Fix/restrict rpaas shell volumes #164

ravilock · 2025-02-18T17:45:04Z

No description provided.

…ources

ravilock · 2025-02-18T18:01:09Z

Ideas:

Use some sort of rule or naming rule to not create many new ephemeral containers. Only creating one is enough
Create some sort of feature flag for the exec command
Instead of hardcoding the VolumeMounts, iterate over the nginx container volume mounts and filter out /certs

…tpoint

…meral container

internal/pkg/rpaas/k8s.go

ravilock added 2 commits February 18, 2025 14:43

chore: set debug-image default as tsuru/netshoot

7eba6d0

fix: configure Exec command to use ephemeral containers with less res…

3ede9b4

…ources

ravilock requested a review from wpjunior February 18, 2025 17:45

ravilock added 7 commits February 19, 2025 00:11

ref: set 'command' as a Common Terminal Arg

4ceaa97

feat: load volume points on ephemeral container avoiding 'certs' moun…

3603b98

…tpoint

feat: feature flag rpaas shell on ephemeral container

e59a136

feat: use default name for debug container so we only create one ephe…

94f63bb

…meral container

chore: remove deadline from .golangci.yml

67955df

chore: remove gover check-shadowing options

4d8adf4

test: set default debug image on config_test

ef3cfd5

wpjunior reviewed Feb 19, 2025

View reviewed changes

internal/pkg/rpaas/k8s.go Outdated Show resolved Hide resolved

ravilock commented Feb 19, 2025

View reviewed changes

internal/pkg/rpaas/k8s.go Outdated Show resolved Hide resolved

fix: use a more restrictive condition to filter certs volume

4eefc9e

wpjunior merged commit df593a4 into main Feb 19, 2025
14 checks passed

wpjunior deleted the fix/restrict-rpaas-shell-volumes branch February 19, 2025 20:54

Provide feedback