From eda75c7c39d0cc8e01840dc1fccb632d8315d5b1 Mon Sep 17 00:00:00 2001
From: Frederic Branczyk <fbranczyk@gmail.com>
Date: Fri, 2 Oct 2020 17:29:20 +0200
Subject: [PATCH] node-exporter: Make host mounts read only and set mount
propagation
---
.../kube-prometheus/node-exporter/node-exporter.libsonnet | 8 ++++++--
manifests/node-exporter-daemonset.yaml | 6 ++++--
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet b/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
index a6fb0587..d26afefa 100644
--- a/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
+++ b/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
@@ -79,11 +79,15 @@ local k = import 'github.com/ksonnet/ksonnet-lib/ksonnet.beta.4/k.libsonnet';
toleration.withOperator('Exists');
local procVolumeName = 'proc';
local procVolume = volume.fromHostPath(procVolumeName, '/proc');
- local procVolumeMount = containerVolumeMount.new(procVolumeName, '/host/proc');
+ local procVolumeMount = containerVolumeMount.new(procVolumeName, '/host/proc').
+ withMountPropagation('HostToContainer').
+ withReadOnly(true);
local sysVolumeName = 'sys';
local sysVolume = volume.fromHostPath(sysVolumeName, '/sys');
- local sysVolumeMount = containerVolumeMount.new(sysVolumeName, '/host/sys');
+ local sysVolumeMount = containerVolumeMount.new(sysVolumeName, '/host/sys').
+ withMountPropagation('HostToContainer').
+ withReadOnly(true);
local rootVolumeName = 'root';
local rootVolume = volume.fromHostPath(rootVolumeName, '/');
diff --git a/manifests/node-exporter-daemonset.yaml b/manifests/node-exporter-daemonset.yaml
index f99a1e58..bd1d21b5 100644
--- a/manifests/node-exporter-daemonset.yaml
+++ b/manifests/node-exporter-daemonset.yaml
@@ -36,11 +36,13 @@ spec:
memory: 180Mi
volumeMounts:
- mountPath: /host/proc
+ mountPropagation: HostToContainer
name: proc
- readOnly: false
+ readOnly: true
- mountPath: /host/sys
+ mountPropagation: HostToContainer
name: sys
- readOnly: false
+ readOnly: true
- mountPath: /host/root
mountPropagation: HostToContainer
name: root
--
GitLab