Repository navigation
fix(helm): make default values produce a startable pod (#645) - #649
Merged
Merged
Conversation
pirog-spb
force-pushed
the
fix/645-helm-defaults
branch
3 times, most recently
from
October 5, 2026 19:12
11998ae to
1369669
Compare
added 2 commits
October 11, 2026 16:36
The chart defaults left securityContext, resources, probes empty, set service.port to 80 and passed no configuration, so a default helm install produced a CrashLoopBackOff (eUPF dies raising RLIMIT_MEMLOCK without privileges). Defaults now include everything the pod needs to start: - privileged securityContext (documented capabilities-based alternative) - net.ipv4.ip_forward sysctl (unsafe, requires allowed-unsafe-sysctls) - read-only /sys hostPath (entrypoint mounts bpffs/debugfs) - TCP liveness/readiness probes and modest resources - service.port 8080 + metrics port 9090 Configuration is passed via UPF_* environment variables by default (defaultEnv), with an optional ConfigMap-based mode (config.enabled) that wires up the ConfigMap, volume, mount and --config automatically. The ConfigMap name is generated from the release fullname instead of being hardcoded. Also fixes global.imagePullPolicy being ignored due to a case typo (ImagePullPolicy) and to a non-empty image.pullPolicy default. dev/test profiles keep only environment specifics; test now uses the ConfigMap mode as its example and gains the ip_forward sysctl it was missing. Signed-off-by: pirog-spb <[email protected]>
The chart defaults now mount the host /sys read-only into the pod (#645), which is required by the image entrypoint to mount bpffs and debugfs for the eBPF data plane. Trivy flags the hostPath volume as a disallowed volume type (AVD-KSV-0121, HIGH), failing the scan-config job of Security scan on this PR - same 'by design' class as AVD-KSV-0118 (privileged container) ignored earlier. Add the rule to .trivyignore with the justification instead of weakening the chart defaults. Verified locally: trivy fs --scanners misconfig --severity HIGH,CRITICAL with this .trivyignore and trivy.yaml reports 0 findings. Signed-off-by: pirog-spb <[email protected]>
pirog-spb
force-pushed
the
fix/645-helm-defaults
branch
from
October 11, 2026 13:36
9f33d40 to
6a72569
Compare
This was referenced Oct 11, 2026
pirog-spb
added a commit
that referenced
this pull request
Oct 31, 2026
Signed-off-by: pirog-spb <[email protected]> (cherry picked from commit 7465720) Signed-off-by: pirog-spb <[email protected]>
pirog-spb
added a commit
that referenced
this pull request
Oct 31, 2026
Signed-off-by: pirog-spb <[email protected]> (cherry picked from commit 7465720) Signed-off-by: pirog-spb <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The chart defaults left securityContext, resources, probes empty, set service.port to 80 and passed no configuration, so a default helm install produced a CrashLoopBackOff (eUPF dies raising RLIMIT_MEMLOCK without privileges).
Defaults now include everything the pod needs to start:
Configuration is passed via UPF_* environment variables by default (defaultEnv), with an optional ConfigMap-based mode (config.enabled) that wires up the ConfigMap, volume, mount and --config automatically. The ConfigMap name is generated from the release fullname instead of being hardcoded.
Also fixes global.imagePullPolicy being ignored due to a case typo (ImagePullPolicy) and to a non-empty image.pullPolicy default.
dev/test profiles keep only environment specifics; test now uses the ConfigMap mode as its example and gains the ip_forward sysctl it was missing.