fix: switch from pod to defaultPodOptions on storage cluster

Signed-off-by: Devin Buhl <[email protected]>
onedr0p · Apr 15, 2024 · d6c1177 · d6c1177
1 parent bfc3a5b
commit d6c1177
Show file tree

Hide file tree

Showing 6 changed files with 62 additions and 47 deletions.
diff --git a/kubernetes/storage/apps/default/filebrowser/app/helmrelease.yaml b/kubernetes/storage/apps/default/filebrowser/app/helmrelease.yaml
@@ -59,9 +59,9 @@ spec:
               capabilities: { drop: ["ALL"] }
             resources:
               requests:
-                cpu: 10m
+                cpu: 100m
               limits:
-                memory: 512Mi
+                memory: 2Gi
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true

diff --git a/kubernetes/storage/apps/default/kopia/app/externalsecret.yaml b/kubernetes/storage/apps/default/kopia/app/externalsecret.yaml
@@ -31,11 +31,31 @@ spec:
   target:
     name: kopia-repository-secret
     template:
-      templateFrom:
-        - configMap:
-            name: kopia-repository-config-tpl
-            items:
-              - key: repository.config
+      engineVersion: v2
+      data:
+        repository.config: |
+          {
+            "storage": {
+              "type": "s3",
+              "config": {
+                "bucket": "expanse",
+                "endpoint": "{{ .CLOUDFLARE_ACCOUNT_TAG }}.r2.cloudflarestorage.com",
+                "accessKeyID": "{{ .AWS_ACCESS_KEY_ID }}",
+                "secretAccessKey": "{{ .AWS_SECRET_ACCESS_KEY }}"
+              }
+            },
+            "caching": {
+              "cacheDirectory": "/app/cache",
+              "maxCacheSize": 5242880000,
+              "maxMetadataCacheSize": 5242880000,
+              "maxListCacheDuration": 30
+            },
+            "hostname": "expanse.turbo.ac",
+            "username": "devin",
+            "description": "expanse",
+            "enableActions": false,
+            "formatBlobCacheDuration": 900000000000
+          }
   dataFrom:
     - extract:
         key: cloudflare
diff --git a/kubernetes/storage/apps/default/kopia/app/helmrelease.yaml b/kubernetes/storage/apps/default/kopia/app/helmrelease.yaml
@@ -66,8 +66,23 @@ spec:
               startup:
                 enabled: false
             securityContext:
-              privileged: true
-              runAsUser: 0
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 100m
+              limits:
+                memory: 2Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        supplementalGroups: [10000]
+        seccompProfile: { type: RuntimeDefault }
     service:
       app:
         controller: kopia

diff --git a/kubernetes/storage/apps/default/kopia/app/kustomization.yaml b/kubernetes/storage/apps/default/kopia/app/kustomization.yaml
@@ -5,9 +5,3 @@ kind: Kustomization
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-configMapGenerator:
-  - name: kopia-repository-config-tpl
-    files:
-      - repository.config=./resources/repository.config
-generatorOptions:
-  disableNameSuffixHash: true
diff --git a/kubernetes/storage/apps/default/kopia/app/resources/repository.config b/kubernetes/storage/apps/default/kopia/app/resources/repository.config
diff --git a/kubernetes/storage/apps/default/minio/app/helmrelease.yaml b/kubernetes/storage/apps/default/minio/app/helmrelease.yaml
@@ -43,11 +43,7 @@ spec:
             envFrom:
               - secretRef:
                   name: minio-secret
-            args:
-              - server
-              - /data
-              - --console-address
-              - :9001
+            args: ["server", "/data", "--console-address", ":9001"]
             probes:
               liveness: &probes
                 enabled: true
@@ -64,11 +60,23 @@ spec:
               startup:
                 enabled: false
             securityContext:
-              runAsUser: 568
-              runAsGroup: 568
-              fsGroup: 568
-              fsGroupChangePolicy: OnRootMismatch
-              supplementalGroups: [100]
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 100m
+              limits:
+                memory: 2Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        supplementalGroups: [10000]
+        seccompProfile: { type: RuntimeDefault }
     service:
       app:
         controller: minio