[stable/prometheus-blackbox-exporter] add "allowIcmp" setting (helm#2…

…0409) * [stable/prometheus-blackbox-exporter] add "allowIcmp" setting Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] minor version bump Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] fix NET_RAW capability Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] run as root if allowIcmp is set Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] document security implications of allowIcmp Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] add test values for allowIcmp Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
alexppg · Feb 4, 2020 · 6253e21 · 6253e21
1 parent 494892c
commit 6253e21
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 0 deletions.
diff --git a/stable/prometheus-blackbox-exporter/README.md b/stable/prometheus-blackbox-exporter/README.md
@@ -64,6 +64,7 @@ The following table lists the configurable parameters of the Blackbox-Exporter c
 | `podAnnotations`                          | annotations to add to each pod                                                   | `{}`                                                                         |
 | `podDisruptionBudget`                     | pod disruption budget                                                            | `{}`                                                                         |
 | `priorityClassName`                       | priority class name                                                              | None                                                                         |
+| `allowIcmp`                               | whether to enable ICMP probes, by giving the pods `CAP_NET_RAW` and running as root | `false`                                                                   |
 | `resources`                               | pod resource requests & limits                                                   | `{}`                                                                         |
 | `restartPolicy`                           | container restart policy                                                         | `Always`                                                                     |
 | `service.annotations`                     | annotations for the service                                                      | `{}`                                                                         |

diff --git a/stable/prometheus-blackbox-exporter/ci/icmp-values.yaml b/stable/prometheus-blackbox-exporter/ci/icmp-values.yaml
@@ -0,0 +1 @@
+allowIcmp: true
diff --git a/stable/prometheus-blackbox-exporter/templates/deployment.yaml b/stable/prometheus-blackbox-exporter/templates/deployment.yaml
@@ -59,8 +59,13 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
             readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem }}
+            {{- if .Values.allowIcmp }}
+            capabilities:
+              add: ["NET_RAW"]
+            {{- else }}
             runAsNonRoot: {{ .Values.runAsNonRoot  }}
             runAsUser: {{ .Values.runAsUser }}
+            {{- end }}
           args:
 {{- if .Values.config }}
             - "--config.file=/config/blackbox.yaml"

diff --git a/stable/prometheus-blackbox-exporter/values.yaml b/stable/prometheus-blackbox-exporter/values.yaml
@@ -60,6 +60,8 @@ extraSecretMounts: []
   #   readOnly: true
   #   defaultMode: 420
 
+allowIcmp: false
+
 resources: {}
   # limits:
   #   memory: 300Mi