feat: add bounded Kubernetes runtime verification
Dependency Audit / dependency-audit (push) Failing after 9s
Deployment Installer / deployment-installer (push) Successful in 6s
Security Audit / security-audit (push) Failing after 8s

This commit is contained in:
2026-08-02 05:30:26 +02:00
parent 50e9607e72
commit ed31409034
6 changed files with 1094 additions and 11 deletions
@@ -40,6 +40,18 @@ RUNTIME_ENV_KEYS = (
"ENABLED_MODULES",
"CELERY_ENABLED",
"CELERY_QUEUES",
"CELERY_WORKER_CONCURRENCY",
"GOVOPLAN_DB_CONNECTION_LIMIT",
"GOVOPLAN_DB_CONNECTION_RESERVE",
"GOVOPLAN_API_DB_POOL_SIZE",
"GOVOPLAN_API_DB_MAX_OVERFLOW",
"GOVOPLAN_WORKER_DB_POOL_SIZE",
"GOVOPLAN_WORKER_DB_MAX_OVERFLOW",
"GOVOPLAN_SCHEDULER_DB_POOL_SIZE",
"GOVOPLAN_SCHEDULER_DB_MAX_OVERFLOW",
"GOVOPLAN_MIGRATION_DB_POOL_SIZE",
"GOVOPLAN_MIGRATION_DB_MAX_OVERFLOW",
"GOVOPLAN_WORKER_POOLS",
"REDIS_URL",
"CORS_ORIGINS",
"GOVOPLAN_TRUSTED_HOSTS",
@@ -193,6 +205,46 @@ def reconcile_runtime_environment(
"CELERY_QUEUES": (
"send_email,append_sent,notifications,mail,calendar,dataflow,workflow,postbox,events,idm,default"
),
"CELERY_WORKER_CONCURRENCY": values.get(
"CELERY_WORKER_CONCURRENCY",
"2",
),
"GOVOPLAN_DB_CONNECTION_RESERVE": values.get(
"GOVOPLAN_DB_CONNECTION_RESERVE",
"10",
),
"GOVOPLAN_API_DB_POOL_SIZE": values.get(
"GOVOPLAN_API_DB_POOL_SIZE",
"5",
),
"GOVOPLAN_API_DB_MAX_OVERFLOW": values.get(
"GOVOPLAN_API_DB_MAX_OVERFLOW",
"2",
),
"GOVOPLAN_WORKER_DB_POOL_SIZE": values.get(
"GOVOPLAN_WORKER_DB_POOL_SIZE",
"1",
),
"GOVOPLAN_WORKER_DB_MAX_OVERFLOW": values.get(
"GOVOPLAN_WORKER_DB_MAX_OVERFLOW",
"1",
),
"GOVOPLAN_SCHEDULER_DB_POOL_SIZE": values.get(
"GOVOPLAN_SCHEDULER_DB_POOL_SIZE",
"1",
),
"GOVOPLAN_SCHEDULER_DB_MAX_OVERFLOW": values.get(
"GOVOPLAN_SCHEDULER_DB_MAX_OVERFLOW",
"0",
),
"GOVOPLAN_MIGRATION_DB_POOL_SIZE": values.get(
"GOVOPLAN_MIGRATION_DB_POOL_SIZE",
"2",
),
"GOVOPLAN_MIGRATION_DB_MAX_OVERFLOW": values.get(
"GOVOPLAN_MIGRATION_DB_MAX_OVERFLOW",
"0",
),
"CORS_ORIGINS": spec.public_url,
"GOVOPLAN_TRUSTED_HOSTS": public.hostname or "",
"FORWARDED_ALLOW_IPS": spec.network_subnet,
@@ -212,6 +264,8 @@ def reconcile_runtime_environment(
values["GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE"] = "true"
else:
values["GOVOPLAN_ALLOW_PROCESS_LOCAL_LOGIN_THROTTLE"] = "false"
if postgres.mode == "managed":
values.setdefault("GOVOPLAN_DB_CONNECTION_LIMIT", "100")
storage = spec.components.storage
if storage.mode == "local":