mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Fable 5.1
8eac1b2c69
ops/k8s/profiles/kind.toml and k3s.toml hold the values that differ per cluster (exec, kube_context, registry, images, router_url, ax_server, memory, atespace, snapshots_bucket, image_pull_secret, pools); kind-images.json carries the digest pin ops/ax/up.sh wrote. load_profile() reads OUSAST_PLANE_PROFILE (name or path, default kind), applies OUSAST_<FIELD> and OUSAST_POOL_<NAME>_<FIELD>, and refuses an unknown key, a credential-shaped key or value, an exec outside local|remote and an images file without digest pins. `python -m openultrasast.plane.profile --print FIELD` serves shell scripts. The module-audit manifest is regenerated for the new module (counts 147/5, no orphan). Gates: pytest full suite 2002 passed, 1 failed (the module-audit manifest, fixed by regenerating it; tests/test_module_audit.py re-run exit 0), ruff check 0, ruff format 0, mypy 0. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
27 lines
1.7 KiB
TOML
27 lines
1.7 KiB
TOML
# The k3s profile: the plane on the maintainer's production cluster (plane-on-kubernetes design section 1;
|
|
# requirements "Target Environment"). Documented values, not secrets: the kubeconfig for the context, the GHCR
|
|
# pull secret's content and the store's keys live outside this file. Every field is overridable by OUSAST_<FIELD>,
|
|
# a pool by OUSAST_POOL_<NAME>_<FIELD>. Nothing has been applied to a k3s cluster yet; docs/deployment.md says
|
|
# which items are planned.
|
|
|
|
exec = "remote" # the same CLI from a laptop or a CI job, through the cluster's kube context
|
|
kube_context = "ousast-k3s" # the maintainer's context name for the k3s cluster
|
|
registry = "ghcr.io/norandom" # images built by GitHub Actions from tagged commits (design section 8)
|
|
images = "images.json" # the release asset {"runner": "ghcr.io/norandom/ousast-runner@sha256:...", "engine": ...}
|
|
router_url = "" # empty: port-forward to atenet-router through the kube context (ax-tunnel)
|
|
ax_server = "" # empty: the ax CLI's own tunnel through the kube context (ax-tunnel)
|
|
memory = "s3://sast-memory" # the memory store; S3_ENDPOINT and the keys come from the CI secrets or .env
|
|
atespace = "default"
|
|
snapshots_bucket = "s3://ax-snapshots" # ax's AX_SNAPSHOTS_BUCKET, ours (rendered into the ax-server patch)
|
|
image_pull_secret = "ghcr-pull" # only needed while the GHCR packages are private
|
|
|
|
[pools.default] # production sizing: four verify-class workers; the HPA (design section 5) scales it
|
|
replicas = 4
|
|
cpu = "1"
|
|
memory = "1536Mi"
|
|
|
|
[pools.engine] # two engine workers sized from the measured 2.1 GiB peak under a 3 GiB limit
|
|
replicas = 2
|
|
cpu = "2"
|
|
memory = "4Gi"
|