Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(base-cluster/monitoring): fix most of resource linting errors #741

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

feat(base-cluster/monitoring): fix most of resource linting errors #741

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
eceaa0f
feat(base-cluster/monitoring): fix most of resource linting errors
marvinWolff Jan 23, 2024
b0f9169
fix(base-cluster/cert-manager): fix styling
marvinWolff Jan 23, 2024
be9ee51
feat(base-cluster/monitoring): set resource presets
marvinWolff Aug 30, 2024
676293b
fix(base-cluster/monitoring): fix typo
marvinWolff Aug 30, 2024
8c4492e
Update charts/base-cluster/templates/flux/_create-authentication-key-…
marvinWolff Sep 6, 2024
5687923
Update charts/base-cluster/templates/flux/_create-authentication-key-…
marvinWolff Sep 6, 2024
59a3983
Update charts/base-cluster/templates/monitoring/security/trivy.yaml
marvinWolff Sep 6, 2024
228f59d
Update charts/base-cluster/values.yaml
marvinWolff Sep 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions charts/base-cluster/templates/backup/velero.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ spec:
volumeMounts:
- mountPath: /target
name: plugins
resources: {{- include "common.resources" .Values.backup.initContainer | nindent 10 }}
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
Expand Down
9 changes: 9 additions & 0 deletions charts/base-cluster/templates/cert-manager/cert-manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,16 @@ spec:
{{- if .Values.global.imageRegistry }}
image:
repository: {{ printf "%s/jetstack/cert-manager-controller" $.Values.global.imageRegistry }}
{{- end }}
startupapicheck:
resources: {{- include "common.resources" $.Values.certManager.startupapicheck | nindent 8 }}
limits:
cpu: 50m
memory: 100m
requests:
cpu: 10m
memory: 10m
{{- if .Values.global.imageRegistry }}
image:
repository: {{ printf "%s/jetstack/cert-manager-ctl" $.Values.global.imageRegistry }}
{{- end }}
Expand Down
31 changes: 31 additions & 0 deletions charts/base-cluster/templates/flux/_create-authentication-key-secret-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,18 @@ spec:
containers:
- name: generate-ssh-key
image: {{ template "base-cluster.flux.image" .context }}
{{- if .context.Values.global.flux.image.digest }}
imagePullPolicy: IfNotPresent
{{- else }}
imagePullPolicy: Always
{{- end }}
marvinWolff marked this conversation as resolved.
Show resolved Hide resolved
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 50m
memory: 100m
imagePullPolicy: {{ empty .Values.global.flux.image.digest | ternary "Always" "IfNotPresent" }}
securityContext:
readOnlyRootFilesystem: true
Expand Down Expand Up @@ -55,6 +67,13 @@ spec:
value: {{ .identity }}
- name: GNUPGHOME
value: /tmp/gnupg
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 50m
memory: 100m
securityContext:
readOnlyRootFilesystem: true
privileged: false
Expand Down Expand Up @@ -89,6 +108,18 @@ spec:
containers:
- name: create-k8s-secret
image: {{ include "base-cluster.kubectl.image" .context }}
{{- if .context.Values.global.kubectl.image.digest }}
imagePullPolicy: IfNotPresent
{{- else }}
imagePullPolicy: Always
{{- end }}
marvinWolff marked this conversation as resolved.
Show resolved Hide resolved
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 10m
memory: 10m
imagePullPolicy: {{ empty .Values.global.kubectl.image.digest | ternary "Always" "IfNotPresent" }}
securityContext:
readOnlyRootFilesystem: true
Expand Down
7 changes: 7 additions & 0 deletions charts/base-cluster/templates/global/prevent-uninstallation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ spec:
- name: fail
image: {{ template "base-cluster.kubectl.image" . }}
imagePullPolicy: {{ empty .Values.global.kubectl.image.digest | ternary "Always" "IfNotPresent" }}
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 50m
memory: 100m
securityContext:
readOnlyRootFilesystem: true
privileged: false
Expand Down
1 change: 1 addition & 0 deletions charts/base-cluster/templates/ingress/nginx.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ spec:
{{- if .Values.monitoring.tracing.enabled }}
opentelemetry:
enabled: true
resources: {{- include "common.resources" .Values.ingress | nindent 10 }}
{{- if and .Values.global.imageRegistry false }}
# TODO: this is not really viable, therefore we skip this image for mirroring until this is adjusted upstream
image: {{ printf "%s/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472" .Values.global.imageRegistry }}
Expand Down
7 changes: 7 additions & 0 deletions charts/base-cluster/templates/monitoring/deadMansSwitch/registration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,13 @@ spec:
- name: register
image: {{ include "base-cluster.curl.image" . }}
imagePullPolicy: {{ empty .Values.global.kubectl.image.digest | ternary "Always" "IfNotPresent" }}
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 50m
memory: 100m
securityContext:
allowPrivilegeEscalation: false
capabilities:
Expand Down
8 changes: 8 additions & 0 deletions charts/base-cluster/templates/monitoring/kube-prometheus-stack/_grafana-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ imageRenderer:
runAsNonRoot: true
runAsUser: 472
runAsGroup: 472
resources: {{- include "common.resources" .Values.monitoring.grafana.imageRenderer | nindent 2 }}
enabled: true
securityContext:
seccompProfile:
Expand Down Expand Up @@ -191,6 +192,13 @@ envValueFrom:
grafana.ini: {{- $grafanaIni | toYaml | nindent 2 }}
{{- end }}
downloadDashboards:
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 10m
memory: 10m
securityContext: {{- include "base-cluster.prometheus-stack.containerSecurityContext" (dict) | nindent 4 }}
initChownData:
enabled: false
Expand Down
9 changes: 9 additions & 0 deletions charts/base-cluster/templates/monitoring/kube-prometheus-stack/_prometheus-stack-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,15 @@ global:
imageRegistry: {{ .Values.global.imageRegistry }}
{{- end }}
prometheusOperator:
admissionWebhooks:
patch:
resources:
limits:
cpu: 50m
memory: 100m
requests:
cpu: 10m
memory: 10m
secretFieldSelector: 'type!=helm.sh/release.v1'
resources: {{- include "common.resources" .Values.monitoring.prometheus.operator | nindent 4 }}
priorityClassName: monitoring-components
Expand Down
4 changes: 4 additions & 0 deletions charts/base-cluster/templates/monitoring/metrics-server/metrics-server.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ spec:
global:
imageRegistry: {{ $.Values.global.imageRegistry }}
{{- end }}
resources:
limits:
cpu: 100m
memory: 64Mi
replicas: 2
priorityClassName: cluster-components
podDisruptionBudget:
Expand Down
6 changes: 1 addition & 5 deletions charts/base-cluster/templates/monitoring/security/trivy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ spec:
upgrade:
crds: CreateReplace
values:
resources: {{ include "common.resources" .Values.monitoring.securityScanning | nindent 6 }}
marvinWolff marked this conversation as resolved.
Show resolved Hide resolved
{{- if .Values.global.imageRegistry }}
image:
registry: {{ $.Values.global.imageRegistry }}
Expand All @@ -44,11 +45,6 @@ spec:
registry: {{ $.Values.global.imageRegistry }}
{{- end }}
ignoreUnfixed: true
resources:
requests:
memory: 256Mi
limits:
memory: 4Gi
Comment on lines -47 to -51
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably remove accidentaly.

Will re-add it.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah no, no accident.

I miss placed it before. According to the values, resources is a top level key of the values: https://github.com/aquasecurity/trivy/blob/main/helm/trivy/values.yaml#L21

operator:
scanJobsConcurrentLimit: 3
metricsVulnIdEnabled: true
Expand Down
20 changes: 19 additions & 1 deletion charts/base-cluster/templates/monitoring/tracing/grafana-tempo.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,32 @@ spec:
global:
imageRegistry: {{ $.Values.global.imageRegistry }}
{{- end }}
ingester: {{- include "common.resourcesWithPreset" .Values.monitoring.tracing.ingester | nindent 6 }}
tempo:
traces:
jaeger:
grpc: false
thriftHttp: false
otlp:
grpc: true
resources: {{- include "common.resources" .Values.monitoring.tracing.tempo | nindent 6 }}
ingester:
resources: {{- include "common.resources" .Values.monitoring.tracing.ingester | nindent 6 }}
query:
resources: {{- include "common.resources" .Values.monitoring.tracing.query | nindent 6 }}
querier:
resources: {{- include "common.resources" .Values.monitoring.tracing.querier | nindent 6 }}
distributor:
resources: {{- include "common.resources" .Values.monitoring.tracing.distributor | nindent 6 }}
memcached:
resources: {{- include "common.resources" .Values.monitoring.tracing.memcached | nindent 6 }}
compactor:
resources: {{- include "common.resources" .Values.monitoring.tracing.compactor | nindent 6 }}
metricsGenerator:
resources: {{- include "common.resources" .Values.monitoring.tracing.metricsGenerator | nindent 6 }}
queryFrontend:
resources: {{- include "common.resources" .Values.monitoring.tracing.queryFrontend | nindent 6 }}
vulture:
resources: {{- include "common.resources" .Values.monitoring.tracing.vulture | nindent 6 }}
metrics:
enabled: true
serviceMonitor:
Expand Down
7 changes: 7 additions & 0 deletions charts/base-cluster/templates/monitoring/tracing/opentelemetry-collector.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,13 @@ spec:
mode: daemonset
service:
enabled: true
resources:
limits:
cpu: 250m
memory: 512Mi
requests:
cpu: 10m
memory: 60Mi
config:
receivers:
prometheus: null
Expand Down
1 change: 1 addition & 0 deletions charts/base-cluster/templates/nfs-server-provisioner/nfs-server-provisioner.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ spec:
image:
repository: {{ printf "%s/sig-storage/nfs-provisioner" $.Values.global.imageRegistry }}
{{- end }}
resources: {{- include "common.resources" .Values.nfsServerProvisioner | nindent 6 }}
podSecurityContext:
seccompProfile:
type: Unconfined
Expand Down
Loading