feat(charts): harden backend securityContext, drop :latest defaults, accept KSV-0110/0125

.gitignore

@@ -11,3 +11,6 @@ Thumbs.db
 .idea/
 # Helm dependency archives for umbrella charts (Argo CD rebuilds them from Chart.lock)
 platform/*/charts/
+
+# CI scratch: the security workflow renders charts here for Trivy; never committed.
+rendered/

.trivyignore

@@ -1,2 +1,15 @@
-# Accepted misconfig / vuln IDs, one per line. e.g.
-# AVD-AWS-0089
+# Accepted misconfig IDs, one per line, each with its reason. Trivy picks this
+# file up automatically from the scan root (the repo root, in security.yml).
+# Convention mirrors collectiongeek-infra/.trivyignore.
+
+# Workloads land in their namespace via the Argo CD Application's
+# `destination.namespace` (argocd/*.yaml) — helm template output deliberately
+# carries no metadata.namespace, so Trivy misreads it as "default".
+AVD-KSV-0110
+KSV-0110
+
+# ghcr.io/collectiongeek is OUR registry: images are built and pushed only by
+# this org's CI (app repo) and referenced by immutable per-env tags. Trivy's
+# built-in trusted-registry list simply doesn't know it.
+AVD-KSV-0125
+KSV-0125

charts/backend/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: backend
 description: Go API backend service
 type: application
-version: 0.1.0
+version: 0.2.0
 appVersion: "1.0.0"

charts/backend/templates/deployment.yaml

@@ -20,10 +20,25 @@ spec:
       imagePullSecrets:
         - name: {{ .Values.image.pullSecret }}
       {{- end }}
+      # Hardened by default (Trivy KSV set): the runtime image is distroless
+      # static — a lone Go binary that needs no root, no capabilities, and
+      # never writes to its filesystem. 65532 is the distroless "nonroot" UID.
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.repository }}:{{ required "image.tag is required (set per-env in values-test/values-prod)" .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           ports:
             - name: http
               containerPort: {{ .Values.service.targetPort }}

charts/backend/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/collectiongeek/backend
-  tag: latest
+  tag: "" # always set per-env (values-test/values-prod); the template enforces it
   pullPolicy: IfNotPresent
   # pullSecret: ghcr-pull-secret  # Only needed if GHCR packages are private
 

charts/frontend/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: frontend
 description: React web frontend served via Nginx
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "1.0.0"

charts/frontend/templates/deployment.yaml

@@ -22,7 +22,7 @@ spec:
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.repository }}:{{ required "image.tag is required (set per-env in values-test/values-prod)" .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           envFrom:
             - configMapRef:

charts/frontend/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/collectiongeek/frontend
-  tag: latest
+  tag: "" # always set per-env (values-test/values-prod); the template enforces it
   pullPolicy: IfNotPresent
   # pullSecret: ghcr-pull-secret  # Only needed if GHCR packages are private