cloudkite-io / helm-charts Goto Github PK

We can't have more than 1 mongo, since we might as well put it in a StatefulSet. We should also rename replica_set.yaml and statefulset.yaml to just be what they are for: mongo.yaml and pritunl.yaml or whatever and then put in the resources required for each in the same file. That's clearer what the purpose is than the resource-type file names.

Pritunl pod should only have the security privileges it needs. Notably, the net.ipv4.ip_forwarding sysctl.
WIP: https://github.com/cloudkite-io/charts/tree/pritunl-security
References:

• Setting a sysctl at the pod level: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#setting-sysctls-for-a-pod
• Creating a sysctl sidecar container: https://stackoverflow.com/questions/49543820/using-sysctls-in-google-kubernetes-engine-gke
• Use KubeletConfiguration (only v1.16+) : https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/#
• Configuring a node's kubelet with a configmap: https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/