72 lines
1.5 KiB
Markdown
72 lines
1.5 KiB
Markdown
# Declarative Remediation Manifests
|
|
|
|
Use these manifests with OCI DevOps `Apply manifest to your Kubernetes cluster` stages.
|
|
|
|
## Business remediation
|
|
|
|
Apply in this order:
|
|
|
|
```text
|
|
business-configmap.yaml
|
|
order-rollout-restart.yaml
|
|
```
|
|
|
|
`business-configmap.yaml` sets safe business thresholds.
|
|
|
|
`order-rollout-restart.yaml` reapplies the `order-service` deployment template so pods reload ConfigMap-backed environment variables.
|
|
|
|
Before applying `order-rollout-restart.yaml`, replace:
|
|
|
|
```text
|
|
<restart-token>
|
|
```
|
|
|
|
with a new value, for example the OCI DevOps deployment ID, build number, or timestamp. If the annotation does not change, Kubernetes will not restart the pods.
|
|
|
|
## ImagePull remediation
|
|
|
|
Use the manifest matching the affected deployment:
|
|
|
|
```text
|
|
imagepull-all-services.yaml
|
|
imagepull-order.yaml
|
|
imagepull-payment.yaml
|
|
imagepull-inventory.yaml
|
|
```
|
|
|
|
For the demo, prefer `imagepull-all-services.yaml`. It restores `ocir-secret` across all three business deployments, so the same remediation pipeline works regardless of which service hit `ImagePullBackOff`.
|
|
|
|
Each manifest restores:
|
|
|
|
```yaml
|
|
imagePullSecrets:
|
|
- name: ocir-secret
|
|
```
|
|
|
|
Before applying an ImagePull remediation manifest, replace:
|
|
|
|
```text
|
|
<region-key>
|
|
<tenancy-namespace>
|
|
<image-tag>
|
|
<restart-token>
|
|
```
|
|
|
|
with the same values used by the active deployment. The `restart-token` forces a new ReplicaSet after the secret is restored.
|
|
|
|
## HPA remediation
|
|
|
|
Use:
|
|
|
|
```text
|
|
order-hpa-capacity.yaml
|
|
```
|
|
|
|
It changes `order-service` HPA to:
|
|
|
|
```text
|
|
minReplicas=3
|
|
maxReplicas=8
|
|
averageUtilization=65
|
|
```
|