Commit released Helm Chart and docs for TrueCharts
Signed-off-by: TrueCharts-Bot <bot@truecharts.org>
This commit is contained in:
TrueCharts-Bot
@@ -1,6 +1,15 @@
|
||||
# Changelog<br>
|
||||
|
||||
|
||||
<a name="prometheus-1.1.69"></a>
|
||||
### [prometheus-1.1.69](https://github.com/truecharts/apps/compare/prometheus-1.1.68...prometheus-1.1.69) (2022-02-26)
|
||||
|
||||
#### Fix
|
||||
|
||||
* enable hostNetworking and change port ([#1969](https://github.com/truecharts/apps/issues/1969))
|
||||
|
||||
|
||||
|
||||
<a name="prometheus-1.1.68"></a>
|
||||
### [prometheus-1.1.68](https://github.com/truecharts/apps/compare/prometheus-1.1.67...prometheus-1.1.68) (2022-02-26)
|
||||
|
||||
|
||||
@@ -151,8 +151,9 @@ You will, however, be able to use all values referenced in the common chart here
|
||||
| kubelet.serviceMonitor.relabelings | list | `[]` | |
|
||||
| node-exporter.extraArgs."collector.filesystem.ignored-fs-types" | string | `"^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$"` | |
|
||||
| node-exporter.extraArgs."collector.filesystem.ignored-mount-points" | string | `"^/(dev|proc|sys|var/lib/docker/.+)($|/)"` | |
|
||||
| node-exporter.hostNetwork | bool | `false` | |
|
||||
| node-exporter.service.labels.jobLabel | string | `"node-exporter"` | |
|
||||
| node-exporter.service.port | int | `9910` | |
|
||||
| node-exporter.service.targetPort | int | `9910` | |
|
||||
| node-exporter.serviceMonitor.enabled | bool | `true` | |
|
||||
| node-exporter.serviceMonitor.jobLabel | string | `"jobLabel"` | |
|
||||
| operator.configReloaderResources | object | `{}` | |
|
||||
|
||||
@@ -52,6 +52,7 @@ hide:
|
||||
|:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------|
|
||||
| Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM | <details><summary>Expand...</summary> A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. <br> <hr> <br> Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.allowPrivilegeEscalation' to false </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv001">https://avd.aquasec.com/appshield/ksv001</a><br></details> |
|
||||
| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW | <details><summary>Expand...</summary> The container should drop all default capabilities and add only those that are needed for its execution. <br> <hr> <br> Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should add 'ALL' to 'securityContext.capabilities.drop' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/">https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/</a><br><a href="https://avd.aquasec.com/appshield/ksv003">https://avd.aquasec.com/appshield/ksv003</a><br></details> |
|
||||
| Kubernetes Security Check | KSV009 | Access to host network | HIGH | <details><summary>Expand...</summary> Sharing the host’s network namespace permits processes in the pod to communicate with processes bound to the host’s loopback adapter. <br> <hr> <br> DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.spec.hostNetwork' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline">https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline</a><br><a href="https://avd.aquasec.com/appshield/ksv009">https://avd.aquasec.com/appshield/ksv009</a><br></details> |
|
||||
| Kubernetes Security Check | KSV010 | Access to host PID | HIGH | <details><summary>Expand...</summary> Sharing the host’s PID namespace allows visibility on host processes, potentially leaking information such as environment variables and configuration. <br> <hr> <br> DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.spec.hostPID' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline">https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline</a><br><a href="https://avd.aquasec.com/appshield/ksv010">https://avd.aquasec.com/appshield/ksv010</a><br></details> |
|
||||
| Kubernetes Security Check | KSV011 | CPU not limited | LOW | <details><summary>Expand...</summary> Enforcing CPU limits prevents DoS via resource exhaustion. <br> <hr> <br> Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.limits.cpu' </details>| <details><summary>Expand...</summary><a href="https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits">https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits</a><br><a href="https://avd.aquasec.com/appshield/ksv011">https://avd.aquasec.com/appshield/ksv011</a><br></details> |
|
||||
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
|
||||
|
||||
Reference in New Issue
Block a user