Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: enable Kyverno metrics #1865

Draft
wants to merge 13 commits into
base: main
Choose a base branch
from
Draft

fix: enable Kyverno metrics #1865

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
dbd4269
fix: kyverno metrics
srodenhuis Dec 10, 2024
7acfb4e
fix: labels
srodenhuis Dec 10, 2024
add0771
fix: add team policy dashboard
srodenhuis Dec 10, 2024
fc4e5c6
fix: enable dashboard
srodenhuis Dec 10, 2024
c0ecdb5
fix: dashboard values
srodenhuis Dec 10, 2024
e37f9d9
fix: improve dashboard
srodenhuis Dec 10, 2024
5c4f007
feat: improve dashboard
srodenhuis Dec 10, 2024
4172cbc
fix: excludes
srodenhuis Dec 12, 2024
040a2cc
fix: exclude tag indent
srodenhuis Dec 12, 2024
f69d8c1
fix: add excludes
srodenhuis Dec 12, 2024
68db2ac
fix: add kyverno db platform
srodenhuis Dec 12, 2024
56a10c5
fix: dashboard queries
srodenhuis Dec 13, 2024
baae580
fix: prom queries
srodenhuis Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
593 changes: 593 additions & 0 deletions charts/grafana-dashboards/kyverno-teams/kyverno-teams.json
View file
Open in desktop

Large diffs are not rendered by default.

4,342 changes: 4,342 additions & 0 deletions charts/grafana-dashboards/kyverno/kyverno.json
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 2 additions & 0 deletions charts/grafana-dashboards/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ folders:
- trivy
- trivy-teams
- velero
- kyverno-teams
- kyverno

sidecar:
dashboards:
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-capabilities.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
preconditions:
all:
- key: "{{`{{ request.operation || 'BACKGROUND' }}`}}"
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-host-namespaces.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-host-path.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-host-ports.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-host-process.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-privileged-containers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-proc-mount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
40 changes: 40 additions & 0 deletions charts/team-ns/templates/policies/baseline/disallow-selinux.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down Expand Up @@ -57,6 +77,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/restrict-apparmor-profiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/restrict-seccomp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
20 changes: 20 additions & 0 deletions charts/team-ns/templates/policies/baseline/restrict-sysctls.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,26 @@ spec:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
18 changes: 18 additions & 0 deletions charts/team-ns/templates/policies/best-practice/allowed-image-repos.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,24 @@ spec:
- resources:
annotations:
tekton.dev/tags: git
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: prometheus-{{ $v.teamId }}
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: {{ $v.teamId }}-po-alertmanager
- resources:
kinds:
- Pod
selector:
matchLabels:
app.kubernetes.io/instance: tekton-dashboard-{{ $v.teamId }}
skipBackgroundRequests: true
validate:
message: >-
Expand Down
Loading
Loading