From 70005ee9574058e0b819de79b5fe1ab386b02b6f Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Thu, 16 Jul 2026 13:09:20 -0700
Subject: [PATCH 1/3] ci(trivy): resolve configuration alerts by adding
 resource limits and ignore rules

---
 .trivyignore               |  6 ++++++
 charts/pubcode/values.yaml | 12 ++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 00000000..d296bfc8
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,6 @@
+# Ignore rule checking container registries (Helm templates use dynamic templating, e.g., {{ .Values.global.registry }} which defaults to ghcr.io, but static scan fails to resolve it)
+AVD-KSV-0125
+
+# Ignore checks for UID/GID <= 10000. OpenShift dynamic Security Context Constraints (SCC) controller dynamically injects extremely high UIDs/GIDs at runtime. Hardcoding IDs in templates breaks compliance in dynamic namespaces.
+AVD-KSV-0020
+AVD-KSV-0021
diff --git a/charts/pubcode/values.yaml b/charts/pubcode/values.yaml
index 2c8afd8b..b3a1b34a 100644
--- a/charts/pubcode/values.yaml
+++ b/charts/pubcode/values.yaml
@@ -46,6 +46,9 @@ api:
         requests:
           cpu: 50m
           memory: 100Mi
+        limits:
+          cpu: 100m
+          memory: 200Mi
       readinessProbe:
         httpGet:
           path: /api/pub-code/health
@@ -147,6 +150,9 @@ frontend:
         requests:
           cpu: 50m
           memory: 50Mi
+        limits:
+          cpu: 100m
+          memory: 100Mi
       readinessProbe:
         httpGet:
           path: /health
@@ -239,6 +245,9 @@ database:
         requests:
           cpu: 50m
           memory: 150Mi
+        limits:
+          cpu: 100m
+          memory: 300Mi
       volumeMounts:
         - name: '{{ .Release.Name }}-database'
           mountPath: /data/db
@@ -261,6 +270,9 @@ database:
         requests:
           cpu: 50m
           memory: 150Mi
+        limits:
+          cpu: 100m
+          memory: 300Mi
       readinessProbe:
         tcpSocket:
           port: 27017

From 764c4896a23bbc7247cd65d43ea153db9137b3b2 Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Thu, 16 Jul 2026 13:11:34 -0700
Subject: [PATCH 2/3] docs(trivy): expand explanations for ignored rules in
 .trivyignore

---
 .trivyignore | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index d296bfc8..10928383 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,6 +1,14 @@
-# Ignore rule checking container registries (Helm templates use dynamic templating, e.g., {{ .Values.global.registry }} which defaults to ghcr.io, but static scan fails to resolve it)
+# KSV-0125: Restrict container images to trusted registries
+# Why ignored: The container image path is dynamically constructed using Helm templates 
+# (e.g., "{{- if and $c.registry ... }}") and defaults to ghcr.io. Trivy performs static 
+# analysis on raw templates before values are rendered, and flags the Go template syntax 
+# itself as an untrusted registry name.
 AVD-KSV-0125
 
-# Ignore checks for UID/GID <= 10000. OpenShift dynamic Security Context Constraints (SCC) controller dynamically injects extremely high UIDs/GIDs at runtime. Hardcoding IDs in templates breaks compliance in dynamic namespaces.
+# KSV-0020 / KSV-0021: Runs with UID/GID <= 10000
+# Why ignored: OpenShift's Security Context Constraints (SCC) dynamically allocate 
+# extremely high range UIDs and GIDs (e.g., 1000600000+) at runtime. Hardcoding specific 
+# UIDs/GIDs like 10001 in these Helm templates to satisfy the static scanner will trigger 
+# admission webhook rejections on standard OpenShift namespaces.
 AVD-KSV-0020
 AVD-KSV-0021

From 3b3222180dfd69e83a6461f45448e35b026c24fe Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Thu, 16 Jul 2026 13:31:21 -0700
Subject: [PATCH 3/3] feat(trivy): remove CPU limits for bursting and increase
 RAM limit to 4Gi

---
 .trivyignore               |  5 +++++
 charts/pubcode/values.yaml | 12 ++++--------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index 10928383..01fbbdbc 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -12,3 +12,8 @@ AVD-KSV-0125
 # admission webhook rejections on standard OpenShift namespaces.
 AVD-KSV-0020
 AVD-KSV-0021
+
+# KSV-0011: CPU not limited
+# Why ignored: Om, our smart coworker, advised removing CPU limits to allow containers 
+# to burst into unallocated node capacity, preventing unnecessary throttling during peak load.
+AVD-KSV-0011
diff --git a/charts/pubcode/values.yaml b/charts/pubcode/values.yaml
index b3a1b34a..7bd43114 100644
--- a/charts/pubcode/values.yaml
+++ b/charts/pubcode/values.yaml
@@ -47,8 +47,7 @@ api:
           cpu: 50m
           memory: 100Mi
         limits:
-          cpu: 100m
-          memory: 200Mi
+          memory: 4Gi
       readinessProbe:
         httpGet:
           path: /api/pub-code/health
@@ -151,8 +150,7 @@ frontend:
           cpu: 50m
           memory: 50Mi
         limits:
-          cpu: 100m
-          memory: 100Mi
+          memory: 4Gi
       readinessProbe:
         httpGet:
           path: /health
@@ -246,8 +244,7 @@ database:
           cpu: 50m
           memory: 150Mi
         limits:
-          cpu: 100m
-          memory: 300Mi
+          memory: 4Gi
       volumeMounts:
         - name: '{{ .Release.Name }}-database'
           mountPath: /data/db
@@ -271,8 +268,7 @@ database:
           cpu: 50m
           memory: 150Mi
         limits:
-          cpu: 100m
-          memory: 300Mi
+          memory: 4Gi
       readinessProbe:
         tcpSocket:
           port: 27017