fix: Potential Denial of Service via unrestricted CPU/memory and root user execution (#5203)

* fix: hostPID set to false

Signed-off-by: zyue110026 <[email protected]>

* fix: hostPID set to false

Signed-off-by: zyue110026 <[email protected]>

* fix: Potential Denial of Service via unrestricted CPU/memory and root user execution

Signed-off-by: zyue110026 <[email protected]>

* fix: Potential Denial of Service via unrestricted CPU/memory and root user execution

Signed-off-by: zyue110026 <[email protected]>

* fix: Potential Denial of Service via unrestricted CPU/memory and root user execution

Signed-off-by: zyue110026 <[email protected]>

---------

Signed-off-by: zyue110026 <[email protected]>
Co-authored-by: Pritesh Kiri <[email protected]>

Author: zyue110026

monitoring/utils/grafana/deployment.yaml

@@ -18,6 +18,17 @@ spec:
         - image: grafana/grafana:latest
           imagePullPolicy: Always
           name: grafana
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
           ports:
             - containerPort: 3000
               name: grafana

monitoring/utils/metrics-exporters-with-service-monitors/litmus-metrics/chaos-exporter/chaos-exporter.yaml

@@ -28,6 +28,17 @@ spec:
           env:
             - name: TSDB_SCRAPE_INTERVAL
               value: '10'
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
           # uncomment the following lines to use the litmuschaos exporter for monitoring the chaos events and chaosresults for a selected namespace
           # - name: WATCH_NAMESPACE
           #   value: 'litmus'

monitoring/utils/metrics-exporters-with-service-monitors/mysqld-exporter/deployment.yaml

@@ -31,6 +31,17 @@ spec:
             - '--collect.engine_innodb_status'
             - '--collect.slave_hosts'
           name: mysql-exporter
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          securityContext:
+            runAsUser: 1000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
           ports:
             - containerPort: 9104
               name: mysql-metrics