From ac994f144af757bc95fa4b55cb6b988029c7b523 Mon Sep 17 00:00:00 2001
From: Sirius Devops <sirius@siriusdevops.com>
Date: Fri, 15 May 2026 00:00:58 +0000
Subject: [PATCH] fix: container hardening + NetworkPolicy for waitlist-api

- deployment.yaml: securityContext (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps)
- network-policy.yaml: egress only to CNPG PG (5432) + api.telegram.org (443)
- kustomization.yaml: register new NetworkPolicy resource
- waitlist-telegram-secret: add admin_api_key field
---
 .../customer1/waitlist-api/deployment.yaml    | 26 +++++++++++
 .../customer1/waitlist-api/kustomization.yaml |  1 +
 .../waitlist-api/network-policy.yaml          | 44 +++++++++++++++++++
 .../waitlist-telegram-secret.yaml             |  1 +
 4 files changed, 72 insertions(+)
 create mode 100644 apps/base/customer1/waitlist-api/network-policy.yaml

diff --git a/apps/base/customer1/waitlist-api/deployment.yaml b/apps/base/customer1/waitlist-api/deployment.yaml
index a1c9c9f..9beed23 100644
--- a/apps/base/customer1/waitlist-api/deployment.yaml
+++ b/apps/base/customer1/waitlist-api/deployment.yaml
@@ -13,6 +13,12 @@ spec:
       labels:
         app: waitlist-api
     spec:
+      serviceAccountName: waitlist-api
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
       containers:
       - name: api
         image: ghcr.io/sirius0xdev/waitlist-api:latest
@@ -20,6 +26,12 @@ spec:
         ports:
         - containerPort: 8080
           protocol: TCP
+        securityContext:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         env:
         - name: DB_HOST
           value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local"
@@ -47,6 +59,11 @@ spec:
             secretKeyRef:
               name: waitlist-telegram-secret
               key: chat_id
+        - name: ADMIN_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: waitlist-telegram-secret
+              key: admin_api_key
         resources:
           requests:
             cpu: 50m
@@ -55,6 +72,11 @@ spec:
             cpu: 200m
             memory: 256Mi
 
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+          readOnly: false
+
         startupProbe:
           httpGet:
             path: /healthz
@@ -88,6 +110,10 @@ spec:
           failureThreshold: 3
           successThreshold: 1
 
+      volumes:
+      - name: tmp
+        emptyDir: {}
+
 ---
 apiVersion: v1
 kind: Service
diff --git a/apps/base/customer1/waitlist-api/kustomization.yaml b/apps/base/customer1/waitlist-api/kustomization.yaml
index a221887..7dfda4c 100644
--- a/apps/base/customer1/waitlist-api/kustomization.yaml
+++ b/apps/base/customer1/waitlist-api/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - waitlist-telegram-secret.yaml
   - http-route.yaml
+  - network-policy.yaml
diff --git a/apps/base/customer1/waitlist-api/network-policy.yaml b/apps/base/customer1/waitlist-api/network-policy.yaml
new file mode 100644
index 0000000..8f2c9ea
--- /dev/null
+++ b/apps/base/customer1/waitlist-api/network-policy.yaml
@@ -0,0 +1,44 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: waitlist-api-egress
+  namespace: customer1
+spec:
+  podSelector:
+    matchLabels:
+      app: waitlist-api
+  policyTypes:
+    - Egress
+  egress:
+    # Allow DNS resolution (required for api.telegram.org lookups)
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+        - podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Allow PostgreSQL to CNPG cluster
+    - to:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: siriusdevops-pgdb
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow Telegram Bot API
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
diff --git a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml
index 961e65b..7d63e27 100644
--- a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml
+++ b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml
@@ -7,6 +7,7 @@ type: Opaque
 stringData:
     bot_token: CHANGEME
     chat_id: CHANGEME
+    admin_api_key: CHANGEME
 sops:
     age:
         - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7