update k8s deployment spec to include vuln database path (#7229)

charts/fleet/templates/deployment.yaml

@@ -46,6 +46,8 @@ spec:
             memory: {{ .Values.resources.requests.memory }}
         env:
           ## BEGIN FLEET SECTION
+          - name: FLEET_VULNERABILITIES_DATABASES_PATH
+            value: /tmp/vuln # /tmp might not work on all cloud providers by default
           - name: FLEET_SERVER_ADDRESS
             value: "0.0.0.0:{{ .Values.fleet.listenPort }}"
           - name: FLEET_AUTH_BCRYPT_COST
@@ -273,6 +275,8 @@ spec:
             port: {{ .Values.fleet.listenPort }}
         {{- if or (.Values.fleet.tls.enabled) (.Values.mysql.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
         volumeMounts:
+          - name: tmp
+            mountPath: /tmp
           {{- if .Values.fleet.tls.enabled }}
           - name: fleet-tls
             readOnly: true
@@ -318,6 +322,8 @@ spec:
       serviceAccountName: fleet
       {{- if or (.Values.fleet.tls.enabled) (.Values.mysql.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
       volumes:
+        - name: tmp
+          emptyDir:
         {{- if .Values.fleet.tls.enabled }}
         - name: fleet-tls
           secret:

docs/Deploying/Server-Installation.md

@@ -266,6 +266,11 @@ spec:
       - name: fleet
         image: fleetdm/fleet:4.20.1
         env:
+          # if running Fleet behind external ingress controller that terminates TLS
+          - name: FLEET_SERVER_TLS
+            value: FALSE
+          - name: FLEET_VULNERABILITIES_DATABASES_PATH
+            value: /tmp/vuln
           - name: FLEET_MYSQL_ADDRESS
             valueFrom:
               secretKeyRef:
@@ -291,15 +296,21 @@ spec:
               secretKeyRef:
                 name: fleet_secrets
                 key: redis_address
+        volumeMounts:
+          - name: tmp
+            mountPath: /tmp # /tmp might not work on all cloud providers by default
         resources:
           requests:
             memory: "64Mi"
             cpu: "250m"
           limits:
-            memory: "128Mi"
+            memory: "2048Mi" # vulnerability processing
             cpu: "500m"
         ports:
         - containerPort: 3000
+      volumes:
+        - name: tmp
+          emptyDir:
 
 ```
 Notice we are using secrets to pass in values for Fleet's dependencies' environment variables.