Improve Kubernetes deployment quality and security

[pmarques]

Kubernetes Deployment Quality and Security Improvements

This PR implements several improvements to the Kubernetes deployment manifests for ifconfig.me, focusing on maintainability, security, and reliability.

Changes Summary

• File Restructuring: Split the combined Deployment and Service resource into 10-deployment.yaml and 11-service.yaml. This follows standard practice for better resource management and clarity.
• Typo Fix: Corrected the filename 30-netowrk-policy.yaml to 30-network-policy.yaml.
• Security Enhancements:
  • Removed the NET_BIND_SERVICE capability from the main container. Since the application listens on port 8080 (an unprivileged port), this capability is unnecessary and its removal follows the Principle of Least Privilege.
  • Disabled automountServiceAccountToken in the Deployment as the pods do not require access to the Kubernetes API.
• Reliability Improvements: Added an httpGet readiness probe to the Deployment to ensure the load balancer only directs traffic to pods that are fully initialized and ready to serve requests.

Rationale

These changes ensure the infrastructure code is as robust as the application code. By splitting manifests, we make it easier to manage resource-specific updates. Adding probes improves the zero-downtime deployment capabilities of the cluster. Tightening security contexts reduces the potential blast radius of any container-level vulnerability.

Prompt Engineering and Methodology

During the analysis phase, I used a structured approach to identify areas for improvement:

1. File Integrity Check: Identified typos and naming inconsistencies.
2. Resource Decoupling Analysis: Evaluated if resources were grouped logically or if they should be separated for better lifecycle management.
3. Security Baseline Review: Checked for common security anti-patterns such as redundant capabilities, privileged ports usage, and loose network policies.
4. Reliability Audit: Verified the presence and configuration of liveness and readiness probes.

The prompts used to drive this task involved recursive refinement of the implementation plan based on the standard Kubernetes 'Well-Architected' principles.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud