Review fixes for the memory-mappings page, and a security pillar - #541
Merged
Merged
Conversation
- Correct the Helm values key to initContainers.sysctlInitContainer.sysctlVmMaxMapCount and note the init container also sets vm.overcommit_memory=1. - Collapse the log-line table into search-the-phrase prose plus a version-pinned details block; date the docs_url field to v1.39.5 (new EntryFacts since prop). - Derive the sizing numbers (70% budget, 3 mappings reserved per shard open) and name Elasticsearch for 262144. - Move sysctl persistence to a /etc/sysctl.d drop-in; add sudo; fix the kernel-default wording. - Narrow the errors index card to what the page covers. - Add a Lock-the-door pillar to /improve-your-cluster: authentication on, anonymous access off, RBAC, network exposure.
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
SAST | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review follow-up to #536, plus one addition.
initContainers.sysctlVmMaxMapCount→initContainers.sysctlInitContainer.sysctlVmMaxMapCount. Helm swallows unknown keys, so the wrong key silently left the limit at the chart's 524288 — the worst place for that is the fix path of an error page. Verified against the chart template, which also setsvm.overcommit_memory=1(now noted, so nobody disables the init container to replace it).<details>block pinned to v1.39.5/v1.40.0, and thedocs_urlfield is dated Since v1.39.5 (EntryFactsgained asinceprop)./etc/sysctl.ddrop-in on both pages. The errors index card is narrowed to the one entry that exists.Merging note:
docs/improve-your-cluster-structurerewrites the same page; whichever lands second ports the pillar onto its restructured checklists.