Create deployment.yaml

[anto-deepsource]

No description provided.

[deepsource-development]

DeepSource Code Review

We reviewed changes in 9d1323c...b8222cc on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Focus Area: Security

Security   Reliability   Complexity   Hygiene

Feedback

Image version and tag assumptions

• Across both Helm templates and the Ansible deploy YAML, images are using :latest and IfNotPresent, which ties together the “stale/vulnerable” and “unreviewed changes” issues.
• The core question is how deterministic you want deployments to be; once that’s decided, you can align all manifests on the same versioning/tagging approach.

Security context consistency

• runAsUser: 0 shows up in multiple places, while the positives mention privilege-conscious automation and structure.
• You’ve got a good separation of concerns and templating; this is a natural place to centralize a safer default security context so every manifest inherits it instead of repeating root.

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Ansible		May 27, 2026 9:17a.m.	Review ↗
Helm		May 27, 2026 9:17a.m.	Review ↗
Python		May 27, 2026 9:17a.m.	Review ↗
Secrets		May 27, 2026 9:17a.m.	Review ↗

[deepsource-development]

`apiVersion` scalar with indented `kind` breaks manifest parsing

kind and metadata are indented as if children of scalar apiVersion. Helm rendering or YAML parsing can fail before deployment, causing release failures.

Align top-level keys to column 1. Remove the extra two-space indentation before kind, metadata, and spec

[deepsource-development]

`runAsUser: 0` allows root-level process execution

securityContext explicitly runs the workload as root. If the application is exploited, attackers get maximal in-container privileges and easier escalation paths.

Use a non-root UID and enforce it. Replace with runAsNonRoot: true and a nonzero runAsUser

[deepsource-development]

`:latest` tag permits unpinned image replacement

The image value appends :latest, so pod restarts may pull different binaries than originally tested. This weakens release integrity and incident reproducibility.

Replace :latest with an explicit immutable tag or digest supplied through chart values

[deepsource-development]

`runAsUser: 0` permits root-privileged process execution

securityContext sets runAsUser to root. A runtime exploit in the application would execute with maximum in-container privileges, increasing impact and easing lateral movement attempts.

Use a non-root UID in runAsUser and enforce runAsNonRoot: true to block root execution paths

[deepsource-development]

`:latest` with `IfNotPresent` risks stale vulnerable deployments

image is pinned to :latest and imagePullPolicy is IfNotPresent. Nodes may continue running older cached images, causing inconsistent behavior and delayed security patch adoption.

Replace :latest with an immutable version or digest and set imagePullPolicy: Always when using mutable tags

[deepsource-development]

Misindented `kind`/`spec` makes manifest unparsable

kind and spec are nested incorrectly, producing invalid YAML. Helm/Kubernetes parsers will fail before rendering a deployment, breaking automation and rollout reliability.

Align top-level keys at column 0. Keep apiVersion, kind, and spec as sibling fields in the manifest root.

[deepsource-development]

`latest` tag allows unreviewed image changes

The container image is pinned to :latest, so identical manifests can run different binaries over time. That weakens provenance guarantees and can pull unexpected or compromised images during redeployments.

Replace :latest with an immutable version tag or digest from values, such as {{ .Values.image.tag }} or @sha256:....