mirror of
https://github.com/imjasonh/snoop
synced 2026-07-17 06:01:51 +00:00
c6fec442b7
Create comprehensive Kubernetes deployment resources: - deployment.yaml: Example deployment with snoop sidecar - rbac.yaml: ServiceAccount and ClusterRole for required permissions - example-app.yaml: Complete nginx example showing sidecar integration - README.md: Extensive documentation with quick start, configuration, troubleshooting, and best practices Manifests include: - Security context with minimal required capabilities - Init container for cgroup discovery - Health probes and metrics endpoints - Resource limits and requests - Prometheus annotations for scraping Completes first deliverable of Milestone 4 (Kubernetes Integration). Signed-off-by: Jason Hall <jason@chainguard.dev>
54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: snoop
|
|
rules:
|
|
# Allow reading pod information for metadata enrichment
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list"]
|
|
|
|
# Allow reading node information (for cgroup discovery)
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: snoop
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: snoop
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: snoop
|
|
namespace: snoop-system
|
|
---
|
|
# Note: If you want to restrict snoop to a single namespace,
|
|
# use a Role and RoleBinding instead:
|
|
#
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: Role
|
|
# metadata:
|
|
# name: snoop
|
|
# namespace: snoop-system
|
|
# rules:
|
|
# - apiGroups: [""]
|
|
# resources: ["pods"]
|
|
# verbs: ["get", "list"]
|
|
# ---
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: RoleBinding
|
|
# metadata:
|
|
# name: snoop
|
|
# namespace: snoop-system
|
|
# roleRef:
|
|
# apiGroup: rbac.authorization.k8s.io
|
|
# kind: Role
|
|
# name: snoop
|
|
# subjects:
|
|
# - kind: ServiceAccount
|
|
# name: snoop
|
|
# namespace: snoop-system
|