[stable/prometheus-blackbox-exporter] add "allowIcmp" setting (helm#2…

…0409) * [stable/prometheus-blackbox-exporter] add "allowIcmp" setting Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] minor version bump Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] fix NET_RAW capability Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] run as root if allowIcmp is set Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] document security implications of allowIcmp Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> * [stable/prometheus-blackbox-exporter] add test values for allowIcmp Signed-off-by: Alice Sawatzky <alice.sawatzky@farmersedge.ca> Signed-off-by: Miguel Mingorance <miguel.mingorance@deliveryhero.com>
mmingorance-dh · Aug 28, 2020 · b3dbe6a · b3dbe6a
1 parent f3bb7e3
commit b3dbe6a
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 2 deletions.
diff --git a/stable/prometheus-blackbox-exporter/Chart.yaml b/stable/prometheus-blackbox-exporter/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Prometheus Blackbox Exporter
 name: prometheus-blackbox-exporter
-version: 3.0.1
+version: 3.1.0
 appVersion: 0.15.1
 home: https://github.com/prometheus/blackbox_exporter
 sources:

diff --git a/stable/prometheus-blackbox-exporter/README.md b/stable/prometheus-blackbox-exporter/README.md
@@ -63,6 +63,7 @@ The following table lists the configurable parameters of the Blackbox-Exporter c
 | `podAnnotations`                          | annotations to add to each pod                                                   | `{}`                                                                         |
 | `podDisruptionBudget`                     | pod disruption budget                                                            | `{}`                                                                         |
 | `priorityClassName`                       | priority class name                                                              | None                                                                         |
+| `allowIcmp`                               | whether to enable ICMP probes, by giving the pods `CAP_NET_RAW` and running as root | `false`                                                                   |
 | `resources`                               | pod resource requests & limits                                                   | `{}`                                                                         |
 | `restartPolicy`                           | container restart policy                                                         | `Always`                                                                     |
 | `service.annotations`                     | annotations for the service                                                      | `{}`                                                                         |

diff --git a/stable/prometheus-blackbox-exporter/ci/icmp-values.yaml b/stable/prometheus-blackbox-exporter/ci/icmp-values.yaml
@@ -0,0 +1 @@
+allowIcmp: true
diff --git a/stable/prometheus-blackbox-exporter/templates/deployment.yaml b/stable/prometheus-blackbox-exporter/templates/deployment.yaml
@@ -58,8 +58,13 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
             readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem }}
+            {{- if .Values.allowIcmp }}
+            capabilities:
+              add: ["NET_RAW"]
+            {{- else }}
             runAsNonRoot: {{ .Values.runAsNonRoot  }}
             runAsUser: {{ .Values.runAsUser }}
+            {{- end }}
           args:
 {{- if .Values.config }}
             - "--config.file=/config/blackbox.yaml"
@@ -117,4 +122,4 @@ spec:
           secret:
             secretName: {{ .secretName }}
             defaultMode: {{ .defaultMode }}
-      {{- end }}
+      {{- end }}
diff --git a/stable/prometheus-blackbox-exporter/values.yaml b/stable/prometheus-blackbox-exporter/values.yaml
@@ -58,6 +58,8 @@ extraSecretMounts: []
   #   readOnly: true
   #   defaultMode: 420
 
+allowIcmp: false
+
 resources: {}
   # limits:
   #   memory: 300Mi