New security constraints coming to Prometheus-Operator

[ArthurSens]

Prometheus-operator just got a new release with several new security policies implemented:

• [CHANGE] Enabled read-only root filesystem for containers generated from the Prometheus, Alertmanager and ThanosRuler objects. Add securityContext to managed containers prometheus-operator/prometheus-operator#4552
• [CHANGE] Disabled privilege escalation for the containers generated from Prometheus, Alertmanager and ThanosRuler objects. Add securityContext to managed containers prometheus-operator/prometheus-operator#4552
• [CHANGE] Dropped all capabilities for the containers generated from Prometheus, Alertmanager and ThanosRuler objects. Add securityContext to managed containers prometheus-operator/prometheus-operator#4552
• [CHANGE] Added emptyDir volume to the Prometheus statefulset when spec.queryLogFile is only a base filename (e.g. query.log as opposed to /tmp/query.log). When the path contains a full path, a volume + volume mount should be explicitly given in the Prometheus spec since the root file system is now read-only. pkg/prometheus/statefulset: Add VolumeMount for query-log-file prometheus-operator/prometheus-operator#4566

All those changes will be imported here by our next Automated version update, we should keep an eye on when that happens and make sure everything is working as expected.

[mads-hartmann]

@ArthurSens Added this to the next iteration, but if we're lucky this is no-op for us right?

[ArthurSens]

@ArthurSens Added this to the next iteration, but if we're lucky this is no-op for us right?

Hopefully yes 🤞

[ArthurSens]

Those changes are live and nothing seems to be broken!