mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
b9e069301f
- gcp/cloudrun-service.yaml: add comment + README sed one-liner so PROJECT_ID
is substituted before gcloud run services replace (was a literal placeholder
that caused image-pull failure on the declarative deploy path)
- azure/main.parameters.json: replace wildcard allowedOrigins "*" with a
REPLACE_ME placeholder; add README note to set the real URL after first deploy
- kubernetes/networkpolicy.yaml + helm networkpolicy template: add from: selector
(ingress-nginx namespace + same-namespace pods) so ingress is no longer
allow-all; restrict egress to FalkorDB port 6379 and DNS port 53 instead of
the allow-all egress: - {} wildcard
- helm/values.yaml: expose networkPolicy.ingressNamespace and falkordbPort values
- kubernetes/deployment.yaml: add secretRef for knowledge-explorer-secrets so
FALKORDB_PASSWORD is actually injected into the container
- app.py: add _mutation_bridge_installed guard to prevent closure stacking when
the same GraphSession is passed to create_app() more than once; remove
duplicate app.state.allowed_origins assignment (single source of truth is
app.state.explorer_settings); add comment on falkordb_host/port dead config
- tests: update allowed_origins assertions to use explorer_settings dict
- .checkov.yaml: remove global CKV_K8S_21/28/30 suppressions; rely on per-file
inline checkov:skip comments in cloudrun-service.yaml so future real K8s
manifests are not silently exempted
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
# checkov:skip=CKV_K8S_21:Cloud Run has no namespace concept; Knative services are project-scoped not namespace-scoped
|
|
# checkov:skip=CKV_K8S_28:Cloud Run enforces seccomp at the platform level; this Knative YAML is not a K8s deployment
|
|
# checkov:skip=CKV_K8S_30:Cloud Run enforces AppArmor at the platform level; this Knative YAML is not a K8s deployment
|
|
apiVersion: serving.knative.dev/v1
|
|
kind: Service
|
|
metadata:
|
|
name: knowledge-explorer
|
|
annotations:
|
|
# Use 'internal-and-cloud-load-balancing' or 'internal' in production.
|
|
# 'all' permits direct unauthenticated public internet access.
|
|
run.googleapis.com/ingress: internal-and-cloud-load-balancing
|
|
spec:
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
autoscaling.knative.dev/minScale: "0"
|
|
autoscaling.knative.dev/maxScale: "10"
|
|
spec:
|
|
containerConcurrency: 80
|
|
timeoutSeconds: 300
|
|
containers:
|
|
- name: explorer
|
|
# Replace PROJECT_ID with your GCP project ID before deploying.
|
|
# See the README for the sed one-liner that does this automatically.
|
|
image: gcr.io/PROJECT_ID/knowledge-explorer:latest
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
ports:
|
|
- name: http1
|
|
containerPort: 8000
|
|
env:
|
|
- name: ALLOWED_ORIGINS
|
|
# Replace with your actual service URL — do not use '*' in production.
|
|
value: "https://knowledge-explorer-REPLACE_ME.a.run.app"
|
|
- name: FALKORDB_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: falkordb-host
|
|
key: latest
|
|
- name: FALKORDB_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: falkordb-port
|
|
key: latest
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 8000
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|