Kubernetes Infrastructure

<h2 id="bkmrk-kubernetes-infrastru">Kubernetes Infrastructure — SecuScan v0.28.0</h2>

<h3 id="bkmrk-cluster-overview">Cluster Overview</h3> <table id="bkmrk-aspectdetail-provide"> <thead><tr><th>Aspect</th><th>Detail</th></tr></thead> <tbody> <tr><td><strong>Provider</strong></td><td>OVH Managed Kubernetes (Canada)</td></tr> <tr><td><strong>Clusters</strong></td><td>k8s-dev (development), k8s-prod (production)</td></tr> <tr><td><strong>Namespace</strong></td><td>secuscan</td></tr> <tr><td><strong>Total pods</strong></td><td>11 pods on k8s-dev</td></tr> <tr><td><strong>Registry</strong></td><td>Harbor OVH (qq9o8vqe.c1.bhs5.container-registry.ovh.net)</td></tr> <tr><td><strong>CLI</strong></td><td>All operations via <code>secuops</code> (never direct kubectl)</td></tr> </tbody> </table>

<h3 id="bkmrk-pod-inventory-%28k8s-d">Pod Inventory (k8s-dev)</h3> <table id="bkmrk-podtypeimageresource"> <thead><tr><th>Pod</th><th>Type</th><th>Image</th><th>Resources</th></tr></thead> <tbody> <tr><td>backend</td><td>Deployment</td><td>secuscan-backend</td><td>1 replica</td></tr> <tr><td>frontend</td><td>Deployment</td><td>secuscan-frontend</td><td>1 replica</td></tr> <tr><td>worker</td><td>Deployment</td><td>secuscan-worker</td><td>1 replica</td></tr> <tr><td>codeworker</td><td>Deployment</td><td>secuscan-codeworker</td><td>1 replica</td></tr> <tr><td>pentest-worker</td><td>Deployment</td><td>secuscan-pentest-worker</td><td>1 replica</td></tr> <tr><td>pentest-agent</td><td>Deployment</td><td>secuscan-pentest-agent</td><td>1 replica</td></tr> <tr><td>postgres</td><td>StatefulSet</td><td>postgres:15-alpine</td><td>PVC 10Gi</td></tr> <tr><td>redis</td><td>Deployment</td><td>redis:7-alpine</td><td>PVC 2Gi</td></tr> <tr><td>temporal</td><td>Deployment</td><td>temporalio/auto-setup</td><td>1 replica</td></tr> <tr><td>temporal-ui</td><td>Deployment</td><td>temporalio/ui</td><td>1 replica</td></tr> <tr><td>temporal-db</td><td>StatefulSet</td><td>postgres:15-alpine</td><td>PVC 5Gi</td></tr> </tbody> </table>

<h3 id="bkmrk-ingress-configuratio">Ingress Configuration (nginx)</h3> <table id="bkmrk-hostpathserviceport-"> <thead><tr><th>Host</th><th>Path</th><th>Service</th><th>Port</th></tr></thead> <tbody> <tr><td>secuscan.secuaas.dev</td><td>/ (catch-all)</td><td>frontend</td><td>3000</td></tr> <tr><td>secuscan.secuaas.dev</td><td>/api</td><td>frontend</td><td>3000</td></tr> <tr><td>api.secuscan.secuaas.dev</td><td>/v1</td><td>backend</td><td>8080</td></tr> <tr><td>api.secuscan.secuaas.dev</td><td>/health, /healthz</td><td>backend</td><td>8080</td></tr> </tbody> </table>

<h3 id="bkmrk-dns-configuration">DNS Configuration</h3> <table id="bkmrk-domainenvironmentpur"> <thead><tr><th>Domain</th><th>Environment</th><th>Purpose</th></tr></thead> <tbody> <tr><td>secuscan.secuaas.dev</td><td>k8s-dev</td><td>Main application (frontend + API proxy)</td></tr> <tr><td>api.secuscan.secuaas.dev</td><td>k8s-dev</td><td>Direct API access</td></tr> <tr><td>secuscan.secuaas.ovh</td><td>k8s-prod</td><td>Production frontend</td></tr> <tr><td>api.secuscan.secuaas.ovh</td><td>k8s-prod</td><td>Production API</td></tr> </tbody> </table>

<h3 id="bkmrk-secrets-management">Secrets Management</h3> <p id="bkmrk-all-secrets-are-mana">All secrets are managed exclusively via <code>secuops</code>, never stored in plain text in manifests.</p> <table id="bkmrk-secret-keydescriptio"> <thead><tr><th>Secret Key</th><th>Description</th><th>Required</th></tr></thead> <tbody> <tr><td>POSTGRES_PASSWORD / DB_PASSWORD</td><td>PostgreSQL password</td><td>Yes</td></tr> <tr><td>JWT_SECRET</td><td>JWT signing key</td><td>Yes</td></tr> <tr><td>AUTH_SECRET</td><td>NextAuth secret</td><td>Yes</td></tr> <tr><td>ADMIN_API_KEY</td><td>Admin API key (agent registration)</td><td>Yes</td></tr> <tr><td>CLAUDE_API_KEY</td><td>Anthropic API key (code scanning + AI analysis)</td><td>For AI features</td></tr> <tr><td>SSH_ENCRYPTION_KEY</td><td>AES-GCM key for SSH key encryption</td><td>For code scanning</td></tr> <tr><td>ZITADEL_CLIENT_SECRET</td><td>Zitadel OIDC secret</td><td>For SSO</td></tr> <tr><td>STRIPE_SECRET_KEY</td><td>Stripe API key</td><td>For billing</td></tr> <tr><td>STRIPE_WEBHOOK_SECRET</td><td>Stripe webhook verification</td><td>For billing</td></tr> </tbody> </table>

<h3 id="bkmrk-security-hardening-%28">Security Hardening (v0.27.x)</h3> <p id="bkmrk-all-containers-in-th">All containers in the SecuScan deployment have been hardened:</p> <ul id="bkmrk-readonlyrootfilesyst"> <li><strong>readOnlyRootFilesystem: true</strong> on all 11 containers</li> <li><strong>runAsNonRoot: true</strong> with UID/GID 1001 on all custom images</li> <li><strong>no-new-privileges: true</strong> security option</li> <li><strong>tmpfs volumes</strong> for writable directories (/tmp, /app/scans, /app/.next/cache, etc.)</li> <li><strong>Image pinning</strong>: all custom images use <code>${TAG}</code> instead of <code>:latest</code></li> </ul>

<h3 id="bkmrk-deployment-commands">Deployment Commands</h3> <pre id="bkmrk-%23-get-complete-proje"><code class="language-bash"># Get complete project topology secuops deploy-info --project=secuscan

Build all 6 Docker images and push to Harbor

secuops build --app=secuscan --env=k8s-dev

Deploy to Kubernetes

secuops deploy --app=secuscan --env=k8s-dev

Check deployment status

secuops status --app=secuscan --env=k8s-dev

View logs

secuops logs --app=secuscan --env=k8s-dev

Smoke tests

curl -s https://api.secuscan.secuaas.dev/health curl -s -o /dev/null -w "%{http_code}" https://secuscan.secuaas.dev/&lt;/code>&lt;/pre>