mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00

Files

T

KaifAhmad1 8b5f75160a fix(ci): fix 2 remaining checkov HIGH findings and Terrascan seccomp warnings

The 2 active checkov HIGH results (CKV_K8S_28 + CKV_K8S_30) were coming
from deploy/gcp/cloudrun-service.yaml — checkov scans it as a Kubernetes
resource (apiVersion: serving.knative.dev/v1) and flagged missing AppArmor
and seccomp on that file, regardless of the fixes made to the k8s/ and
helm/ manifests.

deploy/gcp/cloudrun-service.yaml:
- Add container name (explorer) so AppArmor annotation key matches
- Add AppArmor annotation to pod template metadata (CKV_K8S_30)
- Add legacy seccomp annotation (AC_K8S_0080 / CKV_K8S_28)
- Add pod-level seccompProfile: RuntimeDefault (CKV_K8S_28)
- Add container securityContext (runAsNonRoot, allowPrivilegeEscalation)
  Cloud Run Gen 2 supports all of these fields

deploy/kubernetes/deployment.yaml:
- Pin image tag from ':latest' to ':0.5.0' (AC_K8S_0068 / AC_K8S_0069)
- Add legacy seccomp pod annotation alongside existing seccompProfile field

deploy/helm/knowledge-explorer/values.yaml:
- Add legacy seccomp annotation to podAnnotations so it renders into
  the Helm-generated pod template alongside the modern seccompProfile

2026-06-24 13:15:41 +05:30

cloudbuild.yaml

fix(deploy): harden security in deployment templates and explorer app

2026-06-24 12:51:09 +05:30

cloudrun-service.yaml

fix(ci): fix 2 remaining checkov HIGH findings and Terrascan seccomp warnings

2026-06-24 13:15:41 +05:30

README.md

fix(deploy): harden security in deployment templates and explorer app

2026-06-24 12:51:09 +05:30

README.md

GCP Cloud Run

Create the Secret Manager entries, then submit the Cloud Build pipeline:

gcloud services enable cloudbuild.googleapis.com run.googleapis.com secretmanager.googleapis.com
printf "falkordb-host.example.internal" | gcloud secrets create falkordb-host --data-file=-
printf "6379" | gcloud secrets create falkordb-port --data-file=-
# Set _ALLOWED_ORIGINS to your actual service URL after the first deploy.
gcloud builds submit --config deploy/gcp/cloudbuild.yaml \
  --substitutions _REGION=us-central1,_SERVICE_NAME=knowledge-explorer,_ALLOWED_ORIGINS=https://knowledge-explorer-REPLACE_ME.a.run.app

For declarative deploys, replace PROJECT_ID in cloudrun-service.yaml, then run:

gcloud run services replace deploy/gcp/cloudrun-service.yaml --region us-central1