Kubernetes

Hardening and probes

The chart's pod security settings, network policies and health probes.

Hardening

Pods run as user 65532 with a read-only root filesystem, no capabilities and no service account token.
The worker accepts only metrics scrapes, from metrics.allowScrapesFrom (default: every pod). networkPolicy.allowServerAccessFrom limits access to the server. SeaweedFS has seaweedfs.networkPolicy.
The SeaweedFS chart creates a ClusterRole (seaweedfs.global.seaweedfs.createClusterRole). Review it.
Egress stays open for remote repositories. Relic refuses private upstream and replication addresses unless RELIC_UPSTREAM_ALLOW_PRIVATE_ADDRESSES is true.

Path	Reports
`/healthz`	The process is alive.
`/readyz`	The database and object storage answer.

The probes follow tls.enabled. See also Troubleshooting.

Upgrades and removal

Upgrade Relic with helm upgrade, and uninstall it with or without its data.

Monitoring

Get metrics, traces, logs and dashboards from the chart, with its own monitoring stack or yours.