Popeye warnings & errors

[0-sv]

https://popeyecli.io scans clusters for potential issues. I came across it while working on #171 (I wanted to have a view in which I can see the resources of Loki, I'm not familiar at all with this tool). The goal of this discussion is to decide if there are any important issues to take care of.

Overview lists scores, as you can see everything below clusterrolebindings is 100. The findings are from the demo cluster. Refer to the table to see how many of the warnings/errors listed below are present:

│ RESOURCE                                                                                                                                      SCORE%↑                                                           SCANNED                                                           ERROR                                                           WARNING                                                           INFO                                                             OK  │
│ ingresses                                                                                                                                           0                                                                13                                                               0                                                                13                                                              0                                                              0  │
│ pods                                                                                                                                                0                                                               121                                                               0                                                               121                                                              0                                                              0  │
│ services                                                                                                                                           21                                                               125                                                              10                                                                88                                                              3                                                             24  │
│ daemonsets                                                                                                                                         40                                                                 5                                                               0                                                                 3                                                              0                                                              2  │
│ deployments                                                                                                                                        66                                                                72                                                               0                                                                24                                                             20                                                             28  │
│ statefulsets                                                                                                                                       66                                                                18                                                               0                                                                 6                                                              0                                                             12  │
│ nodes                                                                                                                                              75                                                                 4                                                               0                                                                 1                                                              0                                                              3  │
│ rolebindings                                                                                                                                       87                                                                48                                                               0                                                                 6                                                              0                                                             42  │
│ clusterrolebindings                                                                                                                               100                                                               114                                                               0                                                                 0                                                              0                                                            114  │
│ clusterroles                                                                                                                                      100                                                               138                                                               0                                                                 0                                                             44                                                             94  │
│ configmaps                                                                                                                                        100                                                               146                                                               0                                                                 0                                                             88                                                             58  │
│ horizontalpodautoscalers                                                                                                                          100                                                                 6                                                               0                                                                 0                                                              0                                                              6  │
│ namespaces                                                                                                                                        100                                                                27                                                               0                                                                 0                                                              9                                                             18  │
│ persistentvolumeclaims                                                                                                                            100                                                                17                                                               0                                                                 0                                                              5                                                             12  │
│ persistentvolumes                                                                                                                                 100                                                                17                                                               0                                                                 0                                                              0                                                             17  │
│ poddisruptionbudgets                                                                                                                              100                                                                 6                                                               0                                                                 0                                                              0                                                              6  │
│ podsecuritypolicies                                                                                                                               100                                                                 7                                                               0                                                                 0                                                              0                                                              7  │
│ replicasets                                                                                                                                       100                                                               223                                                               0                                                                 0                                                              0                                                            223  │
│ roles                                                                                                                                             100                                                                36                                                               0                                                                 0                                                              2                                                             34  │
│ secrets                                                                                                                                           100                                                               396                                                               0                                                                 0                                                            276                                                            120  │
│ serviceaccounts                                                                                                                                   100                                                               117                                                               0                                                                 0                                                             19                                                             98

The rest of the resources whose scores are <100 and their output (in order of severity, least severe at the bottom of this post, errors are marked bold):

Ingresses:

• (POP-403) Deprecated Ingress API group "extensions::v1beta1". Use "networking.k8s.io::v1beta1" instead

Pods:

• (POP-301) Connects to API Server? ServiceAccount token is mounted
• (POP-302) Pod could be running as root user. Check SecurityContext::Image
• (POP-102) No probes defined
• (POP-106) No resources requests::limits defined
• (POP-306) Container could be running as root user. Check SecurityContext::Image
• (POP-300) Using "default" ServiceAccount
• (POP-103) No liveness probe
• (POP-110) Memory Current::Request (69Mi::80Mi) reached user 80% threshold (86%)
• (POP-105) Liveness probe uses a port#, prefer a named port
• (POP-108) Unnamed port xxxxx
• (POP-206) No PodDisruptionBudget defined

Services:

• (POP-1100) No pods match service selector
• (POP-1101) Skip ports check. No explicit ports detected on pod istio-operator::istio-operator-9848fbbb5-gshhj
• (POP-1102) Use of target port%!(EXTRA string=9999, string=TCP::80)
• (POP-1105) No associated endpoints
• (POP-1109) Only one associated endpoint
  - (POP-1106) No target ports match service port TCP::xxxx
• (POP-1103) Type Loadbalancer detected. Could be expensive
• (POP-1107) LoadBalancer detected but service sets externalTrafficPolicy to "Cluster"

Daemonsets:

• (POP-107) No resource limits defined
• (POP-106) No resources requests::limits defined

Deployments:

• (POP-106) No resources requests::limits defined
• (POP-107) No resource limits defined
• (POP-108) Unnamed port xxxx
• (POP-505) At current load, Memory under allocated. Current:1697Mi vs Requested:512Mi (331.45%)
• (POP-106) No resources requests::limits defined
• (POP-101) Image tagged "latest" in use

Statefulsets:

• (POP-101) Image tagged "latest" in use
• (POP-106) No resources requests::limits defined
• (POP-107) No resource limits defined
• (POP-500) Zero scale detected

Rolebindings:

• (POP-1300) References a ClusterRole (psp:unprivileged) which does not exist

[Morriz]

Nice, now we need a report telling us the details: which resource is suffering from what found issue(s)?

[0-sv]

Sorry for the confusion. It does do that, but I wanted to keep this report brief. Please refer to the CLI for that.

[Morriz]

Then please create a Spike for this to draft a plan how to tighten this.