From 30afcad5a2a33abd3a43f9e2957db9ccbbef90ae Mon Sep 17 00:00:00 2001 From: diwakar thyagaraj Date: Sun, 23 Aug 2020 18:03:24 +0000 Subject: [PATCH] Add Apparmor to Prometheus alert manager and snmp-notifier 1) Added to service account name insted of traditional pod name to resolve for dynamic release names. 2) Added Apparmor Job to Prometheus Alert Manager. Change-Id: Ib65f721c5b99b3ae3d3af924ca5187ad6174ed20 Signed-off-by: diwakar thyagaraj --- .../snmp-notifier/snmp-deployment.yaml | 2 +- .../templates/statefulset.yaml | 2 +- .../values_overrides/apparmor.yaml | 7 ++-- .../apparmor/050-prometheus-alertmanager.sh | 34 ++++++++++++++++++- 4 files changed, 40 insertions(+), 5 deletions(-) mode change 120000 => 100755 tools/deployment/apparmor/050-prometheus-alertmanager.sh diff --git a/prometheus-alertmanager/templates/snmp-notifier/snmp-deployment.yaml b/prometheus-alertmanager/templates/snmp-notifier/snmp-deployment.yaml index c7aa79adb..9823286b8 100644 --- a/prometheus-alertmanager/templates/snmp-notifier/snmp-deployment.yaml +++ b/prometheus-alertmanager/templates/snmp-notifier/snmp-deployment.yaml @@ -40,7 +40,7 @@ spec: labels: {{ tuple $envAll "snmpnotifier" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} annotations: -{{ dict "envAll" $envAll "podName" "snmpnotifier" "containerNames" (list "snmpnotifier" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} +{{ dict "envAll" $envAll "podName" $serviceAccountName "containerNames" (list "snmpnotifier") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: {{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} diff --git a/prometheus-alertmanager/templates/statefulset.yaml b/prometheus-alertmanager/templates/statefulset.yaml index e23a41ad3..86bf4fe3b 100644 --- a/prometheus-alertmanager/templates/statefulset.yaml +++ b/prometheus-alertmanager/templates/statefulset.yaml @@ -44,7 +44,7 @@ spec: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} -{{ dict "envAll" $envAll "podName" "alertmanager" "containerNames" (list "alertmanager" "alertmanager_perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} +{{ dict "envAll" $envAll "podName" $serviceAccountName "containerNames" (list "prometheus-alertmanager" "prometheus-alertmanager-perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: {{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} diff --git a/prometheus-alertmanager/values_overrides/apparmor.yaml b/prometheus-alertmanager/values_overrides/apparmor.yaml index 93b0c2760..4849de5db 100644 --- a/prometheus-alertmanager/values_overrides/apparmor.yaml +++ b/prometheus-alertmanager/values_overrides/apparmor.yaml @@ -2,7 +2,10 @@ pod: mandatory_access_control: type: apparmor - alertmanager: - alertmanager-perms: runtime/default + prometheus-alertmanager: + prometheus-alertmanager: runtime/default + prometheus-alertmanager-perms: runtime/default init: runtime/default + snmpnotifier: + snmpnotifier: runtime/default ... diff --git a/tools/deployment/apparmor/050-prometheus-alertmanager.sh b/tools/deployment/apparmor/050-prometheus-alertmanager.sh deleted file mode 120000 index 8c33bb27f..000000000 --- a/tools/deployment/apparmor/050-prometheus-alertmanager.sh +++ /dev/null @@ -1 +0,0 @@ -../osh-infra-monitoring/060-alertmanager.sh \ No newline at end of file diff --git a/tools/deployment/apparmor/050-prometheus-alertmanager.sh b/tools/deployment/apparmor/050-prometheus-alertmanager.sh new file mode 100755 index 000000000..28c16c082 --- /dev/null +++ b/tools/deployment/apparmor/050-prometheus-alertmanager.sh @@ -0,0 +1,33 @@ +#!/bin/bash + +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +set -xe + +#NOTE: Lint and package chart +make prometheus-alertmanager + +: ${OSH_INFRA_EXTRA_HELM_ARGS_PROMETHEUS_ALERTMANAGER:="$(./tools/deployment/common/get-values-overrides.sh prometheus-alertmanager)"} + +#NOTE: Deploy command +helm upgrade --install prometheus-alertmanager ./prometheus-alertmanager \ + --namespace=osh-infra \ + --set pod.replicas.alertmanager=1 \ + ${OSH_INFRA_EXTRA_HELM_ARGS} \ + ${OSH_INFRA_EXTRA_HELM_ARGS_PROMETHEUS_ALERTMANAGER} + +#NOTE: Wait for deploy +./tools/deployment/common/wait-for-pods.sh osh-infra + +#NOTE: Validate Deployment info +helm status prometheus-alertmanager