GoogleCloudPlatform / GoogleCloudPlatform/prometheus-engine
Improve Pod and Container Security Context for Prometheus Frontend
Open
enhancement
- Dominant language
- Go
- Stars
- 232
- Forks
- 109
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 27
Description
`prometheus-frontend` already has a container security context, but it can be improved: https://github.com/GoogleCloudPlatform/prometheus-engine/blob/0aad9daccde2771f0a1c02247f250a33d58a3572/examples/frontend.yaml#L57-L65
I would propose:
* Adding a `seccompProfile` (RuntimeDefault)
* Setting `readOnlyRootFilesystem: true`
* Adding a Pod Security Context
* Switching to a non-root base image ([`distroless` publishes `nonroot` tags](https://github.com/GoogleContainerTools/distroless))
Contributor guide
Assessment
This issue has not been assessed yet.