From 21333b74bd88f9f13fde6b198c5b91135cedfda5 Mon Sep 17 00:00:00 2001 From: harshalkwagh Date: Wed, 4 Mar 2020 14:29:40 +0530 Subject: [PATCH 1/4] mount docker socket in dkube-exporter --- kustomize/dkube/base/dkube.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kustomize/dkube/base/dkube.yaml b/kustomize/dkube/base/dkube.yaml index dfc03ce..722fdcf 100644 --- a/kustomize/dkube/base/dkube.yaml +++ b/kustomize/dkube/base/dkube.yaml @@ -134,6 +134,8 @@ spec: volumeMounts: - mountPath: /usr/local/nvidia/lib64 name: nvidia-lib + - mountPath: /var/run/docker.sock + name: docker serviceAccountName: dkube dnsConfig: options: @@ -146,6 +148,10 @@ spec: - hostPath: path: /usr/lib64/nvidia name: nvidia-lib + - hostPath: + path: /var/run/docker.sock + name: docker + --- apiVersion: extensions/v1beta1 kind: DaemonSet From b0bf4a70f806213a8f3d580af1839429bee8b08a Mon Sep 17 00:00:00 2001 From: harshalkwagh Date: Wed, 4 Mar 2020 15:11:12 +0530 Subject: [PATCH 2/4] ext fix --- kustomize-nfs/dkube/base/dkube.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kustomize-nfs/dkube/base/dkube.yaml b/kustomize-nfs/dkube/base/dkube.yaml index 7d388bd..09e7962 100644 --- a/kustomize-nfs/dkube/base/dkube.yaml +++ b/kustomize-nfs/dkube/base/dkube.yaml @@ -128,6 +128,8 @@ spec: volumeMounts: - mountPath: /usr/local/nvidia/lib64 name: nvidia-lib + - mountPath: /var/run/docker.sock + name: docker serviceAccountName: dkube dnsConfig: options: @@ -140,6 +142,10 @@ spec: - hostPath: path: /usr/lib64/nvidia name: nvidia-lib + - hostPath: + path: /var/run/docker.sock + name: docker + --- apiVersion: extensions/v1beta1 kind: DaemonSet @@ -166,7 +172,7 @@ spec: procMount: Default runAsUser: 0 volumeMounts: - - mountPath: /var/lib/docker/containers + - mountPath: LOG_PATH name: varlibdockercontainers readOnly: true - mountPath: /fluentd/etc/ @@ -181,7 +187,7 @@ spec: procMount: Default runAsUser: 0 volumeMounts: - - mountPath: /var/lib/docker/containers + - mountPath: LOG_PATH name: varlibdockercontainers readOnly: true - mountPath: /fluentd/etc/ @@ -207,7 +213,7 @@ spec: name: dkube-log-collector name: dkube-log-collector - hostPath: - path: /var/lib/docker/containers + path: LOG_PATH name: varlibdockercontainers - configMap: defaultMode: 420 From bebb2e47e53abaa7a2129a809ac7a7c5840d2450 Mon Sep 17 00:00:00 2001 From: harshalkwagh Date: Wed, 4 Mar 2020 15:41:29 +0530 Subject: [PATCH 3/4] run dkube-exporter with root user --- kustomize-nfs/dkube/base/dkube.yaml | 2 ++ kustomize/dkube/base/dkube.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/kustomize-nfs/dkube/base/dkube.yaml b/kustomize-nfs/dkube/base/dkube.yaml index 09e7962..c0aae3d 100644 --- a/kustomize-nfs/dkube/base/dkube.yaml +++ b/kustomize-nfs/dkube/base/dkube.yaml @@ -119,6 +119,8 @@ spec: image: dkubeExtImage imagePullPolicy: IfNotPresent name: main + securityContext: + runAsUser: 0 ports: - containerPort: 9401 name: http-metrics diff --git a/kustomize/dkube/base/dkube.yaml b/kustomize/dkube/base/dkube.yaml index 722fdcf..a0bbc8b 100644 --- a/kustomize/dkube/base/dkube.yaml +++ b/kustomize/dkube/base/dkube.yaml @@ -125,6 +125,8 @@ spec: image: dkubeExtImage imagePullPolicy: IfNotPresent name: main + securityContext: + runAsUser: 0 ports: - containerPort: 9401 name: http-metrics From ef3af080ace66a41f8f502e6d963d95ae2b62863 Mon Sep 17 00:00:00 2001 From: harshalkwagh Date: Wed, 4 Mar 2020 16:29:58 +0530 Subject: [PATCH 4/4] security context tune --- kustomize-nfs/dkube/base/dkube.yaml | 3 +-- kustomize/dkube/base/dkube.yaml | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/kustomize-nfs/dkube/base/dkube.yaml b/kustomize-nfs/dkube/base/dkube.yaml index c0aae3d..06e5c37 100644 --- a/kustomize-nfs/dkube/base/dkube.yaml +++ b/kustomize-nfs/dkube/base/dkube.yaml @@ -119,14 +119,13 @@ spec: image: dkubeExtImage imagePullPolicy: IfNotPresent name: main - securityContext: - runAsUser: 0 ports: - containerPort: 9401 name: http-metrics protocol: TCP securityContext: privileged: true + runAsUser: 0 volumeMounts: - mountPath: /usr/local/nvidia/lib64 name: nvidia-lib diff --git a/kustomize/dkube/base/dkube.yaml b/kustomize/dkube/base/dkube.yaml index a0bbc8b..9d29241 100644 --- a/kustomize/dkube/base/dkube.yaml +++ b/kustomize/dkube/base/dkube.yaml @@ -125,14 +125,13 @@ spec: image: dkubeExtImage imagePullPolicy: IfNotPresent name: main - securityContext: - runAsUser: 0 ports: - containerPort: 9401 name: http-metrics protocol: TCP securityContext: privileged: true + runAsUser: 0 volumeMounts: - mountPath: /usr/local/nvidia/lib64 name: nvidia-lib