diff options
| author |   Fiete Ostkamp <Fiete.Ostkamp@telekom.de> | 2024-04-30 13:08:03 +0200 |
|---|---|---|
| committer | Fiete Ostkamp <Fiete.Ostkamp@telekom.de> | 2024-05-06 10:12:26 +0200 |
| commit | d2b2a3d446a92910fcf3be4c6a3b4254451f730c (patch) | |
| tree | 097843313c5cd6b2f3d807377a615682bca90329 /kubernetes/common/mongodb/templates/replicaset/statefulset.yaml | |
| parent | c64f1c0954e631709083499f6d1c80258c7809ee (diff) | |
[COMMON] Fix Kyverno policy violations in common/mongodb
- set resourceLimit's for emptyDir volumes
- use non-root group in mongo pods
- make pod filesystem read-only
- bump mongodb chart version from 14.12.2 to 14.12.3
- use new version in portal-ng, nbi, multicloud and dcae-tcagen2
Issue-ID: OOM-3293
Change-Id: Ife7445433337ac97a03f8cd22ad551e8745b9717
Signed-off-by: Fiete Ostkamp <Fiete.Ostkamp@telekom.de>
Diffstat (limited to 'kubernetes/common/mongodb/templates/replicaset/statefulset.yaml')
| -rw-r--r-- | kubernetes/common/mongodb/templates/replicaset/statefulset.yaml | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml b/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml index 55158e8fb0..b171eca005 100644 --- a/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml +++ b/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml @@ -512,7 +512,8 @@ spec: {{- end }} volumes: - name: empty-dir - emptyDir: {} + emptyDir: + sizeLimit: 64Mi - name: common-scripts configMap: name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }} @@ -529,7 +530,8 @@ spec: {{- end }} {{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }} - name: shared - emptyDir: {} + emptyDir: + sizeLimit: 64Mi {{- end }} - name: scripts configMap: @@ -540,7 +542,8 @@ spec: {{- end }} {{- if .Values.tls.enabled }} - name: certs - emptyDir: {} + emptyDir: + sizeLimit: 64Mi {{- if (include "mongodb.autoGenerateCerts" .) }} - name: certs-volume secret: @@ -566,8 +569,10 @@ spec: {{- if .Values.persistence.medium }} emptyDir: medium: {{ .Values.persistence.medium | quote }} + sizeLimit: 64Mi {{- else }} - emptyDir: {} + emptyDir: + sizeLimit: 64Mi {{- end }} {{- else }} {{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }} |