Add some security tweaks for k8s deployment example (#119)

Signed-off-by: Igor Shishkin <me@teran.dev>
teran · Aug 15, 2024 · ac0448e · ac0448e
1 parent 124ae0a
commit ac0448e
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 0 deletions.
diff --git a/docs/examples/deploy/k8s/003-migrator-job.yaml b/docs/examples/deploy/k8s/003-migrator-job.yaml
@@ -15,6 +15,7 @@ spec:
         app.kubernetes.io/name: archived-migrator
         app.kubernetes.io/app: archived-migrator
     spec:
+      automountServiceAccountToken: false
       containers:
         - name: migrator
           image: ghcr.io/teran/archived/migrator:latest
@@ -27,4 +28,10 @@ spec:
                   key: uri
             - name: LOG_LEVEL
               value: "trace"
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+            limits:
+              memory: 256Mi
       restartPolicy: OnFailure
diff --git a/docs/examples/deploy/k8s/archived-exporter.yaml b/docs/examples/deploy/k8s/archived-exporter.yaml
@@ -33,6 +33,7 @@ spec:
                 - archived-exporter
             topologyKey: "kubernetes.io/node"
       terminationGracePeriodSeconds: 30
+      automountServiceAccountToken: false
       containers:
         - name: exporter
           image: ghcr.io/teran/archived/exporter:latest

diff --git a/docs/examples/deploy/k8s/archived-manager.yaml b/docs/examples/deploy/k8s/archived-manager.yaml
@@ -33,6 +33,7 @@ spec:
                 - archived-manager
             topologyKey: "kubernetes.io/node"
       terminationGracePeriodSeconds: 30
+      automountServiceAccountToken: false
       containers:
         - name: manager
           image: ghcr.io/teran/archived/manager:latest

diff --git a/docs/examples/deploy/k8s/archived-publisher.yaml b/docs/examples/deploy/k8s/archived-publisher.yaml
@@ -33,6 +33,7 @@ spec:
                 - archived-publisher
             topologyKey: "kubernetes.io/node"
       terminationGracePeriodSeconds: 30
+      automountServiceAccountToken: false
       containers:
         - name: publisher
           image: ghcr.io/teran/archived/publisher:latest