Project: KICS (Provisioning / Security & Compliance)
File: 420e6360-47bb-46f6-9072-b20ed22c842d.md

title: StatefulSet Without Service Name hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 420e6360-47bb-46f6-9072-b20ed22c842d Query name: StatefulSet Without Service Name Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Availability URL: StatefulSets should have an existing headless 'serviceName'. The headless service labels should also be implemented on StatefulSets labels.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="49" resource "kubernetes_service" "example" { metadata { name = "prometheus" namespace = "prometheus" } spec { cluster_ip = "ALL" selector = { k8s-app = "prometheus" } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetesstatefulset" "prometheus" { metadata { annotations = { SomeAnnotation = "foobar" } labels = { k8s-app = "prometheus" "kubernetes.io/cluster-service" = "true" "addonmanager.kubernetes.io/mode" = "Reconcile" version = "v2.2.1" } name = "prometheus" namespace = "prometheus" } spec { podmanagementpolicy = "Parallel" replicas = 1 revisionhistorylimit = 5 selector { match_labels = { k8s-app = "prometheus" } } service_name = "prometheus" template { metadata { labels = { k8s-app = "prometheus" } annotations = {} } spec { serviceaccountname = "prometheus" init_container { name = "init-chown-data" image = "busybox:latest" imagepullpolicy = "IfNotPresent" command = ["chown", "-R", "65534:65534", "/data"] volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } } container { name = "prometheus-server-configmap-reload" image = "jimmidyson/configmap-reload:v0.1" imagepullpolicy = "IfNotPresent" args = [ "--volume-dir=/etc/config", "--webhook-url=http://localhost:9090/-/reload", ] volume_mount { name = "config-volume" mount_path = "/etc/config" read_only = true } resources { limits = { cpu = "10m" memory = "10Mi" } requests = { cpu = "10m" memory = "10Mi" } } } container { name = "prometheus-server" image = "prom/prometheus:v2.2.1" imagepullpolicy = "IfNotPresent" args = [ "--config.file=/etc/config/prometheus.yml", "--storage.tsdb.path=/data", "--web.console.libraries=/etc/prometheus/console_libraries", "--web.console.templates=/etc/prometheus/consoles",

] port { container_port = 9090 } resources { limits = { cpu = "200m" memory = "1000Mi" } requests = { cpu = "200m" memory = "1000Mi" } } volume_mount { name = "config-volume" mount_path = "/etc/config" } volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } readiness_probe { http_get { path = "/-/ready" port = 9090 } initialdelayseconds = 30 timeout_seconds = 30 } liveness_probe { http_get { path = "/-/healthy" port = 9090 scheme = "HTTPS" } initialdelayseconds = 30 timeout_seconds = 30 } } terminationgraceperiod_seconds = 300 volume { name = "config-volume" config_map { name = "prometheus-config" } } } } update_strategy { type = "RollingUpdate" rolling_update { partition = 1 } } volumeclaimtemplate { metadata { name = "prometheus-data" } spec { access_modes = ["ReadWriteOnce"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_service" "example22" { metadata { name = "prometheus22" namespace = "prometheus22" } spec { cluster_ip = "None" selector = { k8s-app = "prometheus22" } session_affinity = "ClientIP" port { port = 8080 target_port = 80 } type = "LoadBalancer" } } resource "kubernetesstatefulset" "prometheus22" { metadata { annotations = { SomeAnnotation = "foobar" } labels = { k8s-app = "prometheus" "kubernetes.io/cluster-service" = "true" "addonmanager.kubernetes.io/mode" = "Reconcile" version = "v2.2.1" } name = "prometheus22" namespace = "prometheus22" } spec { podmanagementpolicy = "Parallel" replicas = 1 revisionhistorylimit = 5 selector { match_labels = { k8s-app = "prometheus22" } } service_name = "prometheus22" template { metadata { labels = { k8s-app = "prometheus22" } annotations = {} } spec { serviceaccountname = "prometheus22" init_container { name = "init-chown-data" image = "busybox:latest" imagepullpolicy = "IfNotPresent" command = ["chown", "-R", "65534:65534", "/data"] volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } } container { name = "prometheus-server-configmap-reload" image = "jimmidyson/configmap-reload:v0.1" imagepullpolicy = "IfNotPresent" args = [ "--volume-dir=/etc/config", "--webhook-url=http://localhost:9090/-/reload", ] volume_mount { name = "config-volume" mount_path = "/etc/config" read_only = true } resources { limits = { cpu = "10m" memory = "10Mi" } requests = { cpu = "10m" memory = "10Mi" } } } container { name = "prometheus-server" image = "prom/prometheus:v2.2.1" imagepullpolicy = "IfNotPresent" args = [ "--config.file=/etc/config/prometheus.yml", "--storage.tsdb.path=/data", "--web.console.libraries=/etc/prometheus/console_libraries", "--web.console.templates=/etc/prometheus/consoles", "--web.enable-lifecycle", ] port { container_port = 9090 } resources { limits = { cpu = "200m" memory = "1000Mi" } requests = { cpu = "200m" memory = "1000Mi" } } volume_mount { name = "config-volume" mount_path = "/etc/config" } volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } readiness_probe { http_get { path = "/-/ready" port = 9090 } initialdelayseconds = 30 timeout_seconds = 30 } liveness_probe { http_get { path = "/-/healthy" port = 9090 scheme = "HTTPS" } initialdelayseconds = 30 timeout_seconds = 30 } } terminationgraceperiod_seconds = 300 volume { name = "config-volume" config_map { name = "prometheus-config" } } } } update_strategy { type = "RollingUpdate" rolling_update { partition = 1 } } volumeclaimtemplate { metadata { name = "prometheus-data" } spec { access_modes = ["ReadWriteOnce"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } } } ```