From 8b5f75160a8ace774fa9867c82fef4f594031f2a Mon Sep 17 00:00:00 2001
From: KaifAhmad1 <kaifahmad087@gmail.com>
Date: Wed, 24 Jun 2026 13:15:41 +0530
Subject: [PATCH] fix(ci): fix 2 remaining checkov HIGH findings and Terrascan
 seccomp warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 2 active checkov HIGH results (CKV_K8S_28 + CKV_K8S_30) were coming
from deploy/gcp/cloudrun-service.yaml — checkov scans it as a Kubernetes
resource (apiVersion: serving.knative.dev/v1) and flagged missing AppArmor
and seccomp on that file, regardless of the fixes made to the k8s/ and
helm/ manifests.

deploy/gcp/cloudrun-service.yaml:
- Add container name (explorer) so AppArmor annotation key matches
- Add AppArmor annotation to pod template metadata (CKV_K8S_30)
- Add legacy seccomp annotation (AC_K8S_0080 / CKV_K8S_28)
- Add pod-level seccompProfile: RuntimeDefault (CKV_K8S_28)
- Add container securityContext (runAsNonRoot, allowPrivilegeEscalation)
  Cloud Run Gen 2 supports all of these fields

deploy/kubernetes/deployment.yaml:
- Pin image tag from ':latest' to ':0.5.0' (AC_K8S_0068 / AC_K8S_0069)
- Add legacy seccomp pod annotation alongside existing seccompProfile field

deploy/helm/knowledge-explorer/values.yaml:
- Add legacy seccomp annotation to podAnnotations so it renders into
  the Helm-generated pod template alongside the modern seccompProfile
---
 deploy/gcp/cloudrun-service.yaml           | 13 ++++++++++++-
 deploy/helm/knowledge-explorer/values.yaml |  3 +++
 deploy/kubernetes/deployment.yaml          |  3 ++-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/deploy/gcp/cloudrun-service.yaml b/deploy/gcp/cloudrun-service.yaml
index afee9c69..9990b308 100644
--- a/deploy/gcp/cloudrun-service.yaml
+++ b/deploy/gcp/cloudrun-service.yaml
@@ -12,11 +12,22 @@ spec:
       annotations:
         autoscaling.knative.dev/minScale: "0"
         autoscaling.knative.dev/maxScale: "10"
+        container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
     spec:
       containerConcurrency: 80
       timeoutSeconds: 300
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
-        - image: gcr.io/PROJECT_ID/knowledge-explorer:latest
+        - name: explorer
+          image: gcr.io/PROJECT_ID/knowledge-explorer:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
           ports:
             - name: http1
               containerPort: 8000
diff --git a/deploy/helm/knowledge-explorer/values.yaml b/deploy/helm/knowledge-explorer/values.yaml
index 7b5914b0..78577d88 100644
--- a/deploy/helm/knowledge-explorer/values.yaml
+++ b/deploy/helm/knowledge-explorer/values.yaml
@@ -13,6 +13,9 @@ fullnameOverride: ""
 podAnnotations:
   # AppArmor — must match the container name defined in the Deployment template ("explorer").
   container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
+  # Legacy seccomp annotation — required by older Terrascan/checkov versions
+  # that predate the seccompProfile field in PodSecurityContext.
+  seccomp.security.alpha.kubernetes.io/pod: runtime/default
 podLabels: {}
 
 podSecurityContext:
diff --git a/deploy/kubernetes/deployment.yaml b/deploy/kubernetes/deployment.yaml
index 4a6c9d3d..7343da95 100644
--- a/deploy/kubernetes/deployment.yaml
+++ b/deploy/kubernetes/deployment.yaml
@@ -20,6 +20,7 @@ spec:
     metadata:
       annotations:
         container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
+        seccomp.security.alpha.kubernetes.io/pod: runtime/default
       labels:
         app.kubernetes.io/name: knowledge-explorer
         app.kubernetes.io/part-of: semantica
@@ -30,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: explorer
-          image: semantica-knowledge-explorer:latest
+          image: semantica-knowledge-explorer:0.5.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http