Skip to content

Commit 04b7c30

Browse files
cpsmxcpsmx
authored
feat(sec) - customize service account mounting (#283)
It's best practice to disable automounting the service account tokens. In heavily audited environments there is often an admission controller preventing pods starting that have automountServiceAccountToken enabled on the service account. They require it specified on the pod instead. This change makes that behaviour configurable per SA and pod.
1 parent 3b71fab commit 04b7c30

File tree

4 files changed

+47
-16
lines changed

4 files changed

+47
-16
lines changed

‎charts/opencost/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ keywords:
99
- finops
1010
- monitoring
1111
- opencost
12-
version: 2.1.5
12+
version: 2.1.6
1313
maintainers:
1414
- name: jessegoodier
1515
- name: toscott

‎charts/opencost/README.md‎

Lines changed: 43 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,21 @@
22

33
OpenCost and OpenCost UI
44

5-
![Version: 1.44.0](https://img.shields.io/badge/Version-1.44.0-informational?style=flat-square)
5+
![Version: 2.1.5](https://img.shields.io/badge/Version-2.1.5-informational?style=flat-square)
66
![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
7-
![AppVersion: 1.114.0](https://img.shields.io/badge/AppVersion-1.114.0-informational?style=flat-square)
7+
![AppVersion: 1.115.0](https://img.shields.io/badge/AppVersion-1.115.0-informational?style=flat-square)
88
[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/opencost)](https://artifacthub.io/packages/search?repo=opencost)
99
[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/opencost-oci)](https://artifacthub.io/packages/search?repo=opencost-oci)
1010

11+
## Maintainers
12+
13+
| Name | Email | Url |
14+
| ---- | ------ | --- |
15+
| jessegoodier | | |
16+
| toscott | | |
17+
| mittal-ishaan | | |
18+
| brito-rafa | <rafa@stormforge.io> | |
19+
1120
## Installing the Chart
1221

1322
To install the chart with the release name `opencost`:
@@ -21,6 +30,7 @@ $ helm install opencost opencost/opencost
2130
| Key | Type | Default | Description |
2231
|-----|------|---------|-------------|
2332
| annotations | object | `{}` | Annotations to add to the all the resources |
33+
| clusterName | string | `"cluster.local"` | Override the default name of cluster - Can be found in /etc/kubernetes/admin.conf: clusters -> cluster -> name |
2434
| extraVolumes | list | `[]` | A list of volumes to be added to the pod |
2535
| fullnameOverride | string | `""` | Overwrite all resources name created by the chart |
2636
| imagePullSecrets | list | `[]` | List of secret names to use for pulling the images |
@@ -48,16 +58,22 @@ $ helm install opencost opencost/opencost
4858
| opencost.customPricing.enabled | bool | `false` | Enables custom pricing configuration |
4959
| opencost.customPricing.provider | string | `"custom"` | Sets the provider type for the custom pricing file. |
5060
| opencost.dataRetention.dailyResolutionDays | int | `15` | |
51-
| opencost.exporter.apiIngress.annotations | object | `{}` | Annotations for API Ingress resource |
61+
| opencost.exporter.apiIngress.annotations | object | `{}` | Annotations for Ingress resource |
5262
| opencost.exporter.apiIngress.enabled | bool | `false` | Ingress for OpenCost API |
53-
| opencost.exporter.apiIngress.hosts | list | See [values.yaml](values.yaml) | A list of host rules used to configure the API Ingress |
63+
| opencost.exporter.apiIngress.hosts | list | See [values.yaml](values.yaml) | A list of host rules used to configure the Ingress |
5464
| opencost.exporter.apiIngress.ingressClassName | string | `""` | Ingress controller which implements the resource |
5565
| opencost.exporter.apiIngress.servicePort | string | `"http"` | Redirect ingress to an extraPort defined on the service such as oauth-proxy |
5666
| opencost.exporter.apiIngress.tls | list | `[]` | Ingress TLS configuration |
5767
| opencost.exporter.apiPort | int | `9003` | |
5868
| opencost.exporter.aws.access_key_id | string | `""` | AWS secret key id |
5969
| opencost.exporter.aws.secret_access_key | string | `""` | AWS secret access key |
6070
| opencost.exporter.cloudProviderApiKey | string | `""` | The GCP Pricing API requires a key. This is supplied just for evaluation. |
71+
| opencost.exporter.collectorDataSource.enabled | bool | `false` | |
72+
| opencost.exporter.collectorDataSource.networkPort | int | `3001` | The port at which network pods are open to egress |
73+
| opencost.exporter.collectorDataSource.retentionResolution10m | int | `36` | The number of 10m intervals the Collector DataSource should maintain |
74+
| opencost.exporter.collectorDataSource.retentionResolution1d | int | `15` | The number of 1d intervals the Collector DataSource should maintain |
75+
| opencost.exporter.collectorDataSource.retentionResolution1h | int | `49` | The number of 1h intervals the Collector DataSource should maintain |
76+
| opencost.exporter.collectorDataSource.scrapeInterval | string | `"30s"` | define the interval at which the collector scrapes for data points (10s, 15s, 1m) |
6177
| opencost.exporter.csv_path | string | `""` | |
6278
| opencost.exporter.defaultClusterId | string | `"default-cluster"` | Default cluster ID to use if cluster_id is not set in Prometheus metrics. |
6379
| opencost.exporter.env | list | `[]` | List of additional environment variables to set in the container |
@@ -68,7 +84,7 @@ $ helm install opencost opencost/opencost
6884
| opencost.exporter.image.pullPolicy | string | `"IfNotPresent"` | Exporter container image pull policy |
6985
| opencost.exporter.image.registry | string | `"ghcr.io"` | Exporter container image registry |
7086
| opencost.exporter.image.repository | string | `"opencost/opencost"` | Exporter container image name |
71-
| opencost.exporter.image.tag | string | `""` (use appVersion in Chart.yaml) | Exporter container image tag |
87+
| opencost.exporter.image.tag | string | `"1.115.0@sha256:fb6468a1ef45dbd4a9e521122c8d306f882bb33d1657d28d21aeaef79412e9e1"` | Exporter container image tag |
7288
| opencost.exporter.livenessProbe.enabled | bool | `true` | Whether probe is enabled |
7389
| opencost.exporter.livenessProbe.failureThreshold | int | `3` | Number of failures for probe to be considered failed |
7490
| opencost.exporter.livenessProbe.initialDelaySeconds | int | `10` | Number of seconds before probe is initiated |
@@ -77,6 +93,7 @@ $ helm install opencost opencost/opencost
7793
| opencost.exporter.persistence.accessMode | string | `""` | Access mode for persistent volume |
7894
| opencost.exporter.persistence.annotations | object | `{}` | Annotations for persistent volume |
7995
| opencost.exporter.persistence.enabled | bool | `false` | |
96+
| opencost.exporter.persistence.mountPath | string | `"/mnt/export"` | The path that the PV will be mounted to the exporter at |
8097
| opencost.exporter.persistence.size | string | `""` | Size for persistent volume |
8198
| opencost.exporter.persistence.storageClass | string | `""` | Storage class for persistent volume |
8299
| opencost.exporter.readinessProbe.enabled | bool | `true` | Whether probe is enabled |
@@ -85,7 +102,7 @@ $ helm install opencost opencost/opencost
85102
| opencost.exporter.readinessProbe.path | string | `"/healthz"` | Probe path |
86103
| opencost.exporter.readinessProbe.periodSeconds | int | `10` | Probe frequency in seconds |
87104
| opencost.exporter.replicas | int | `1` | Number of OpenCost replicas to run |
88-
| opencost.exporter.resources.limits | object | `{"cpu":"999m","memory":"1Gi"}` | CPU/Memory resource limits |
105+
| opencost.exporter.resources.limits | object | `{"memory":"1Gi"}` | CPU/Memory resource limits |
89106
| opencost.exporter.resources.requests | object | `{"cpu":"10m","memory":"55Mi"}` | CPU/Memory resource requests |
90107
| opencost.exporter.securityContext | object | `{}` | The security options the container should be run with |
91108
| opencost.exporter.startupProbe.enabled | bool | `true` | Whether probe is enabled |
@@ -113,6 +130,13 @@ $ helm install opencost opencost/opencost
113130
| opencost.metrics.serviceMonitor.scrapeTimeout | string | `"10s"` | Timeout after which the scrape is ended |
114131
| opencost.metrics.serviceMonitor.tlsConfig | object | `{}` | TLS configuration for scraping metrics |
115132
| opencost.nodeSelector | object | `{}` | Node labels for pod assignment |
133+
| opencost.platforms.openshift.createMonitoringClusterRoleBinding | bool | `false` | If true, the helm chart will create a ClusterRoleBinding to grant the OpenCost ServiceAccount access to query Prometheus. |
134+
| opencost.platforms.openshift.createMonitoringResourceReaderRoleBinding | bool | `false` | If true, create a Role and RoleBinding to allow Prometheus to list and watch OpenCost resources. |
135+
| opencost.platforms.openshift.enablePromAccess | bool | `false` | If true, enable internal prom access |
136+
| opencost.platforms.openshift.enableSCC | bool | `false` | If true, set Security Context Constraints on serviceaccount for read/write premissions |
137+
| opencost.platforms.openshift.enabled | bool | `false` | Enable OpenShift specific configurations |
138+
| opencost.platforms.openshift.monitoringServiceAccountName | string | `"prometheus-k8s"` | Name of the Prometheus serviceaccount to bind to the Resource Reader Role Binding. |
139+
| opencost.platforms.openshift.monitoringServiceAccountNamespace | string | `"openshift-monitoring"` | Namespace of the Prometheus serviceaccount to bind to the Resource Reader Role Binding. |
116140
| opencost.prometheus.amp.enabled | bool | `false` | Use Amazon Managed Service for Prometheus (AMP) |
117141
| opencost.prometheus.amp.workspaceId | string | `""` | Workspace ID for AMP |
118142
| opencost.prometheus.bearer_token | string | `""` | Prometheus Bearer token |
@@ -123,7 +147,9 @@ $ helm install opencost opencost/opencost
123147
| opencost.prometheus.internal.enabled | bool | `true` | Use in-cluster Prometheus |
124148
| opencost.prometheus.internal.namespaceName | string | `"prometheus-system"` | Namespace of in-cluster Prometheus |
125149
| opencost.prometheus.internal.port | int | `80` | Service port of in-cluster Prometheus |
150+
| opencost.prometheus.internal.scheme | string | `"http"` | Scheme to use for in-cluster Prometheus |
126151
| opencost.prometheus.internal.serviceName | string | `"prometheus-server"` | Service name of in-cluster Prometheus |
152+
| opencost.prometheus.kubeRBACProxy | bool | `false` | If true, opencost will use kube-rbac-proxy to authenticate with in cluster Prometheus for openshift |
127153
| opencost.prometheus.password | string | `""` | Prometheus Basic auth password |
128154
| opencost.prometheus.password_key | string | `"DB_BASIC_AUTH_PW"` | Key in the secret that references the password |
129155
| opencost.prometheus.secret_name | string | `nil` | Secret name that contains credentials for Prometheus |
@@ -133,16 +159,12 @@ $ helm install opencost opencost/opencost
133159
| opencost.prometheus.thanos.internal.enabled | bool | `true` | |
134160
| opencost.prometheus.thanos.internal.namespaceName | string | `"opencost"` | |
135161
| opencost.prometheus.thanos.internal.port | int | `10901` | |
162+
| opencost.prometheus.thanos.internal.scheme | string | `"http"` | |
136163
| opencost.prometheus.thanos.internal.serviceName | string | `"my-thanos-query"` | |
137164
| opencost.prometheus.thanos.maxSourceResolution | string | `""` | |
138165
| opencost.prometheus.thanos.queryOffset | string | `""` | |
139166
| opencost.prometheus.username | string | `""` | Prometheus Basic auth username |
140167
| opencost.prometheus.username_key | string | `"DB_BASIC_AUTH_USERNAME"` | Key in the secret that references the username |
141-
| opencost.platforms.openshift.enabled | bool | `false` | Enable OpenShift specific configurations |
142-
| opencost.platforms.openshift.createMonitoringClusterRoleBinding | bool | `false` | Create a ClusterRoleBinding to grant the OpenCost ServiceAccount access to query Prometheus. (Only when using in-cluster prometheus) |
143-
| opencost.platforms.openshift.createMonitoringResourceReaderRoleBinding | bool | `false` | Create a Role and RoleBinding to allow Prometheus to list and watch OpenCost resources. (Only when using in-cluster prometheus) |
144-
| opencost.platforms.openshift.monitoringServiceAccountName | string | `prometheus-k8s` | Name of the Prometheus serviceaccount to bind to the Resource Reader Role Binding. (Only when using in-cluster prometheus) |
145-
| opencost.platforms.openshift.monitoringServiceAccountNamespace | string | `openshift-monitoring` | Namespace of the Prometheus serviceaccount to bind to the Resource Reader Role Binding.. (Only when using in-cluster prometheus) |
146168
| opencost.sigV4Proxy.extraEnv | string | `nil` | |
147169
| opencost.sigV4Proxy.host | string | `"aps-workspaces.us-west-2.amazonaws.com"` | |
148170
| opencost.sigV4Proxy.image | string | `"public.ecr.aws/aws-observability/aws-sigv4-proxy:latest"` | |
@@ -178,13 +200,18 @@ $ helm install opencost opencost/opencost
178200
| opencost.ui.readinessProbe.initialDelaySeconds | int | `30` | Number of seconds before probe is initiated |
179201
| opencost.ui.readinessProbe.path | string | `"/healthz"` | Probe path |
180202
| opencost.ui.readinessProbe.periodSeconds | int | `10` | Probe frequency in seconds |
181-
| opencost.ui.resources.limits | object | `{"cpu":"999m","memory":"1Gi"}` | CPU/Memory resource limits |
203+
| opencost.ui.resources.limits | object | `{"memory":"1Gi"}` | CPU/Memory resource limits |
182204
| opencost.ui.resources.requests | object | `{"cpu":"10m","memory":"55Mi"}` | CPU/Memory resource requests |
205+
| opencost.ui.route.annotations | object | `{}` | Annotations for Ingress resource |
206+
| opencost.ui.route.enabled | bool | `false` | OpenShift route for OpenCost UI |
207+
| opencost.ui.route.host | string | `"example.local"` | |
208+
| opencost.ui.route.path | string | `nil` | |
209+
| opencost.ui.route.targetPort | string | `"http-ui"` | Redirect ingress to an extraPort defined on the service such as oauth-proxy |
210+
| opencost.ui.route.tls | list | `[]` | Ingress TLS configuration |
183211
| opencost.ui.securityContext | object | `{}` | The security options the container should be run with |
184212
| opencost.ui.uiPort | int | `9090` | |
213+
| opencost.ui.useDefaultFqdn | bool | `false` | |
185214
| opencost.ui.useIPv6 | bool | `true` | |
186-
| opencost.ui.useDefaultFqdn | bool | false | To use `<service>.<namespace>.svc.cluster.local` or `<service>.<namespace>` |
187-
| opencost.ui.modelFqdn | string | `nil` | Set the model fqdn to use for the upstream |
188215
| plugins.configs | string | `nil` | |
189216
| plugins.enabled | bool | `false` | |
190217
| plugins.folder | string | `"/opt/opencost/plugin"` | |
@@ -197,6 +224,7 @@ $ helm install opencost opencost/opencost
197224
| plugins.install.securityContext.runAsUser | int | `1000` | |
198225
| plugins.install.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
199226
| podAnnotations | object | `{}` | Annotations to add to the OpenCost Pod |
227+
| podAutomountServiceAccountToken | bool | `true` | Enable automounting of service account token at the pod level |
200228
| podLabels | object | `{}` | Labels to add to the OpenCost Pod |
201229
| podSecurityContext | object | `{}` | Holds pod-level security attributes and common container settings |
202230
| priorityClassName | string | `nil` | Pod priority |
@@ -216,4 +244,4 @@ $ helm install opencost opencost/opencost
216244
| updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":1},"type":"RollingUpdate"}` | Strategy to be used for the Deployment |
217245

218246
----------------------------------------------
219-
Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1)
247+
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎charts/opencost/templates/deployment.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ spec:
3737
securityContext: {{- toYaml . | nindent 8 }}
3838
{{- end }}
3939
serviceAccountName: {{ template "opencost.serviceAccountName" . }}
40+
automountServiceAccountToken: {{ .Values.podAutomountServiceAccountToken }}
4041
{{- with .Values.opencost.tolerations }}
4142
tolerations: {{- toYaml . | nindent 8 }}
4243
{{- end }}

‎charts/opencost/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ secretAnnotations: {}
8484
podLabels: {}
8585
# -- Pod priority
8686
priorityClassName: ~
87+
# -- Enable automounting of service account token at the pod level
88+
podAutomountServiceAccountToken: true
8789

8890
# -- Holds pod-level security attributes and common container settings
8991
podSecurityContext: {}

0 commit comments

Comments
 (0)