mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
8b5f75160a
The 2 active checkov HIGH results (CKV_K8S_28 + CKV_K8S_30) were coming from deploy/gcp/cloudrun-service.yaml — checkov scans it as a Kubernetes resource (apiVersion: serving.knative.dev/v1) and flagged missing AppArmor and seccomp on that file, regardless of the fixes made to the k8s/ and helm/ manifests. deploy/gcp/cloudrun-service.yaml: - Add container name (explorer) so AppArmor annotation key matches - Add AppArmor annotation to pod template metadata (CKV_K8S_30) - Add legacy seccomp annotation (AC_K8S_0080 / CKV_K8S_28) - Add pod-level seccompProfile: RuntimeDefault (CKV_K8S_28) - Add container securityContext (runAsNonRoot, allowPrivilegeEscalation) Cloud Run Gen 2 supports all of these fields deploy/kubernetes/deployment.yaml: - Pin image tag from ':latest' to ':0.5.0' (AC_K8S_0068 / AC_K8S_0069) - Add legacy seccomp pod annotation alongside existing seccompProfile field deploy/helm/knowledge-explorer/values.yaml: - Add legacy seccomp annotation to podAnnotations so it renders into the Helm-generated pod template alongside the modern seccompProfile
Knowledge Explorer Helm Chart
helm lint deploy/helm/knowledge-explorer
helm upgrade --install knowledge-explorer deploy/helm/knowledge-explorer --namespace semantica --create-namespace
helm upgrade --install knowledge-explorer deploy/helm/knowledge-explorer --namespace semantica --create-namespace -f deploy/helm/knowledge-explorer/values.prod.yaml
Set autoscaling.enabled=true to render the HPA. Put sensitive values in Kubernetes Secrets and reference them outside this chart, or pass non-secret env values through env.