Microsoft recommendations to improve security and resilience in the Grafana service

Grafana Configuration
1

Hi Everyone,

Needed advice from community members. We have deployed Grafana 11.1.4 using helm in Microsoft Azure Kubernetes Service (AKS). Also during an assessment of our platform towards improved security & resilience angle received below recommendations from Microsoft experts to be implemented.

  1. Least privileged Linux capabilities should be enforced for containers
  2. The root access inside the service container should be avoided.

We are not sure if above actions when implemented will have an impact on Promotheus Grafana since we used default Promotheus Grafana configs which are in helm chart for Promotheus Grafana.

Could anyone from the community please help or guide us on below queries?

  1. Have you tried implementing custom configs apart from default configs provided?
  2. Do you have a view of the impact by any means if we go ahead and implement this?
  3. Are there any other general recommendation towards achieving this?
2

I would use better helm chart. I would say official one has decent security (when PodSecurityPolicy is enabled):

3

Hi @jangaraj,
Thank you for your suggestion. I want to know if do you have a view of the impact by any means if we go ahead and implement this?