rcourtman ae70d9e423 feat: add --kube-include-all-deployments flag for Kubernetes agent

Adds IncludeAllDeployments option to show all deployments, not just
problem ones (where replicas don't match desired). This provides parity
with the existing --kube-include-all-pods flag.

- Add IncludeAllDeployments to kubernetesagent.Config
- Add --kube-include-all-deployments flag and PULSE_KUBE_INCLUDE_ALL_DEPLOYMENTS env var
- Update collectDeployments to respect the new flag
- Add test for IncludeAllDeployments functionality
- Update UNIFIED_AGENT.md documentation

Addresses feedback from PR #855

2025-12-18 20:58:30 +00:00

2.1 KiB

Raw Blame History

🌡️ Temperature Monitoring

This page describes the recommended v5 approach for temperature monitoring and the security tradeoffs between approaches.

For the full sensor-proxy setup guide (socket mounts, HTTP mode, troubleshooting), see: docs/TEMPERATURE_MONITORING.md.

Recommended: Pulse Agent

The simplest and most feature-rich method is installing the Pulse agent on your Proxmox nodes:

curl -fsSL http://your-pulse-server:7655/install.sh | bash -s -- \
  --url http://your-pulse-server:7655 \
  --token YOUR_TOKEN \
  --enable-proxmox

Benefits:

✅ One-command setup
✅ Temperature monitoring built-in
✅ No SSH keys or proxy configuration required

The agent runs sensors -j locally and reports temperatures directly to Pulse.

Deprecated: Sensor Proxy (Host Service)

pulse-sensor-proxy is deprecated in v5 and is not recommended for new deployments. This section is retained for existing installations during the migration window.

🛡️ Security Model

Isolation: SSH keys live on the host, not in the container.
Least Privilege: Proxy runs as pulse-sensor-proxy (no shell).
Verification: Container identity verified via SO_PEERCRED.

🏗️ Components

Pulse Backend: Connects to Unix socket /mnt/pulse-proxy/pulse-sensor-proxy.sock.
Sensor Proxy: Validates request, executes SSH to node.
Target Node: Accepts SSH key restricted to sensors -j.

🔒 Key Restrictions

SSH keys deployed to nodes are locked down:

command="sensors -j",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty

🚦 Rate Limiting

Per Peer: ~12 req/min.
Concurrency: Max 2 parallel requests per peer.
Global: Max 8 concurrent requests.

📝 Auditing

All requests logged to system journal:

journalctl -u pulse-sensor-proxy

Logs include: uid, pid, method, node, correlation_id.

Sensor proxy hardening: docs/security/SENSOR_PROXY_HARDENING.md
Network segmentation: docs/security/SENSOR_PROXY_NETWORK.md
AppArmor/Seccomp: docs/security/SENSOR_PROXY_APPARMOR.md

2.1 KiB Raw Blame History