mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
8b5f75160a
The 2 active checkov HIGH results (CKV_K8S_28 + CKV_K8S_30) were coming from deploy/gcp/cloudrun-service.yaml — checkov scans it as a Kubernetes resource (apiVersion: serving.knative.dev/v1) and flagged missing AppArmor and seccomp on that file, regardless of the fixes made to the k8s/ and helm/ manifests. deploy/gcp/cloudrun-service.yaml: - Add container name (explorer) so AppArmor annotation key matches - Add AppArmor annotation to pod template metadata (CKV_K8S_30) - Add legacy seccomp annotation (AC_K8S_0080 / CKV_K8S_28) - Add pod-level seccompProfile: RuntimeDefault (CKV_K8S_28) - Add container securityContext (runAsNonRoot, allowPrivilegeEscalation) Cloud Run Gen 2 supports all of these fields deploy/kubernetes/deployment.yaml: - Pin image tag from ':latest' to ':0.5.0' (AC_K8S_0068 / AC_K8S_0069) - Add legacy seccomp pod annotation alongside existing seccompProfile field deploy/helm/knowledge-explorer/values.yaml: - Add legacy seccomp annotation to podAnnotations so it renders into the Helm-generated pod template alongside the modern seccompProfile
95 lines
1.9 KiB
YAML
95 lines
1.9 KiB
YAML
replicaCount: 2
|
|
|
|
image:
|
|
repository: semantica-knowledge-explorer
|
|
pullPolicy: IfNotPresent
|
|
# Use a pinned tag (e.g. "0.5.0") or digest in production; empty string falls back to .Chart.AppVersion.
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
podAnnotations:
|
|
# AppArmor — must match the container name defined in the Deployment template ("explorer").
|
|
container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
|
|
# Legacy seccomp annotation — required by older Terrascan/checkov versions
|
|
# that predate the seccompProfile field in PodSecurityContext.
|
|
seccomp.security.alpha.kubernetes.io/pod: runtime/default
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
targetPort: 8000
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: knowledge-explorer.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: knowledge-explorer-tls
|
|
hosts:
|
|
- knowledge-explorer.example.com
|
|
|
|
env:
|
|
ALLOWED_ORIGINS: https://knowledge-explorer.example.com
|
|
FALKORDB_HOST: falkordb
|
|
FALKORDB_PORT: "6379"
|
|
|
|
secretEnv: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
livenessProbe:
|
|
path: /api/health
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
path: /api/health
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 2
|
|
maxReplicas: 10
|
|
targetCPUUtilizationPercentage: 80
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|