POC WIP Cloud native pg #319
Conversation
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
Signed-off-by: OLoughlin, John <john.oloughlin@intel.com>
There was a problem hiding this comment.
this file needs to be moved to a better DIR
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check warning
Code scanning / Trivy
Can elevate its own privileges Medium
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check notice
Code scanning / Trivy
Default capabilities: some containers do not drop all Low
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check notice
Code scanning / Trivy
Default capabilities: some containers do not drop any Low
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check notice
Code scanning / Trivy
CPU not limited Low
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check warning
Code scanning / Trivy
Runs as root user Medium
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check warning
Code scanning / Trivy
All container images must start with a GCR domain Medium
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check warning
Code scanning / Trivy
Container images from public registries used Medium
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check warning
Code scanning / Trivy
All container images must start with an ECR domain Medium
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check warning
Code scanning / Trivy
Seccomp policies disabled Medium
| - name: psql | ||
| image: postgres:15 | ||
| command: ["sh", "-c", "psql -h postgresql-cloudnative-cluster-rw -U postgres -f /sql/orch-database_postgresql-0_backup.sql"] | ||
| env: | ||
| - name: PGPASSWORD | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: postgresql-cloudnative-cluster-superuser | ||
| key: password | ||
| volumeMounts: | ||
| - name: sql-volume | ||
| mountPath: /sql |
Check notice
Code scanning / Trivy
Container capabilities must only include NET_BIND_SERVICE Low
testing if cloud native postgres would be a better solution than bitnami
Description
Please include a summary of the changes and the related issue. List any dependencies that are required for this change.
Fixes # (issue)
Any Newly Introduced Dependencies
Please describe any newly introduced 3rd party dependencies in this change. List their name, license information and how they are used in the project.
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
Checklist: