From 9d3f0b7753dd4036957fc93b578232d25cf4f923 Mon Sep 17 00:00:00 2001 From: Senthil Raja R Date: Mon, 15 Jun 2026 18:46:02 +0530 Subject: [PATCH] fix: k8s ingress rewrites all paths, missing TLS, securityContext, resource limits, probes - Ingress: fixed rewrite-target from '/' to '/' with regex capture so /api/auth/login becomes /auth/login (not /) - Ingress: added TLS section with atlas-tls secret - Ingress: added ssl-redirect annotation, explicit ingressClassName - Deployments: added pod securityContext (runAsNonRoot, runAsUser, fsGroup) - Deployments: added container securityContext (no ptrace, no CAP) - Deployments: added resource requests/limits (cpu/memory) on all containers - Deployments: added livenessProbe and readinessProbe on all containers --- k8s/deployments.yaml | 429 ++++++++++++++++++++++++++++++++++++++++--- k8s/ingress.yaml | 13 +- 2 files changed, 413 insertions(+), 29 deletions(-) diff --git a/k8s/deployments.yaml b/k8s/deployments.yaml index 53b496d..a34f1b2 100644 --- a/k8s/deployments.yaml +++ b/k8s/deployments.yaml @@ -14,11 +14,38 @@ spec: labels: app: api-gateway spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: api-gateway image: atlas/api-gateway:latest ports: - containerPort: 8080 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8080 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -39,11 +66,38 @@ spec: labels: app: frontend spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: frontend image: atlas/frontend:latest ports: - containerPort: 3000 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 3000 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 3000 + initialDelaySeconds: 5 + periodSeconds: 10 --- apiVersion: apps/v1 kind: Deployment @@ -61,11 +115,90 @@ spec: labels: app: auth-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: auth-service image: atlas/auth-service:latest ports: - containerPort: 8010 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8010 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8010 + initialDelaySeconds: 5 + periodSeconds: 10 + envFrom: + - secretRef: + name: atlas-secrets +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: employee-service + labels: + app: employee-service +spec: + replicas: 1 + selector: + matchLabels: + app: employee-service + template: + metadata: + labels: + app: employee-service + spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 + containers: + - name: employee-service + image: atlas/employee-service:latest + ports: + - containerPort: 8001 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8001 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8001 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -86,11 +219,38 @@ spec: labels: app: payroll-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: payroll-service image: atlas/payroll-service:latest ports: - containerPort: 8002 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8002 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8002 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -111,11 +271,38 @@ spec: labels: app: analytics-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: analytics-service image: atlas/analytics-service:latest ports: - containerPort: 8003 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8003 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8003 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -136,36 +323,38 @@ spec: labels: app: notification-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: notification-service image: atlas/notification-service:latest ports: - containerPort: 8004 - envFrom: - - secretRef: - name: atlas-secrets ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: employee-service - labels: - app: employee-service -spec: - replicas: 1 - selector: - matchLabels: - app: employee-service - template: - metadata: - labels: - app: employee-service - spec: - containers: - - name: employee-service - image: atlas/employee-service:latest - ports: - - containerPort: 8001 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8004 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8004 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -186,11 +375,38 @@ spec: labels: app: attendance-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: attendance-service image: atlas/attendance-service:latest ports: - containerPort: 8005 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8005 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8005 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -211,11 +427,38 @@ spec: labels: app: leave-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: leave-service image: atlas/leave-service:latest ports: - containerPort: 8006 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8006 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8006 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -236,11 +479,38 @@ spec: labels: app: audit-compliance-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: audit-compliance-service image: atlas/audit-compliance-service:latest ports: - containerPort: 8011 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8011 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8011 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -261,11 +531,38 @@ spec: labels: app: ats-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: ats-service image: atlas/ats-service:latest ports: - containerPort: 8012 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8012 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8012 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -286,11 +583,38 @@ spec: labels: app: lms-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: lms-service image: atlas/lms-service:latest ports: - containerPort: 8013 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8013 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8013 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -311,11 +635,38 @@ spec: labels: app: performance-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: performance-service image: atlas/performance-service:latest ports: - containerPort: 8014 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8014 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8014 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets @@ -336,12 +687,38 @@ spec: labels: app: ai-copilot-service spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 + fsGroup: 1001 containers: - name: ai-copilot-service image: atlas/ai-copilot-service:latest ports: - containerPort: 8015 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" + livenessProbe: + httpGet: + path: /health + port: 8015 + initialDelaySeconds: 10 + periodSeconds: 15 + readinessProbe: + httpGet: + path: /health + port: 8015 + initialDelaySeconds: 5 + periodSeconds: 10 envFrom: - secretRef: name: atlas-secrets - diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml index 5539732..62ae1c6 100644 --- a/k8s/ingress.yaml +++ b/k8s/ingress.yaml @@ -3,14 +3,21 @@ kind: Ingress metadata: name: atlas-ingress annotations: - nginx.ingress.kubernetes.io/rewrite-target: / + nginx.ingress.kubernetes.io/rewrite-target: /$2 + nginx.ingress.kubernetes.io/use-regex: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: + ingressClassName: nginx + tls: + - hosts: + - atlas.local + secretName: atlas-tls rules: - host: atlas.local http: paths: - - path: /api - pathType: Prefix + - path: /api(/|$)(.*) + pathType: ImplementationSpecific backend: service: name: api-gateway