openstack
/
openstack-helm-infra
Code Issues Proposed changes

Add Apparmor to Grafana 

Added apparmor feature gate and Zuul Gate Job

Change-Id: I9ce522f77447b1cb3f189ab7023c5c711e577618
This commit is contained in:
dt241s@att.com 2020-02-25 00:37:19 +00:00 committed by diwakar thyagaraj
parent e54f5f778f
commit cc392aaa85
7 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
grafana/templates/deployment.yaml
View File

@ -41,9 +41,9 @@ spec:
labels:
{{ tuple $envAll "grafana" "dashboard" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
annotations:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "grafana" "containerNames" (list "grafana") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "dashboard" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}

4
grafana/templates/job-db-init-session.yaml
View File

@ -31,6 +31,10 @@ spec:
metadata:
labels:
{{ tuple $envAll "grafana" "db-init" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
annotations:
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
{{ dict "envAll" $envAll "podName" "grafana-db-init-session" "containerNames" (list "grafana-db-init-session") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
spec:
{{ dict "envAll" $envAll "application" "db_init" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
serviceAccountName: {{ $serviceAccountName }}

7
grafana/values_overrides/apparmor.yaml Normal file
View File

@ -0,0 +1,7 @@
pod:
mandatory_access_control:
type: apparmor
grafana:
grafana: runtime/default
grafana-db-init-session:
grafana-db-init-session: runtime/default

0
tools/deployment/apparmor/080-prometheus-process-exporter.sh → tools/deployment/apparmor/075-prometheus-process-exporter.sh
View File

1
tools/deployment/apparmor/080-grafana.sh Symbolic link
View File

@ -0,0 +1 @@
../osh-infra-monitoring/110-grafana.sh

2
tools/deployment/osh-infra-monitoring/110-grafana.sh
View File

@ -19,7 +19,7 @@ set -xe
#NOTE: Lint and package chart
make grafana
FEATURE_GATES="calico,ceph,containers,coredns,elasticsearch,kubernetes,nginx,nodes,openstack,prometheus"
FEATURE_GATES="calico,ceph,containers,coredns,elasticsearch,kubernetes,nginx,nodes,openstack,prometheus,apparmor"
: ${OSH_INFRA_EXTRA_HELM_ARGS_GRAFANA:="$({ ./tools/deployment/common/get-values-overrides.sh grafana;} 2> /dev/null)"}
#NOTE: Deploy command

3
zuul.d/jobs.yaml
View File

@ -280,7 +280,8 @@
- ./tools/deployment/apparmor/055-prometheus.sh
- ./tools/deployment/apparmor/060-prometheus-node-exporter.sh
- ./tools/deployment/apparmor/070-prometheus-openstack-exporter.sh
- ./tools/deployment/apparmor/080-prometheus-process-exporter.sh
- ./tools/deployment/apparmor/075-prometheus-process-exporter.sh
- ./tools/deployment/apparmor/080-grafana.sh
- ./tools/deployment/apparmor/085-rabbitmq.sh
- ./tools/deployment/apparmor/090-elasticsearch.sh
- ./tools/deployment/apparmor/100-fluentbit.sh