feat(charts): harden backend securityContext, drop :latest defaults, accept KSV-0110/0125 - #20
Conversation
…accept KSV-0110/0125 Addresses ~40 of the 73 Trivy code-scanning alerts: - backend deployment: runAsNonRoot uid/gid 65532, RuntimeDefault seccomp, no privilege escalation, drop ALL capabilities, read-only root fs — the runtime image is distroless static, a lone Go binary that needs none of what this removes. Clears the KSV securityContext family for backend (incl. high KSV-0118/KSV-0014) in the raw template and both env renders. - both charts: image.tag defaults to "" with a required-guard in the template — deploying without per-env values now fails at render instead of silently tracking :latest (KSV-0013). - .trivyignore: KSV-0110 (namespace comes from the Argo CD Application destination, not the manifests) and KSV-0125 (ghcr.io/collectiongeek is our own registry) accepted with reasons, mirroring the infra convention. - .gitignore: rendered/ (CI scratch dir for the scan). Verified with a local dockerized trivy config scan: backend clean, ignores effective, frontend residual (13 findings/env) is the known follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe Helm charts now require environment-specific image tags. The backend container adds restricted non-root security settings. Chart versions are updated, and Trivy configuration plus CI scratch output handling are added. ChangesHelm security and image validation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.gitignore (1)
15-16: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAnchor the ignore rule to the CI output directory.
The workflow writes root-level
rendered/;/rendered/avoids unintentionally ignoring unrelated nested directories with the same name.Suggested change
- rendered/ + /rendered/🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.gitignore around lines 15 - 16, Update the rendered ignore rule in .gitignore to use the root-anchored /rendered/ pattern, ensuring only the CI workflow’s root-level output directory is ignored and nested rendered directories remain unaffected.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.trivyignore:
- Around line 8-15: Scope the KSV-0110 and KSV-0125 ignores to the intended
rendered Helm/ArgoCD manifests instead of applying them repository-wide through
.trivyignore. Use a scoped .trivyignore.yaml with the Trivy --ignorefile option
or isolate the scan roots, while preserving the existing registry justification
only for the affected outputs.
---
Nitpick comments:
In @.gitignore:
- Around line 15-16: Update the rendered ignore rule in .gitignore to use the
root-anchored /rendered/ pattern, ensuring only the CI workflow’s root-level
output directory is ignored and nested rendered directories remain unaffected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6198eb67-877c-468e-8e79-5f4ddbac2c13
📒 Files selected for processing (8)
.gitignore.trivyignorecharts/backend/Chart.yamlcharts/backend/templates/deployment.yamlcharts/backend/values.yamlcharts/frontend/Chart.yamlcharts/frontend/templates/deployment.yamlcharts/frontend/values.yaml
A repo-root .trivyignore suppresses an ID everywhere forever — a future manifest outside the chart outputs (or one pulling from a foreign registry) would be silently excused too. Replaced with the structured .trivyignore.yaml, KSV-0110/0125 scoped to charts/** and rendered/** with statements, wired via TRIVY_IGNOREFILE (the .yaml format is not auto-discovered like the legacy file). Re-verified with a local dockerized scan: both IDs suppressed in scope, backend still clean, frontend residual unchanged at 26. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Adopted the CodeRabbit suggestion in 95cf582: replaced the repo-root |
Carries the backend securityContext hardening (gitops #20) verified in test: pod nonroot 65532 + RuntimeDefault seccomp, container no-priv-esc + drop-ALL + read-only rootfs; same image tag. frontend-prod and platform-observability pins unmoved (the frontend required-tag guard renders identical output). Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 participant
First of two PRs for the 73 open Trivy code-scanning alerts. This one addresses everything except the frontend nginx rework (which needs an app-repo image change and comes next).
Changes
Backend deployment — full securityContext (clears the KSV family incl. high
KSV-0118/KSV-0014across the raw template + both env renders):runAsNonRoot, uid/gid 65532 (distroless nonroot convention, >10000 for KSV-0020/21),seccompProfile: RuntimeDefaultallowPrivilegeEscalation: false,readOnlyRootFilesystem: true,capabilities.drop: [ALL]:latestdefaults removed (KSV-0013) — both charts:image.tag: ""+requiredguard in the template. Env values always set the tag; a render without one now fails loudly instead of silently tracking:latest. (Side effect: Trivy's raw-chart render skips, so raw-template alerts close; the rendered/ scans keep full coverage with real values.).trivyignore— two accepted classes with reasons (infra convention):KSV-0110"default namespace": manifests deliberately carry no namespace — the Argo CD Application'sdestination.namespaceinjects it.KSV-0125"untrusted registry":ghcr.io/collectiongeekis our own org registry; Trivy's built-in trusted list just doesn't know it.Verification
Local dockerized
trivy configscan of the repo with rendered/ built exactly as CI does: backend clean (0 findings), both ignores effective, frontend residual is the known 13-findings-per-env set for PR 2. Rendered output confirmed to carry the new contexts.Rollout
Merge → test auto-syncs
backend-test(pod restarts under the new context — /healthz probes verify it boots). After test soak: pin-bump promotion forbackend-prod. Expected alert count after both env scans re-run on main: 73 → 26 (frontend only).🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Chores