Agent injector should set a maxSize for its tmpfs mount
BojanZelic opened this issue · comments
Is your feature request related to a problem? Please describe.
the vault agent injector currently adds some volumes using the Memory tmpfs filesystem:
- emptyDir:
medium: Memory
name: vault-secrets
These don't have any limits set & kubernetes will default this to the node's allocatable memory; A user could add files to these directories eventually maxing out the underlying node's memory & crash the node;
Describe the solution you'd like
vault secrets don't take up much size; set a limit like 10M
- emptyDir:
medium: Memory
sizeLimit: 10Mi
name: vault-secrets
Describe alternatives you've considered
n/a
Additional context
see kubernetes/kubernetes#119611