mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
b9e069301f
- gcp/cloudrun-service.yaml: add comment + README sed one-liner so PROJECT_ID
is substituted before gcloud run services replace (was a literal placeholder
that caused image-pull failure on the declarative deploy path)
- azure/main.parameters.json: replace wildcard allowedOrigins "*" with a
REPLACE_ME placeholder; add README note to set the real URL after first deploy
- kubernetes/networkpolicy.yaml + helm networkpolicy template: add from: selector
(ingress-nginx namespace + same-namespace pods) so ingress is no longer
allow-all; restrict egress to FalkorDB port 6379 and DNS port 53 instead of
the allow-all egress: - {} wildcard
- helm/values.yaml: expose networkPolicy.ingressNamespace and falkordbPort values
- kubernetes/deployment.yaml: add secretRef for knowledge-explorer-secrets so
FALKORDB_PASSWORD is actually injected into the container
- app.py: add _mutation_bridge_installed guard to prevent closure stacking when
the same GraphSession is passed to create_app() more than once; remove
duplicate app.state.allowed_origins assignment (single source of truth is
app.state.explorer_settings); add comment on falkordb_host/port dead config
- tests: update allowed_origins assertions to use explorer_settings dict
- .checkov.yaml: remove global CKV_K8S_21/28/30 suppressions; rely on per-file
inline checkov:skip comments in cloudrun-service.yaml so future real K8s
manifests are not silently exempted
104 lines
2.2 KiB
YAML
104 lines
2.2 KiB
YAML
replicaCount: 2
|
|
|
|
image:
|
|
repository: semantica-knowledge-explorer
|
|
pullPolicy: Always
|
|
# Replace this placeholder digest with the digest of the image you publish.
|
|
digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
|
# Used only when image.digest is empty.
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
automountServiceAccountToken: false
|
|
|
|
podAnnotations:
|
|
# AppArmor — must match the container name defined in the Deployment template ("explorer").
|
|
container.apparmor.security.beta.kubernetes.io/explorer: runtime/default
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
targetPort: 8000
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: knowledge-explorer.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: knowledge-explorer-tls
|
|
hosts:
|
|
- knowledge-explorer.example.com
|
|
|
|
env:
|
|
ALLOWED_ORIGINS: https://knowledge-explorer.example.com
|
|
FALKORDB_HOST: falkordb
|
|
FALKORDB_PORT: "6379"
|
|
|
|
secretEnv: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
livenessProbe:
|
|
path: /api/health
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
path: /api/health
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 2
|
|
maxReplicas: 10
|
|
targetCPUUtilizationPercentage: 80
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
|
|
networkPolicy:
|
|
enabled: true
|
|
# Namespace label of your ingress controller. Ingress is only admitted from this namespace
|
|
# and from pods within the same namespace as the Explorer.
|
|
ingressNamespace: ingress-nginx
|
|
# FalkorDB port allowed for egress. Must match FALKORDB_PORT.
|
|
falkordbPort: 6379
|