hashicorp / vault-k8s

First-class support for Vault and Kubernetes.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Agent injector should set a maxSize for its tmpfs mount

BojanZelic opened this issue · comments

Is your feature request related to a problem? Please describe.
the vault agent injector currently adds some volumes using the Memory tmpfs filesystem:

  - emptyDir:
      medium: Memory
    name: vault-secrets

These don't have any limits set & kubernetes will default this to the node's allocatable memory; A user could add files to these directories eventually maxing out the underlying node's memory & crash the node;

Describe the solution you'd like
vault secrets don't take up much size; set a limit like 10M

  - emptyDir:
      medium: Memory
      sizeLimit: 10Mi
    name: vault-secrets

Describe alternatives you've considered
n/a

Additional context
see kubernetes/kubernetes#119611