mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-12 04:01:35 +00:00
KaifAhmad1
095e8c8714
checkov HIGH (2 breaking results, CKV_K8S_30): - Add AppArmor annotation to k8s deployment pod template (container.apparmor.security.beta.kubernetes.io/explorer: runtime/default) - Add AppArmor annotation via Helm values.yaml podAnnotations so it renders into the Helm-generated pod template Terrascan warnings (AC_K8S_0087 / AC_K8S_0080 / AC_K8S_0073): - Add runAsNonRoot: true and seccompProfile: RuntimeDefault at container securityContext level in both k8s deployment and Helm values (these were only at pod spec level before) Terrascan AC_K8S_0002 (noHttps): - Add nginx ssl-redirect annotation to k8s ingress so HTTPS enforcement is explicit at the ingress controller layer Terrascan AC_K8S_0013 (noOwnerLabel): - Add owner label to k8s namespace.yaml Terrascan AC_K8S_0068 (imageWithLatestTag): - Change Helm values.yaml image.tag from 'latest' to '' (falls back to .Chart.AppVersion at render time) - Pin values.prod.yaml to explicit release tag 0.5.0
92 lines
1.7 KiB
YAML
92 lines
1.7 KiB
YAML
replicaCount: 2
|
|
|
|
image:
|
|
repository: semantica-knowledge-explorer
|
|
pullPolicy: IfNotPresent
|
|
# Use a pinned tag (e.g. "0.5.0") or digest in production; empty string falls back to .Chart.AppVersion.
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
podAnnotations:
|
|
# AppArmor — must match the container name defined in the Deployment template ("explorer").
|
|
container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
targetPort: 8000
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: knowledge-explorer.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: knowledge-explorer-tls
|
|
hosts:
|
|
- knowledge-explorer.example.com
|
|
|
|
env:
|
|
ALLOWED_ORIGINS: https://knowledge-explorer.example.com
|
|
FALKORDB_HOST: falkordb
|
|
FALKORDB_PORT: "6379"
|
|
|
|
secretEnv: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
livenessProbe:
|
|
path: /api/health
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
path: /api/health
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 2
|
|
maxReplicas: 10
|
|
targetCPUUtilizationPercentage: 80
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|