Conversation
Walkthrough모니터링과 서비스 디스커버리를 위한 Kubernetes 설정을 업데이트합니다. Loki 라벨링 규칙을 변경하고, 백엔드와 프론트엔드 배포에서 명명된 포트를 추가하며, 새로운 백엔드 PodMonitor를 생성하고 프론트엔드 서비스 포트 매핑을 업데이트합니다. Changes
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
k8s-kustomize/base/frontend/deployment.yaml (1)
33-42:⚠️ Potential issue | 🟠 Major보안 컨텍스트 미설정으로 권한이 과도합니다.
Line 33-42에서 파드/컨테이너
securityContext가 없어 기본(root/권한상승 가능) 상태로 배포됩니다. 정적 분석 결과와 동일하게 하드닝이 필요합니다.🔒 권장 수정안
spec: replicas: 2 @@ template: @@ spec: + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault containers: - name: pinhouse-fe @@ image: REPLACE_ME + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] ports: - name: http containerPort: 3000 protocol: TCP🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@k8s-kustomize/base/frontend/deployment.yaml` around lines 33 - 42, The pod is deploying the container "pinhouse-fe" without any securityContext so it runs as root and can escalate privileges; add a securityContext for the container (and optionally a pod-level securityContext) on the "pinhouse-fe" container to enforce least privilege: set runAsNonRoot: true and a non-root runAsUser UID, set allowPrivilegeEscalation: false, drop all Linux capabilities (e.g., drop: ["ALL"]), and enable readOnlyRootFilesystem: true (and consider setting seccomp/profile or fsGroup at pod-level) so the container cannot run as root or gain extra privileges.
🧹 Nitpick comments (1)
k8s-helm/releases/monitoring-alloy/values.yaml (1)
143-151:service라벨 단일 소스 의존은 누락 라벨 파드에서 빈 값을 만들 수 있습니다.Line 143-151은
app라벨이 없는 파드에서service/job가 비거나 분류가 약해질 수 있습니다.app.kubernetes.io/name또는container기반 fallback을 추가하면unknown/empty라벨을 더 줄일 수 있습니다.♻️ fallback 포함 예시
loki.relabel "pod_logs" { @@ rule { source_labels = ["__meta_kubernetes_pod_label_app"] target_label = "service" } + + rule { + source_labels = ["service", "__meta_kubernetes_pod_label_app_kubernetes_io_name"] + regex = "^;(.+)$" + replacement = "$1" + target_label = "service" + } + + rule { + source_labels = ["service", "__meta_kubernetes_pod_container_name"] + regex = "^;(.+)$" + replacement = "$1" + target_label = "service" + } rule { - source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_label_app"] + source_labels = ["__meta_kubernetes_namespace", "service"] separator = "/" target_label = "job" } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@k8s-helm/releases/monitoring-alloy/values.yaml` around lines 143 - 151, 현재 rule 블록들에서 source_labels가 단일 항목("__meta_kubernetes_pod_label_app")에만 의존해 app 라벨이 없는 파드에서 빈값이 생성될 수 있으니, service와 job 라벨 규칙 모두에 대해 source_labels 배열에 우선순위가 높은 대체 라벨들을 추가하도록 수정하세요; 예를 들어 service 규칙의 source_labels에 "__meta_kubernetes_pod_label_app", "__meta_kubernetes_pod_label_app_kubernetes_io_name", "__meta_kubernetes_pod_container_name" 등을 순서대로 넣어 fallback을 제공하고, job 규칙에서도 "__meta_kubernetes_namespace", "__meta_kubernetes_pod_label_app", "__meta_kubernetes_pod_label_app_kubernetes_io_name", "__meta_kubernetes_pod_container_name" 같은 추가 항목을 포함해 target_label ("service"와 "job")이 가능한 한 비지 않도록 보장하세요.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@k8s-kustomize/base/frontend/deployment.yaml`:
- Around line 33-42: The pod is deploying the container "pinhouse-fe" without
any securityContext so it runs as root and can escalate privileges; add a
securityContext for the container (and optionally a pod-level securityContext)
on the "pinhouse-fe" container to enforce least privilege: set runAsNonRoot:
true and a non-root runAsUser UID, set allowPrivilegeEscalation: false, drop all
Linux capabilities (e.g., drop: ["ALL"]), and enable readOnlyRootFilesystem:
true (and consider setting seccomp/profile or fsGroup at pod-level) so the
container cannot run as root or gain extra privileges.
---
Nitpick comments:
In `@k8s-helm/releases/monitoring-alloy/values.yaml`:
- Around line 143-151: 현재 rule 블록들에서 source_labels가 단일
항목("__meta_kubernetes_pod_label_app")에만 의존해 app 라벨이 없는 파드에서 빈값이 생성될 수 있으니,
service와 job 라벨 규칙 모두에 대해 source_labels 배열에 우선순위가 높은 대체 라벨들을 추가하도록 수정하세요; 예를 들어
service 규칙의 source_labels에 "__meta_kubernetes_pod_label_app",
"__meta_kubernetes_pod_label_app_kubernetes_io_name",
"__meta_kubernetes_pod_container_name" 등을 순서대로 넣어 fallback을 제공하고, job 규칙에서도
"__meta_kubernetes_namespace", "__meta_kubernetes_pod_label_app",
"__meta_kubernetes_pod_label_app_kubernetes_io_name",
"__meta_kubernetes_pod_container_name" 같은 추가 항목을 포함해 target_label ("service"와
"job")이 가능한 한 비지 않도록 보장하세요.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 87975004-5dd4-4919-ac39-2a789b94b34e
📒 Files selected for processing (5)
k8s-helm/releases/monitoring-alloy/values.yamlk8s-kustomize/base/backend/deployment.yamlk8s-kustomize/base/backend/podmonitor.yamlk8s-kustomize/base/frontend/deployment.yamlk8s-kustomize/base/frontend/service.yaml
This was referenced Apr 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📌 작업한 내용
🔍 참고 사항
unknown_service문제 해결relabel_configs를 통한 서비스별 로그 구분 및 포트 매핑 적용🖼️ 스크린샷
🔗 관련 이슈
#49 (Grafana Loki Service명 분류 문제)
✅ 체크리스트
Summary by CodeRabbit
릴리스 노트