mirrors/kube-prometheus
1
0
Fork 0
mirror of https://github.com/prometheus-operator/kube-prometheus.git synced 2025-08-27 01:11:53 +02:00
Code Issues Projects Releases Wiki Activity

node-exporter: Make host mounts read only and set mount propagation

Browse Source
This commit is contained in:
Frederic Branczyk 2020-10-02 17:29:20 +02:00
parent 9cbafdb812
commit eda75c7c39
No known key found for this signature in database
GPG Key ID: 576DA6AF8CB9027F
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
View File

@ -79,11 +79,15 @@ local k = import 'github.com/ksonnet/ksonnet-lib/ksonnet.beta.4/k.libsonnet';
toleration.withOperator('Exists'); toleration.withOperator('Exists');
local procVolumeName = 'proc'; local procVolumeName = 'proc';
local procVolume = volume.fromHostPath(procVolumeName, '/proc'); local procVolume = volume.fromHostPath(procVolumeName, '/proc');
local procVolumeMount = containerVolumeMount.new(procVolumeName, '/host/proc'); local procVolumeMount = containerVolumeMount.new(procVolumeName, '/host/proc').
withMountPropagation('HostToContainer').
withReadOnly(true);
local sysVolumeName = 'sys'; local sysVolumeName = 'sys';
local sysVolume = volume.fromHostPath(sysVolumeName, '/sys'); local sysVolume = volume.fromHostPath(sysVolumeName, '/sys');
local sysVolumeMount = containerVolumeMount.new(sysVolumeName, '/host/sys'); local sysVolumeMount = containerVolumeMount.new(sysVolumeName, '/host/sys').
withMountPropagation('HostToContainer').
withReadOnly(true);
local rootVolumeName = 'root'; local rootVolumeName = 'root';
local rootVolume = volume.fromHostPath(rootVolumeName, '/'); local rootVolume = volume.fromHostPath(rootVolumeName, '/');

6
manifests/node-exporter-daemonset.yaml
View File

@ -36,11 +36,13 @@ spec:
memory: 180Mi memory: 180Mi
volumeMounts: volumeMounts:
- mountPath: /host/proc - mountPath: /host/proc
mountPropagation: HostToContainer
name: proc name: proc
readOnly: false readOnly: true
- mountPath: /host/sys - mountPath: /host/sys
mountPropagation: HostToContainer
name: sys name: sys
readOnly: false readOnly: true
- mountPath: /host/root - mountPath: /host/root
mountPropagation: HostToContainer mountPropagation: HostToContainer
name: root name: root