Fix deployment template security scan blockers

deploy/helm/knowledge-explorer/templates/deployment.yaml

@@ -28,6 +28,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -38,7 +39,11 @@ spec:
         - name: explorer
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- if .Values.image.digest }}
+          image: "{{ .Values.image.repository }}@{{ .Values.image.digest }}"
+          {{- else }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          {{- end }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http

deploy/helm/knowledge-explorer/templates/networkpolicy.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.networkPolicy.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "knowledge-explorer.fullname" . }}
+  labels:
+    {{- include "knowledge-explorer.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "knowledge-explorer.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.service.targetPort }}
+  egress:
+    - {}
+{{- end }}

deploy/helm/knowledge-explorer/values.prod.yaml

@@ -1,8 +1,9 @@
 image:
   repository: ghcr.io/semantica-agi/semantica-knowledge-explorer
-  # Pin to a specific release tag or digest before deploying to production.
+  # Replace this placeholder digest with the digest of the image you publish.
+  digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
   tag: "0.5.0"
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 ingress:
   enabled: true

deploy/helm/knowledge-explorer/values.yaml

@@ -2,14 +2,18 @@ replicaCount: 2
 
 image:
   repository: semantica-knowledge-explorer
-  pullPolicy: IfNotPresent
-  # Use a pinned tag (e.g. "0.5.0") or digest in production; empty string falls back to .Chart.AppVersion.
+  pullPolicy: Always
+  # Replace this placeholder digest with the digest of the image you publish.
+  digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  # Used only when image.digest is empty.
   tag: ""
 
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+automountServiceAccountToken: false
+
 podAnnotations:
   # AppArmor — must match the container name defined in the Deployment template ("explorer").
   container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
@@ -24,7 +28,7 @@ securityContext:
   allowPrivilegeEscalation: false
   readOnlyRootFilesystem: true
   runAsNonRoot: true
-  runAsUser: 1000
+  runAsUser: 10001
   seccompProfile:
     type: RuntimeDefault
   capabilities:
@@ -89,3 +93,6 @@ autoscaling:
 nodeSelector: {}
 tolerations: []
 affinity: {}
+
+networkPolicy:
+  enabled: true

deploy/kubernetes/README.md

@@ -9,4 +9,4 @@ kubectl apply -k deploy/kubernetes
 kubectl -n semantica rollout status deployment/knowledge-explorer
 ```
 
-Update the image name and ingress host before deploying to production. `secret.yaml` is intentionally ignored from the kustomization; keep only `secret.yaml.example` in git.
+Update the placeholder image digest and ingress host before deploying to production. `secret.yaml` is intentionally ignored from the kustomization; keep only `secret.yaml.example` in git.

deploy/kubernetes/deployment.yaml

@@ -25,23 +25,21 @@ spec:
         app.kubernetes.io/name: knowledge-explorer
         app.kubernetes.io/part-of: semantica
     spec:
+      automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
         - name: explorer
-          image: semantica-knowledge-explorer:0.5.0
-          imagePullPolicy: IfNotPresent
+          image: semantica-knowledge-explorer@sha256:0000000000000000000000000000000000000000000000000000000000000000
+          imagePullPolicy: Always
           ports:
             - name: http
               containerPort: 8000
           envFrom:
             - configMapRef:
                 name: knowledge-explorer-config
-            - secretRef:
-                name: knowledge-explorer-secrets
-                optional: true
           livenessProbe:
             httpGet:
               path: /api/health
@@ -69,7 +67,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-            runAsUser: 1000
+            runAsUser: 10001
             seccompProfile:
               type: RuntimeDefault
             capabilities:

deploy/kubernetes/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - networkpolicy.yaml

deploy/kubernetes/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: knowledge-explorer
+  namespace: semantica
+  labels:
+    app.kubernetes.io/name: knowledge-explorer
+    app.kubernetes.io/part-of: semantica
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: knowledge-explorer
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 8000
+  egress:
+    - {}