semantica/deploy/kubernetes/namespace.yaml at c4e971c91cac8d9f65b1c86531a8f5ce79ceabb1 - semantica - Gitea: Git with a cup of tea

mengzhx/semantica

mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00

Files

T

KaifAhmad1 095e8c8714 fix(ci): resolve MSDO/checkov and Terrascan failures on K8s and Helm manifests

checkov HIGH (2 breaking results, CKV_K8S_30):
- Add AppArmor annotation to k8s deployment pod template
  (container.apparmor.security.beta.kubernetes.io/explorer: runtime/default)
- Add AppArmor annotation via Helm values.yaml podAnnotations so it
  renders into the Helm-generated pod template

Terrascan warnings (AC_K8S_0087 / AC_K8S_0080 / AC_K8S_0073):
- Add runAsNonRoot: true and seccompProfile: RuntimeDefault at container
  securityContext level in both k8s deployment and Helm values (these
  were only at pod spec level before)

Terrascan AC_K8S_0002 (noHttps):
- Add nginx ssl-redirect annotation to k8s ingress so HTTPS enforcement
  is explicit at the ingress controller layer

Terrascan AC_K8S_0013 (noOwnerLabel):
- Add owner label to k8s namespace.yaml

Terrascan AC_K8S_0068 (imageWithLatestTag):
- Change Helm values.yaml image.tag from 'latest' to '' (falls back to
  .Chart.AppVersion at render time)
- Pin values.prod.yaml to explicit release tag 0.5.0

2026-06-24 13:01:54 +05:30

7 lines

90 B

YAML

Raw Blame History

 apiVersion: v1
 kind: Namespace
 metadata:
   name: semantica
   labels:
     owner: semantica