@cryptotaxi247 / netdata-1 / commits / bb03a037b

Update netdata-kubernetes.md

Costa Tsaousis committed Apr 18, 2025 at 19:06 UTC bb03a037b36872c26d6b9c8612130dd1bcb58ed5
1 file changed +141
docs/security-and-privacy-design/netdata-kubernetes.md
+141
@@ -124,6 +124,147 @@ Specific Linux capabilities grant elevated privileges necessary for certain moni
124
125 IMPORTANT: All the plugins or helpers that utilize these capabilities are isolated from the rest of Netdata. This means that all the other plugins of Netdata and the main Netdata daemon cannot utilize these capabilities, even when the capabilities have been given to the whole container Netdata is installed.
126
127 +### Overview
128 +
129 +An overview of the structure, related to permissions:
130 +
131 +1. The Netdata Child Agent and its internal plugins (`proc.plugin`, `diskspace.plugin`, `cgroups.plugin`) run unprivileged.
132 +2. External Plugins are requiring access to resources depending on their job.
133 +3. Helpers (`local-listeners`, `cgroup-network`) are command line tools that unprivileged plugins call to enrich the information they collect.
134 +
135 +Netdata allows configuring the available capabilities, namespaces and mounts, but also allows disabling specific plugins or features.
136 +
137 +```mermaid
138 +flowchart TB
139 + classDef unprivileged fill:#9d9,stroke:#333,stroke-width:1px,color:#000
140 + classDef privileged fill:#eec,stroke:#333,stroke-width:1px,color:#000
141 + classDef parent fill:#99f,stroke:#333,stroke-width:1px,color:#000
142 + classDef child fill:#4caf50,stroke:#333,stroke-width:1px,color:#000
143 + classDef agentGroup fill:#eee,stroke:#333,stroke-width:1px
144 + classDef helper fill:#dd8,stroke:#333,stroke-width:1px,color:#000
145 +
146 + Parent["<big><b>Netdata Parent Pod</b></big>
147 + <i>Central aggregation point for all Child agents</i><br/>
148 + <b>Unprivileged</b>
149 + - No host path mounts
150 + - No host namespaces
151 + - No special capabilities
152 + - Exposes API and dashboard
153 + "]
154 +
155 + class Parent parent
156 + Parent <---> Child
157 +
158 + subgraph Child ["<b>Child Pod/Agent (DaemonSet)</b>"]
159 +
160 + NetdataDaemon <---> GoPlugin
161 + GoPlugin ==> LocalListeners
162 + NetdataDaemon <-.-> ProcPlugin
163 + NetdataDaemon <-.-> CgroupsPlugin
164 + CgroupsPlugin ---> CgroupNetwork
165 + NetdataDaemon <-.-> DiskspacePlugin
166 + NetdataDaemon <---> AppsPlugin
167 + NetdataDaemon <---> NetworkViewerPlugin
168 + NetdataDaemon <---> SystemdJournalPlugin
169 + NetdataDaemon <---> DebugfsPlugin
170 +
171 + NetdataDaemon["<big><b>Netdata Child Daemon</b></big>
172 + <i>Orchestrates collection, streams to Parent</i><br/>
173 + <b>Unprivileged</b>
174 + - Runs as 'netdata' user
175 + - Listens to localhost only
176 + "]
177 +
178 + GoPlugin["<big><b>go.d.plugin</b></big>
179 + <i>Collects application provided metrics from Host applications and sibling containers</i><br/>
180 + <b>Unprivileged</b>
181 + No special needs
182 + "]
183 +
184 + LocalListeners["<big><b>local-listeners</b></big>
185 + <i>Discovers listening ports on host and sibling containers, mapping them to process names</i><br/>
186 + <b>Privileged Helper</b>
187 + Needs: Host Network NS, CAP_SYS_ADMIN, CAP_SYS_PTRACE
188 + "]
189 +
190 + ProcPlugin["<big><b>proc.plugin</b></big>
191 + <i>Monitors Host CPU, Memory, Network, Storage, etc.</i><br/>
192 + <b>Unprivileged</b>
193 + Needs: /proc, /sys, Host Network NS
194 + "]
195 +
196 + CgroupsPlugin["<big><b>cgroups.plugin</b></big>
197 + <i>Monitors all Running Containers</i><br/>
198 + <b>Unprivileged</b>
199 + - Needs: /proc, /sys
200 + "]
201 +
202 + CgroupNetwork["<big><b>cgroup-network</b></big>
203 + <i>Maps network interfaces to containers</i><br/>
204 + <b>Privileged Helper</b>
205 + Needs: /proc, Host Network NS, Host PID NS, CAP_SYS_ADMIN
206 + "]
207 +
208 + AppsPlugin["<big><b>apps.plugin</b></big>
209 + <i>Monitors all Host and sibling container processes</i><br/>
210 + <b>Privileged Plugin</b>
211 + Needs: /proc, /etc/passwd, /etc/group, CAP_SYS_PTRACE
212 + "]
213 +
214 + DiskspacePlugin["<big><b>diskspace.plugin</b></big>
215 + <i>Detects and monitors host mount points</i><br/>
216 + <b>Unprivileged</b>
217 + Needs: / (Docker only)
218 + "]
219 +
220 + NetworkViewerPlugin["<big><b>network-viewer.plugin</b></big>
221 + <i>Monitors TCP/UDP sockets and connections on host and containers</i><br/>
222 + <b>Privileged Plugin</b>
223 + Needs: /proc, /etc/passwd, /etc/group, Host Network NS, CAP_SYS_ADMIN, CAP_SYS_PTRACE
224 + "]
225 +
226 + SystemdJournalPlugin["<big><b>systemd-journal.plugin</b></big>
227 + <i>Processes and queries system logs</i><br/>
228 + <b>Privileged Plugin</b>
229 + Needs: /var/log
230 + "]
231 +
232 + DebugfsPlugin["<big><b>debugfs.plugin</b></big>
233 + <i>Monitors hardware sensors and kernel subsystems</i><br/>
234 + <b>Unprivileged</b>
235 + Needs: /sys
236 + "]
237 +
238 + end
239 +
240 + linkStyle 0 stroke:#000,stroke-width:5px;
241 + linkStyle 1 stroke:#000,stroke-width:4px;
242 + linkStyle 2 stroke:#000,stroke-width:4px;
243 + linkStyle 3 stroke:#000,stroke-width:4px;
244 + linkStyle 4 stroke:#000,stroke-width:4px;
245 + linkStyle 5 stroke:#000,stroke-width:4px;
246 + linkStyle 6 stroke:#000,stroke-width:4px;
247 + linkStyle 7 stroke:#000,stroke-width:4px;
248 + linkStyle 8 stroke:#000,stroke-width:4px;
249 + linkStyle 9 stroke:#000,stroke-width:4px;
250 + linkStyle 10 stroke:#000,stroke-width:4px;
251 +
252 + class NetdataDaemon unprivileged
253 + class ProcPlugin unprivileged
254 + class CgroupsPlugin unprivileged
255 + class DiskspacePlugin unprivileged
256 + class GoPlugin unprivileged
257 +
258 + class AppsPlugin privileged
259 + class CgroupNetwork helper
260 + class NetworkViewerPlugin privileged
261 + class SystemdJournalPlugin privileged
262 + class LocalListeners helper
263 + class DebugfsPlugin privileged
264 +
265 + class Child agentGroup
266 +```
267 +
268 ## Configuration Strategies and Monitoring Scope
269
270 Administrators can configure Netdata `child` agents with varying levels of host access, directly impacting both the depth of observability achieved and the security posture of the deployment. Understanding the trade-offs associated with different configurations is essential for aligning Netdata with organizational security policies and monitoring requirements. We outline three primary approaches below: