From f7e910c1bf8520d039faaf583ea6f0cfcaafb403 Mon Sep 17 00:00:00 2001 From: Shivender Reddy Date: Sat, 22 Aug 2026 21:27:29 -0400 Subject: [PATCH 1/4] Add resource limits to vote deployment --- k8s-specifications/vote-deployment.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/k8s-specifications/vote-deployment.yaml b/k8s-specifications/vote-deployment.yaml index 165a9478f8..8808968206 100644 --- a/k8s-specifications/vote-deployment.yaml +++ b/k8s-specifications/vote-deployment.yaml @@ -20,3 +20,10 @@ spec: ports: - containerPort: 80 name: vote + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "500m" + memory: "256Mi" From 02a67b9b713350834ec9d6d433bcf680bf8eeaa1 Mon Sep 17 00:00:00 2001 From: Shivender Reddy Date: Sat, 22 Aug 2026 22:54:41 -0400 Subject: [PATCH 2/4] Add Sysdig IaC and image scanning --- .github/workflows/sysdig-iac-scan.yaml | 38 ++++++++++++++++++++++++ .github/workflows/sysdig-image-scan.yaml | 37 +++++++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 .github/workflows/sysdig-iac-scan.yaml create mode 100644 .github/workflows/sysdig-image-scan.yaml diff --git a/.github/workflows/sysdig-iac-scan.yaml b/.github/workflows/sysdig-iac-scan.yaml new file mode 100644 index 0000000000..14d17b1acd --- /dev/null +++ b/.github/workflows/sysdig-iac-scan.yaml @@ -0,0 +1,38 @@ +name: Sysdig IaC Scan + +on: + workflow_dispatch: + pull_request: + paths: + - '**/*.tf' + - '**/*.yaml' + - '**/*.yml' + - '.github/workflows/sysdig-iac-scan.yaml' + push: + branches: + - main + paths: + - '**/*.tf' + - '**/*.yaml' + - '**/*.yml' + - '.github/workflows/sysdig-iac-scan.yaml' + +jobs: + iac-scan: + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Sysdig IaC Scan + uses: sysdiglabs/scan-action@v6 + with: + iac-scan: true + sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }} + sysdig-secure-url: https://app.us4.sysdig.com + stop-on-failed-policy-eval: false + stop-on-processing-error: true diff --git a/.github/workflows/sysdig-image-scan.yaml b/.github/workflows/sysdig-image-scan.yaml new file mode 100644 index 0000000000..e0e1ebd250 --- /dev/null +++ b/.github/workflows/sysdig-image-scan.yaml @@ -0,0 +1,37 @@ +name: Sysdig IaC Scan + +on: + workflow_dispatch: + pull_request: + paths: + - 'k8s-specifications/**' + - '.github/workflows/sysdig-iac-scan.yaml' + push: + branches: + - main + paths: + - 'k8s-specifications/**' + - '.github/workflows/sysdig-iac-scan.yaml' + +jobs: + iac-scan: + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Scan Kubernetes IaC + uses: sysdiglabs/scan-action@v6 + with: + mode: iac + iac-scan-path: ./k8s-specifications + recursive: true + cli-scanner-version: 1.9.0 + sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }} + sysdig-secure-url: https://app.us4.sysdig.com + stop-on-failed-policy-eval: false + stop-on-processing-error: true \ No newline at end of file From caccbd381a10505f10348c7e331764ff808090c7 Mon Sep 17 00:00:00 2001 From: Shivender Reddy Date: Sun, 23 Aug 2026 11:34:29 -0400 Subject: [PATCH 3/4] Trigger Sysdig IaC scan From 27fcb180bb64d26620162187a5a19650ca0e2988 Mon Sep 17 00:00:00 2001 From: Shivender Reddy Date: Sun, 23 Aug 2026 11:48:28 -0400 Subject: [PATCH 4/4] Fix Sysdig image scan workflow --- .github/workflows/sysdig-image-scan.yaml | 52 ++++++++++++++++++------ 1 file changed, 40 insertions(+), 12 deletions(-) diff --git a/.github/workflows/sysdig-image-scan.yaml b/.github/workflows/sysdig-image-scan.yaml index e0e1ebd250..1199fe02b4 100644 --- a/.github/workflows/sysdig-image-scan.yaml +++ b/.github/workflows/sysdig-image-scan.yaml @@ -1,20 +1,24 @@ -name: Sysdig IaC Scan +name: Sysdig Image Scan on: workflow_dispatch: pull_request: paths: - - 'k8s-specifications/**' - - '.github/workflows/sysdig-iac-scan.yaml' + - 'vote/**' + - 'worker/**' + - 'result/**' + - '.github/workflows/sysdig-image-scan.yaml' push: branches: - main paths: - - 'k8s-specifications/**' - - '.github/workflows/sysdig-iac-scan.yaml' + - 'vote/**' + - 'worker/**' + - 'result/**' + - '.github/workflows/sysdig-image-scan.yaml' jobs: - iac-scan: + image-scan: runs-on: ubuntu-latest permissions: @@ -24,14 +28,38 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Scan Kubernetes IaC + - name: Build vote image + run: docker build -t examplevotingapp_vote:ci ./vote + + - name: Build worker image + run: docker build -t examplevotingapp_worker:ci ./worker + + - name: Build result image + run: docker build -t examplevotingapp_result:ci ./result + + - name: Scan vote image + uses: sysdiglabs/scan-action@v6 + with: + image-tag: examplevotingapp_vote:ci + sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }} + sysdig-secure-url: https://app.us4.sysdig.com + stop-on-failed-policy-eval: false + stop-on-processing-error: true + + - name: Scan worker image + uses: sysdiglabs/scan-action@v6 + with: + image-tag: examplevotingapp_worker:ci + sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }} + sysdig-secure-url: https://app.us4.sysdig.com + stop-on-failed-policy-eval: false + stop-on-processing-error: true + + - name: Scan result image uses: sysdiglabs/scan-action@v6 with: - mode: iac - iac-scan-path: ./k8s-specifications - recursive: true - cli-scanner-version: 1.9.0 + image-tag: examplevotingapp_result:ci sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }} sysdig-secure-url: https://app.us4.sysdig.com stop-on-failed-policy-eval: false - stop-on-processing-error: true \ No newline at end of file + stop-on-processing-error: true