updated okteto deployment for further hardening:
@@ -29,12 +29,43 @@ spec:
fsGroup: 2000
containers:
- image: jeroenwillemsen/wrongsecrets:1.5.7-no-vault
+ name: secret-challenge
imagePullPolicy: IfNotPresent
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
ports:
- containerPort: 8080
protocol: TCP
- name: secret-challenge
- resources: {}
+ readinessProbe:
+ httpGet:
+ path: '/actuator/health/readiness'
+ port: 8080
+ initialDelaySeconds: 30
+ timeoutSeconds: 5
+ periodSeconds: 5
+ failureThreshold: 8
+ livenessProbe:
+ httpGet:
+ path: '/actuator/health/liveness'
+ port: 8080
+ initialDelaySeconds: 35
+ timeoutSeconds: 30
+ periodSeconds: 40
+ failureThreshold: 5
+ resources:
+ requests:
+ memory: '512Mi'
+ cpu: '200m'
+ ephemeral-storage: '1Gi'
+ limits:
+ memory: '512Mi'
+ cpu: '500m'
+ ephemeral-storage: '2Gi'
+ volumeMounts:
+ - name: 'ephemeral'
+ mountPath: '/tmp'
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
env:
@@ -50,6 +81,9 @@ spec:
secretKeyRef:
name: funnystuff
key: funnier
+ volumes:
+ - name: 'ephemeral'
+ emptyDir: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
