Project: KICS (Provisioning / Security & Compliance)
File: 26b047a9-0329-48fd-8fb7-05bbe5ba80ee.md

title: Incorrect Volume Claim Access Mode ReadWriteOnce hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 26b047a9-0329-48fd-8fb7-05bbe5ba80ee Query name: Incorrect Volume Claim Access Mode ReadWriteOnce Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Build Process URL: Kubernetes Stateful Sets must have one Volume Claim template with the access mode 'ReadWriteOnce'<br> ```tf title="Positive test num. 1 - tf file" hl_lines="166 367" resource "kubernetesstatefulset" "prometheus-1" { metadata { annotations = { SomeAnnotation = "foobar" } labels = { k8s-app = "prometheus" "kubernetes.io/cluster-service" = "true" "addonmanager.kubernetes.io/mode" = "Reconcile" version = "v2.2.1" } name = "prometheus" } spec { podmanagementpolicy = "Parallel" replicas = 1 revisionhistorylimit = 5 selector { match_labels = { k8s-app = "prometheus" } } service_name = "prometheus" template { metadata { labels = { k8s-app = "prometheus" } annotations = {} } spec { serviceaccountname = "prometheus" init_container { name = "init-chown-data" image = "busybox:latest" imagepullpolicy = "IfNotPresent" command = ["chown", "-R", "65534:65534", "/data"] volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } } container { name = "prometheus-server-configmap-reload" image = "jimmidyson/configmap-reload:v0.1" imagepullpolicy = "IfNotPresent" args = [ "--volume-dir=/etc/config", "--webhook-url=http://localhost:9090/-/reload", ] volume_mount { name = "config-volume" mount_path = "/etc/config" read_only = true } resources { limits = { cpu = "10m" memory = "10Mi" } requests = { cpu = "10m" memory = "10Mi" } } } container { name = "prometheus-server" image = "prom/prometheus:v2.2.1" imagepullpolicy = "IfNotPresent" args = [ "--config.file=/etc/config/prometheus.yml", "--storage.tsdb.path=/data", "--web.console.libraries=/etc/prometheus/console_libraries", "--web.console.templates=/etc/prometheus/consoles", "--web.enable-lifecycle", ] port { container_port = 9090 } resources { limits = { cpu = "200m" memory = "1000Mi" } requests = { cpu = "200m" memory = "1000Mi" } } volume_mount { name = "config-volume" mount_path = "/etc/config" } volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } readiness_probe { http_get { path = "/-/ready" port = 9090 } initialdelayseconds = 30 timeout_seconds = 30 } liveness_probe { http_get { path = "/-/healthy" port = 9090 scheme = "HTTPS" } initialdelayseconds = 30 timeout_seconds = 30 } } terminationgraceperiod_seconds = 300 volume { name = "config-volume" config_map { name = "prometheus-config" } } } } update_strategy { type = "RollingUpdate" rolling_update { partition = 1 } } volumeclaimtemplate { metadata { name = "prometheus-data-1" } spec { access_modes = ["ReadWriteOnce"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } volumeclaimtemplate { metadata { name = "prometheus-data-2" } spec { access_modes = ["ReadWriteOnce"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } } } resource "kubernetesstatefulset" "prometheus-2" { metadata { annotations = { SomeAnnotation = "foobar" } labels = { k8s-app = "prometheus" "kubernetes.io/cluster-service" = "true" "addonmanager.kubernetes.io/mode" = "Reconcile" version = "v2.2.1" } name = "prometheus" } spec { podmanagementpolicy = "Parallel" replicas = 1 revisionhistorylimit = 5 selector { match_labels = { k8s-app = "prometheus" } } service_name = "prometheus" template { metadata { labels = { k8s-app = "prometheus" } annotations = {} } spec { serviceaccountname = "prometheus" init_container { name = "init-chown-data" image = "busybox:latest" imagepullpolicy = "IfNotPresent" command = ["chown", "-R", "65534:65534", "/data"] volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } } container { name = "prometheus-server-configmap-reload" image =

imagepullpolicy = "IfNotPresent" args = [ "--volume-dir=/etc/config", "--webhook-url=http://localhost:9090/-/reload", ] volume_mount { name = "config-volume" mount_path = "/etc/config" read_only = true } resources { limits = { cpu = "10m" memory = "10Mi" } requests = { cpu = "10m" memory = "10Mi" } } } container { name = "prometheus-server" image = "prom/prometheus:v2.2.1" imagepullpolicy = "IfNotPresent" args = [ "--config.file=/etc/config/prometheus.yml", "--storage.tsdb.path=/data", "--web.console.libraries=/etc/prometheus/console_libraries", "--web.console.templates=/etc/prometheus/consoles", "--web.enable-lifecycle", ] port { container_port = 9090 } resources { limits = { cpu = "200m" memory = "1000Mi" } requests = { cpu = "200m" memory = "1000Mi" } } volume_mount { name = "config-volume" mount_path = "/etc/config" } volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } readiness_probe { http_get { path = "/-/ready" port = 9090 } initialdelayseconds = 30 timeout_seconds = 30 } liveness_probe { http_get { path = "/-/healthy" port = 9090 scheme = "HTTPS" } initialdelayseconds = 30 timeout_seconds = 30 } } terminationgraceperiod_seconds = 300 volume { name = "config-volume" config_map { name = "prometheus-config" } } } } update_strategy { type = "RollingUpdate" rolling_update { partition = 1 } } volumeclaimtemplate { metadata { name = "prometheus-data-1" } spec { access_modes = ["ReadWrite"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetesstatefulset" "prometheus" { metadata { annotations = { SomeAnnotation = "foobar" } labels = { k8s-app = "prometheus" "kubernetes.io/cluster-service" = "true" "addonmanager.kubernetes.io/mode" = "Reconcile" version = "v2.2.1" } name = "prometheus" } spec { podmanagementpolicy = "Parallel" replicas = 1 revisionhistorylimit = 5 selector { match_labels = { k8s-app = "prometheus" } } service_name = "prometheus" template { metadata { labels = { k8s-app = "prometheus" } annotations = {} } spec { serviceaccountname = "prometheus" init_container { name = "init-chown-data" image = "busybox:latest" imagepullpolicy = "IfNotPresent" command = ["chown", "-R", "65534:65534", "/data"] volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } } container { name = "prometheus-server-configmap-reload" image = "jimmidyson/configmap-reload:v0.1" imagepullpolicy = "IfNotPresent" args = [ "--volume-dir=/etc/config", "--webhook-url=http://localhost:9090/-/reload", ] volume_mount { name = "config-volume" mount_path = "/etc/config" read_only = true } resources { limits = { cpu = "10m" memory = "10Mi" } requests = { cpu = "10m" memory = "10Mi" } } } container { name = "prometheus-server" image = "prom/prometheus:v2.2.1" imagepullpolicy = "IfNotPresent" args = [ "--config.file=/etc/config/prometheus.yml", "--storage.tsdb.path=/data", "--web.console.libraries=/etc/prometheus/console_libraries", "--web.console.templates=/etc/prometheus/consoles", "--web.enable-lifecycle", ] port { container_port = 9090 } resources { limits = { cpu = "200m" memory = "1000Mi" } requests = { cpu = "200m" memory = "1000Mi" } } volume_mount { name = "config-volume" mount_path = "/etc/config" } volume_mount { name = "prometheus-data" mount_path = "/data" sub_path = "" } readiness_probe { http_get { path = "/-/ready" port = 9090 } initialdelayseconds = 30 timeout_seconds = 30 } liveness_probe { http_get { path = "/-/healthy" port = 9090 scheme = "HTTPS" } initialdelayseconds = 30 timeout_seconds = 30 } } terminationgraceperiod_seconds = 300 volume { name = "config-volume" config_map { name = "prometheus-config" } } } } update_strategy { type = "RollingUpdate" rolling_update { partition = 1 } } volumeclaimtemplate { metadata { name = "prometheus-data-1" } spec { access_modes = ["ReadWriteOnce"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } volumeclaimtemplate { metadata { name = "prometheus-data-2" } spec { access_modes = ["ReadWrite"] storageclassname = "standard" resources { requests = { storage = "16Gi" } } } } } } ```