From 54f2f42710cc51945f5622d9f3c477edc9a8d34f Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Sat, 23 May 2026 04:38:51 +0000 Subject: [PATCH] fix(osint-dashboard): fix critical manifest issues found during audit - Fix PostgreSQL topologySpreadConstraints label selector (cnpg.io/cluster) - Fix Ingress HTTPRoutes: route API and WS traffic to correct backends - Fix API NetworkPolicy port mismatch (4000 -> 8000) - Fix MinIO bucket index syntax (_0 -> 0) in ConfigMap - Add postgresql.port and postgresql.database to values.yaml - Add container-level securityContext to API deployment - Restrict monitoring NetworkPolicy ingress to monitoring namespace - Enable readOnlyRootFilesystem for MinIO container - Add activeDeadlineSeconds (3600s) to all 4 CronJobs --- .../base/osint-dashboard/templates/api/configmap.yaml | 6 +++--- apps/base/osint-dashboard/templates/api/cronjobs.yaml | 4 ++++ .../osint-dashboard/templates/api/deployment.yaml | 5 +++++ .../osint-dashboard/templates/ingress/ingress.yaml | 11 +++++++++++ .../osint-dashboard/templates/minio/statefulset.yaml | 2 +- .../osint-dashboard/templates/postgresql/cluster.yaml | 2 +- .../templates/security/dashboard-netpol.yaml | 6 +++--- .../templates/security/monitoring-netpol.yaml | 7 +++++-- apps/base/osint-dashboard/values.yaml | 2 ++ 9 files changed, 35 insertions(+), 10 deletions(-) diff --git a/apps/base/osint-dashboard/templates/api/configmap.yaml b/apps/base/osint-dashboard/templates/api/configmap.yaml index e2566b7..21190fd 100644 --- a/apps/base/osint-dashboard/templates/api/configmap.yaml +++ b/apps/base/osint-dashboard/templates/api/configmap.yaml @@ -14,9 +14,9 @@ data: NATS_URLS: "nats://{{ include \"osint-dashboard.fullname\" . }}-nats.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.nats.ports.client }}" REDIS_URL: "redis://{{ include \"osint-dashboard.fullname\" . }}-redis.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.redis.ports.redis }}/0" MINIO_ENDPOINT: "{{ include \"osint-dashboard.fullname\" . }}-minio.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.minio.ports.api }}" - MINIO_BUCKET_VIDEO: "{{ .Values.minio.buckets._0.name | default \"osint-video-clips\" }}" - MINIO_BUCKET_SATELLITE: "{{ .Values.minio.buckets._1.name | default \"osint-satellite-tiles\" }}" - MINIO_BUCKET_DATA: "{{ .Values.minio.buckets._2.name | default \"osint-data-dumps\" }}" + MINIO_BUCKET_VIDEO: "{{ .Values.minio.buckets.0.name | default \"osint-video-clips\" }}" + MINIO_BUCKET_SATELLITE: "{{ .Values.minio.buckets.1.name | default \"osint-satellite-tiles\" }}" + MINIO_BUCKET_DATA: "{{ .Values.minio.buckets.2.name | default \"osint-data-dumps\" }}" PYTHONPATH: "/app/app" PYTHONUNBUFFERED: "1" PYTHONDONTWRITEBYTECODE: "1" diff --git a/apps/base/osint-dashboard/templates/api/cronjobs.yaml b/apps/base/osint-dashboard/templates/api/cronjobs.yaml index 3606e00..71c9057 100644 --- a/apps/base/osint-dashboard/templates/api/cronjobs.yaml +++ b/apps/base/osint-dashboard/templates/api/cronjobs.yaml @@ -10,6 +10,7 @@ metadata: spec: schedule: "*/5 * * * *" concurrencyPolicy: Forbid + activeDeadlineSeconds: 3600 successfulJobsHistoryLimit: 3 failedJobsHistoryLimit: 3 jobTemplate: @@ -62,6 +63,7 @@ metadata: spec: schedule: "*/15 * * * *" concurrencyPolicy: Forbid + activeDeadlineSeconds: 3600 successfulJobsHistoryLimit: 3 failedJobsHistoryLimit: 3 jobTemplate: @@ -114,6 +116,7 @@ metadata: spec: schedule: "0 * * * *" concurrencyPolicy: Forbid + activeDeadlineSeconds: 3600 successfulJobsHistoryLimit: 3 failedJobsHistoryLimit: 3 jobTemplate: @@ -166,6 +169,7 @@ metadata: spec: schedule: "*/2 * * * *" concurrencyPolicy: Forbid + activeDeadlineSeconds: 3600 successfulJobsHistoryLimit: 3 failedJobsHistoryLimit: 3 jobTemplate: diff --git a/apps/base/osint-dashboard/templates/api/deployment.yaml b/apps/base/osint-dashboard/templates/api/deployment.yaml index 54ba832..0c885e7 100644 --- a/apps/base/osint-dashboard/templates/api/deployment.yaml +++ b/apps/base/osint-dashboard/templates/api/deployment.yaml @@ -53,6 +53,11 @@ spec: secretKeyRef: name: {{ .Values.postgresql.credentialsSecret }} key: password + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] startupProbe: httpGet: path: /api/health diff --git a/apps/base/osint-dashboard/templates/ingress/ingress.yaml b/apps/base/osint-dashboard/templates/ingress/ingress.yaml index 1893432..197b738 100644 --- a/apps/base/osint-dashboard/templates/ingress/ingress.yaml +++ b/apps/base/osint-dashboard/templates/ingress/ingress.yaml @@ -19,8 +19,19 @@ spec: type: PathPrefix value: {{ $rule.path }} backendRefs: + {{- if eq $host.host "dashboard.siriusdevops.com" }} - name: dashboard-web port: 3000 + {{- else if eq $host.host "api.siriusdevops.com" }} + - name: {{ include "osint-dashboard.fullname" $ }}-api + port: 8000 + {{- else if eq $host.host "ws.siriusdevops.com" }} + - name: {{ include "osint-dashboard.fullname" $ }}-api + port: 8000 + {{- else }} + - name: dashboard-web + port: 3000 + {{- end }} weight: 100 {{- end }} --- diff --git a/apps/base/osint-dashboard/templates/minio/statefulset.yaml b/apps/base/osint-dashboard/templates/minio/statefulset.yaml index 17b7bed..0fe7286 100644 --- a/apps/base/osint-dashboard/templates/minio/statefulset.yaml +++ b/apps/base/osint-dashboard/templates/minio/statefulset.yaml @@ -69,7 +69,7 @@ spec: periodSeconds: 10 securityContext: allowPrivilegeEscalation: false - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true capabilities: drop: ["ALL"] volumeClaimTemplates: diff --git a/apps/base/osint-dashboard/templates/postgresql/cluster.yaml b/apps/base/osint-dashboard/templates/postgresql/cluster.yaml index 40a629b..0258c1d 100644 --- a/apps/base/osint-dashboard/templates/postgresql/cluster.yaml +++ b/apps/base/osint-dashboard/templates/postgresql/cluster.yaml @@ -144,7 +144,7 @@ spec: whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: - postgresql operator: {{ .Values.postgresql.clusterName }} + postgresql.cnpg.io/cluster: {{ .Values.postgresql.clusterName }} nodesAutoRemediationChecks: livenessProbe: initialDelaySeconds: 10 diff --git a/apps/base/osint-dashboard/templates/security/dashboard-netpol.yaml b/apps/base/osint-dashboard/templates/security/dashboard-netpol.yaml index d756763..6b841e2 100644 --- a/apps/base/osint-dashboard/templates/security/dashboard-netpol.yaml +++ b/apps/base/osint-dashboard/templates/security/dashboard-netpol.yaml @@ -44,7 +44,7 @@ spec: app.kubernetes.io/component: api ports: - protocol: TCP - port: 4000 + port: 8000 # Allow to external APIs (GDelt, satellite providers) - to: - ipBlock: @@ -78,7 +78,7 @@ spec: app.kubernetes.io/component: web ports: - protocol: TCP - port: 4000 + port: 8000 # Allow from ingress controller / Gateway API - from: - namespaceSelector: @@ -86,7 +86,7 @@ spec: kubernetes.io/metadata.name: ingress-nginx ports: - protocol: TCP - port: 4000 + port: 8000 egress: # Allow DNS - to: diff --git a/apps/base/osint-dashboard/templates/security/monitoring-netpol.yaml b/apps/base/osint-dashboard/templates/security/monitoring-netpol.yaml index fa24dd3..958b836 100644 --- a/apps/base/osint-dashboard/templates/security/monitoring-netpol.yaml +++ b/apps/base/osint-dashboard/templates/security/monitoring-netpol.yaml @@ -16,8 +16,11 @@ spec: - Ingress - Egress ingress: - # Allow Grafana web access - - from: [] + # Allow Grafana web access from monitoring namespace + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring ports: - protocol: TCP port: {{ .Values.monitoring.grafana.port }} diff --git a/apps/base/osint-dashboard/values.yaml b/apps/base/osint-dashboard/values.yaml index 3db7dfa..3c997a9 100644 --- a/apps/base/osint-dashboard/values.yaml +++ b/apps/base/osint-dashboard/values.yaml @@ -31,6 +31,8 @@ postgresql: imageName: ghcr.io/cloudnative-pg/postgresql:16 # Custom image with PostGIS + TimescaleDB # Use CNPG bootstrap to create extensions + port: 5432 + database: osint storage: size: 200Gi storageClass: premium-rwo