From 5920df3f5d81688122699b47d7e712dc6dc840be Mon Sep 17 00:00:00 2001
From: Benjamin Edwards <edwards.benw@gmail.com>
Date: Wed, 21 Sep 2022 14:15:13 -0400
Subject: [PATCH] update k8s deployment spec to include vuln database path
 (#7229)

---
 charts/fleet/templates/deployment.yaml |  6 ++++++
 docs/Deploying/Server-Installation.md  | 13 ++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/charts/fleet/templates/deployment.yaml b/charts/fleet/templates/deployment.yaml
index 2b9ee2f8b8..4dd0be0c90 100644
--- a/charts/fleet/templates/deployment.yaml
+++ b/charts/fleet/templates/deployment.yaml
@@ -46,6 +46,8 @@ spec:
             memory: {{ .Values.resources.requests.memory }}
         env:
           ## BEGIN FLEET SECTION
+          - name: FLEET_VULNERABILITIES_DATABASES_PATH
+            value: /tmp/vuln # /tmp might not work on all cloud providers by default
           - name: FLEET_SERVER_ADDRESS
             value: "0.0.0.0:{{ .Values.fleet.listenPort }}"
           - name: FLEET_AUTH_BCRYPT_COST
@@ -273,6 +275,8 @@ spec:
             port: {{ .Values.fleet.listenPort }}
         {{- if or (.Values.fleet.tls.enabled) (.Values.mysql.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
         volumeMounts:
+          - name: tmp
+            mountPath: /tmp
           {{- if .Values.fleet.tls.enabled }}
           - name: fleet-tls
             readOnly: true
@@ -318,6 +322,8 @@ spec:
       serviceAccountName: fleet
       {{- if or (.Values.fleet.tls.enabled) (.Values.mysql.tls.enabled) (eq .Values.osquery.logging.statusPlugin "filesystem") (eq .Values.osquery.logging.resultPlugin "filesystem") }}
       volumes:
+        - name: tmp
+          emptyDir:
         {{- if .Values.fleet.tls.enabled }}
         - name: fleet-tls
           secret:
diff --git a/docs/Deploying/Server-Installation.md b/docs/Deploying/Server-Installation.md
index e347f31a10..b78a0b72d2 100644
--- a/docs/Deploying/Server-Installation.md
+++ b/docs/Deploying/Server-Installation.md
@@ -266,6 +266,11 @@ spec:
       - name: fleet
         image: fleetdm/fleet:4.20.1
         env:
+          # if running Fleet behind external ingress controller that terminates TLS
+          - name: FLEET_SERVER_TLS
+            value: FALSE
+          - name: FLEET_VULNERABILITIES_DATABASES_PATH
+            value: /tmp/vuln
           - name: FLEET_MYSQL_ADDRESS
             valueFrom:
               secretKeyRef:
@@ -291,15 +296,21 @@ spec:
               secretKeyRef:
                 name: fleet_secrets
                 key: redis_address
+        volumeMounts:
+          - name: tmp
+            mountPath: /tmp # /tmp might not work on all cloud providers by default
         resources:
           requests:
             memory: "64Mi"
             cpu: "250m"
           limits:
-            memory: "128Mi"
+            memory: "2048Mi" # vulnerability processing
             cpu: "500m"
         ports:
         - containerPort: 3000
+      volumes:
+        - name: tmp
+          emptyDir:
 
 ```
 Notice we are using secrets to pass in values for Fleet's dependencies' environment variables.