Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/kube-prometheus] feat: ✨ 🔒 Add readOnlyRootFilesystem support (#23942)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-02-27 13:51:52 +01:00
committed by GitHub
parent 11b99af423
commit d851f49f4c
7 changed files with 63 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/kube-prometheus/Chart.yaml
+1 -1
View File
@@ -46,4 +46,4 @@ maintainers:
name: kube-prometheus
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus
version: 8.28.2
version: 8.29.0
bitnami/kube-prometheus/README.md
+6
View File
@@ -122,6 +122,7 @@ The command removes all the Kubernetes components associated with the chart and
| `operator.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `operator.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `operator.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `operator.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `operator.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `operator.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `operator.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -202,6 +203,7 @@ The command removes all the Kubernetes components associated with the chart and
| `operator.prometheusConfigReloader.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `operator.prometheusConfigReloader.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `operator.prometheusConfigReloader.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `operator.prometheusConfigReloader.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `operator.prometheusConfigReloader.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `operator.prometheusConfigReloader.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `operator.prometheusConfigReloader.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -243,6 +245,7 @@ The command removes all the Kubernetes components associated with the chart and
| `prometheus.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `prometheus.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `prometheus.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `prometheus.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `prometheus.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `prometheus.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `prometheus.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -402,6 +405,7 @@ The command removes all the Kubernetes components associated with the chart and
| `prometheus.thanos.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `prometheus.thanos.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `prometheus.thanos.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `prometheus.thanos.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `prometheus.thanos.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `prometheus.thanos.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `prometheus.thanos.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -502,6 +506,7 @@ The command removes all the Kubernetes components associated with the chart and
| `alertmanager.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `alertmanager.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `alertmanager.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `alertmanager.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `alertmanager.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `alertmanager.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `alertmanager.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
@@ -692,6 +697,7 @@ The command removes all the Kubernetes components associated with the chart and
| `blackboxExporter.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `blackboxExporter.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
| `blackboxExporter.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `blackboxExporter.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `0` |
| `blackboxExporter.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `blackboxExporter.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `blackboxExporter.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
bitnami/kube-prometheus/templates/alertmanager/alertmanager.yaml
+13 -6
View File
@@ -99,12 +99,19 @@ spec:
{{- if .Values.alertmanager.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.alertmanager.tolerations "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.alertmanager.volumes }}
volumes: {{- include "common.tplvalues.render" (dict "value" .Values.alertmanager.volumes "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.alertmanager.volumeMounts }}
volumeMounts: {{- include "common.tplvalues.render" (dict "value" .Values.alertmanager.volumeMounts "context" $) | nindent 4 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.alertmanager.volumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.alertmanager.volumes "context" $) | nindent 4 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.alertmanager.volumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.alertmanager.volumeMounts "context" $) | nindent 4 }}
{{- end }}
{{- include "kube-prometheus.imagePullSecrets" . | indent 2 }}
{{- if or .Values.alertmanager.containers .Values.alertmanager.containerSecurityContext.enabled .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled }}
containers:
bitnami/kube-prometheus/templates/blackbox-exporter/deployment.yaml
+5
View File
@@ -133,6 +133,9 @@ spec:
volumeMounts:
- name: blackbox-exporter-config
mountPath: /bitnami/blackbox-exporter/conf
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.blackboxExporter.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.blackboxExporter.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -140,6 +143,8 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.blackboxExporter.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
- name: blackbox-exporter-config
configMap:
name: {{ template "kube-prometheus.blackboxExporter.configmapName" . }}
bitnami/kube-prometheus/templates/prometheus-operator/deployment.yaml
+13 -6
View File
@@ -168,13 +168,20 @@ spec:
{{- else if ne .Values.operator.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.operator.resourcesPreset) | nindent 12 }}
{{- end }}
{{- if .Values.operator.extraVolumeMounts }}
volumeMounts: {{- include "common.tplvalues.render" (dict "value" .Values.operator.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.operator.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.operator.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.operator.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.operator.sidecars "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.operator.extraVolumes }}
volumes: {{- include "common.tplvalues.render" (dict "value" .Values.operator.extraVolumes "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.operator.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.operator.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- end }}
bitnami/kube-prometheus/templates/prometheus/prometheus.yaml
+13 -6
View File
@@ -220,12 +220,19 @@ spec:
{{- if .Values.prometheus.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.prometheus.topologySpreadConstraints "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.prometheus.volumes }}
volumes: {{- include "common.tplvalues.render" (dict "value" .Values.prometheus.volumes "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.prometheus.volumeMounts }}
volumeMounts: {{- include "common.tplvalues.render" (dict "value" .Values.prometheus.volumeMounts "context" $) | nindent 4 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if .Values.prometheus.volumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.prometheus.volumes "context" $) | nindent 4 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if .Values.prometheus.volumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.prometheus.volumeMounts "context" $) | nindent 4 }}
{{- end }}
{{- if or .Values.prometheus.additionalScrapeConfigs.enabled .Values.prometheus.additionalScrapeConfigsExternal.enabled }}
additionalScrapeConfigs:
{{- if and .Values.prometheus.additionalScrapeConfigs.enabled (eq .Values.prometheus.additionalScrapeConfigs.type "external") }}
bitnami/kube-prometheus/values.yaml
+12
View File
@@ -190,6 +190,7 @@ operator:
## @param operator.containerSecurityContext.enabled Enabled containers' Security Context
## @param operator.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param operator.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param operator.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param operator.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param operator.containerSecurityContext.privileged Set container's Security Context privileged
## @param operator.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -201,6 +202,7 @@ operator:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -533,6 +535,7 @@ operator:
## @param operator.prometheusConfigReloader.containerSecurityContext.enabled Enabled containers' Security Context
## @param operator.prometheusConfigReloader.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param operator.prometheusConfigReloader.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param operator.prometheusConfigReloader.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param operator.prometheusConfigReloader.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param operator.prometheusConfigReloader.containerSecurityContext.privileged Set container's Security Context privileged
## @param operator.prometheusConfigReloader.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -544,6 +547,7 @@ operator:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -657,6 +661,7 @@ prometheus:
## @param prometheus.containerSecurityContext.enabled Enabled containers' Security Context
## @param prometheus.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param prometheus.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param prometheus.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param prometheus.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param prometheus.containerSecurityContext.privileged Set container's Security Context privileged
## @param prometheus.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -668,6 +673,7 @@ prometheus:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -1384,6 +1390,7 @@ prometheus:
## @param prometheus.thanos.containerSecurityContext.enabled Enabled containers' Security Context
## @param prometheus.thanos.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param prometheus.thanos.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param prometheus.thanos.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param prometheus.thanos.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param prometheus.thanos.containerSecurityContext.privileged Set container's Security Context privileged
## @param prometheus.thanos.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -1395,6 +1402,7 @@ prometheus:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -1822,6 +1830,7 @@ alertmanager:
## @param alertmanager.containerSecurityContext.enabled Enabled containers' Security Context
## @param alertmanager.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param alertmanager.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param alertmanager.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param alertmanager.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param alertmanager.containerSecurityContext.privileged Set container's Security Context privileged
## @param alertmanager.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -1833,6 +1842,7 @@ alertmanager:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
@@ -2645,6 +2655,7 @@ blackboxExporter:
## @param blackboxExporter.containerSecurityContext.enabled Enabled containers' Security Context
## @param blackboxExporter.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param blackboxExporter.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param blackboxExporter.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
## @param blackboxExporter.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param blackboxExporter.containerSecurityContext.privileged Set container's Security Context privileged
## @param blackboxExporter.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
@@ -2656,6 +2667,7 @@ blackboxExporter:
enabled: true
seLinuxOptions: null
runAsUser: 1001
runAsGroup: 0
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false