openstack
/
openstack-helm-infra
Code Issues Proposed changes

Add Apparmor to Prometheus alert manager and snmp-notifier 

1) Added to service account name insted of traditional pod name
   to resolve for dynamic release names.
2) Added Apparmor Job to Prometheus Alert Manager.

Change-Id: Ib65f721c5b99b3ae3d3af924ca5187ad6174ed20
Signed-off-by: diwakar thyagaraj <diwakar.chitoor.thyagaraj@att.com>
This commit is contained in:
diwakar thyagaraj 2020-08-23 18:03:24 +00:00
parent fab612ce94
commit 30afcad5a2
4 changed files with 40 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
prometheus-alertmanager/templates/snmp-notifier/snmp-deployment.yaml
View File

@ -40,7 +40,7 @@ spec:
labels:
{{ tuple $envAll "snmpnotifier" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
annotations:
{{ dict "envAll" $envAll "podName" "snmpnotifier" "containerNames" (list "snmpnotifier" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
{{ dict "envAll" $envAll "podName" $serviceAccountName "containerNames" (list "snmpnotifier") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}

2
prometheus-alertmanager/templates/statefulset.yaml
View File

@ -44,7 +44,7 @@ spec:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "alertmanager" "containerNames" (list "alertmanager" "alertmanager_perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
{{ dict "envAll" $envAll "podName" $serviceAccountName "containerNames" (list "prometheus-alertmanager" "prometheus-alertmanager-perms" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}

7
prometheus-alertmanager/values_overrides/apparmor.yaml
View File

@ -2,7 +2,10 @@
pod:
mandatory_access_control:
type: apparmor
alertmanager:
alertmanager-perms: runtime/default
prometheus-alertmanager:
prometheus-alertmanager: runtime/default
prometheus-alertmanager-perms: runtime/default
init: runtime/default
snmpnotifier:
snmpnotifier: runtime/default
...

1
tools/deployment/apparmor/050-prometheus-alertmanager.sh
View File

@ -1 +0,0 @@
../osh-infra-monitoring/060-alertmanager.sh

33
tools/deployment/apparmor/050-prometheus-alertmanager.sh Executable file
View File

@ -0,0 +1,33 @@
#!/bin/bash
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
set -xe
#NOTE: Lint and package chart
make prometheus-alertmanager
: ${OSH_INFRA_EXTRA_HELM_ARGS_PROMETHEUS_ALERTMANAGER:="$(./tools/deployment/common/get-values-overrides.sh prometheus-alertmanager)"}
#NOTE: Deploy command
helm upgrade --install prometheus-alertmanager ./prometheus-alertmanager \
--namespace=osh-infra \
--set pod.replicas.alertmanager=1 \
${OSH_INFRA_EXTRA_HELM_ARGS} \
${OSH_INFRA_EXTRA_HELM_ARGS_PROMETHEUS_ALERTMANAGER}
#NOTE: Wait for deploy
./tools/deployment/common/wait-for-pods.sh osh-infra
#NOTE: Validate Deployment info
helm status prometheus-alertmanager