ab8292 --- /dev/null +++ b/stable/prometheus/templates/pushgateway-networkpolicy.yaml @@ -0,0 +1,19 @@ +{{- if and .Values.pushgateway.enabled .Values.networkPolicy.enabled -}} +apiVersion: {{ template "prometheus.networkPolicy.apiVersion" . }} +kind: NetworkPolicy +metadata: + name: {{ template "prometheus.pushgateway.fullname" . }} + labels: + {{- include "prometheus.pushgateway.labels" . | nindent 4 }} +spec: + podSelector: + matchLabels: + {{- include "prometheus.pushgateway.matchLabels" . | nindent 6 }} + ingress: + - from: + - podSelector: + matchLabels: + {{- include "prometheus.server.matchLabels" . | nindent 12 }} + - ports: + - port: 9091 +{{- end -}} diff --git a/stable/prometheus/templates/server-deployment.yaml b/stable/prometheus/templates/server-deployment.yaml index 1e6987692f..7ecaabe818 100644 --- a/stable/prometheus/templates/server-deployment.yaml +++ b/stable/prometheus/templates/server-deployment.yaml @@ -37,20 +37,6 @@ spec: schedulerName: "{{ .Values.server.schedulerName }}" {{- end }} serviceAccountName: {{ template "prometheus.serviceAccountName.server" . }} - {{- if .Values.initChownData.enabled }} - initContainers: - - name: "{{ .Values.initChownData.name }}" - image: "{{ .Values.initChownData.image.repository }}:{{ .Values.initChownData.image.tag }}" - imagePullPolicy: "{{ .Values.initChownData.image.pullPolicy }}" - resources: -{{ toYaml .Values.initChownData.resources | indent 10 }} - # 65534 is the nobody user that prometheus uses. - command: ["chown", "-R", "65534:65534", "{{ .Values.server.persistentVolume.mountPath }}"] - volumeMounts: - - name: storage-volume - mountPath: {{ .Values.server.persistentVolume.mountPath }} - subPath: "{{ .Values.server.persistentVolume.subPath }}" - {{- end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.server.name }}-{{ .Values.configmapReload.name }} image: "{{ .Values.configmapReload.image.repository }}:{{ .Values.configmapReload.image.tag }}" @@ -151,7 +137,6 @@ spec: {{- if .Values.server.sidecarContainers }} {{- toYaml .Values.server.sidecarContainers | nindent 8 }} {{- end }} - {{- if .Values.imagePullSecrets }} imagePullSecrets: {{ toYaml .Values.imagePullSecrets | indent 2 }} diff --git a/stable/prometheus/templates/server-statefulset.yaml b/stable/prometheus/templates/server-statefulset.yaml index 1a3ccc0205..e9f5627376 100644 --- a/stable/prometheus/templates/server-statefulset.yaml +++ b/stable/prometheus/templates/server-statefulset.yaml @@ -42,20 +42,6 @@ spec: schedulerName: "{{ .Values.server.schedulerName }}" {{- end }} serviceAccountName: {{ template "prometheus.serviceAccountName.server" . }} - {{- if .Values.initChownData.enabled }} - initContainers: - - name: "{{ .Values.initChownData.name }}" - image: "{{ .Values.initChownData.image.repository }}:{{ .Values.initChownData.image.tag }}" - imagePullPolicy: "{{ .Values.initChownData.image.pullPolicy }}" - resources: -{{ toYaml .Values.initChownData.resources | indent 10 }} - # 65534 is the nobody user that prometheus uses. - command: ["chown", "-R", "65534:65534", "{{ .Values.server.persistentVolume.mountPath }}"] - volumeMounts: - - name: storage-volume - mountPath: {{ .Values.server.persistentVolume.mountPath }} - subPath: "{{ .Values.server.persistentVolume.subPath }}" - {{- end }} containers: - name: {{ template "prometheus.name" . }}-{{ .Values.server.name }}-{{ .Values.configmapReload.name }} image: "{{ .Values.configmapReload.image.repository }}:{{ .Values.configmapReload.image.tag }}" diff --git a/stable/prometheus/values.yaml b/stable/prometheus/values.yaml index 4aed3b3b9d..e21a25e482 100644 --- a/stable/prometheus/values.yaml +++ b/stable/prometheus/values.yaml @@ -229,7 +229,11 @@ alertmanager: ## Security context to be added to alertmanager pods ## - securityContext: {} + securityContext: + runAsUser: 65534 + runAsNonRoot: true + runAsGroup: 65534 + fsGroup: 65534 service: annotations: {} @@ -289,28 +293,6 @@ configmapReload: ## resources: {} -initChownData: - ## If false, data ownership will not be reset at startup - ## This allows the prometheus-server to be run with an arbitrary user - ## - enabled: true - - ## initChownData container name - ## - name: init-chown-data - - ## initChownData container image - ## - image: - repository: busybox - tag: latest - pullPolicy: IfNotPresent - - ## initChownData resource requests and limits - ## Ref: http://kubernetes.io/docs/user-guide/compute-resources/ - ## - resources: {} - kubeStateMetrics: ## If false, kube-state-metrics will not be installed ## @@ -371,7 +353,9 @@ kubeStateMetrics: ## Security context to be added to kube-state-metrics pods ## - securityContext: {} + securityContext: + runAsUser: 65534 + runAsNonRoot: true service: annotations: @@ -771,7 +755,11 @@ server: ## Security context to be added to server pods ## - securityContext: {} + securityContext: + runAsUser: 65534 + runAsNonRoot: true + runAsGroup: 65534 + fsGroup: 65534 service: annotations: {} @@ -885,7 +873,9 @@ pushgateway: ## Security context to be added to push-gateway pods ## - securityContext: {} + securityContext: + runAsUser: 65534 + runAsNonRoot: true service: annotations: