From 4dab241ff674833bcc3460a679ace3b7828fd405 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81ngel=20Barrera=20S=C3=A1nchez?= Date: Thu, 14 Nov 2019 17:00:11 +0100 Subject: [PATCH 1/3] Change daemonset definition to be more secure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Ángel Barrera Sánchez --- extras/example-serviceaccounts.yml | 34 +++++++++++++++++++++++++---- extras/example-with-kubeconfig.yaml | 32 +++++++++++++++++++-------- 2 files changed, 53 insertions(+), 13 deletions(-) diff --git a/extras/example-serviceaccounts.yml b/extras/example-serviceaccounts.yml index 7ff2bb2..9958262 100644 --- a/extras/example-serviceaccounts.yml +++ b/extras/example-serviceaccounts.yml @@ -25,13 +25,17 @@ spec: app: goldpinger spec: serviceAccount: "goldpinger-serviceaccount" + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 containers: - name: goldpinger env: - name: HOST value: "0.0.0.0" - name: PORT - value: "80" + value: "8080" # injecting real hostname will make for easier to understand graphs/metrics - name: HOSTNAME valueFrom: @@ -42,10 +46,32 @@ spec: valueFrom: fieldRef: fieldPath: status.podIP - image: "docker.io/bloomberg/goldpinger:1.4.0" + image: "docker.io/bloomberg/goldpinger:2.0.0" + imagePullPolicy: Always + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + resources: + limits: + memory: 80Mi + requests: + cpu: 1m + memory: 40Mi ports: - - containerPort: 80 + - containerPort: 8080 name: http + readinessProbe: + httpGet: + path: /healthz + port: 8080 + initialDelaySeconds: 20 + periodSeconds: 5 + livenessProbe: + httpGet: + path: /healthz + port: 8080 + initialDelaySeconds: 20 + periodSeconds: 5 --- apiVersion: v1 kind: Service @@ -57,7 +83,7 @@ metadata: spec: type: NodePort ports: - - port: 80 + - port: 8080 nodePort: 30080 name: http selector: diff --git a/extras/example-with-kubeconfig.yaml b/extras/example-with-kubeconfig.yaml index 8404f14..04b9135 100644 --- a/extras/example-with-kubeconfig.yaml +++ b/extras/example-with-kubeconfig.yaml @@ -5,20 +5,24 @@ metadata: name: goldpinger labels: app: goldpinger - version: "1.5.0" + version: "2.0.0" spec: updateStrategy: type: RollingUpdate selector: matchLabels: app: goldpinger - version: "1.5.0" + version: "2.0.0" template: metadata: labels: app: goldpinger - version: "1.5.0" + version: "2.0.0" spec: + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 # if you'd like to use a secret to inject a kubeconfig, you can do it like this volumes: - name: kubeconfig @@ -30,7 +34,7 @@ spec: - name: HOST value: "0.0.0.0" - name: PORT - value: "80" + value: "8080" # kubeconfig needs to match the location of what's injected in the secret # if not specified goldpinger will default to using in-cluster config - name: KUBECONFIG @@ -48,20 +52,30 @@ spec: valueFrom: fieldRef: fieldPath: status.podIP - image: "docker.io/bloomberg/goldpinger:1.5.0" + image: "docker.io/bloomberg/goldpinger:2.0.0" + imagePullPolicy: Always + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + resources: + limits: + memory: 80Mi + requests: + cpu: 1m + memory: 40Mi ports: - - containerPort: 80 + - containerPort: 8080 name: http readinessProbe: httpGet: path: /healthz - port: 80 + port: 8080 initialDelaySeconds: 20 periodSeconds: 5 livenessProbe: httpGet: path: /healthz - port: 80 + port: 8080 initialDelaySeconds: 20 periodSeconds: 5 volumeMounts: @@ -78,7 +92,7 @@ metadata: spec: type: NodePort ports: - - port: 80 + - port: 8080 nodePort: 30080 name: http selector: From 8a86a7447898f330d16fbf26be527b5d7aefe5cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81ngel=20Barrera=20S=C3=A1nchez?= Date: Thu, 14 Nov 2019 17:01:18 +0100 Subject: [PATCH 2/3] Change dashboard's datasource parameter to be variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Ángel Barrera Sánchez --- extras/goldpinger-dashboard.json | 41 ++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 13 deletions(-) diff --git a/extras/goldpinger-dashboard.json b/extras/goldpinger-dashboard.json index 81587fd..c864f7d 100644 --- a/extras/goldpinger-dashboard.json +++ b/extras/goldpinger-dashboard.json @@ -33,7 +33,7 @@ "rgba(237, 129, 40, 0.89)", "rgba(245, 54, 54, 0.9)" ], - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "format": "none", @@ -113,7 +113,7 @@ "rgba(237, 129, 40, 0.89)", "rgba(245, 54, 54, 0.9)" ], - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "format": "none", @@ -199,7 +199,7 @@ "value": "avg" } ], - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fontSize": "100%", @@ -256,7 +256,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -340,7 +340,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -436,7 +436,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -519,7 +519,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -602,7 +602,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -697,7 +697,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -781,7 +781,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -865,7 +865,7 @@ "bars": false, "dashLength": 10, "dashes": false, - "datasource": "K8S", + "datasource": "$datasource", "editable": true, "error": false, "fill": 1, @@ -958,10 +958,25 @@ "tags": [], "templating": { "list": [ + { + "current": { + "text": "prometheus", + "value": "prometheus" + }, + "hide": 0, + "label": "datasource", + "name": "datasource", + "options": [], + "query": "prometheus", + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "type": "datasource" + }, { "allValue": ".*", "current": {}, - "datasource": "K8S", + "datasource": "$datasource", "hide": 0, "includeAll": true, "label": "Instance", @@ -981,7 +996,7 @@ { "allValue": ".*", "current": {}, - "datasource": "K8S", + "datasource": "$datasource", "hide": 0, "includeAll": true, "label": "Call Type", From e552b236a0df0424a9f62c5722e230696e662839 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81ngel=20Barrera=20S=C3=A1nchez?= Date: Thu, 14 Nov 2019 17:01:35 +0100 Subject: [PATCH 3/3] Change documentation example MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Ángel Barrera Sánchez --- README.md | 69 +++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 44 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 241ee75..9a95189 100644 --- a/README.md +++ b/README.md @@ -10,23 +10,25 @@ Oh, and it gives you the graph below for your cluster. Check out the [video expl ## On the menu -- [Rationale](#rationale) -- [Quick start](#quick-start) -- [Building](#building) - - [Compiling using a multi-stage Dockerfile](#compiling-using-a-multi-stage-dockerfile) - - [Compiling locally](#compiling-locally) -- [Installation](#installation) - - [Authentication with Kubernetes API](#authentication-with-kubernetes-api) - - [Example YAML](#example-yaml) - - [Note on DNS](#note-on-dns) -- [Usage](#usage) - - [UI](#ui) - - [API](#api) - - [Prometheus](#prometheus) - - [Grafana](#grafana) - - [Alert Manager](#alert-manager) -- [Contributions](#contributions) -- [License](#license) +- [Goldpinger ![Build Status](https://travis-ci.com/bloomberg/goldpinger)](#goldpinger-build-statushttpstravis-cicombloomberggoldpinger) + - [On the menu](#on-the-menu) + - [Rationale](#rationale) + - [Quick start](#quick-start) + - [Building](#building) + - [Compiling using a multi-stage Dockerfile](#compiling-using-a-multi-stage-dockerfile) + - [Compiling locally](#compiling-locally) + - [Installation](#installation) + - [Authentication with Kubernetes API](#authentication-with-kubernetes-api) + - [Example YAML](#example-yaml) + - [Note on DNS](#note-on-dns) + - [Usage](#usage) + - [UI](#ui) + - [API](#api) + - [Prometheus](#prometheus) + - [Grafana](#grafana) + - [Alert Manager](#alert-manager) + - [Contributions](#contributions) + - [License](#license) ## Rationale @@ -121,26 +123,32 @@ apiVersion: apps/v1 kind: DaemonSet metadata: name: goldpinger + namespace: default + labels: + app: goldpinger spec: updateStrategy: type: RollingUpdate selector: matchLabels: app: goldpinger - version: "1.5.0" template: metadata: labels: app: goldpinger - version: "1.5.0" spec: + serviceAccount: "goldpinger-serviceaccount" + securityContext: + runAsNonRoot: true + runAsUser: 1000 + fsGroup: 2000 containers: - name: goldpinger env: - name: HOST value: "0.0.0.0" - name: PORT - value: "80" + value: "8080" # injecting real hostname will make for easier to understand graphs/metrics - name: HOSTNAME valueFrom: @@ -151,20 +159,30 @@ spec: valueFrom: fieldRef: fieldPath: status.podIP - image: "docker.io/bloomberg/goldpinger:1.5.0" + image: "docker.io/bloomberg/goldpinger:2.0.0" + imagePullPolicy: Always + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + resources: + limits: + memory: 80Mi + requests: + cpu: 1m + memory: 40Mi ports: - - containerPort: 80 + - containerPort: 8080 name: http readinessProbe: httpGet: path: /healthz - port: 80 + port: 8080 initialDelaySeconds: 20 periodSeconds: 5 livenessProbe: httpGet: path: /healthz - port: 80 + port: 8080 initialDelaySeconds: 20 periodSeconds: 5 --- @@ -172,12 +190,13 @@ apiVersion: v1 kind: Service metadata: name: goldpinger + namespace: default labels: app: goldpinger spec: type: NodePort ports: - - port: 80 + - port: 8080 nodePort: 30080 name: http selector: