From cc392aaa85b721a30c7839477f9096324013fb03 Mon Sep 17 00:00:00 2001 From: "dt241s@att.com" Date: Tue, 25 Feb 2020 00:37:19 +0000 Subject: [PATCH] Add Apparmor to Grafana Added apparmor feature gate and Zuul Gate Job Change-Id: I9ce522f77447b1cb3f189ab7023c5c711e577618 --- grafana/templates/deployment.yaml | 2 +- grafana/templates/job-db-init-session.yaml | 4 ++++ grafana/values_overrides/apparmor.yaml | 7 +++++++ ...cess-exporter.sh => 075-prometheus-process-exporter.sh} | 0 tools/deployment/apparmor/080-grafana.sh | 1 + tools/deployment/osh-infra-monitoring/110-grafana.sh | 2 +- zuul.d/jobs.yaml | 3 ++- 7 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 grafana/values_overrides/apparmor.yaml rename tools/deployment/apparmor/{080-prometheus-process-exporter.sh => 075-prometheus-process-exporter.sh} (100%) create mode 120000 tools/deployment/apparmor/080-grafana.sh diff --git a/grafana/templates/deployment.yaml b/grafana/templates/deployment.yaml index 9ee3fb0e0..e5e604b7d 100644 --- a/grafana/templates/deployment.yaml +++ b/grafana/templates/deployment.yaml @@ -41,9 +41,9 @@ spec: labels: {{ tuple $envAll "grafana" "dashboard" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} annotations: -{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "grafana" "containerNames" (list "grafana") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: {{ dict "envAll" $envAll "application" "dashboard" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} diff --git a/grafana/templates/job-db-init-session.yaml b/grafana/templates/job-db-init-session.yaml index e22be2387..68064da19 100644 --- a/grafana/templates/job-db-init-session.yaml +++ b/grafana/templates/job-db-init-session.yaml @@ -31,6 +31,10 @@ spec: metadata: labels: {{ tuple $envAll "grafana" "db-init" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} + annotations: + configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} + configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} +{{ dict "envAll" $envAll "podName" "grafana-db-init-session" "containerNames" (list "grafana-db-init-session") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: {{ dict "envAll" $envAll "application" "db_init" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} serviceAccountName: {{ $serviceAccountName }} diff --git a/grafana/values_overrides/apparmor.yaml b/grafana/values_overrides/apparmor.yaml new file mode 100644 index 000000000..f73531d9f --- /dev/null +++ b/grafana/values_overrides/apparmor.yaml @@ -0,0 +1,7 @@ +pod: + mandatory_access_control: + type: apparmor + grafana: + grafana: runtime/default + grafana-db-init-session: + grafana-db-init-session: runtime/default diff --git a/tools/deployment/apparmor/080-prometheus-process-exporter.sh b/tools/deployment/apparmor/075-prometheus-process-exporter.sh similarity index 100% rename from tools/deployment/apparmor/080-prometheus-process-exporter.sh rename to tools/deployment/apparmor/075-prometheus-process-exporter.sh diff --git a/tools/deployment/apparmor/080-grafana.sh b/tools/deployment/apparmor/080-grafana.sh new file mode 120000 index 000000000..60dc21427 --- /dev/null +++ b/tools/deployment/apparmor/080-grafana.sh @@ -0,0 +1 @@ +../osh-infra-monitoring/110-grafana.sh \ No newline at end of file diff --git a/tools/deployment/osh-infra-monitoring/110-grafana.sh b/tools/deployment/osh-infra-monitoring/110-grafana.sh index 4b6a98ba9..9036ffb5b 100755 --- a/tools/deployment/osh-infra-monitoring/110-grafana.sh +++ b/tools/deployment/osh-infra-monitoring/110-grafana.sh @@ -19,7 +19,7 @@ set -xe #NOTE: Lint and package chart make grafana -FEATURE_GATES="calico,ceph,containers,coredns,elasticsearch,kubernetes,nginx,nodes,openstack,prometheus" +FEATURE_GATES="calico,ceph,containers,coredns,elasticsearch,kubernetes,nginx,nodes,openstack,prometheus,apparmor" : ${OSH_INFRA_EXTRA_HELM_ARGS_GRAFANA:="$({ ./tools/deployment/common/get-values-overrides.sh grafana;} 2> /dev/null)"} #NOTE: Deploy command diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index 998fd186a..781a65392 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -280,7 +280,8 @@ - ./tools/deployment/apparmor/055-prometheus.sh - ./tools/deployment/apparmor/060-prometheus-node-exporter.sh - ./tools/deployment/apparmor/070-prometheus-openstack-exporter.sh - - ./tools/deployment/apparmor/080-prometheus-process-exporter.sh + - ./tools/deployment/apparmor/075-prometheus-process-exporter.sh + - ./tools/deployment/apparmor/080-grafana.sh - ./tools/deployment/apparmor/085-rabbitmq.sh - ./tools/deployment/apparmor/090-elasticsearch.sh - ./tools/deployment/apparmor/100-fluentbit.sh