fix(deploy): address security and correctness blockers from PR review

- gcp/cloudrun-service.yaml: add comment + README sed one-liner so PROJECT_ID
  is substituted before gcloud run services replace (was a literal placeholder
  that caused image-pull failure on the declarative deploy path)
- azure/main.parameters.json: replace wildcard allowedOrigins "*" with a
  REPLACE_ME placeholder; add README note to set the real URL after first deploy
- kubernetes/networkpolicy.yaml + helm networkpolicy template: add from: selector
  (ingress-nginx namespace + same-namespace pods) so ingress is no longer
  allow-all; restrict egress to FalkorDB port 6379 and DNS port 53 instead of
  the allow-all egress: - {} wildcard
- helm/values.yaml: expose networkPolicy.ingressNamespace and falkordbPort values
- kubernetes/deployment.yaml: add secretRef for knowledge-explorer-secrets so
  FALKORDB_PASSWORD is actually injected into the container
- app.py: add _mutation_bridge_installed guard to prevent closure stacking when
  the same GraphSession is passed to create_app() more than once; remove
  duplicate app.state.allowed_origins assignment (single source of truth is
  app.state.explorer_settings); add comment on falkordb_host/port dead config
- tests: update allowed_origins assertions to use explorer_settings dict
- .checkov.yaml: remove global CKV_K8S_21/28/30 suppressions; rely on per-file
  inline checkov:skip comments in cloudrun-service.yaml so future real K8s
  manifests are not silently exempted

deploy/azure/README.md

@@ -18,6 +18,8 @@ azd env set AZURE_INFRASTRUCTURE_SUBNET_ID /subscriptions/<sub>/resourceGroups/<
 azd up
 ```
 
+After the first deploy, set `allowedOrigins` in `main.parameters.json` to the Container App URL printed by `azd up` (e.g. `https://<app-name>.<unique>.eastus.azurecontainerapps.io`), then re-run `azd up` to apply the CORS restriction.
+
 The Bicep template provisions:
 
 - A Container Apps managed environment with an internal load balancer (private VNet, no public IP) and a system-assigned managed identity on the Container App (AZR-000363 / AZR-000361 compliant).

deploy/azure/main.parameters.json

@@ -12,7 +12,7 @@
       "value": "${SERVICE_EXPLORER_IMAGE_NAME}"
     },
     "allowedOrigins": {
-      "value": "*"
+      "value": "https://REPLACE_ME.azurecontainerapps.io"
     },
     "falkordbHost": {
       "value": "falkordb"

deploy/gcp/README.md

@@ -11,8 +11,9 @@ gcloud builds submit --config deploy/gcp/cloudbuild.yaml \
   --substitutions _REGION=us-central1,_SERVICE_NAME=knowledge-explorer,_ALLOWED_ORIGINS=https://knowledge-explorer-REPLACE_ME.a.run.app
 ```
 
-For declarative deploys, replace `PROJECT_ID` in `cloudrun-service.yaml`, then run:
+For declarative deploys, substitute your project ID and deploy in one step:
 
 ```bash
-gcloud run services replace deploy/gcp/cloudrun-service.yaml --region us-central1
+sed "s/PROJECT_ID/$(gcloud config get-value project)/g" deploy/gcp/cloudrun-service.yaml | \
+  gcloud run services replace - --region us-central1
 ```

deploy/gcp/cloudrun-service.yaml

@@ -20,6 +20,8 @@ spec:
       timeoutSeconds: 300
       containers:
         - name: explorer
+          # Replace PROJECT_ID with your GCP project ID before deploying.
+          # See the README for the sed one-liner that does this automatically.
           image: gcr.io/PROJECT_ID/knowledge-explorer:latest
           securityContext:
             allowPrivilegeEscalation: false

deploy/helm/knowledge-explorer/templates/networkpolicy.yaml

@@ -13,9 +13,30 @@ spec:
     - Ingress
     - Egress
   ingress:
-    - ports:
+    # Allow traffic from the ingress controller namespace.
+    # Override networkPolicy.ingressNamespace in values if your controller uses a different namespace.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.networkPolicy.ingressNamespace }}
+      ports:
+        - protocol: TCP
+          port: {{ .Values.service.targetPort }}
+    # Allow traffic from pods within the same namespace (e.g. monitoring sidecars).
+    - from:
+        - podSelector: {}
+      ports:
         - protocol: TCP
           port: {{ .Values.service.targetPort }}
   egress:
-    - {}
+    # FalkorDB
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.networkPolicy.falkordbPort | default 6379 }}
+    # DNS resolution
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
 {{- end }}

deploy/helm/knowledge-explorer/values.yaml

@@ -96,3 +96,8 @@ affinity: {}
 
 networkPolicy:
   enabled: true
+  # Namespace label of your ingress controller. Ingress is only admitted from this namespace
+  # and from pods within the same namespace as the Explorer.
+  ingressNamespace: ingress-nginx
+  # FalkorDB port allowed for egress. Must match FALKORDB_PORT.
+  falkordbPort: 6379

deploy/kubernetes/deployment.yaml

@@ -40,6 +40,9 @@ spec:
           envFrom:
             - configMapRef:
                 name: knowledge-explorer-config
+            - secretRef:
+                name: knowledge-explorer-secrets
+                optional: true
           livenessProbe:
             httpGet:
               path: /api/health

deploy/kubernetes/networkpolicy.yaml

@@ -14,8 +14,29 @@ spec:
     - Ingress
     - Egress
   ingress:
-    - ports:
+    # Allow traffic from the ingress controller namespace.
+    # Adjust the namespace label if your ingress controller uses a different namespace.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 8000
+    # Allow traffic from pods within the same namespace (e.g. monitoring sidecars).
+    - from:
+        - podSelector: {}
+      ports:
         - protocol: TCP
           port: 8000
   egress:
-    - {}
+    # FalkorDB
+    - ports:
+        - protocol: TCP
+          port: 6379
+    # DNS resolution
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53