From dee254fa01293618dc8dd77cc228c157234f9c85 Mon Sep 17 00:00:00 2001
From: Matthias Loibl <mail@matthiasloibl.com>
Date: Fri, 7 Dec 2018 17:32:34 +0100
Subject: [PATCH] contrib/kube-prometheus: Set securityContext in the manifests
---
.../kube-prometheus/alertmanager/alertmanager.libsonnet | 5 +++++
jsonnet/kube-prometheus/prometheus/prometheus.libsonnet | 7 ++++++-
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/jsonnet/kube-prometheus/alertmanager/alertmanager.libsonnet b/jsonnet/kube-prometheus/alertmanager/alertmanager.libsonnet
index e109b0ad..347d9a3c 100644
--- a/jsonnet/kube-prometheus/alertmanager/alertmanager.libsonnet
+++ b/jsonnet/kube-prometheus/alertmanager/alertmanager.libsonnet
@@ -113,6 +113,11 @@ local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
baseImage: $._config.imageRepos.alertmanager,
nodeSelector: { 'beta.kubernetes.io/os': 'linux' },
serviceAccountName: 'alertmanager-' + $._config.alertmanager.name,
+ securityContext: {
+ runAsUser: 1000,
+ runAsNonRoot: true,
+ fsGroup: 2000,
+ },
},
},
},
diff --git a/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet b/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet
index 8d19c456..c745f1c4 100644
--- a/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet
+++ b/jsonnet/kube-prometheus/prometheus/prometheus.libsonnet
@@ -40,7 +40,7 @@ local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
service.new('prometheus-' + $._config.prometheus.name, { app: 'prometheus', prometheus: $._config.prometheus.name }, prometheusPort) +
service.mixin.metadata.withNamespace($._config.namespace) +
service.mixin.metadata.withLabels({ prometheus: $._config.prometheus.name }),
- [if $._config.prometheus.rules != null && $._config.prometheus.rules != {} then "rules"]:
+ [if $._config.prometheus.rules != null && $._config.prometheus.rules != {} then 'rules']:
{
apiVersion: 'monitoring.coreos.com/v1',
kind: 'PrometheusRule',
@@ -185,6 +185,11 @@ local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
},
],
},
+ securityContext: {
+ runAsUser: 1000,
+ runAsNonRoot: true,
+ fsGroup: 2000,
+ },
},
},
serviceMonitor:
--
GitLab