K8s improved

.gitignore

@@ -26,6 +26,7 @@ go.work.sum
 
 # env file
 .env
+*.env
 
 # Editor/IDE
 # .idea/

docker-compose.yaml

@@ -47,9 +47,12 @@ services:
       - mynet
 
   grafana:
-    image: grafana/grafana
+    image: grafana/grafana:12.3.3
     container_name: grafana
     hostname: grafana
+    env_file:
+      - path: ./grafana-admin.env
+        required: false
     ports:
       - 3000:3000
     networks:
@@ -61,7 +64,7 @@ services:
       - ./grafana/dashboards:/var/lib/grafana/dashboards
 
   prometheus:
-    image: prom/prometheus
+    image: prom/prometheus:v3.9.1
     container_name: prometheus
     hostname: prometheus
     ports:
@@ -73,7 +76,7 @@ services:
       - prometheus-data:/prometheus
 
   node-exporter:
-    image: prom/node-exporter
+    image: prom/node-exporter:v1.10.2
     container_name: node-exporter
     hostname: node-exporter
     ports:
@@ -82,7 +85,7 @@ services:
       - mynet
 
   docker-exporter:
-    image: ghcr.io/davidborzek/docker-exporter:latest
+    image: ghcr.io/davidborzek/docker-exporter:v0.3.0
     container_name: docker-exporter
     hostname: docker-exporter
     user: root

grafana-admin.env.example

@@ -0,0 +1,6 @@
+# copy to grafana-admin.env and set values
+# Grafana applies these only on first init. if you change them later:
+#   Docker Compose: remove the grafana volume, then up again.
+#   Kubernetes:     scale down grafana pods, delete the PVC, re-apply and scale back
+GF_SECURITY_ADMIN_USER=admin
+GF_SECURITY_ADMIN_PASSWORD=admin

k8s/deployment-docker-exporter.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: docker-exporter
-        image: ghcr.io/davidborzek/docker-exporter:latest
+        image: ghcr.io/davidborzek/docker-exporter:v0.3.0
         ports:
         - containerPort: 8080
           name: http

k8s/deployment-gateway.yaml

@@ -15,17 +15,45 @@ spec:
       labels:
         app: gateway
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: gateway
         image: geostreamdb-gateway:latest
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 8080
           name: http
         - containerPort: 50051
           name: grpc
         - containerPort: 2112
           name: metrics
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 6
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 6
         env:
         - name: PORT
           value: "8080"

k8s/deployment-grafana.yaml

@@ -15,9 +15,22 @@ spec:
       labels:
         app: grafana
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 472
+        runAsGroup: 472
+        fsGroup: 472
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: grafana
-        image: grafana/grafana:latest
+        image: grafana/grafana:12.3.3
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 3000
           name: http
@@ -35,6 +48,13 @@ spec:
           periodSeconds: 5
           timeoutSeconds: 2
           failureThreshold: 6
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
         volumeMounts:
         - name: grafana-data
           mountPath: /var/lib/grafana
@@ -48,6 +68,18 @@ spec:
           value: /var/lib/grafana
         - name: GF_PATHS_PROVISIONING
           value: /etc/grafana/provisioning
+        - name: GF_SECURITY_ADMIN_USER
+          valueFrom:
+            secretKeyRef:
+              name: grafana-admin
+              key: GF_SECURITY_ADMIN_USER
+              optional: true
+        - name: GF_SECURITY_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: grafana-admin
+              key: GF_SECURITY_ADMIN_PASSWORD
+              optional: true
       volumes:
       - name: grafana-data
         persistentVolumeClaim:

k8s/deployment-node-exporter.yaml

@@ -15,9 +15,50 @@ spec:
       labels:
         app: node-exporter
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: node-exporter
-        image: prom/node-exporter:latest
+        image: prom/node-exporter:v1.10.2
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9100
           name: http
+        startupProbe:
+          httpGet:
+            path: /metrics
+            port: 9100
+          failureThreshold: 30
+          periodSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: 9100
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 6
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 9100
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 6
+        resources:
+          requests:
+            memory: "32Mi"
+            cpu: "25m"
+          limits:
+            memory: "128Mi"
+            cpu: "200m"

k8s/deployment-prometheus.yaml

@@ -18,12 +18,54 @@ spec:
         app: prometheus
     spec:
       serviceAccountName: prometheus
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: prometheus
-        image: prom/prometheus:latest
+        image: prom/prometheus:v3.9.1
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 9090
           name: http
+        startupProbe:
+          httpGet:
+            path: /-/ready
+            port: 9090
+          failureThreshold: 30
+          periodSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /-/ready
+            port: 9090
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 6
+        livenessProbe:
+          httpGet:
+            path: /-/healthy
+            port: 9090
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 6
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits:
+            memory: "3Gi"
+            cpu: "1000m"
         volumeMounts:
         - name: prometheus-config
           mountPath: /etc/prometheus/prometheus.yml

k8s/deployment-registry.yaml

@@ -15,15 +15,43 @@ spec:
       labels:
         app: registry
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: registry
         image: geostreamdb-registry:latest
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 50051
           name: grpc
         - containerPort: 2112
           name: metrics
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: 2112
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 6
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 2112
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 6
         env:
         - name: PORT
           value: "50051"

k8s/deployment-worker.yaml

@@ -20,15 +20,43 @@ spec:
       labels:
         app: worker-node
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: worker-node
         image: geostreamdb-worker-node:latest
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 50051
           name: grpc
         - containerPort: 2112
           name: metrics
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: 2112
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 6
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 2112
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 6
         env:
         - name: PORT
           value: "50051"
@@ -43,7 +71,7 @@ spec:
         resources:
           requests:
             memory: "256Mi"
-            cpu: "200m"
+            cpu: "100m"
           limits:
-            memory: "1Gi"
-            cpu: "2000m"
+            memory: "3Gi"
+            cpu: "3000m"