chore: build

2026-08-18 20:07:52 +02:00
parent aa1aa60f00
commit dfc62c305d
25 changed files with 741 additions and 58 deletions
@@ -0,0 +1,105 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "waf-cluster.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "waf-cluster.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "waf-cluster.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "waf-cluster.selectorLabels" . | nindent 8 }}
+      annotations:
+        # Force un rollout des pods quand la ConfigMap (nginx.conf,
+        # custom-rules.conf) change — sinon nginx garde l'ancienne config en
+        # mémoire jusqu'au prochain redémarrage manuel (les changements de
+        # ConfigMap seule ne déclenchent pas de rollout par défaut).
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      # Pas de readOnlyRootFilesystem ici : l'image owasp/modsecurity-crs
+      # écrit à plusieurs endroits internes à /etc/nginx/modsec (activation
+      # des plugins CRS, génération de la config paranoia/anomaly) au
+      # démarrage — voir les logs "Running CRS plugin activation" /
+      # "Running CRS rule configuration". Même posture que docker/waf
+      # (omnex-prod), qui tourne avec cette même image sans souci. À
+      # durcir plus tard une fois le mapping exact des chemins écrits
+      # identifié (cf. la mésaventure readOnlyRootFilesystem sur le
+      # frontend, deploy/chart-gestion/frontend).
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: waf
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          env:
+            - name: DISABLE_MODSEC_ENV_SUBST
+              value: "true"
+            - name: PARANOIA
+              value: "{{ .Values.waf.paranoia }}"
+            - name: ANOMALY_INBOUND
+              value: "{{ .Values.waf.anomalyInbound }}"
+            - name: ANOMALY_OUTBOUND
+              value: "{{ .Values.waf.anomalyOutbound }}"
+            - name: MODSEC_AUDIT_LOG
+              value: "/var/log/modsec/modsec_audit.log"
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+            - name: https
+              containerPort: 443
+              protocol: TCP
+          volumeMounts:
+            - name: conf
+              mountPath: /etc/nginx/conf.d/app.conf
+              subPath: app.conf
+            - name: conf
+              mountPath: /etc/nginx/modsec/custom-rules.conf
+              subPath: custom-rules.conf
+            - name: certs
+              mountPath: /etc/nginx/certs
+              readOnly: true
+            - name: modsec-log
+              mountPath: /var/log/modsec
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: conf
+          configMap:
+            name: {{ include "waf-cluster.fullname" . }}-conf
+        - name: certs
+          secret:
+            secretName: {{ .Values.tls.secretName }}
+        - name: modsec-log
+          emptyDir: {}