Enable Docker default Apparmor for all Prometheus Containers
Change-Id: I97fc39e52b36fc0be84abd049fdbce1e7026107d Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
This commit is contained in:
parent
88b419d133
commit
17592f54ae
@ -46,7 +46,7 @@ spec:
|
||||
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||
{{ dict "envAll" $envAll "podName" "alertmanager" "containerNames" (list "alertmanager") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||
{{ dict "envAll" $envAll "podName" "alertmanager" "containerNames" (list "alertmanager" "alertmanager-perms") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||
spec:
|
||||
{{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
|
5
prometheus-alertmanager/values_overrides/apparmor.yaml
Normal file
5
prometheus-alertmanager/values_overrides/apparmor.yaml
Normal file
@ -0,0 +1,5 @@
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
alertmanager:
|
||||
alertmanager-perms: runtime/default
|
@ -104,6 +104,7 @@ spec:
|
||||
annotations:
|
||||
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||
{{ dict "envAll" $envAll "podName" "kube-state-metrics" "containerNames" (list "kube-state-metrics") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||
spec:
|
||||
{{ dict "envAll" $envAll "application" "exporter" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
|
@ -0,0 +1,5 @@
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
kube-state-metrics:
|
||||
kube-state-metrics: runtime/default
|
5
prometheus-node-exporter/values_overrides/apparmor.yaml
Normal file
5
prometheus-node-exporter/values_overrides/apparmor.yaml
Normal file
@ -0,0 +1,5 @@
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
node-exporter:
|
||||
node-exporter: runtime/default
|
@ -0,0 +1,5 @@
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
prometheus-openstack-exporter:
|
||||
openstack-metrics-exporter: runtime/default
|
@ -0,0 +1,5 @@
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
process-exporter:
|
||||
process-exporter: runtime/default
|
@ -1,40 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
set -xe
|
||||
|
||||
#NOTE: Lint and package chart
|
||||
make prometheus-alertmanager
|
||||
|
||||
#NOTE: Deploy command
|
||||
tee /tmp/prometheus-alertmanager.yaml << EOF
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
alertmanager:
|
||||
alertmanager: runtime/default
|
||||
storage:
|
||||
enabled: false
|
||||
EOF
|
||||
helm upgrade --install prometheus-alertmanager ./prometheus-alertmanager \
|
||||
--namespace=osh-infra \
|
||||
--values=/tmp/prometheus-alertmanager.yaml
|
||||
|
||||
#NOTE: Wait for deploy
|
||||
./tools/deployment/common/wait-for-pods.sh osh-infra
|
||||
|
||||
#NOTE: Validate Deployment info
|
||||
helm status prometheus-alertmanager
|
1
tools/deployment/apparmor/050-prometheus-alertmanager.sh
Symbolic link
1
tools/deployment/apparmor/050-prometheus-alertmanager.sh
Symbolic link
@ -0,0 +1 @@
|
||||
../osh-infra-monitoring/060-alertmanager.sh
|
@ -1,38 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
set -xe
|
||||
|
||||
#NOTE: Lint and package chart
|
||||
make prometheus-node-exporter
|
||||
|
||||
#NOTE: Deploy command
|
||||
tee /tmp/prometheus-node-exporter.yaml << EOF
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
node-exporter:
|
||||
node-exporter: runtime/default
|
||||
EOF
|
||||
helm upgrade --install prometheus-node-exporter ./prometheus-node-exporter \
|
||||
--namespace=kube-system \
|
||||
--values=/tmp/prometheus-node-exporter.yaml
|
||||
|
||||
#NOTE: Wait for deploy
|
||||
./tools/deployment/common/wait-for-pods.sh kube-system
|
||||
|
||||
#NOTE: Validate Deployment info
|
||||
helm status prometheus-node-exporter
|
1
tools/deployment/apparmor/060-prometheus-node-exporter.sh
Symbolic link
1
tools/deployment/apparmor/060-prometheus-node-exporter.sh
Symbolic link
@ -0,0 +1 @@
|
||||
../osh-infra-monitoring/080-node-exporter.sh
|
@ -1,45 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
set -xe
|
||||
|
||||
#NOTE: Lint and package chart
|
||||
make prometheus-openstack-exporter
|
||||
|
||||
#NOTE: Deploy command
|
||||
tee /tmp/prometheus-openstack-exporter.yaml << EOF
|
||||
manifests:
|
||||
job_ks_user: false
|
||||
dependencies:
|
||||
static:
|
||||
prometheus_openstack_exporter:
|
||||
jobs: null
|
||||
services: null
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
prometheus-openstack-exporter:
|
||||
openstack-metrics-exporter: runtime/default
|
||||
EOF
|
||||
helm upgrade --install prometheus-openstack-exporter ./prometheus-openstack-exporter \
|
||||
--namespace=openstack \
|
||||
--values=/tmp/prometheus-openstack-exporter.yaml
|
||||
|
||||
#NOTE: Wait for deploy
|
||||
./tools/deployment/common/wait-for-pods.sh openstack
|
||||
|
||||
#NOTE: Validate Deployment info
|
||||
helm status prometheus-openstack-exporter
|
1
tools/deployment/apparmor/070-prometheus-openstack-exporter.sh
Symbolic link
1
tools/deployment/apparmor/070-prometheus-openstack-exporter.sh
Symbolic link
@ -0,0 +1 @@
|
||||
../osh-infra-monitoring/100-openstack-exporter.sh
|
@ -1,38 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
set -xe
|
||||
|
||||
#NOTE: Lint and package chart
|
||||
make prometheus-process-exporter
|
||||
|
||||
#NOTE: Deploy command
|
||||
tee /tmp/prometheus-process-exporter.yaml << EOF
|
||||
pod:
|
||||
mandatory_access_control:
|
||||
type: apparmor
|
||||
process-exporter:
|
||||
process-exporter: runtime/default
|
||||
EOF
|
||||
helm upgrade --install prometheus-process-exporter ./prometheus-process-exporter \
|
||||
--namespace=kube-system \
|
||||
--values=/tmp/prometheus-process-exporter.yaml
|
||||
|
||||
#NOTE: Wait for deploy
|
||||
./tools/deployment/common/wait-for-pods.sh kube-system
|
||||
|
||||
#NOTE: Validate Deployment info
|
||||
helm status prometheus-process-exporter
|
1
tools/deployment/apparmor/080-prometheus-process-exporter.sh
Symbolic link
1
tools/deployment/apparmor/080-prometheus-process-exporter.sh
Symbolic link
@ -0,0 +1 @@
|
||||
../osh-infra-monitoring/090-process-exporter.sh
|
Loading…
Reference in New Issue
Block a user