cluster

commit 04a59203fd2d6f592a175ecf7178cf7c74a0022c
parent 0be64e53dd6c7a8fef844943ed364b65a4883b92
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sun,  9 Apr 2023 15:28:34 +0200

Tune pg clister, try checkov, apply some security params to sliding-sync container

Diffstat:
M
apps/base/matrix/sliding-proxy/deployment.yaml
 | 
11
+++++++++++
M
infrastructure/configs/postgres-clusters.yaml
 | 
31
+++++++++++++++++++++++++++++++
M
infrastructure/controllers/kube-router.yaml
 | 
6
++++--

3 files changed, 46 insertions(+), 2 deletions(-)
diff --git a/apps/base/matrix/sliding-proxy/deployment.yaml b/apps/base/matrix/sliding-proxy/deployment.yaml
@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: sliding-proxy-midnightthoughts
   namespace: matrix
+  annotations:
+    checkov.io/skip1: CKV_K8S_35=False positive.
+    checkov.io/skip2: CKV_K8S_40=Too late too change.
+    checkov.io/skip3: CKV_K8S_23=Too late too change.
 spec:
   replicas: 1
   selector:
@@ -14,6 +18,11 @@ spec:
       labels:
         app: sliding-proxy-midnightthoughts
     spec:
+      securityContext:
+        #runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      automountServiceAccountToken: false
       containers:
         - image: ghcr.io/matrix-org/sliding-sync:v0.99.1 # {"$imagepolicy": "matrix:sliding-proxy"}
           imagePullPolicy: Always
@@ -40,6 +49,8 @@ spec:
             initialDelaySeconds: 60
             periodSeconds: 30
           securityContext:
+            seccompProfile:
+              type: RuntimeDefault
             allowPrivilegeEscalation: false
             capabilities:
               drop:
diff --git a/infrastructure/configs/postgres-clusters.yaml b/infrastructure/configs/postgres-clusters.yaml
@@ -32,6 +32,37 @@ spec:
     parameters:
       password_encryption: scram-sha-256
       max_connections: "200"
+      superuser_reserved_connections: "6"
+      shared_buffers: "10240 MB"
+      work_mem: "128 MB"
+      maintenance_work_mem: "620 MB"
+      huge_pages: try
+      effective_cache_size: "45 GB"
+      effective_io_concurrency: "200"
+      random_page_cost: "1.25"
+      track_io_timing: on
+      min_wal_size: "512 MB"
+      max_wal_size: "1024 MB"
+      wal_buffers: "-1"
+      wal_writer_delay: 200ms
+      wal_writer_flush_after: 1MB
+      wal_keep_size: "3650 MB"
+      bgwriter_delay: 200ms
+      bgwriter_lru_maxpages: "100"
+      bgwriter_lru_multiplier: "2.0"
+      bgwriter_flush_after: "0"
+      max_worker_processes: "16"
+      max_parallel_workers_per_gather: "8"
+      max_parallel_maintenance_workers: "8"
+      max_parallel_workers: "16"
+      parallel_leader_participation: "on"
+      enable_partitionwise_join: "on"
+      enable_partitionwise_aggregate: "on"
+      jit: "on"
+      max_slot_wal_keep_size: "1000 MB"
+      track_wal_io_timing: "on"
+      maintenance_io_concurrency: "200"
+      wal_recycle: "on"
   teamId: matrix
   users:
     synapse: []
diff --git a/infrastructure/controllers/kube-router.yaml b/infrastructure/controllers/kube-router.yaml
@@ -6,8 +6,10 @@ metadata:
     k8s-app: kube-router
     tier: node
   annotations:
-    checkov.io/skip1: CKV_K8S_19=The container needs to modify host network rules.
-    checkov.io/skip2: CKV_K8S_35=The container needs to know values from the node.
+    checkov.io/skip1: CKV_K8S_20=The container needs to modify host network rules.
+    checkov.io/skip2: CKV_K8S_19=The container needs to modify host network rules.
+    checkov.io/skip3: CKV_K8S_38=The container needs to know values from the node.
+    checkov.io/skip4: CKV_K8S_28=The container does bgp.
     prometheus.io/scrape: "true"
     prometheus.io/port: "8080"
   name: kube-router