Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(container)!: Update image redis to v20 #154

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 10, 2024

This PR contains the following updates:

Package Update Change
redis (source) major 18.1.5 -> 20.6.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

bitnami/charts (redis)

v20.6.2

v20.6.1

v20.6.0

  • [bitname/redis] Add support for master and replicas resources to be annotated (#​31034)

v20.5.0

  • [bitnami/redis] Detect non-standard images (#​30942)

v20.4.1

v20.4.0

v20.3.0

v20.2.2

v20.2.1

v20.2.0

  • [bitnami/redis] add extraPodSpec (#​29725)

v20.1.7

v20.1.6

v20.1.5

v20.1.4

v20.1.3

v20.1.2

v20.1.1

v20.1.0

v20.0.5

v20.0.4

v20.0.3

v20.0.2

v20.0.1

v20.0.0

v19.6.4

v19.6.3

v19.6.2

v19.6.1

v19.6.0

v19.5.5

v19.5.4

v19.5.3

v19.5.2

v19.5.1

v19.5.0

v19.4.0

v19.3.4

v19.3.3

v19.3.2

v19.3.1

v19.3.0

v19.2.0

v19.1.5

v19.1.3

v19.1.2

v19.1.1

v19.1.0

v19.0.2

  • allow to set containerSecurityContext on kubectl container to fix issue e.g. with OpenShift (#​24730) (4fda65b), closes #​24730

v19.0.1

v19.0.0

v18.19.4

v18.19.3

v18.19.2

v18.19.1

v18.19.0

v18.18.1

v18.18.0

  • [bitnami/redis] feat: ✨ 🔒 Add automatic adaptation for Openshift restricted-v2 SCC (#​2 (063463f), closes #​24149

v18.17.1

v18.17.0

v18.16.1

v18.16.0

v18.15.1

v18.13.0

v18.12.1

v18.12.0

  • [bitnami/redis] fix: 🐛 Add allowExternalEgress to avoid breaking istio and fix metrics port (#​22 (2b78bee), closes #​22955

v18.11.1

v18.11.0

v18.10.0

v18.9.1

v18.9.0

v18.8.3

  • [bitnami/redis] Do not create master and replica serviceaccounts when using sentinel (#​22716) (13c6479), closes #​22716

v18.8.2

v18.8.0

v18.7.1

v18.7.0

  • [bitnami/redis] fix: 🔒 Improve podSecurityContext and containerSecurityContext with essential s (2198b3f), closes #​22184

v18.6.4

v18.6.3

v18.6.2

v18.6.1

v18.6.0

v18.5.0

v18.4.0

v18.3.3

v18.3.2

v18.3.1

v18.3.0

v18.2.2

v18.2.1

v18.2.0

v18.1.6


Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

github-actions bot commented Aug 10, 2024

--- kubernetes/apps/database/redis/app Kustomization: flux-system/cluster-apps-redis HelmRelease: database/redis

+++ kubernetes/apps/database/redis/app Kustomization: flux-system/cluster-apps-redis HelmRelease: database/redis

@@ -9,13 +9,13 @@

     spec:
       chart: redis
       sourceRef:
         kind: HelmRepository
         name: bitnami
         namespace: flux-system
-      version: 18.1.5
+      version: 20.2.1
   install:
     remediation:
       retries: 3
   interval: 30m
   maxHistory: 2
   timeout: 15m

Copy link

github-actions bot commented Aug 10, 2024

--- kubernetes HelmRelease: database/redis ServiceAccount: database/redis

+++ kubernetes HelmRelease: database/redis ServiceAccount: database/redis

@@ -1,10 +1,10 @@

 ---
 apiVersion: v1
 kind: ServiceAccount
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 metadata:
   name: redis
   namespace: database
   labels:
     app.kubernetes.io/instance: redis
     app.kubernetes.io/managed-by: Helm
--- kubernetes HelmRelease: database/redis ConfigMap: database/redis-scripts

+++ kubernetes HelmRelease: database/redis ConfigMap: database/redis-scripts

@@ -80,23 +80,30 @@

             sentinel_info_command="timeout 10 redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name redis-master"
         else
             sentinel_info_command="timeout 10 redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT sentinel get-master-addr-by-name redis-master"
         fi
 
         info "about to run the command: $sentinel_info_command"
-        retry_while "eval $sentinel_info_command" 2 1
+        retry_while "eval $sentinel_info_command" 2 5
     }
 
     [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
     [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
 
     # check if there is a master
     master_in_persisted_conf="$(get_full_hostname "$HOSTNAME")"
     master_port_in_persisted_conf="$REDIS_MASTER_PORT_NUMBER"
     master_in_sentinel="$(get_sentinel_master_info)"
     redisRetVal=$?
+
+    if [[ -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then
+        master_in_persisted_conf="$(awk '/monitor/ {print $4}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)"
+        master_port_in_persisted_conf="$(awk '/monitor/ {print $5}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)"
+        info "Found previous master ${master_in_persisted_conf}:${master_port_in_persisted_conf} in /opt/bitnami/redis-sentinel/etc/sentinel.conf"
+        debug "$(cat /opt/bitnami/redis-sentinel/etc/sentinel.conf | grep monitor)"
+    fi
 
     if [[ $redisRetVal -ne 0 ]]; then
         if [[ "$master_in_persisted_conf" == "$(get_full_hostname "$HOSTNAME")" ]]; then
             # Case 1: No active sentinel and in previous sentinel.conf we were the master --> MASTER
             info "Configuring the node as master"
             export REDIS_REPLICATION_MODE="master"
@@ -198,56 +205,64 @@

         # Sanitize inputs
         value="${value//\\/\\\\}"
         value="${value//&/\\&}"
         value="${value//\?/\\?}"
         [[ "$value" = "" ]] && value="\"$value\""
 
-        replace_in_file "/opt/bitnami/redis-sentinel/etc/sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false
+        replace_in_file "/opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false
     }
     sentinel_conf_add() {
-        echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/sentinel.conf"
+        echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf"
     }
     host_id() {
         echo "$1" | openssl sha1 | awk '{print $2}'
     }
     get_sentinel_master_info() {
         if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then
             sentinel_info_command="timeout 10 redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name redis-master"
         else
             sentinel_info_command="timeout 10 redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT sentinel get-master-addr-by-name redis-master"
         fi
         info "about to run the command: $sentinel_info_command"
-        retry_while "eval $sentinel_info_command" 2 1
+        retry_while "eval $sentinel_info_command" 2 5
     }
 
     [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
 
     master_in_persisted_conf="$(get_full_hostname "$HOSTNAME")"
-    if ! get_sentinel_master_info && [[ "$master_in_persisted_conf" == "$(get_full_hostname "$HOSTNAME")" ]]; then
-        # No master found, lets create a master node
-        export REDIS_REPLICATION_MODE="master"
-
-        REDIS_MASTER_HOST=$(get_full_hostname "$HOSTNAME")
-        REDIS_MASTER_PORT_NUMBER="$REDISPORT"
-    else
-        export REDIS_REPLICATION_MODE="replica"
-
-        # Fetches current master's host and port
-        REDIS_SENTINEL_INFO=($(get_sentinel_master_info))
+
+    if [[ -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then
+        master_in_persisted_conf="$(awk '/monitor/ {print $4}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)"
+        info "Found previous master $master_in_persisted_conf in /opt/bitnami/redis-sentinel/etc/sentinel.conf"
+        debug "$(cat /opt/bitnami/redis-sentinel/etc/sentinel.conf | grep monitor)"
+    fi
+    REDIS_SENTINEL_INFO=($(get_sentinel_master_info))
+    if [ "$?" -eq "0" ]; then
+        # current master's host and port obtained from other Sentinel
         info "printing REDIS_SENTINEL_INFO=(${REDIS_SENTINEL_INFO[0]},${REDIS_SENTINEL_INFO[1]})"
         REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]}
         REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]}
+    else
+        REDIS_MASTER_HOST="$master_in_persisted_conf"
+        REDIS_MASTER_PORT_NUMBER="$REDISPORT"
+    fi
+    if [[ "$REDIS_MASTER_HOST" == "$(get_full_hostname "$HOSTNAME")" ]]; then
+        export REDIS_REPLICATION_MODE="master"
+    else
+        export REDIS_REPLICATION_MODE="replica"
     fi
 
     if [[ -n "$REDIS_EXTERNAL_MASTER_HOST" ]]; then
       REDIS_MASTER_HOST="$REDIS_EXTERNAL_MASTER_HOST"
       REDIS_MASTER_PORT_NUMBER="${REDIS_EXTERNAL_MASTER_PORT}"
     fi
 
-    cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf
-    printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
+    # To prevent incomplete configuration and as the redis container accesses /opt/bitnami/redis-sentinel/etc/sentinel.conf
+    # as well, prepare the new config in `prepare-sentinel.conf` and move it atomically to the ultimate destination when it is complete.
+    cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+    printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
 
     if [[ -z "$REDIS_MASTER_HOST" ]] || [[ -z "$REDIS_MASTER_PORT_NUMBER" ]]
     then
         # Prevent incorrect configuration to be written to sentinel.conf
         error "Redis master host is configured incorrectly (host: $REDIS_MASTER_HOST, port: $REDIS_MASTER_PORT_NUMBER)"
         exit 1
@@ -277,17 +292,18 @@

         hostname="redis-node-$node"
         ip="$(getent hosts "$hostname.$HEADLESS_SERVICE" | awk '{ print $1 }')"
         add_known_sentinel "$hostname" "$ip"
         add_known_replica "$hostname" "$ip"
     done
 
-    echo "" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
-    echo "sentinel announce-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
-    echo "sentinel resolve-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
-    echo "sentinel announce-port $SERVPORT" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
-    echo "sentinel announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
+    echo "" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+    echo "sentinel announce-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+    echo "sentinel resolve-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+    echo "sentinel announce-port $SERVPORT" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+    echo "sentinel announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+    mv /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf
     exec redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel
   prestop-sentinel.sh: |
     #!/bin/bash
 
     . /opt/bitnami/scripts/libvalidations.sh
     . /opt/bitnami/scripts/libos.sh
@@ -299,13 +315,13 @@

         full_hostname="${hostname}.${HEADLESS_SERVICE}"
         echo "${full_hostname}"
     }
 
     run_sentinel_command() {
         if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then
-            redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
+            redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_TLS_PORT_NUMBER" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
         else
             redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" sentinel "$@"
         fi
     }
     sentinel_failover_finished() {
       REDIS_SENTINEL_INFO=($(run_sentinel_command get-master-addr-by-name "redis-master"))
@@ -354,13 +370,13 @@

         full_hostname="${hostname}.${HEADLESS_SERVICE}"
         echo "${full_hostname}"
     }
 
     run_sentinel_command() {
         if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then
-            env -u REDISCLI_AUTH redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
+            env -u REDISCLI_AUTH redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_TLS_PORT_NUMBER" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
         else
             env -u REDISCLI_AUTH redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" sentinel "$@"
         fi
     }
     sentinel_failover_finished() {
         REDIS_SENTINEL_INFO=($(run_sentinel_command get-master-addr-by-name "redis-master"))
--- kubernetes HelmRelease: database/redis PodDisruptionBudget: database/redis-node

+++ kubernetes HelmRelease: database/redis PodDisruptionBudget: database/redis-node

@@ -0,0 +1,19 @@

+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: redis-node
+  namespace: database
+  labels:
+    app.kubernetes.io/instance: redis
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: node
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: redis
+      app.kubernetes.io/name: redis
+      app.kubernetes.io/component: node
+
--- kubernetes HelmRelease: database/redis NetworkPolicy: database/redis

+++ kubernetes HelmRelease: database/redis NetworkPolicy: database/redis

@@ -0,0 +1,27 @@

+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: redis
+  namespace: database
+  labels:
+    app.kubernetes.io/instance: redis
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: redis
+      app.kubernetes.io/name: redis
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  - ports:
+    - port: 6379
+    - port: 26379
+  - ports:
+    - port: 9121
+
--- kubernetes HelmRelease: database/redis StatefulSet: database/redis-node

+++ kubernetes HelmRelease: database/redis StatefulSet: database/redis-node

@@ -8,12 +8,13 @@

     app.kubernetes.io/instance: redis
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: redis
     app.kubernetes.io/component: node
 spec:
   replicas: 3
+  revisionHistoryLimit: 10
   selector:
     matchLabels:
       app.kubernetes.io/instance: redis
       app.kubernetes.io/name: redis
       app.kubernetes.io/component: node
   serviceName: redis-headless
@@ -26,20 +27,23 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: redis
         app.kubernetes.io/component: node
       annotations:
         checksum/configmap: 44827545caa1794c0c6696c4406beb71e64dd804ef278fe070efe561c4bc71b7
         checksum/health: 07a9e9f1ff08347b0d2cd65e962feb94d6390f5b64a77ed1346867af2559df4a
-        checksum/scripts: f96a72112f23aa32b09f4231221b7a9a8c6e34e43d6efcccae617def75913976
+        checksum/scripts: aae9d6391abdd7877b9bc4cc8f75cd0ab9ba7f8241335f066f04e3e94a7e7a5e
         checksum/secret: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
         prometheus.io/port: '9121'
         prometheus.io/scrape: 'true'
     spec:
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 1001
-      automountServiceAccountToken: true
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
       serviceAccountName: redis
       affinity:
         podAffinity: null
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
           - podAffinityTerm:
@@ -52,13 +56,13 @@

             weight: 1
         nodeAffinity: null
       enableServiceLinks: true
       terminationGracePeriodSeconds: 30
       containers:
       - name: redis
-        image: docker.io/bitnami/redis:7.2.1-debian-11-r26
+        image: docker.io/bitnami/redis:7.4.1-debian-12-r0
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /bin/bash
@@ -66,15 +70,17 @@

               - /opt/bitnami/scripts/start-scripts/prestop-redis.sh
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
-          runAsGroup: 0
+          readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         command:
         - /bin/bash
         args:
         - -c
@@ -130,29 +136,39 @@

           exec:
             command:
             - sh
             - -c
             - /health/ping_readiness_local.sh 1
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 2Gi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts:
         - name: start-scripts
           mountPath: /opt/bitnami/scripts/start-scripts
         - name: health
           mountPath: /health
+        - name: sentinel-data
+          mountPath: /opt/bitnami/redis-sentinel/etc
         - name: redis-data
           mountPath: /data
         - name: config
           mountPath: /opt/bitnami/redis/mounted-etc
-        - name: redis-tmp-conf
+        - name: empty-dir
           mountPath: /opt/bitnami/redis/etc
-        - name: tmp
+          subPath: app-conf-dir
+        - name: empty-dir
           mountPath: /tmp
+          subPath: tmp-dir
       - name: sentinel
-        image: docker.io/bitnami/redis-sentinel:7.2.1-debian-11-r26
+        image: docker.io/bitnami/redis-sentinel:7.4.1-debian-12-r0
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /bin/bash
@@ -160,15 +176,17 @@

               - /opt/bitnami/scripts/start-scripts/prestop-sentinel.sh
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
-          runAsGroup: 0
+          readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         command:
         - /bin/bash
         args:
         - -c
@@ -216,36 +234,47 @@

           exec:
             command:
             - sh
             - -c
             - /health/ping_sentinel.sh 1
         resources:
-          limits: {}
-          requests: {}
+          limits:
+            cpu: 150m
+            ephemeral-storage: 2Gi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
         volumeMounts:
+        - name: empty-dir
+          mountPath: /tmp
+          subPath: tmp-dir
         - name: start-scripts
           mountPath: /opt/bitnami/scripts/start-scripts
         - name: health
           mountPath: /health
         - name: sentinel-data
           mountPath: /opt/bitnami/redis-sentinel/etc
         - name: redis-data
           mountPath: /data
         - name: config
           mountPath: /opt/bitnami/redis-sentinel/mounted-etc
       - name: metrics
-        image: docker.io/bitnami/redis-exporter:1.55.0-debian-11-r0
+        image: docker.io/bitnami/redis-exporter:1.63.0-debian-12-r1
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
-          runAsGroup: 0
+          readOnlyRootFilesystem: true
+          runAsGroup: 1001
           runAsNonRoot: true
           runAsUser: 1001
+          seLinuxOptions: {}
           seccompProfile:
             type: RuntimeDefault
         command:
         - /bin/bash
         - -c
         - |
@@ -253,12 +282,14 @@

               export REDIS_PASSWORD=$(cat /secrets/redis-password)
           fi
           redis_exporter
         env:
         - name: REDIS_ALIAS
           value: redis
+        - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
+          value: :9121
         ports:
         - name: metrics
           containerPort: 9121
         livenessProbe:
           failureThreshold: 5
           initialDelaySeconds: 10
@@ -274,15 +305,24 @@

           successThreshold: 1
           timeoutSeconds: 1
           httpGet:
             path: /
             port: metrics
         resources:
-          limits: {}
-          requests: {}
-        volumeMounts: null
+          limits:
+            cpu: 150m
+            ephemeral-storage: 2Gi
+            memory: 192Mi
+          requests:
+            cpu: 100m
+            ephemeral-storage: 50Mi
+            memory: 128Mi
+        volumeMounts:
+        - name: empty-dir
+          mountPath: /tmp
+          subPath: tmp-dir
       volumes:
       - name: start-scripts
         configMap:
           name: redis-scripts
           defaultMode: 493
       - name: health
@@ -291,13 +331,11 @@

           defaultMode: 493
       - name: config
         configMap:
           name: redis-configuration
       - name: sentinel-data
         emptyDir: {}
-      - name: redis-tmp-conf
-        emptyDir: {}
-      - name: tmp
+      - name: empty-dir
         emptyDir: {}
       - name: redis-data
         emptyDir: {}
 

@renovate renovate bot force-pushed the renovate/redis-20.x branch 2 times, most recently from ea9d889 to c9eacfa Compare August 20, 2024 22:11
@renovate renovate bot force-pushed the renovate/redis-20.x branch 3 times, most recently from b489f95 to 01c8be5 Compare September 9, 2024 13:55
@renovate renovate bot force-pushed the renovate/redis-20.x branch 4 times, most recently from 5293e36 to 258375d Compare September 19, 2024 13:30
@renovate renovate bot force-pushed the renovate/redis-20.x branch 3 times, most recently from 1613aff to 5a5c8b5 Compare October 3, 2024 01:01
@renovate renovate bot force-pushed the renovate/redis-20.x branch 3 times, most recently from d26c9f8 to 39c23dd Compare October 15, 2024 18:27
@renovate renovate bot force-pushed the renovate/redis-20.x branch 3 times, most recently from 1fe2d7e to 4fe2ab2 Compare November 14, 2024 12:03
@renovate renovate bot force-pushed the renovate/redis-20.x branch from 4fe2ab2 to 3e4ecd2 Compare December 2, 2024 11:21
@renovate renovate bot force-pushed the renovate/redis-20.x branch 3 times, most recently from 8da978e to 447ebc3 Compare December 16, 2024 23:04
@renovate renovate bot force-pushed the renovate/redis-20.x branch from 447ebc3 to fe87ab6 Compare December 22, 2024 00:29
@renovate renovate bot force-pushed the renovate/redis-20.x branch from fe87ab6 to b7f8fc4 Compare January 8, 2025 14:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants