mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
095e8c8714
checkov HIGH (2 breaking results, CKV_K8S_30): - Add AppArmor annotation to k8s deployment pod template (container.apparmor.security.beta.kubernetes.io/explorer: runtime/default) - Add AppArmor annotation via Helm values.yaml podAnnotations so it renders into the Helm-generated pod template Terrascan warnings (AC_K8S_0087 / AC_K8S_0080 / AC_K8S_0073): - Add runAsNonRoot: true and seccompProfile: RuntimeDefault at container securityContext level in both k8s deployment and Helm values (these were only at pod spec level before) Terrascan AC_K8S_0002 (noHttps): - Add nginx ssl-redirect annotation to k8s ingress so HTTPS enforcement is explicit at the ingress controller layer Terrascan AC_K8S_0013 (noOwnerLabel): - Add owner label to k8s namespace.yaml Terrascan AC_K8S_0068 (imageWithLatestTag): - Change Helm values.yaml image.tag from 'latest' to '' (falls back to .Chart.AppVersion at render time) - Pin values.prod.yaml to explicit release tag 0.5.0
26 lines
639 B
YAML
26 lines
639 B
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: knowledge-explorer
|
|
namespace: semantica
|
|
annotations:
|
|
kubernetes.io/ingress.class: nginx
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- knowledge-explorer.example.com
|
|
secretName: knowledge-explorer-tls
|
|
rules:
|
|
- host: knowledge-explorer.example.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: knowledge-explorer
|
|
port:
|
|
name: http
|