warnings from kube-score in helm chart

[oupala]

I'm starting to use the helm chart provided by plik for deploying it and I ran kube-score to evaluate the chart.

Here is the output of the kube-score report:

$ helm template $helm_package ${HELM_K8S_VERSION:+--kube-version "$HELM_K8S_VERSION"} --values generated-values-common.yml --values generated-values-env.yml | kube-score score ${HELM_K8S_VERSION:+--kubernetes-version "$HELM_K8S_VERSION"} ${HELM_KUBE_SCORE_ARGS} -
apps/v1/Deployment release-name-plik                                          💥
    path=plik/templates/deployment.yaml
    [CRITICAL] Pod Probes Identical
        · Container has the same readiness and liveness probe
            Using the same probe for liveness and readiness is very likely
            dangerous. It's generally better to avoid re-using the same probe.
            More information: https://github.com/zegl/kube-score/blob/master/README_PROBES.md
    [CRITICAL] Container Security Context User Group ID
        · plik -> The container is running with a low user ID
            A userid above 10 000 is recommended to avoid conflicts with the
            host. Set securityContext.runAsUser to a value > 10000
        · plik -> The container running with a low group ID
            A groupid above 10 000 is recommended to avoid conflicts with the
            host. Set securityContext.runAsGroup to a value > 10000
    [CRITICAL] Container Image Pull Policy
        · plik -> ImagePullPolicy is not set to Always
            It's recommended to always set the ImagePullPolicy to Always, to
            make sure that the imagePullSecrets are always correct, and to
            always get the image you want.
    [CRITICAL] Container Security Context ReadOnlyRootFilesystem
        · plik -> The pod has a container with a writable root filesystem
            Set securityContext.readOnlyRootFilesystem to true
    [CRITICAL] Container Ephemeral Storage Request and Limit
        · plik -> Ephemeral Storage limit is not set
            Resource limits are recommended to avoid resource DDOS. Set
            resources.limits.ephemeral-storage
        · plik -> Ephemeral Storage request is not set
            Resource requests are recommended to make sure the application can
            start and run without crashing. Set
            resource.requests.ephemeral-storage
    [CRITICAL] Pod NetworkPolicy
        · The pod does not have a matching NetworkPolicy
            Create a NetworkPolicy that targets this pod to control who/what
            can communicate with this pod. Note, this feature needs to be
            supported by the CNI implementation used in the Kubernetes cluster
            to have an effect.
    [WARNING] Deployment Replicas
        · Deployment few replicas
            Deployments targeted by Services are recommended to have at least 2
            replicas to prevent unwanted downtime.
networking.k8s.io/v1/Ingress release-name-plik                                ✅
v1/Service release-name-plik

Feel free to use this report to improve the chart, if you want to and if appropriate.

[bodji]

Thank you, we'll look into that :)