Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add NGINX metrics and update security context #356

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add NGINX metrics and update security context #356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7770c07
Improve security context and configMap
Jeroen0494 Jun 9, 2024
5a8b642
Add NGINX metrics
Jeroen0494 Jun 9, 2024
c64c534
Update defaultMode
Jeroen0494 Jun 9, 2024
909033f
Merge branch 'main' into feat/metrics
jessebot Jul 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion charts/nextcloud/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,8 @@ We include an optional experimental Nextcloud Metrics exporter from [xperimental
| `metrics.timeout` | When the scrape times out | `5s` |
| `metrics.tlsSkipVerify` | Skips certificate verification of Nextcloud server | `false` |
| `metrics.info.apps` | Enable gathering of apps-related metrics. | `false` |
| `metrics.nginx.enabled` | Start NGINX metrics configuration | `false` |
| `metrics.nginx.allow` | NGINX metrics configuration allow list | not set
| `metrics.image.repository` | Nextcloud metrics exporter image name | `xperimental/nextcloud-exporter` |
| `metrics.image.tag` | Nextcloud metrics exporter image tag | `0.6.2` |
| `metrics.image.pullPolicy` | Nextcloud metrics exporter image pull policy | `IfNotPresent` |
Expand All @@ -324,7 +326,6 @@ We include an optional experimental Nextcloud Metrics exporter from [xperimental
| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{} |



> **Note**:
>
> For nextcloud to function correctly, you should specify the `nextcloud.host` parameter to specify the FQDN (recommended) or the public IP address of the nextcloud service.
Expand Down
9 changes: 9 additions & 0 deletions charts/nextcloud/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,16 +360,25 @@ spec:
- name: nextcloud-config
configMap:
name: {{ template "nextcloud.fullname" . }}-config
{{- with .Values.nextcloud.configs.defaultMode }}
defaultMode: {{ . }}
{{- end }}
{{- end }}
{{- if .Values.nextcloud.phpConfigs }}
- name: nextcloud-phpconfig
configMap:
name: {{ template "nextcloud.fullname" . }}-phpconfig
{{- with .Values.nextcloud.configs.defaultMode }}
defaultMode: {{ . }}
{{- end }}
{{- end }}
{{- if .Values.nginx.enabled }}
- name: nextcloud-nginx-config
configMap:
name: {{ template "nextcloud.fullname" . }}-nginxconfig
{{- with .Values.nextcloud.configs.defaultMode }}
defaultMode: {{ . }}
{{- end }}
{{- end }}
{{- if not (values .Values.nextcloud.hooks | compact | empty) }}
- name: nextcloud-hooks
Expand Down
5 changes: 3 additions & 2 deletions charts/nextcloud/templates/metrics/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ spec:
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.metrics.securityContext }}
securityContext:
runAsUser: 1000
runAsNonRoot: true
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
32 changes: 31 additions & 1 deletion charts/nextcloud/templates/nginx-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,8 +157,38 @@ data:
default.conf: |-
{{- template "default.conf" $ }}
{{- end }}
{{- if .Values.metrics.nginx.enabled }}
metrics.conf: |
server {
listen 9205;

# Path to the root of your installation
root /var/www/html;

# Prevent nginx HTTP Server Detection
server_tokens off;

add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;

# NGINX metrics
location /stub_status {
stub_status on;
allow 127.0.0.1;
{{- range .Values.metrics.nginx.allow }}
allow {{ . }};
{{- end }}
deny all;
}
}
{{- end }}
{{- if .Values.nginx.config.custom }}
zz-custom.conf: |-
{{ .Values.nginx.config.custom | indent 4 }}
{{- end }}
{{- end }}
{{- end }}
54 changes: 44 additions & 10 deletions charts/nextcloud/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,9 @@ nextcloud:
smtp.config.php: true
# Extra config files created in /var/www/html/config/
# ref: https://docs.nextcloud.com/server/15/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-config-php-file
configs: {}
configs:
# set defaultMode for mounted configMaps (e.g. defaultMode: 420)
defaultMode: 420

# For example, to use S3 as primary storage
# ref: https://docs.nextcloud.com/server/13/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3
Expand Down Expand Up @@ -208,10 +210,15 @@ nextcloud:
# Set securityContext parameters for the nextcloud CONTAINER only (will not affect nginx container).
# For example, you may need to define runAsNonRoot directive
securityContext: {}
# runAsUser: 33
# runAsGroup: 33
# runAsNonRoot: true
# readOnlyRootFilesystem: false
# allowPrivilegeEscalation: false
# capabilities:
# drop:
# - ALL
# privileged: false
# readOnlyRootFilesystem: true
# runAsGroup: 33
# runAsNonRoot: true
# runAsUser: 33

# Set securityContext parameters for the entire pod. For example, you may need to define runAsNonRoot directive
podSecurityContext: {}
Expand Down Expand Up @@ -250,11 +257,18 @@ nginx:

# Set nginx container securityContext parameters. For example, you may need to define runAsNonRoot directive
securityContext: {}
# the nginx alpine container default user is 82
# runAsUser: 82
# runAsGroup: 33
# runAsNonRoot: true
# readOnlyRootFilesystem: true
# the nginx alpine container default user is 82
# allowPrivilegeEscalation: false
# capabilities:
# add:
# - NET_BIND_SERVICE
# drop:
# - ALL
# privileged: false
# readOnlyRootFilesystem: true
# runAsGroup: 33
# runAsNonRoot: true
# runAsUser: 82

## Extra environment variables
extraEnv: []
Expand Down Expand Up @@ -549,6 +563,26 @@ metrics:

# podLabels: {}

Jeroen0494 marked this conversation as resolved.
Show resolved Hide resolved
nginx:
enabled: false
allow: []
# Example
# - 10.233.105.0/24
# - 10.43.0.0/16
service:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This value has no affact anywhere ....
But maybe usefull (on deployment under ports and your ConfigMap rendered; or service).

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is actually used in nginx-config.yaml:

            {{- range .Values.metrics.nginx.allow }}
                allow {{ . }};
            {{- end }}

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.Values.metrics.nginx.allow is not the same as .Values.nginx.metrics.service.port, which is the values you have here. Am I maybe misunderstanding something?

port: 9205

# Set metrics container securityContext parameters.
securityContext: {}
# allowPrivilegeEscalation: false
# capabilities:
# drop:
# - ALL
# privileged: false
# readOnlyRootFilesystem: true
# runAsUser: 1000
# runAsNonRoot: true

service:
type: ClusterIP
## Use serviceLoadBalancerIP to request a specific static IP,
Expand Down
Loading