cloud-on-k8s
cloud-on-k8s copied to clipboard
Improve security setting to meet kyverno requirements (drop-cap-net-raw, require-emptydir-requests-and-limits)
Proposal
- Init container do not drop "CAP_NET_RAW" on the elasticsearch master and data StatefulSet (drop-cap-net-raw)
- elasticsearch-logs and tmp-volume volumes do not define or allow configuration of sizeLimit (require-emptydir-requests-and-limits)
Use case. Why is this important? More kyverno policies would be fullfilled which is often required by companies to deploy the service