Why does the neuvector-controller run as a deployment rather than a statefulset?

[HujinoKun]

Hello,

It's all in the title.

And why use ReadWriteMany by default on his pvc ?

[lindhe]

Why would it need to be a StatefulSet?

Regarding the PVC, it's pretty straight-forward: the rollingUpdate strategy used is configured to never have 0 replicas available:

neuvector-helm/charts/core/values.yaml

Line 82 in 94c474e

maxUnavailable: 0

In other words, it will always try to start a new replica first and then kill the old one. And if the PVC was RWO, it would not be able to spawn a new pod until the old pod was killed. Thus, it must have RWX if that strategy should work.

And additionally, clearly it must be RWX if users should be able to configure more than 1 replica for the deployment.

[lindhe]

BTW, for questions like this it's probably better to ask in the Slack channel #neuvector-security on Rancher Users.