Skip to content
This repository has been archived by the owner on Feb 22, 2022. It is now read-only.

[stable/prometheus-blackbox-exporter] add "allowIcmp" setting #20409

Merged
merged 7 commits into from
Feb 3, 2020
Merged

[stable/prometheus-blackbox-exporter] add "allowIcmp" setting #20409

merged 7 commits into from
Feb 3, 2020

Conversation

alice-sawatzky
Copy link
Contributor

@alice-sawatzky alice-sawatzky commented Jan 28, 2020 •
edited
Loading

Signed-off-by: Alice Sawatzky alice.sawatzky@farmersedge.ca
@desaintmartin @gianrubio @rsotnychenko

What this PR does / why we need it:

Adds an option allowIcmp to prometheus-blcakbox-exporter, which if enabled adds the CAP_NET_RAW capability to the blackbox container, which is needed for ICMP probes to work.

Checklist

  • DCO signed
  • Chart Version bumped
  • Variables are documented in the README.md
  • Title of the PR starts with chart name (e.g. [stable/mychartname])

@alice-sawatzky
[stable/prometheus-blackbox-exporter] add "allowIcmp" setting
6970e55 
Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
@helm-bot helm-bot added Contribution Allowed If the contributor has signed the DCO or the CNCF CLA (prior to the move to a DCO). size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jan 28, 2020
@k8s-ci-robot
Copy link
Contributor

Hi @alice-sawatzky. Thanks for your PR.

I'm waiting for a helm member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 28, 2020
@alice-sawatzky
[stable/prometheus-blackbox-exporter] minor version bump
cb9a03e 
Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
@helm-bot helm-bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jan 28, 2020
@alice-sawatzky
Copy link
Contributor Author

alice-sawatzky commented Jan 29, 2020 •
edited
Loading

I just managed to run some ICMP probes without this capability. Not sure if this is unique to my cluster config or not. https://github.com/prometheus/blackbox_exporter#permissions says this is needed so, probably still worth adding? At some point my deployment of blackbox is gonna be migrated to a newer kube cluster, and i suspect this will be needed then.

@zanhsieh
Copy link
Collaborator

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 29, 2020
@desaintmartin
Copy link
Collaborator

/assign
Thanks!
I may review it only tomorrow.

@alice-sawatzky
[stable/prometheus-blackbox-exporter] fix NET_RAW capability
1832c78 
Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
@alice-sawatzky
[stable/prometheus-blackbox-exporter] run as root if allowIcmp is set
e27799a 
Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
@alice-sawatzky
[stable/prometheus-blackbox-exporter] document security implications …
8366ac0 
…of allowIcmp

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
@alice-sawatzky
Copy link
Contributor Author

I had to make the container run as root for ICMP to work. I've updated the README to mention this

@desaintmartin
Copy link
Collaborator

I am not sure if it is indeed needed on all clusters, but if documentation states it, it might be better to add it so that it does not break when upgrading cluster or prometheus-blackbox-exporter.

Could you add a ci/icmp-values.yaml testing this configuration?

@alice-sawatzky
[stable/prometheus-blackbox-exporter] add test values for allowIcmp
785729e 
Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
@alice-sawatzky
Copy link
Contributor Author

added the test!

I don't know why ICMP initially worked for me without this patch, but shortly after it spontaneously stopped working and needed these changes to work. so, i agree that this seems like a good idea to have

@desaintmartin
Copy link
Collaborator

Thanks!
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Feb 3, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alice-sawatzky, desaintmartin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 3, 2020
@k8s-ci-robot k8s-ci-robot merged commit 91a1ab9 into helm:master Feb 3, 2020
MarcusSorealheis added a commit to MarcusSorealheis/charts that referenced this pull request Feb 4, 2020
@MarcusSorealheis
Merge remote-tracking branch 'upstream/master' into add_superset_main…
51c5fba 
…tainer

* upstream/master: (309 commits)
  [stable/moodle] Set MOODLE_SKIP_INSTALL environment variable via values.yaml config. (helm#20523)
  [stable/prometheus-redis-exporter] Update image for exporter (helm#19317)
  update alantis version (helm#20507)
  [stable/spring-cloud-data-flow] Update to new SCDF version 2.4.0 (helm#20517)
  [stable/prometheus-blackbox-exporter] add "allowIcmp" setting (helm#20409)
  Allow DNS egress to resolve hostnames (helm#20437)
  [stable/rabbitmq] Add PrometheusRule. (helm#20478)
  [stable/drupal] Release 6.2.4 updating components versions (helm#20491)
  [stable/metabase] interpolate liveness and readiness probes (helm#20475)
  [stable/grafana] Fix a typo in the Grafana chart notes (helm#20490)
  [stable/gocd] Quote ingress host (helm#20477)
  [stable/metabase] allow setting jetty options (helm#20456)
  [stable/pgadmin] upgrade to 4.17 and more (helm#20211)
  [stable/prometheus-operator] add apiserverConfig (helm#20453)
  [stable/graylog] Fix helm#20306, add `helm2Compatibility` flag to `values.yaml` that preserves specific labels installed by helm2 for backward compatibility. (helm#20464)
  Add annotation support to pushgateway service (helm#20351)
  Upgrade nfs-provisioner to v2.3.0 (helm#20468)
  [stable/sysdig] Upgrade to latest Sysdig Image (9.5.0) (helm#20471)
  [stable/odoo] Update PostgreSQL dependency to latest major (helm#20467)
  [stable/redis] Add PrometheusRule. (helm#20388)
  ...
@alice-sawatzky alice-sawatzky deleted the blackbox-exporter-icmp branch February 4, 2020 16:16
alexppg pushed a commit to alexppg/charts that referenced this pull request Feb 4, 2020
@alice-sawatzky @alexppg
[stable/prometheus-blackbox-exporter] add "allowIcmp" setting (helm#2…
6253e21 
…0409)

* [stable/prometheus-blackbox-exporter] add "allowIcmp" setting

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] minor version bump

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] fix NET_RAW capability

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] run as root if allowIcmp is set

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] document security implications of allowIcmp

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] add test values for allowIcmp

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
MarcusSorealheis added a commit to MarcusSorealheis/charts that referenced this pull request Feb 4, 2020
@MarcusSorealheis
Merge branch 'solr_plugin_volume' of github.com:MarcusSorealheis/char…
b4833a0 
…ts into solr_plugin_volume

* 'solr_plugin_volume' of github.com:MarcusSorealheis/charts: (611 commits)
  bump version to be compatible with plugins.
  bump version to be compatible with plugins.
  [stable/kube-state-metrics] Version bump to 1.9.4 (helm#20543)
  [stable/nginx-ingress] allow clusterIP values to be set empty (helm#20518)
  update grafana sidecar to 0.1.75 (helm#20538)
  [stable/mongodb] Release 7.8.2 updating components versions (helm#20537)
  [stable/testlink] add service annotations (helm#20531)
  Rr/strategy (helm#20533)
  [stable/superset] Update Maintainers List (helm#20493)
  [stable/nfs-server-provisioner] New nfs-provisioner with NFSv3 support (helm#19260)
  [stable/pgadmin] removed abundance curly bracket (helm#20530)
  Seq: use deployment strategy (helm#20526)
  [stable/moodle] Set MOODLE_SKIP_INSTALL environment variable via values.yaml config. (helm#20523)
  [stable/prometheus-redis-exporter] Update image for exporter (helm#19317)
  update alantis version (helm#20507)
  [stable/spring-cloud-data-flow] Update to new SCDF version 2.4.0 (helm#20517)
  [stable/prometheus-blackbox-exporter] add "allowIcmp" setting (helm#20409)
  Allow DNS egress to resolve hostnames (helm#20437)
  [stable/rabbitmq] Add PrometheusRule. (helm#20478)
  [stable/drupal] Release 6.2.4 updating components versions (helm#20491)
  ...
mmingorance-dh pushed a commit to mmingorance-dh/charts that referenced this pull request Aug 28, 2020
@alice-sawatzky
[stable/prometheus-blackbox-exporter] add "allowIcmp" setting (helm#2…
b3dbe6a 
…0409)

* [stable/prometheus-blackbox-exporter] add "allowIcmp" setting

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] minor version bump

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] fix NET_RAW capability

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] run as root if allowIcmp is set

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] document security implications of allowIcmp

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>

* [stable/prometheus-blackbox-exporter] add test values for allowIcmp

Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca>
Signed-off-by: Miguel Mingorance <miguel.mingorance@deliveryhero.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@desaintmartin desaintmartin Awaiting requested review from desaintmartin

@gianrubio gianrubio Awaiting requested review from gianrubio

Assignees

@desaintmartin desaintmartin

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. Contribution Allowed If the contributor has signed the DCO or the CNCF CLA (prior to the move to a DCO). lgtm Indicates that a PR is ready to be merged. ok-to-test size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@alice-sawatzky @k8s-ci-robot @zanhsieh @desaintmartin @helm-bot