Skip to content

Commit c636912

Browse files
jimmidysonjimmidyson
committed
feat: Explicitly disable profiling for CP components
As per CIS benchmarks.
1 parent 461bae3 commit c636912

File tree

8 files changed

+147
-2
lines changed

8 files changed

+147
-2
lines changed

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/aws-cluster-class.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -85,9 +85,14 @@ spec:
8585
apiServer:
8686
extraArgs:
8787
cloud-provider: external
88+
profiling: "false"
8889
controllerManager:
8990
extraArgs:
9091
cloud-provider: external
92+
profiling: "false"
93+
scheduler:
94+
extraArgs:
95+
profiling: "false"
9196
initConfiguration:
9297
nodeRegistration:
9398
kubeletExtraArgs:

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/docker-cluster-class.yaml

+10-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,16 @@ spec:
8080
template:
8181
spec:
8282
kubeadmConfigSpec:
83-
clusterConfiguration: {}
83+
clusterConfiguration:
84+
apiServer:
85+
extraArgs:
86+
profiling: "false"
87+
controllerManager:
88+
extraArgs:
89+
profiling: "false"
90+
scheduler:
91+
extraArgs:
92+
profiling: "false"
8493
initConfiguration:
8594
nodeRegistration: {}
8695
joinConfiguration:

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/nutanix-cluster-class-old.yaml

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
apiVersion: cluster.x-k8s.io/v1beta1
2+
kind: ClusterClass
3+
metadata:
4+
labels:
5+
cluster.x-k8s.io/provider: nutanix
6+
name: old-nutanix-quick-start
7+
spec:
8+
controlPlane:
9+
machineHealthCheck:
10+
maxUnhealthy: 40%
11+
nodeStartupTimeout: 10m
12+
unhealthyConditions:
13+
- status: "False"
14+
timeout: 300s
15+
type: Ready
16+
- status: Unknown
17+
timeout: 300s
18+
type: Ready
19+
- status: "True"
20+
timeout: 300s
21+
type: MemoryPressure
22+
- status: "True"
23+
timeout: 300s
24+
type: DiskPressure
25+
- status: "True"
26+
timeout: 300s
27+
type: PIDPressure
28+
- status: "True"
29+
timeout: 300s
30+
type: NetworkUnavailable
31+
machineInfrastructure:
32+
ref:
33+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
34+
kind: NutanixMachineTemplate
35+
name: nutanix-quick-start-cp-nmt
36+
ref:
37+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
38+
kind: KubeadmControlPlaneTemplate
39+
name: nutanix-quick-start-kcpt
40+
infrastructure:
41+
ref:
42+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
43+
kind: NutanixClusterTemplate
44+
name: nutanix-quick-start-nct
45+
patches:
46+
- external:
47+
discoverVariablesExtension: nutanixclusterconfigvars-dv.cluster-api-runtime-extensions-nutanix
48+
generateExtension: nutanixclusterconfigpatch-gp.cluster-api-runtime-extensions-nutanix
49+
name: cluster-config
50+
- external:
51+
discoverVariablesExtension: nutanixworkerconfigvars-dv.cluster-api-runtime-extensions-nutanix
52+
generateExtension: nutanixworkerconfigpatch-gp.cluster-api-runtime-extensions-nutanix
53+
name: worker-config
54+
workers:
55+
machineDeployments:
56+
- class: default-worker
57+
machineHealthCheck:
58+
maxUnhealthy: 40%
59+
nodeStartupTimeout: 10m
60+
unhealthyConditions:
61+
- status: "False"
62+
timeout: 300s
63+
type: Ready
64+
- status: Unknown
65+
timeout: 300s
66+
type: Ready
67+
- status: "True"
68+
timeout: 300s
69+
type: MemoryPressure
70+
- status: "True"
71+
timeout: 300s
72+
type: DiskPressure
73+
- status: "True"
74+
timeout: 300s
75+
type: PIDPressure
76+
- status: "True"
77+
timeout: 300s
78+
type: NetworkUnavailable
79+
template:
80+
bootstrap:
81+
ref:
82+
apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
83+
kind: KubeadmConfigTemplate
84+
name: nutanix-quick-start-kcfg-0
85+
infrastructure:
86+
ref:
87+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
88+
kind: NutanixMachineTemplate
89+
name: nutanix-quick-start-md-nmt

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/nutanix-cluster-class.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -124,13 +124,16 @@ spec:
124124
apiServer:
125125
extraArgs:
126126
cloud-provider: external
127+
profiling: "false"
127128
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
128129
controllerManager:
129130
extraArgs:
130131
cloud-provider: external
132+
profiling: "false"
131133
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
132134
scheduler:
133135
extraArgs:
136+
profiling: "false"
134137
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
135138
files:
136139
- content: |-

‎hack/examples/overlays/clusterclasses/aws/kustomization.yaml.tmpl

+7-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,13 @@ patches:
6060
path: "/spec/template/spec/instanceType"
6161
value: "PLACEHOLDER"
6262
- target:
63-
kind: AWSMachineTemplate
63+
kind: AWSMachineTemplate
6464
patch: |-
6565
- op: "remove"
6666
path: "/spec/template/spec/iamInstanceProfile"
67+
68+
# BEGIN CIS patches
69+
- target:
70+
kind: KubeadmControlPlaneTemplate
71+
path: ../../../patches/disable-kubeadmcontrolplane-profiling.yaml
72+
# END CIS patches

‎hack/examples/overlays/clusterclasses/docker/kustomization.yaml.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,9 @@ patches:
2525
external:
2626
generateExtension: "dockerworkerv3configpatch-gp.cluster-api-runtime-extensions-nutanix"
2727
discoverVariablesExtension: "dockerworkerconfigvars-dv.cluster-api-runtime-extensions-nutanix"
28+
29+
# BEGIN CIS patches
30+
- target:
31+
kind: KubeadmControlPlaneTemplate
32+
path: ../../../patches/disable-kubeadmcontrolplane-profiling.yaml
33+
# END CIS patches

‎hack/examples/overlays/clusterclasses/nutanix/kustomization.yaml.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,9 @@ patches:
2525
external:
2626
generateExtension: "nutanixworkerv3configpatch-gp.cluster-api-runtime-extensions-nutanix"
2727
discoverVariablesExtension: "nutanixworkerconfigvars-dv.cluster-api-runtime-extensions-nutanix"
28+
29+
# BEGIN CIS patches
30+
- target:
31+
kind: KubeadmControlPlaneTemplate
32+
path: ../../../patches/disable-kubeadmcontrolplane-profiling.yaml
33+
# END CIS patches

‎hack/examples/patches/disable-kubeadmcontrolplane-profiling.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright 2025 Nutanix. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
5+
kind: KubeadmControlPlaneTemplate
6+
metadata:
7+
name: not-used
8+
spec:
9+
template:
10+
spec:
11+
kubeadmConfigSpec:
12+
clusterConfiguration:
13+
apiServer:
14+
extraArgs:
15+
profiling: "false"
16+
controllerManager:
17+
extraArgs:
18+
profiling: "false"
19+
scheduler:
20+
extraArgs:
21+
profiling: "false"

0 commit comments

Comments
 (0)