Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(terraform): Ensure ephemeral disks are used for OS disks #5584

Merged
merged 1 commit into from
Sep 29, 2023
Merged

feat(terraform): Ensure ephemeral disks are used for OS disks #5584

merged 1 commit into from
Sep 29, 2023

Conversation

tdefise
Copy link
Contributor

@tdefise tdefise commented Sep 21, 2023

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Fixes #5583

New/Edited policies (Delete if not relevant)

Description

Temporary data can contain sensitive data at some points, by using ephemeral disks, we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage

Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage to avoid data loss in case the virtual machine needs to be relocated to another host.
Generally speaking, containers are not designed to have local state persisted to the managed OS disk, hence this behavior offers limited value to AKS hosted while providing some drawbacks, including slower node provisioning and higher read/write latency.
Ephemeral disks allow us also to have faster cluster operations like scale or upgrade due to faster re-imaging and boot times.

More information can be found here

Fix

Set the disk type to "Ephemeral"

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my feature, policy, or fix is effective and works
  • New and existing tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

@tdefise tdefise temporarily deployed to scan-security September 21, 2023 12:29 — with GitHub Actions Inactive
Copy link
Contributor

@JamesWoolfenden JamesWoolfenden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@gruebel gruebel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thansk again 🍻

@gruebel gruebel merged commit 9b06730 into bridgecrewio:main Sep 29, 2023
31 checks passed
JamesWoolfenden pushed a commit that referenced this pull request Sep 29, 2023
JamesWoolfenden pushed a commit that referenced this pull request Sep 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Azure Kubernetes Service - Ensure ephemeral disks are used for OS disks 
3 participants