From 1e55a4057cf2613fbe31d66305a93d2424a6e1e2 Mon Sep 17 00:00:00 2001 From: Matthias Loibl Date: Wed, 31 May 2023 17:32:41 +0100 Subject: [PATCH 1/3] Add securityContext items and add pod security labes --- jsonnet/kube-prometheus/addons/pyrra.libsonnet | 3 +++ jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet | 1 + .../kube-prometheus/components/prometheus-adapter.libsonnet | 2 ++ jsonnet/kube-prometheus/main.libsonnet | 4 ++++ 4 files changed, 10 insertions(+) diff --git a/jsonnet/kube-prometheus/addons/pyrra.libsonnet b/jsonnet/kube-prometheus/addons/pyrra.libsonnet index 1980b22004..06ed5b299e 100644 --- a/jsonnet/kube-prometheus/addons/pyrra.libsonnet +++ b/jsonnet/kube-prometheus/addons/pyrra.libsonnet @@ -80,6 +80,9 @@ securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, + runAsNonRoot: true, + capabilities: { drop: ['ALL'] }, + seccompProfile: { type: 'RuntimeDefault' }, }, }; diff --git a/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet b/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet index bb1c15a2ef..7055c30890 100644 --- a/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet +++ b/jsonnet/kube-prometheus/components/kube-rbac-proxy.libsonnet @@ -63,5 +63,6 @@ function(params) { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: { drop: ['ALL'] }, + seccompProfile: { type: 'RuntimeDefault' }, }, } diff --git a/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet b/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet index 78541d2c3d..af8172627b 100644 --- a/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet +++ b/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet @@ -280,7 +280,9 @@ function(params) { securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, + runAsNonRoot: true, capabilities: { drop: ['ALL'] }, + seccompProfile: { type: 'RuntimeDefault' }, }, }; diff --git a/jsonnet/kube-prometheus/main.libsonnet b/jsonnet/kube-prometheus/main.libsonnet index 3405c8f3e3..969a893b88 100644 --- a/jsonnet/kube-prometheus/main.libsonnet +++ b/jsonnet/kube-prometheus/main.libsonnet @@ -150,6 +150,10 @@ local utils = import './lib/utils.libsonnet'; kind: 'Namespace', metadata: { name: $.values.common.namespace, + labels: { + 'pod-security.kubernetes.io/warn': 'privileged', + 'pod-security.kubernetes.io/warn-version': 'latest', + }, }, }, }, From cc29fc2bfd3ca9e5646621244bffea6c18750ae4 Mon Sep 17 00:00:00 2001 From: Matthias Loibl Date: Mon, 7 Aug 2023 13:02:07 +0200 Subject: [PATCH 2/3] run make generate --- manifests/blackboxExporter-deployment.yaml | 2 ++ manifests/kubeStateMetrics-deployment.yaml | 4 ++++ manifests/nodeExporter-daemonset.yaml | 2 ++ manifests/prometheusAdapter-deployment.yaml | 3 +++ manifests/prometheusOperator-deployment.yaml | 2 ++ manifests/setup/namespace.yaml | 3 +++ 6 files changed, 16 insertions(+) diff --git a/manifests/blackboxExporter-deployment.yaml b/manifests/blackboxExporter-deployment.yaml index 0f471c4e97..3c3b61b00d 100644 --- a/manifests/blackboxExporter-deployment.yaml +++ b/manifests/blackboxExporter-deployment.yaml @@ -105,6 +105,8 @@ spec: runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux serviceAccountName: blackbox-exporter diff --git a/manifests/kubeStateMetrics-deployment.yaml b/manifests/kubeStateMetrics-deployment.yaml index aa609edb21..a8c62717c8 100644 --- a/manifests/kubeStateMetrics-deployment.yaml +++ b/manifests/kubeStateMetrics-deployment.yaml @@ -76,6 +76,8 @@ spec: runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 + seccompProfile: + type: RuntimeDefault - args: - --secure-listen-address=:9443 - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 @@ -101,6 +103,8 @@ spec: runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux serviceAccountName: kube-state-metrics diff --git a/manifests/nodeExporter-daemonset.yaml b/manifests/nodeExporter-daemonset.yaml index 133afed558..0b37775aac 100644 --- a/manifests/nodeExporter-daemonset.yaml +++ b/manifests/nodeExporter-daemonset.yaml @@ -94,6 +94,8 @@ spec: runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 + seccompProfile: + type: RuntimeDefault hostNetwork: true hostPID: true nodeSelector: diff --git a/manifests/prometheusAdapter-deployment.yaml b/manifests/prometheusAdapter-deployment.yaml index 09caa2d7f6..7c852d529b 100644 --- a/manifests/prometheusAdapter-deployment.yaml +++ b/manifests/prometheusAdapter-deployment.yaml @@ -70,6 +70,9 @@ spec: drop: - ALL readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault startupProbe: failureThreshold: 18 httpGet: diff --git a/manifests/prometheusOperator-deployment.yaml b/manifests/prometheusOperator-deployment.yaml index de65dcae88..89a58ca048 100644 --- a/manifests/prometheusOperator-deployment.yaml +++ b/manifests/prometheusOperator-deployment.yaml @@ -73,6 +73,8 @@ spec: runAsGroup: 65532 runAsNonRoot: true runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux securityContext: diff --git a/manifests/setup/namespace.yaml b/manifests/setup/namespace.yaml index d32523606f..5ca07c8edc 100644 --- a/manifests/setup/namespace.yaml +++ b/manifests/setup/namespace.yaml @@ -1,4 +1,7 @@ apiVersion: v1 kind: Namespace metadata: + labels: + pod-security.kubernetes.io/warn: privileged + pod-security.kubernetes.io/warn-version: latest name: monitoring From fd8436ba88d4c6563193316f597a6ee5b7847f26 Mon Sep 17 00:00:00 2001 From: Matthias Loibl Date: Mon, 7 Aug 2023 15:22:30 +0200 Subject: [PATCH 3/3] jsonnetfmt addons/pyrra.libsonnet --- jsonnet/kube-prometheus/addons/pyrra.libsonnet | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jsonnet/kube-prometheus/addons/pyrra.libsonnet b/jsonnet/kube-prometheus/addons/pyrra.libsonnet index 06ed5b299e..18621853bb 100644 --- a/jsonnet/kube-prometheus/addons/pyrra.libsonnet +++ b/jsonnet/kube-prometheus/addons/pyrra.libsonnet @@ -82,7 +82,7 @@ readOnlyRootFilesystem: true, runAsNonRoot: true, capabilities: { drop: ['ALL'] }, - seccompProfile: { type: 'RuntimeDefault' }, + seccompProfile: { type: 'RuntimeDefault' }, }, };