mirror of
https://github.com/bloomberg/goldpinger.git
synced 2026-08-23 21:36:25 +00:00
Merge pull request #70 from angelbarrera92/secure-k8s-deployment
Secure k8s deployment
This commit is contained in:
Mikolaj Pawlikowski
@@ -10,23 +10,25 @@ Oh, and it gives you the graph below for your cluster. Check out the [video expl
|
||||
|
||||
## On the menu
|
||||
|
||||
- [Rationale](#rationale)
|
||||
- [Quick start](#quick-start)
|
||||
- [Building](#building)
|
||||
- [Compiling using a multi-stage Dockerfile](#compiling-using-a-multi-stage-dockerfile)
|
||||
- [Compiling locally](#compiling-locally)
|
||||
- [Installation](#installation)
|
||||
- [Authentication with Kubernetes API](#authentication-with-kubernetes-api)
|
||||
- [Example YAML](#example-yaml)
|
||||
- [Note on DNS](#note-on-dns)
|
||||
- [Usage](#usage)
|
||||
- [UI](#ui)
|
||||
- [API](#api)
|
||||
- [Prometheus](#prometheus)
|
||||
- [Grafana](#grafana)
|
||||
- [Alert Manager](#alert-manager)
|
||||
- [Contributions](#contributions)
|
||||
- [License](#license)
|
||||
- [Goldpinger ](#goldpinger-build-statushttpstravis-cicombloomberggoldpinger)
|
||||
- [On the menu](#on-the-menu)
|
||||
- [Rationale](#rationale)
|
||||
- [Quick start](#quick-start)
|
||||
- [Building](#building)
|
||||
- [Compiling using a multi-stage Dockerfile](#compiling-using-a-multi-stage-dockerfile)
|
||||
- [Compiling locally](#compiling-locally)
|
||||
- [Installation](#installation)
|
||||
- [Authentication with Kubernetes API](#authentication-with-kubernetes-api)
|
||||
- [Example YAML](#example-yaml)
|
||||
- [Note on DNS](#note-on-dns)
|
||||
- [Usage](#usage)
|
||||
- [UI](#ui)
|
||||
- [API](#api)
|
||||
- [Prometheus](#prometheus)
|
||||
- [Grafana](#grafana)
|
||||
- [Alert Manager](#alert-manager)
|
||||
- [Contributions](#contributions)
|
||||
- [License](#license)
|
||||
|
||||
## Rationale
|
||||
|
||||
@@ -121,26 +123,32 @@ apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: goldpinger
|
||||
namespace: default
|
||||
labels:
|
||||
app: goldpinger
|
||||
spec:
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: goldpinger
|
||||
version: "1.5.0"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: goldpinger
|
||||
version: "1.5.0"
|
||||
spec:
|
||||
serviceAccount: "goldpinger-serviceaccount"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
fsGroup: 2000
|
||||
containers:
|
||||
- name: goldpinger
|
||||
env:
|
||||
- name: HOST
|
||||
value: "0.0.0.0"
|
||||
- name: PORT
|
||||
value: "80"
|
||||
value: "8080"
|
||||
# injecting real hostname will make for easier to understand graphs/metrics
|
||||
- name: HOSTNAME
|
||||
valueFrom:
|
||||
@@ -151,20 +159,30 @@ spec:
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
image: "docker.io/bloomberg/goldpinger:1.5.0"
|
||||
image: "docker.io/bloomberg/goldpinger:2.0.0"
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
resources:
|
||||
limits:
|
||||
memory: 80Mi
|
||||
requests:
|
||||
cpu: 1m
|
||||
memory: 40Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 80
|
||||
port: 8080
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 80
|
||||
port: 8080
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
---
|
||||
@@ -172,12 +190,13 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: goldpinger
|
||||
namespace: default
|
||||
labels:
|
||||
app: goldpinger
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- port: 80
|
||||
- port: 8080
|
||||
nodePort: 30080
|
||||
name: http
|
||||
selector:
|
||||
|
||||
@@ -25,13 +25,17 @@ spec:
|
||||
app: goldpinger
|
||||
spec:
|
||||
serviceAccount: "goldpinger-serviceaccount"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
fsGroup: 2000
|
||||
containers:
|
||||
- name: goldpinger
|
||||
env:
|
||||
- name: HOST
|
||||
value: "0.0.0.0"
|
||||
- name: PORT
|
||||
value: "80"
|
||||
value: "8080"
|
||||
# injecting real hostname will make for easier to understand graphs/metrics
|
||||
- name: HOSTNAME
|
||||
valueFrom:
|
||||
@@ -42,10 +46,32 @@ spec:
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
image: "docker.io/bloomberg/goldpinger:1.4.0"
|
||||
image: "docker.io/bloomberg/goldpinger:2.0.0"
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
resources:
|
||||
limits:
|
||||
memory: 80Mi
|
||||
requests:
|
||||
cpu: 1m
|
||||
memory: 40Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -57,7 +83,7 @@ metadata:
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- port: 80
|
||||
- port: 8080
|
||||
nodePort: 30080
|
||||
name: http
|
||||
selector:
|
||||
|
||||
@@ -5,20 +5,24 @@ metadata:
|
||||
name: goldpinger
|
||||
labels:
|
||||
app: goldpinger
|
||||
version: "1.5.0"
|
||||
version: "2.0.0"
|
||||
spec:
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: goldpinger
|
||||
version: "1.5.0"
|
||||
version: "2.0.0"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: goldpinger
|
||||
version: "1.5.0"
|
||||
version: "2.0.0"
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
fsGroup: 2000
|
||||
# if you'd like to use a secret to inject a kubeconfig, you can do it like this
|
||||
volumes:
|
||||
- name: kubeconfig
|
||||
@@ -30,7 +34,7 @@ spec:
|
||||
- name: HOST
|
||||
value: "0.0.0.0"
|
||||
- name: PORT
|
||||
value: "80"
|
||||
value: "8080"
|
||||
# kubeconfig needs to match the location of what's injected in the secret
|
||||
# if not specified goldpinger will default to using in-cluster config
|
||||
- name: KUBECONFIG
|
||||
@@ -48,20 +52,30 @@ spec:
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
image: "docker.io/bloomberg/goldpinger:1.5.0"
|
||||
image: "docker.io/bloomberg/goldpinger:2.0.0"
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
resources:
|
||||
limits:
|
||||
memory: 80Mi
|
||||
requests:
|
||||
cpu: 1m
|
||||
memory: 40Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 80
|
||||
port: 8080
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 80
|
||||
port: 8080
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
volumeMounts:
|
||||
@@ -78,7 +92,7 @@ metadata:
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- port: 80
|
||||
- port: 8080
|
||||
nodePort: 30080
|
||||
name: http
|
||||
selector:
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
"rgba(237, 129, 40, 0.89)",
|
||||
"rgba(245, 54, 54, 0.9)"
|
||||
],
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"format": "none",
|
||||
@@ -113,7 +113,7 @@
|
||||
"rgba(237, 129, 40, 0.89)",
|
||||
"rgba(245, 54, 54, 0.9)"
|
||||
],
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"format": "none",
|
||||
@@ -199,7 +199,7 @@
|
||||
"value": "avg"
|
||||
}
|
||||
],
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fontSize": "100%",
|
||||
@@ -256,7 +256,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -340,7 +340,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -436,7 +436,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -519,7 +519,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -602,7 +602,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -697,7 +697,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -781,7 +781,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -865,7 +865,7 @@
|
||||
"bars": false,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fill": 1,
|
||||
@@ -958,10 +958,25 @@
|
||||
"tags": [],
|
||||
"templating": {
|
||||
"list": [
|
||||
{
|
||||
"current": {
|
||||
"text": "prometheus",
|
||||
"value": "prometheus"
|
||||
},
|
||||
"hide": 0,
|
||||
"label": "datasource",
|
||||
"name": "datasource",
|
||||
"options": [],
|
||||
"query": "prometheus",
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"type": "datasource"
|
||||
},
|
||||
{
|
||||
"allValue": ".*",
|
||||
"current": {},
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"label": "Instance",
|
||||
@@ -981,7 +996,7 @@
|
||||
{
|
||||
"allValue": ".*",
|
||||
"current": {},
|
||||
"datasource": "K8S",
|
||||
"datasource": "$datasource",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"label": "Call Type",
|
||||
|
||||
Reference in New Issue
Block a user