Skip to content

Commit df15f10

Browse files
ilyam8ilyam8
authored
docs: add Required Resources and Permissions section (#483)
1 parent aeeb9ee commit df15f10

1 file changed

Lines changed: 55 additions & 8 deletions

File tree

‎charts/netdata/README.md‎

Lines changed: 55 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,13 @@ This chart bootstraps a [Netdata](https://github.com/netdata/netdata) deployment
1414
cluster using the [Helm](https://helm.sh) package manager.
1515

1616
By default, the chart installs:
17+
1718
- A Netdata child pod on each node of a cluster, using a `Daemonset`
1819
- A Netdata k8s state monitoring pod on one node, using a `Deployment`. This virtual node is called `netdata-k8s-state`.
1920
- A Netdata parent pod on one node, using a `Deployment`. This virtual node is called `netdata-parent`.
2021

2122
Disabled by default:
23+
2224
- A Netdata restarter `CronJob`. Its main purpose is to automatically update Netdata when using nightly releases.
2325

2426
The child pods and the state pod function as headless collectors that collect and forward
@@ -35,6 +37,52 @@ Please validate that the settings are suitable for your cluster before using the
3537
your cluster, on an administrative system.
3638
- The [Helm package manager](https://helm.sh/) v3.8.0 or newer on the same administrative system.
3739

40+
## Required Resources and Permissions
41+
42+
Netdata is a comprehensive monitoring solution that requires specific access to host resources to function effectively. By design, monitoring solutions like Netdata need visibility into various system components to collect metrics and provide insights. The following mounts, privileges, and capabilities are essential for Netdata's operation, and applying restrictive security profiles or limiting these accesses may significantly impact functionality or render the monitoring solution ineffective.
43+
44+
<details>
45+
<summary>See required mounts, privileges and RBAC resources</summary>
46+
47+
### Required Mounts
48+
49+
| Mount | Type | Node | Components & Descriptions |
50+
|:-----------------------------------------------------------|:----------------------------:|:-----------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
51+
| `/` | hostPath | child | • **diskspace.plugin**: Host mount points monitoring. |
52+
| `/proc` | hostPath | child | • **proc.plugin**: Host system monitoring (CPU, memory, network interfaces, disks, etc.). |
53+
| `/sys` | hostPath | child | • **cgroups.plugin**: Docker containers monitoring and name resolution. |
54+
| `/var/log` | hostPath | child | • **systemd-journal.plugin**: Viewing, exploring and analyzing systemd journal logs. |
55+
| `/etc/os-release` | hostPath | child, parent, k8sState | • **netdata**: Host info detection. |
56+
| `/etc/passwd`, `/etc/group` | hostPath | child | • **apps.plugin**: Monitoring of host system resource usage by each user and user group. |
57+
| `{{ .Values.child.persistence.hostPath }}/var/lib/netdata` | hostPath (DirectoryOrCreate) | child | • **netdata**: Persistence of Netdata's /var/lib/netdata directory which contains netdata public unique ID and other files that should persist across container recreations. Without persistence, a new netdata unique ID is generated for each child on every container recreation, causing children to appear as new nodes on the Parent instance. |
58+
59+
### Required Privileges and Capabilities
60+
61+
| Privilege/Capability | Node | Components & Descriptions |
62+
|:---------------------|:-----:|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
63+
| Host Network Mode | child | • **proc.plugin**: Host system networking stack monitoring. <br/>• **go.d.plugin**: Monitoring applications running on the host and inside containers. <br/>• **local-listeners**: Discovering local services/applications. Map open (listening) ports to running services/applications. <br/>• **network-viewer.plugin**: Discovering all current network sockets and building a network-map. |
64+
| Host PID Mode | child | • **cgroups.plugin**: Container network interfaces monitoring. Map virtual interfaces in the system namespace to interfaces inside containers. |
65+
| SYS_ADMIN | child | • **cgroups.plugin**: Container network interfaces monitoring. Map virtual interfaces in the system namespace to interfaces inside containers. <br/>• **network-viewer.plugin**: Discovering all current network sockets and building a network-map. |
66+
| SYS_PTRACE | child | • **local-listeners**: Discovering local services/applications. Map open (listening) ports to running services/applications. |
67+
68+
### Required Kubernetes RBAC Resources
69+
70+
| Resource | Verbs | Components & Descriptions |
71+
|:-------------------|:-----------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
72+
| pods | get, list, watch | • **service discovery**: Used for discovering services. <br/>• **go.d/k8s_state**: Kubernetes state monitoring. <br/>• **netdata**: Used by cgroup-name.sh and get-kubernetes-labels.sh scripts. |
73+
| services | get, list, watch | • **service discovery**: Used for discovering services. |
74+
| configmaps | get, list, watch | • **service discovery**: Used for discovering services. |
75+
| secrets | get, list, watch | • **service discovery**: Used for discovering services. |
76+
| nodes | get, list, watch | • **go.d/k8s_state**: Kubernetes state monitoring. |
77+
| nodes/metrics | get, list, watch | • **go.d/k8s_kubelet**: Used when querying Kubelet HTTPS endpoint. |
78+
| nodes/proxy | get, list, watch | • **netdata**: Used by cgroup-name.sh when querying Kubelet /pods endpoint. |
79+
| deployments (apps) | get, list, watch | • **go.d/k8s_state**: Kubernetes state monitoring. |
80+
| cronjobs (batch) | get, list, watch | • **go.d/k8s_state**: Kubernetes state monitoring. |
81+
| jobs (batch) | get, list, watch | • **go.d/k8s_state**: Kubernetes state monitoring. |
82+
| namespaces | get | • **go.d/k8s_state**: Kubernetes state monitoring. <br/>• **netdata**: Used by cgroup-name.sh and get-kubernetes-labels.sh scripts. |
83+
84+
</details>
85+
3886
## Installing the Helm chart
3987

4088
You can install the Helm chart via our Helm repository, or by cloning this repository.
@@ -281,7 +329,7 @@ $ helm install ./netdata --name my-release -f values.yaml
281329
282330
> **Note:**: To opt out of anonymous statistics, set the `DO_NOT_TRACK`
283331
> environment variable to non-zero or non-empty value in
284-
`parent.env` / `child.env` configuration (e.g: `DO_NOT_TRACK: 1`)
332+
`parent.env` / `child.env` configuration (e.g.,: `DO_NOT_TRACK: 1`)
285333
> or uncomment the line in `values.yml`.
286334
287335
### Configuration files
@@ -308,11 +356,10 @@ the `parent.configs` or the `child.configs` arrays. Regardless of whether you ad
308356
under `/etc/netdata` or in a subdirectory such as `/etc/netdata/go.d`, you can use the already provided configurations
309357
as reference. For reference, the `parent.configs` the array includes an `example` alarm that would get triggered if the
310358
python.d `example` module was enabled. Whenever you pass the sensitive data to your configuration like the database
311-
credential you can take an option to put it into the Kubernetes Secret by specifying `storedType: secret` in the
312-
selected configuration. Default all the configuration will be placed in the Kubernetes configmap.
359+
credential, you can take an option to put it into the Kubernetes Secret by specifying `storedType: secret` in the
360+
selected configuration. By default, all the configurations will be placed in the Kubernetes configmap.
313361

314-
Note that with the default configuration of this chart, the parent does the health checks and triggers alarms, but does
315-
not collect much data. As a result, the only other configuration files that might make sense to add to the parent are
362+
Note that in this chart's default configuration, the parent performs the health checks and triggers alarms but collects little data. As a result, the only other configuration files that might make sense to add to the parent are
316363
the alarm and alarm template definitions, under `/etc/netdata/health.d`.
317364

318365
> **Tip**: Do pay attention to the indentation of the config file contents, as it matters for the parsing of the `yaml` file. Note that the first line under `var: |`
@@ -335,8 +382,8 @@ data for specific PV is lost in case of pod removal.
335382
node in `netdata.cloud` (due to `./registry/` and `./cloud.d/` being removed).
336383

337384
In case of `child` instance it is a bit simpler. By default, hostPath: `/var/lib/netdata-k8s-child` is mounted on child
338-
in: `/var/lib/netdata`. You can disable it but this option is pretty much required in a real life scenario, as without
339-
it each pod deletion will result in new replication node for a parent.
385+
in: `/var/lib/netdata`. You can disable it, but this option is pretty much required in a real life scenario, as without
386+
it each pod deletion will result in a new replication node for a parent.
340387

341388
### Service discovery and supported services
342389

@@ -440,7 +487,7 @@ $ helm install \
440487

441488
## Contributing
442489

443-
If you want to contribute, we are humbled!
490+
If you want to contribute, we’re humbled!
444491

445492
- Take a look at our [Contributing Guidelines](https://github.com/netdata/.github/blob/main/CONTRIBUTING.md).
446493
- This repository is under the [Netdata Code Of Conduct](https://github.com/netdata/.github/blob/main/CODE_OF_CONDUCT.md).

0 commit comments

Comments
 (0)