fix(osint-dashboard): fix critical manifest issues found during audit

- Fix PostgreSQL topologySpreadConstraints label selector (cnpg.io/cluster)
- Fix Ingress HTTPRoutes: route API and WS traffic to correct backends
- Fix API NetworkPolicy port mismatch (4000 -> 8000)
- Fix MinIO bucket index syntax (_0 -> 0) in ConfigMap
- Add postgresql.port and postgresql.database to values.yaml
- Add container-level securityContext to API deployment
- Restrict monitoring NetworkPolicy ingress to monitoring namespace
- Enable readOnlyRootFilesystem for MinIO container
- Add activeDeadlineSeconds (3600s) to all 4 CronJobs

apps/base/osint-dashboard/templates/api/configmap.yaml

@@ -14,9 +14,9 @@ data:
   NATS_URLS: "nats://{{ include \"osint-dashboard.fullname\" . }}-nats.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.nats.ports.client }}"
   REDIS_URL: "redis://{{ include \"osint-dashboard.fullname\" . }}-redis.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.redis.ports.redis }}/0"
   MINIO_ENDPOINT: "{{ include \"osint-dashboard.fullname\" . }}-minio.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.minio.ports.api }}"
-  MINIO_BUCKET_VIDEO: "{{ .Values.minio.buckets._0.name | default \"osint-video-clips\" }}"
-  MINIO_BUCKET_SATELLITE: "{{ .Values.minio.buckets._1.name | default \"osint-satellite-tiles\" }}"
-  MINIO_BUCKET_DATA: "{{ .Values.minio.buckets._2.name | default \"osint-data-dumps\" }}"
+  MINIO_BUCKET_VIDEO: "{{ .Values.minio.buckets.0.name | default \"osint-video-clips\" }}"
+  MINIO_BUCKET_SATELLITE: "{{ .Values.minio.buckets.1.name | default \"osint-satellite-tiles\" }}"
+  MINIO_BUCKET_DATA: "{{ .Values.minio.buckets.2.name | default \"osint-data-dumps\" }}"
   PYTHONPATH: "/app/app"
   PYTHONUNBUFFERED: "1"
   PYTHONDONTWRITEBYTECODE: "1"

apps/base/osint-dashboard/templates/api/cronjobs.yaml

@@ -10,6 +10,7 @@ metadata:
 spec:
   schedule: "*/5 * * * *"
   concurrencyPolicy: Forbid
+  activeDeadlineSeconds: 3600
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
   jobTemplate:
@@ -62,6 +63,7 @@ metadata:
 spec:
   schedule: "*/15 * * * *"
   concurrencyPolicy: Forbid
+  activeDeadlineSeconds: 3600
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
   jobTemplate:
@@ -114,6 +116,7 @@ metadata:
 spec:
   schedule: "0 * * * *"
   concurrencyPolicy: Forbid
+  activeDeadlineSeconds: 3600
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
   jobTemplate:
@@ -166,6 +169,7 @@ metadata:
 spec:
   schedule: "*/2 * * * *"
   concurrencyPolicy: Forbid
+  activeDeadlineSeconds: 3600
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
   jobTemplate:

apps/base/osint-dashboard/templates/api/deployment.yaml

@@ -53,6 +53,11 @@ spec:
                 secretKeyRef:
                   name: {{ .Values.postgresql.credentialsSecret }}
                   key: password
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
           startupProbe:
             httpGet:
               path: /api/health

apps/base/osint-dashboard/templates/ingress/ingress.yaml

@@ -19,8 +19,19 @@ spec:
             type: PathPrefix
             value: {{ $rule.path }}
       backendRefs:
+        {{- if eq $host.host "dashboard.siriusdevops.com" }}
         - name: dashboard-web
           port: 3000
+        {{- else if eq $host.host "api.siriusdevops.com" }}
+        - name: {{ include "osint-dashboard.fullname" $ }}-api
+          port: 8000
+        {{- else if eq $host.host "ws.siriusdevops.com" }}
+        - name: {{ include "osint-dashboard.fullname" $ }}-api
+          port: 8000
+        {{- else }}
+        - name: dashboard-web
+          port: 3000
+        {{- end }}
           weight: 100
     {{- end }}
 ---

apps/base/osint-dashboard/templates/minio/statefulset.yaml

@@ -69,7 +69,7 @@ spec:
             periodSeconds: 10
           securityContext:
             allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
   volumeClaimTemplates:

apps/base/osint-dashboard/templates/postgresql/cluster.yaml

@@ -144,7 +144,7 @@ spec:
       whenUnsatisfiable: DoNotSchedule
       labelSelector:
         matchLabels:
-          postgresql operator: {{ .Values.postgresql.clusterName }}
+          postgresql.cnpg.io/cluster: {{ .Values.postgresql.clusterName }}
   nodesAutoRemediationChecks:
     livenessProbe:
       initialDelaySeconds: 10

apps/base/osint-dashboard/templates/security/dashboard-netpol.yaml

@@ -44,7 +44,7 @@ spec:
               app.kubernetes.io/component: api
       ports:
         - protocol: TCP
-          port: 4000
+          port: 8000
     # Allow to external APIs (GDelt, satellite providers)
     - to:
         - ipBlock:
@@ -78,7 +78,7 @@ spec:
               app.kubernetes.io/component: web
       ports:
         - protocol: TCP
-          port: 4000
+          port: 8000
     # Allow from ingress controller / Gateway API
     - from:
         - namespaceSelector:
@@ -86,7 +86,7 @@ spec:
               kubernetes.io/metadata.name: ingress-nginx
       ports:
         - protocol: TCP
-          port: 4000
+          port: 8000
   egress:
     # Allow DNS
     - to:

apps/base/osint-dashboard/templates/security/monitoring-netpol.yaml

@@ -16,8 +16,11 @@ spec:
     - Ingress
     - Egress
   ingress:
-    # Allow Grafana web access
-    - from: []
+    # Allow Grafana web access from monitoring namespace
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
       ports:
         - protocol: TCP
           port: {{ .Values.monitoring.grafana.port }}

apps/base/osint-dashboard/values.yaml

@@ -31,6 +31,8 @@ postgresql:
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   # Custom image with PostGIS + TimescaleDB
   # Use CNPG bootstrap to create extensions
+  port: 5432
+  database: osint
   storage:
     size: 200Gi
     storageClass: premium-rwo