feat(kube-monitoring): ceph bucket provisioning - #1973
Merged
Conversation
Signed-off-by: trouaux <thomas.rouaux@sap.com>
Signed-off-by: trouaux <thomas.rouaux@sap.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new hook path has security/operational issues (e.g., cleanup on hook failure, unpinned latest image) and needs stronger configuration validation to avoid runtime install failures.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adds optional Ceph (S3-compatible) bucket provisioning to the kube-monitoring Helm chart by introducing a Helm pre-install hook that runs amazon/aws-cli to create a bucket, and bumps the plugin/chart versions accordingly.
Changes:
- Bump
kube-monitoringPluginDefinition version to16.0.2and chart version to15.0.2. - Add
cephBucketconfiguration block to chartvalues.yamlto control endpoint, bucket name, credentials, and job settings. - Introduce a new Helm template that creates a pre-install hook Secret + Job to provision the bucket via AWS CLI.
File summaries
| File | Description |
|---|---|
| kube-monitoring/plugindefinition.yaml | Version bump; plugin definition metadata updated to reference new chart version. |
| kube-monitoring/charts/Chart.yaml | Chart version bump to ship the new Ceph bucket provisioning capability. |
| kube-monitoring/charts/values.yaml | Adds cephBucket values for configuring the pre-install provisioning job. |
| kube-monitoring/charts/templates/ceph-bucket-preinstall-job.yaml | New pre-install hook Secret + Job that runs aws-cli against a Ceph S3 endpoint to create the bucket. |
Review details
Suppressed comments (1)
kube-monitoring/charts/templates/ceph-bucket-preinstall-job.yaml:37
- Similarly, the hook Job will be kept on hook failure with the current hook-delete-policy. If you add
hook-failed, Helm will clean up the failed hook Job as well (and you still keep logs viakubectl logswhile it is running).
"helm.sh/hook": pre-install
"helm.sh/hook-weight": "0"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
- Files reviewed: 5/5 changed files
- Comments generated: 6
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: trouaux <thomas.rouaux@sap.com>
trouaux
force-pushed
the
kube-monitoring-ceph-bucket
branch
from
September 10, 2026 11:01
60a4ce5 to
eab03c8
Compare
Signed-off-by: trouaux <thomas.rouaux@sap.com>
ibakshay
reviewed
Sep 10, 2026
melvinsimmert
pushed a commit
to melvinsimmert/greenhouse-extensions
that referenced
this pull request
Sep 10, 2026
* ceph-bucket-job Signed-off-by: trouaux <thomas.rouaux@sap.com> * bump Signed-off-by: trouaux <thomas.rouaux@sap.com> * make readme Signed-off-by: trouaux <thomas.rouaux@sap.com> * copilot suggestions Signed-off-by: trouaux <thomas.rouaux@sap.com> * lint Signed-off-by: trouaux <thomas.rouaux@sap.com> * Update README.md Signed-off-by: trouaux <thomas.rouaux@sap.com> * minor Signed-off-by: trouaux <thomas.rouaux@sap.com> --------- Signed-off-by: trouaux <thomas.rouaux@sap.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com>
timojohlo
added a commit
that referenced
this pull request
Sep 11, 2026
* fix(_syslog-config.tpl) syslog_tls_double_header_capture_relay_host regex Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add transform/syslog-device-processor based on logstash filters (#1974) * add transform/syslog_network_parsing based on logstash filters Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add fields for hw.type=network and hw.vendor Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add conditional check for sap.cc.audit.source == nil in the beginning to improve performance Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * rename processor to "transform/syslog_hardware_classification" and change its behaviour to first identify and rextract the vendor and then identify the hw.type and the role Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * move hardware processors to dedicated file Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * move hardware processor comment Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add transform/syslog_hardware_classification before audit-classification; edit audit-classification to check for certain vendors Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix frist batch Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add more fixes Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * overwrite resource.host.name by inner hostname in case of two Headed Logs Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add conditional check for syslog.format early on to identify cisco devices Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * bump chart version Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * change audit forwarding rule to device.manufacturer Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> --------- Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix(logs): fix parsing errors from #1974 for devices (#1984) * fix(logs): fix parsing errors from #1974 for devices * rm VMware from manufacturers Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * rename sap.cc.-fields to sap.netbox.; only send certain Cisco Logs to Audit Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * rename attributes and values to use slugs Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * add missing slugs Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * remove typo Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * make network forwarding to audit more fine granular Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * update Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * feat: add kgateway-crds and kgateway PluginDefinitions (#1986) * feat: add kgateway-crds and kgateway PluginDefinitions Adds two PluginDefinitions for kgateway — a Kubernetes-native API gateway built on Envoy and the Gateway API: - **kgateway-crds** — installs the kgateway CRDs from oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds:v2.4.3 - **kgateway** — deploys the kgateway control plane from oci://cr.kgateway.dev/kgateway-dev/charts/kgateway:v2.4.3 Both follow the agentgateway pattern — direct upstream OCI reference, no local chart. Install order: k8s-gateway-api → kgateway-crds → kgateway. Signed-off-by: Vivek Thacker <v.thacker@sap.com> * docs(kgateway): add README for kgateway and kgateway-crds Signed-off-by: Vivek Thacker <v.thacker@sap.com> * docs(kgateway): remove incorrect AI extensions bullet from README Signed-off-by: Vivek Thacker <v.thacker@sap.com> --------- Signed-off-by: Vivek Thacker <v.thacker@sap.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * feat(audit-logs): enable tls verification for kafka brokers (#1979) * feat(audit-logs): enable tls verification for kafka brokers Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> * enhance check for kafka ca_file mount Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> * remove redundant ca_file Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> * Apply batched suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: ztomaszewska <zuzanna.tomaszewska@sap.com> --------- Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> Signed-off-by: ztomaszewska <zuzanna.tomaszewska@sap.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * feat(logs): enable mount of kafka CA cert (#1980) * feat(logs): enable mount of kafka CA cert Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> * Apply batched suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: ztomaszewska <zuzanna.tomaszewska@sap.com> * fix render error Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> * remove one more dig - access directly instead Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> * fix typo Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> --------- Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> Signed-off-by: ztomaszewska <zuzanna.tomaszewska@sap.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix(audit-logs): fix plugindefinition - set kafka.tls as a map (#1987) Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * update Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * update Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * set audit.source.sap.cc to netbox.manufacturer.slug if empty Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * feat(kube-monitoring): ceph bucket provisioning (#1973) * ceph-bucket-job Signed-off-by: trouaux <thomas.rouaux@sap.com> * bump Signed-off-by: trouaux <thomas.rouaux@sap.com> * make readme Signed-off-by: trouaux <thomas.rouaux@sap.com> * copilot suggestions Signed-off-by: trouaux <thomas.rouaux@sap.com> * lint Signed-off-by: trouaux <thomas.rouaux@sap.com> * Update README.md Signed-off-by: trouaux <thomas.rouaux@sap.com> * minor Signed-off-by: trouaux <thomas.rouaux@sap.com> --------- Signed-off-by: trouaux <thomas.rouaux@sap.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix(kube-monitoring): ceph provisioning job add pre-upgrade (#1988) Signed-off-by: trouaux <thomas.rouaux@sap.com> Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * move rule for attacker Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * move rule for attacker Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix typos Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix typos Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix regex Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix type Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * fix type Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> * bump chart version Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> --------- Signed-off-by: Melvin Simmert <melvinsimmert@gmail.com> Signed-off-by: Melvin Simmert <40160553+melvinsimmert@users.noreply.github.com> Signed-off-by: Vivek Thacker <v.thacker@sap.com> Signed-off-by: Zuzanna Tomaszewska <zuzanna.tomaszewska@sap.com> Signed-off-by: ztomaszewska <zuzanna.tomaszewska@sap.com> Signed-off-by: trouaux <thomas.rouaux@sap.com> Co-authored-by: Timo <32620814+timojohlo@users.noreply.github.com> Co-authored-by: vivekthacker007 <160002058+vivekthacker007@users.noreply.github.com> Co-authored-by: ztomaszewska <zuzanna.tomaszewska@sap.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Thomas Rouaux <33913696+trouaux@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When enabled, a Helm pre-install hook Job runs the amazon/aws-cli image to
create an S3 bucket on the provided Ceph (S3-compatible) endpoint using the
supplied EC2-style access key and secret key.