From c59d03c69ea5bd131f5aaefbf55df51e9ae5b50d Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Wed, 31 Jan 2024 18:01:47 -0500 Subject: [PATCH] feat: enabled monitors everywhere and standardize resources a bit (#1281) * feat: enabled monitors everywhere and standardize resources a bit Signed-off-by: Devin Buhl * add raw tags --------- Signed-off-by: Devin Buhl --- .../cert-manager/app/helmrelease.yaml.j2 | 9 +++++--- .../app/helmrelease.yaml.j2 | 4 ++++ .../metrics-server/app/helmrelease.yaml.j2 | 4 ++++ .../reloader/app/helmrelease.yaml.j2 | 3 +++ .../spegel/app/helmrelease.yaml.j2 | 2 ++ .../cloudflared/app/helmrelease.yaml.j2 | 21 +++++++++++++------ .../echo-server/app/helmrelease.yaml.j2 | 16 +++++++++----- .../external-dns/app/helmrelease.yaml.j2 | 2 ++ .../external/helmrelease.yaml.j2 | 9 ++++++-- .../internal/helmrelease.yaml.j2 | 9 ++++++-- .../app/helmrelease.yaml.j2 | 7 +------ .../cilium-values-full.partial.yaml.j2 | 2 -- .../cilium-values-init.partial.yaml.j2 | 2 -- 13 files changed, 62 insertions(+), 28 deletions(-) diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 index 0164d921..6e14c06b 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 @@ -24,11 +24,14 @@ spec: keepHistory: false values: installCRDs: true - extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53 - - --dns01-recursive-nameservers-only + dns01RecursiveNameservers: 1.1.1.1:53,9.9.9.9:53 + dns01RecursiveNameserversOnly: true podDnsPolicy: None podDnsConfig: nameservers: - "1.1.1.1" - "9.9.9.9" + prometheus: + enabled: true + podMonitor: + enabled: true diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 index 33d3ecc4..21bc72f4 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2 @@ -26,3 +26,7 @@ spec: {% filter indent(width=4, first=True) %} {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %} {% endfilter %} + metrics: + enable: true + serviceMonitor: + enabled: true diff --git a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 index ffb498f8..b6979d69 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 @@ -28,3 +28,7 @@ spec: - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --kubelet-use-node-status-port - --metric-resolution=15s + metrics: + enabled: true + serviceMonitor: + enabled: true diff --git a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 index ff23105d..d3bb1e24 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 @@ -26,3 +26,6 @@ spec: fullnameOverride: reloader reloader: readOnlyRootFileSystem: true + podMonitor: + enabled: true + namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}" diff --git a/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 index 059b8b4d..46d9935b 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 @@ -34,3 +34,5 @@ spec: service: registry: hostPort: 29999 + serviceMonitor: + enabled: true diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 index 200bf3d8..0d6c7660 100644 --- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 @@ -35,7 +35,7 @@ spec: repository: docker.io/cloudflare/cloudflared tag: 2024.1.5 env: - NO_AUTOUPDATE: "true" + NO_AUTOUPDATE: true TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json TUNNEL_METRICS: 0.0.0.0:8080 TUNNEL_ORIGIN_ENABLE_HTTP2: true @@ -67,21 +67,30 @@ spec: readiness: *probes startup: enabled: false + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: { drop: ["ALL"] } + seccompProfile: + type: RuntimeDefault resources: requests: - cpu: 5m - memory: 128M + cpu: 10m limits: - memory: 256M + memory: 256Mi pod: securityContext: - runAsUser: 568 - runAsGroup: 568 + runAsUser: 65534 + runAsGroup: 65534 + runAsNonRoot: true service: main: ports: http: port: *port + serviceMonitor: + main: + enabled: true persistence: config: enabled: true diff --git a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 index f60b27ca..435abdde 100644 --- a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 @@ -48,16 +48,22 @@ spec: readiness: *probes startup: enabled: false + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: { drop: ["ALL"] } + seccompProfile: + type: RuntimeDefault resources: requests: - cpu: 5m - memory: 10M + cpu: 10m limits: - memory: 64M + memory: 64Mi pod: securityContext: - runAsUser: 568 - runAsGroup: 568 + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 service: main: ports: diff --git a/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 index 2527ad40..76f90410 100644 --- a/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 @@ -41,5 +41,7 @@ spec: txtPrefix: k8s. txtOwnerId: default domainFilters: ["${SECRET_DOMAIN}"] + serviceMonitor: + enabled: true podAnnotations: secret.reloader.stakater.com/reload: external-dns-secret diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 index 0487dd91..edf9b4fe 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 @@ -63,6 +63,12 @@ spec: proxy-body-size: 0 proxy-buffer-size: 16k ssl-protocols: TLSv1.3 TLSv1.2 + metrics: + enabled: true + serviceMonitor: + enabled: true + namespaceSelector: + any: true extraArgs: {% if cloudflare.acme.production %} default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" @@ -80,8 +86,7 @@ spec: app.kubernetes.io/component: controller resources: requests: - cpu: 10m - memory: 250Mi + cpu: 100m limits: memory: 500Mi defaultBackend: diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 index 2a866d04..a0f3e09b 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 @@ -60,6 +60,12 @@ spec: proxy-body-size: 0 proxy-buffer-size: 16k ssl-protocols: TLSv1.3 TLSv1.2 + metrics: + enabled: true + serviceMonitor: + enabled: true + namespaceSelector: + any: true extraArgs: {% if cloudflare.acme.production %} default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" @@ -77,8 +83,7 @@ spec: app.kubernetes.io/component: controller resources: requests: - cpu: 10m - memory: 250Mi + cpu: 100m limits: memory: 500Mi defaultBackend: diff --git a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2 index 897a1784..4abca852 100644 --- a/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/system-upgrade/system-upgrade-controller/app/helmrelease.yaml.j2 @@ -48,14 +48,9 @@ spec: fieldPath: metadata.namespace pod: securityContext: - runAsNonRoot: true runAsUser: 65534 runAsGroup: 65534 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - capabilities: - drop: ["ALL"] + runAsNonRoot: true affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: diff --git a/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 b/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 index aca34815..d6129672 100644 --- a/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 +++ b/bootstrap/templates/partials/cilium-values-full.partial.yaml.j2 @@ -1,8 +1,6 @@ autoDirectNodeRoutes: true bpf: masquerade: true -bgp: - enabled: false cluster: name: home-kubernetes id: 1 diff --git a/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 b/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 index 581ca66f..28839527 100644 --- a/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 +++ b/bootstrap/templates/partials/cilium-values-init.partial.yaml.j2 @@ -1,8 +1,6 @@ autoDirectNodeRoutes: true bpf: masquerade: true -bgp: - enabled: false cluster: name: home-kubernetes id: 1