From 9a07659ef6e5abc6cbe3f42aba613301aca4056e Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 27 Aug 2026 21:41:17 -0700
Subject: [PATCH] fix: remove privileged init container, set pod-security
 baseline for OpenSearch

---
 k8s/infra/databases/opensearch.yaml | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/k8s/infra/databases/opensearch.yaml b/k8s/infra/databases/opensearch.yaml
index 847d73a..7f7292a 100644
--- a/k8s/infra/databases/opensearch.yaml
+++ b/k8s/infra/databases/opensearch.yaml
@@ -7,6 +7,10 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: poimen
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/warn: baseline
 ---
 
 # OpenSearch Service (Headless for StatefulSet discovery)
@@ -108,14 +112,7 @@ spec:
         app.kubernetes.io/name: opensearch
     spec:
       serviceAccountName: opensearch
-      
-      # Init container: set vm.max_map_count (required by Elasticsearch/OpenSearch)
-      initContainers:
-        - name: set-vm-max-map-count
-          image: busybox:1.35
-          command: ['sysctl', '-w', 'vm.max_map_count=262144']
-          securityContext:
-            privileged: true
+      hostNetwork: false
       
       containers:
         - name: opensearch