easylinux/kube-prometheus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
361bc437744029b75e878f0dfee547adcc3e69a9
kube-prometheus/docs/security.md
Arthur Silva Sens db61b3e18e Merge pull request #1591 from paulfantom/automountServiceAccountToken 
disable injecting unnecessary variables allowing access to k8s API
2022-02-05 18:28:33 +00:00

1.7 KiB
Raw Blame History

Security

The manifests generated in this repository are subject to a security audit in CI via kubescape. The scan can be run locally via make kubescape.

While we aim for best practices in terms of security by default, due to the nature of the project, we are required to make the exceptions in the following components:

node-exporter

  • Host Port is set. Kubernetes already sets a Host Port by default when Host Network is enabled.. Since nothing can be done here, we configure it to our preference port.
  • Host PID is set to true, since node-exporter requires direct access to the host namespace to gather statistics.
  • Host Network is set to true, since node-exporter requires direct access to the host network to gather statistics.
  • automountServiceAccountToken is set to true on Pod level as kube-rbac-proxy sidecar requires connection to kubernetes API server.

prometheus-adapter

  • automountServiceAccountToken is set to true on Pod level as application requires connection to kubernetes API server.

blackbox-exporter

  • automountServiceAccountToken is set to true on Pod level as kube-rbac-proxy sidecar requires connection to kubernetes API server.

kube-state-metrics

  • automountServiceAccountToken is set to true on Pod level as kube-rbac-proxy sidecars requires connection to kubernetes API server.

prometheus-operator

  • automountServiceAccountToken is set to true on Pod level as kube-rbac-proxy sidecars requires connection to kubernetes API server.