Describe the bug
Helm chart does not add IPC_LOCK capability to server container, as documented in https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-security-concerns#ensure-mlock-is-enabled
To Reproduce
Install chart default server.statefulSet.securityContext.
For the Raft leader server, observe non-zero major page faults (I monitor from the kubernetes node with command pidstat -r -C vault 5).
In my case, the raft leader server created on average at least ~50 major page faults per second.
Expected behavior
IPC_LOCK is added as a capability as per the documentation, and Vault pods do not generate unecessary page faults
Environment
- Kubernetes version: v1.32.3
- Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): kubeadm, self-managed
- Other configuration options or runtime services (istio, etc.): N/A
- vault-helm version: 0.30.0
Describe the bug
Helm chart does not add IPC_LOCK capability to server container, as documented in https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-security-concerns#ensure-mlock-is-enabled
To Reproduce
Install chart default
server.statefulSet.securityContext.For the Raft leader server, observe non-zero major page faults (I monitor from the kubernetes node with command
pidstat -r -C vault 5).In my case, the raft leader server created on average at least ~50 major page faults per second.
Expected behavior
IPC_LOCK is added as a capability as per the documentation, and Vault pods do not generate unecessary page faults
Environment