OG T
|
6ce82ff883
|
fix(k3s): Phase O-1 基礎設施修復 — Descheduler + MinIO/Kali 監控
O-1.1: Descheduler securityContext 修復 (PodSecurity restricted 合規)
- 新增 pod securityContext (runAsNonRoot, runAsUser:65534, seccompProfile)
- 新增 container securityContext (allowPrivilegeEscalation:false, drop ALL)
- 補齊 RBAC: namespaces + replicasets list 權限
- 已部署驗證: CronJob 成功執行 (Status: Completed)
O-1.3: MinIO Prometheus scrape 配置 + 告警規則
O-1.4: Kali Blackbox TCP probe + 告警規則
- MinioDown, MinioDiskUsageHigh, MinioOfflineDisk
- KaliScannerDown
待手動部署: Prometheus config → .188, kubectl kubeconfig → 120/121
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-02 13:55:26 +08:00 |
|