From dc2ced2d0fbec1ee3dc0c982c98993b9fccb577b Mon Sep 17 00:00:00 2001
From: Daniel Quintero <danielqb@gmail.com>
Date: Fri, 24 Jul 2026 12:00:28 -0500
Subject: [PATCH] fix(chart): remove unused volume mounts and DB secret from
 nginx container

## Problem

The nginx container in glpi-deployment.yaml mounted the files, marketplace,
and etc PersistentVolumeClaims (ReadWriteOnce) even though nginx's actual
config (default.conf) never reads from those paths - it only serves static
assets from /var/www/html/public (baked into the image) and proxies
everything else to php-fpm via fastcgi_pass. It also pulled glpi-secret
(DB credentials) via envFrom despite never connecting to the database.

Since both nginx and php-fpm mounted the same RWO PVCs, a cluster without
explicit pod affinity forcing them onto the same node could schedule them
on different nodes, causing FailedMount/ContainerCreating for whichever
pod lands second.

## Fix

Removed the files/marketplace/etc volumeMounts and volumes, and the
glpi-secret envFrom, from the nginx container. Only php-fpm (which is
the only container that actually touches GLPI_VAR_DIR/marketplace/etc
and the database) keeps these. nginx now only mounts nginx-conf.

This also reduces blast radius: nginx no longer has DB credentials in
its environment (least privilege).

## Testing

- helm lint: 0 failures
- helm template: nginx Deployment renders with only nginx-conf volume,
  no envFrom block
---
 .../glpi/templates/glpi-deployment.yaml       | 20 -------------------
 1 file changed, 20 deletions(-)

diff --git a/kubernetes/glpi/templates/glpi-deployment.yaml b/kubernetes/glpi/templates/glpi-deployment.yaml
index a036973..d8dff2e 100644
--- a/kubernetes/glpi/templates/glpi-deployment.yaml
+++ b/kubernetes/glpi/templates/glpi-deployment.yaml
@@ -159,21 +159,10 @@ spec:
           securityContext:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          envFrom:
-            - configMapRef:
-                name: glpi-config
-            - secretRef:
-                name: glpi-secret
           ports:
             - containerPort: 8080
               name: http
           volumeMounts:
-            - name: files
-              mountPath: /var/lib/glpi
-            - name: marketplace
-              mountPath: /var/www/html/marketplace
-            - name: etc
-              mountPath: /etc/glpi
             - name: nginx-conf
               mountPath: /etc/nginx/conf.d
           {{- if .Values.glpi.nginx.livenessProbe.enabled }}
@@ -199,15 +188,6 @@ spec:
           resources:
             {{- toYaml .Values.glpi.nginx.resources | nindent 12 }}
       volumes:
-        - name: etc
-          persistentVolumeClaim:
-            claimName: glpi-etc
-        - name: files
-          persistentVolumeClaim:
-            claimName: glpi-files
-        - name: marketplace
-          persistentVolumeClaim:
-            claimName: glpi-marketplace
         - name: nginx-conf
           configMap:
             defaultMode: 420