extension-jvm

command module
v1.0.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 9, 2023 License: MIT Imports: 10 Imported by: 0

README

JVM logo

Steadybit extension-jvm

This Steadybit extension provides a jvm application discovery and the various actions for jvm applications targets.

Learn about the capabilities of this extension in our Reliability Hub.

Configuration

Environment Variable Helm value Meaning Required Default
STEADYBIT_EXTENSION_RUNTIME container.runtime The container runtime to user either docker, containerd or cri-o. Will be automatically configured if not specified. yes (auto)
STEADYBIT_EXTENSION_SOCKET containerRuntimes.(docker/containerd/cri-o).socket The socket used to connect to the container runtime. Will be automatically configured if not specified. yes (auto)
STEADYBIT_EXTENSION_CONTAINERD_NAMESPACE The containerd namespace to use. yes k8s.io
STEADYBIT_EXTENSION_RUNC_ROOT containerRuntimes.(docker/containerd/cri-o).runcRoot The runc root to use. yes (auto)
STEADYBIT_EXTENSION_RUNC_DEBUG Activate debug mode for run.
STEADYBIT_EXTENSION_JVM_ATTACHMENT_ENABLED is jvm attachment enabled no true
STEADYBIT_EXTENSION_JAVA_AGENT_ATTACHMENT_PORT java agent attachment port no 8095
STEADYBIT_EXTENSION_CONTAINER_ADDRESS public ip of the extension no

The extension supports all environment variables provided by steadybit/extension-kit.

Needed capabilities

The capabilities needed by this extension are: (which are provided by the helm chart)

  • SYS_ADMIN
  • SYS_RESOURCE
  • SYS_PTRACE
  • KILL
  • NET_ADMIN
  • DAC_OVERRIDE
  • SETUID
  • SETGID
  • AUDIT_WRITE

Installation

Using Helm in Kubernetes
$ helm repo add steadybit-extension-jvm https://steadybit.github.io/extension-jvm
$ helm repo update
$ helm upgrade steadybit-extension-jvm \
    --install \
    --wait \
    --timeout 5m0s \
    --create-namespace \
    --namespace steadybit-extension \
    --set container.runtime=docker \
    steadybit-extension-jvm/steadybit-extension-jvm
Using Docker
docker run \
  --rm \
  -p 8087 \
  --privileged \
  --pid=host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /run/docker/runtime-runc/moby:/run/docker/runtime-runc/moby\
  -v /sys/fs/cgroup:/sys/fs/cgroup\
  --name steadybit-extension-jvm \
  ghcr.io/steadybit/extension-jvm:latest
Linux Package

Please use our outpost-linux.sh script to install the extension on your Linux machine. The script will download the latest version of the extension and install it using the package manager.

Register the extension

Make sure to register the extension at the steadybit platform. Please refer to the documentation for more information.

Anatomy of the extension / Security

We try to limit the needed access needed for the extension to the absolute minimum. So the extension itself can run as a non-root user on a read-only root file-system and will by default if deployed using the provided helm-chart. In order do execute certain actions the extension needs certain capabilities.

discovery / state attacks

For discovery the extension needs access to the container runtime socket.

resource and network attacks

The jvm attachment reuses the target container's linux namespace(s), control group(s) and user. This requires the following capabilities: SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, KILL, NET_ADMIN, DAC_OVERRIDE, SETUID, SETGID, AUDIT_WRITE.

Documentation

The Go Gopher

There is no documentation for this package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL