Update netdata-kubernetes.md
Costa Tsaousis committed
Apr 17, 2025 at 19:51 UTC
f7eda1de39b404a5bac8698eca85cfb5b499a4d6
1 file changed
+4
-4
docs/security-and-privacy-design/netdata-kubernetes.md
+4
-4
@@ -19,7 +19,7 @@ Using this design, Netdata minimizes the potential attack surface. The main daem
19
20
### Netdata Network Exposure
21
22
-Netdata helm charts limit Netdata children connectivity to `localhost`. Netdata children are not allowed to accept any Network connections from outside the local node, and the only outbound network connection they need is towards the Netdata Parent to stream their data. The Netdata children also do not maintain a database on disk. All information they collect is streaming in real-time to their Netdata Parent.
22
+Netdata helm charts limit Netdata children connectivity to `localhost`. Netdata children are not allowed to accept any Network connections from outside the local node, and the only outbound network connection they need is towards the Netdata Parent to stream their data. The Netdata children also do not maintain a database on disk. All information they collect is streamed in real-time to their Netdata Parent.
23
24
Netdata Parents on the other hand, do not require any mounts, host namespaces, or capabilities. They run in an unprivileged container, ingesting data in real-time from Netdata children and exposing this information via their APIs.
25
@@ -29,7 +29,7 @@ Netdata Children do not need to connect to Netdata Cloud. Netdata Parents only n
29
30
Mounting specific host directories into the Netdata container provides essential data access for various collection plugins.
31
32
-| Mount | Type | Node | Component | Why |
32
+| Mount | Type | Role | Component | Why |
33
|:---:|:---:|:---:|:---:|:---|
34
| `/`| hostPath | child | `diskspace.plugin` | Detect host mount points (only in Docker deployments, not in Kubernetes deployments). |
35
| `/etc/os-release` | hostPath | child | `netdata` | Collect host labels. |
@@ -56,7 +56,7 @@ Notes:
56
57
Utilizing host namespaces allows Netdata to observe network activity and processes as they appear on the host, rather than being confined to the container's isolated view.
58
59
-| Namespace | Node | Component | Why |
59
+| Namespace | Role | Component | Why |
60
|:---:|:---:|:---:|:---|
61
| Host Network Namespace | child | `proc.plugin` | Monitor host's networking stack. |
62
| Host Network Namespace | child | `cgroup-network` | Detect containers' network interfaces. |
@@ -68,7 +68,7 @@ Utilizing host namespaces allows Netdata to observe network activity and process
68
69
Specific Linux capabilities grant elevated privileges necessary for certain monitoring functions, particularly those involving process inspection and namespace manipulation.
70
71
-| Capability | Node | Component | Why |
71
+| Capability | Role | Component | Why |
72
|:---:|:---:|:---:|:---|
73
| SYS_ADMIN | child | `cgroup-network` | Associate containers' network interfaces with the containers (it does so by switching Network Namespaces). Without it, `veth` network interfaces will not be associated to their respective containers, so they will be monitored as host network interfaces. |
74
| SYS_ADMIN | child | `network-viewer.plugin` | Discover containers' network connections (it does so by switching Network Namespaces). Without it, network connections of other containers will not be monitored, limiting the scope of network connections to the host system. |