Skip to content

added k8s manifests #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SWARNENDUKAR138 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

added k8s manifests #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
267 changes: 0 additions & 267 deletions k8s/README.md
View file
Open in desktop

This file was deleted.

40 changes: 0 additions & 40 deletions k8s/backend-deployment.yaml
View file
Open in desktop

This file was deleted.

35 changes: 35 additions & 0 deletions k8s/backend-deployment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: backend-deployment
namespace: chat-app

spec:
replicas: 1
selector:
matchLabels:
app: backend
template:
metadata:
name: backend-pod
namespace: chat-app
labels:
Comment on lines +15 to +16
Copy link

@coderabbitai coderabbitai bot Jul 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Remove namespace from the Pod template — it is invalid in spec.template.metadata.

spec.template.metadata must not contain a namespace field. Its presence prevents the Deployment from being created.

-      namespace: chat-app
🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 16-16: trailing spaces

(trailing-spaces)

🤖 Prompt for AI Agents 
In k8s/backend-deployment.yml at lines 15 to 16, remove the `namespace` field
from the `spec.template.metadata` section because it is invalid there and
prevents the Deployment from being created. The namespace should be specified at
the Deployment level metadata, not inside the Pod template metadata.

app: backend
spec:
containers:
- name: chatapp-backend
image: swarnendukar123/chatapp-backend:latest
ports:
- containerPort: 5001
Comment on lines +19 to +23
Copy link

@coderabbitai coderabbitai bot Jul 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add securityContext to drop root and disable privilege escalation.

Addresses CKV_K8S_20 and CKV_K8S_23.

       containers:
       - name: chatapp-backend
         image: swarnendukar123/chatapp-backend:latest
+        securityContext:
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
🧰 Tools
🪛 YAMLlint (1.37.1)

[warning] 21-21: too many spaces after colon

(colons)

🤖 Prompt for AI Agents 
In k8s/backend-deployment.yml around lines 19 to 23, add a securityContext
section under the container definition for chatapp-backend to drop root
privileges and disable privilege escalation. Specifically, set runAsNonRoot to
true, runAsUser to a non-root user ID (e.g., 1000), and set
allowPrivilegeEscalation to false. This will enhance container security by
preventing it from running as root and stopping privilege escalation.

env:
- name: NODE_ENV
value: production
- name: MONGODB_URI
value: mongodb://mongoadmin:secret@mongodb:27017/dbname?authSource=admin
- name: JWT_SECRET
Comment on lines +27 to +29
Copy link

@coderabbitai coderabbitai bot Jul 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Move DB credentials out of the manifest.

Hard-coding mongoadmin:secret in MONGODB_URI exposes creds in plain text and violates CKV_SECRET_4. Source the URI (or user/password) from a Secret instead:

-        - name: MONGODB_URI
-          value: mongodb://mongoadmin:secret@mongodb:27017/dbname?authSource=admin
+        - name: MONGODB_URI
+          valueFrom:
+            secretKeyRef:
+              name: chatapp-secrets
+              key: mongodb_uri
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: MONGODB_URI
value: mongodb://mongoadmin:secret@mongodb:27017/dbname?authSource=admin
- name: JWT_SECRET
- name: MONGODB_URI
valueFrom:
secretKeyRef:
name: chatapp-secrets
key: mongodb_uri
- name: JWT_SECRET
🧰 Tools
🪛 Checkov (3.2.334)

[MEDIUM] 28-29: Basic Auth Credentials

(CKV_SECRET_4)

🤖 Prompt for AI Agents 
In k8s/backend-deployment.yml around lines 27 to 29, the MongoDB credentials are
hard-coded in the MONGODB_URI environment variable, exposing sensitive
information. To fix this, remove the plain-text credentials from the manifest
and instead reference a Kubernetes Secret that contains the MongoDB URI or the
username and password separately. Update the environment variable to pull the
value from the Secret using the secretKeyRef field.

valueFrom:
secretKeyRef:
name: chatapp-secrets
key: jwt
- name: PORT
value: "5001"
8 changes: 0 additions & 8 deletions k8s/backend-secrets.yaml
View file
Open in desktop

This file was deleted.

9 changes: 4 additions & 5 deletions k8s/backend-service.yaml → k8s/backend-service.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,11 @@ kind: Service
metadata:
name: backend
namespace: chat-app

spec:
selector:
app: backend
ports:
- protocol: TCP
port: 5001
targetPort: 5001
nodePort: 30501
type: NodePort
- port: 5001
targetPort: 5001

Loading