Skip to content

Create deployment.yaml #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anto-deepsource wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Create deployment.yaml #103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c33f734
Create deployment.yaml
anto-deepsource May 27, 2026
b2a114a
Create deploy.yml
anto-deepsource May 27, 2026
919c5b3
Create deployment.yaml
anto-deepsource May 27, 2026
b8222cc
Create setup.yml
anto-deepsource May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions roles/web/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: apps/v1
kind: Deployment
spec:
Comment on lines +2 to +3

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Misindented `kind`/`spec` makes manifest unparsable


kind and spec are nested incorrectly, producing invalid YAML. Helm/Kubernetes parsers will fail before rendering a deployment, breaking automation and rollout reliability.

Align top-level keys at column 0. Keep apiVersion, kind, and spec as sibling fields in the manifest root.

replicas: {{ .Values.replicaCount }}
template:
spec:
containers:
- image: "{{ .Values.image.repository }}:latest"

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`latest` tag allows unreviewed image changes


The container image is pinned to :latest, so identical manifests can run different binaries over time. That weakens provenance guarantees and can pull unexpected or compromised images during redeployments.

Replace :latest with an immutable version tag or digest from values, such as {{ .Values.image.tag }} or @sha256:....

7 changes: 7 additions & 0 deletions roles/web/templates/setup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
- hosts: localhost
become: true
tasks:
- name: install nginx
ansible.builtin.apt:
name: nginx
state: present
29 changes: 29 additions & 0 deletions services/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "myapp.fullname" . }}
labels:
{{- include "myapp.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
{{- include "myapp.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
{{- include "myapp.selectorLabels" . | nindent 8 }}
spec:
securityContext:
runAsUser: 0

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`runAsUser: 0` permits root-privileged process execution


securityContext sets runAsUser to root. A runtime exploit in the application would execute with maximum in-container privileges, increasing impact and easing lateral movement attempts.

Use a non-root UID in runAsUser and enforce runAsNonRoot: true to block root execution paths

containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:latest"
imagePullPolicy: IfNotPresent
Comment on lines +21 to +22

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`:latest` with `IfNotPresent` risks stale vulnerable deployments


image is pinned to :latest and imagePullPolicy is IfNotPresent. Nodes may continue running older cached images, causing inconsistent behavior and delayed security patch adoption.

Replace :latest with an immutable version or digest and set imagePullPolicy: Always when using mutable tags

env:
- name: DB_PASSWORD
value: "supersecret123"
- name: APP_ENV
value: "{{ .Values.appEnv }}"
ports:
- containerPort: 8080
29 changes: 29 additions & 0 deletions templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
apiVersion: apps/v1
kind: Deployment
metadata:
Comment on lines +1 to +3

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`apiVersion` scalar with indented `kind` breaks manifest parsing


kind and metadata are indented as if children of scalar apiVersion. Helm rendering or YAML parsing can fail before deployment, causing release failures.

Align top-level keys to column 1. Remove the extra two-space indentation before kind, metadata, and spec

name: {{ include "myapp.fullname" . }}
labels:
{{- include "myapp.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
{{- include "myapp.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
{{- include "myapp.selectorLabels" . | nindent 8 }}
spec:
securityContext:
runAsUser: 0

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`runAsUser: 0` allows root-level process execution


securityContext explicitly runs the workload as root. If the application is exploited, attackers get maximal in-container privileges and easier escalation paths.

Use a non-root UID and enforce it. Replace with runAsNonRoot: true and a nonzero runAsUser

containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:latest"

@deepsource-development deepsource-development Bot May 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`:latest` tag permits unpinned image replacement


The image value appends :latest, so pod restarts may pull different binaries than originally tested. This weakens release integrity and incident reproducibility.

Replace :latest with an explicit immutable tag or digest supplied through chart values

imagePullPolicy: IfNotPresent
env:
- name: DB_PASSWORD
value: "supersecret123"
- name: APP_ENV
value: "{{ .Values.appEnv }}"
ports:
- containerPort: 8080
Loading