Add Dockerfile, Ankra application descriptor, Kubernetes manifests and CI/CD pipeline

.ankra/ankra.yaml

@@ -0,0 +1,82 @@
+# Ankra application descriptor.
+# Ankra reads this file on every analysis run. The options below are this
+# application's deploy-time parameter contract - they drive the deploy form and
+# are validated on deploy. Edit them here and re-run setup to change it.
+apiVersion: ankra.io/v1
+kind: Application
+metadata:
+  name: "tael-cli"
+  version: "0.1.0"
+  app_version: "0.1.0"
+  description: "Tael platform: cli"
+  icon: "https://avatars.githubusercontent.com/u/231962624?v=4"
+  sources:
+    - "https://github.com/taelio/cli"
+  maintainers:
+    - name: "taelio"
+      url: "https://github.com/taelio"
+options:
+  - name: "image_tag"
+    type: "string"
+    required: false
+    description: "Container image tag to deploy. Use an immutable tag such as sha-<commit> or a semver release, never 'latest'."
+  - name: "replicas"
+    type: "number"
+    default: "1"
+    required: false
+    description: "Number of pod replicas."
+  - name: "target_port"
+    type: "number"
+    default: "8080"
+    required: false
+    description: "Container port the application listens on."
+  - name: "cpu_request"
+    type: "string"
+    default: "100m"
+    required: false
+    description: "CPU request per pod."
+  - name: "cpu_limit"
+    type: "string"
+    default: "500m"
+    required: false
+    description: "CPU limit per pod."
+  - name: "memory_request"
+    type: "string"
+    default: "128Mi"
+    required: false
+    description: "Memory request per pod."
+  - name: "memory_limit"
+    type: "string"
+    default: "512Mi"
+    required: false
+    description: "Memory limit per pod."
+  - name: "ingress_enabled"
+    type: "boolean"
+    default: "false"
+    required: false
+    description: "Expose the service through an Ingress."
+  - name: "ingress_host"
+    type: "string"
+    default: ""
+    required: false
+    description: "Ingress hostname (required when ingress is enabled)."
+  - name: "ingress_class"
+    type: "string"
+    default: ""
+    required: false
+    description: "IngressClass name (e.g. traefik). Leave empty to use the cluster's default IngressClass."
+  - name: "ingress_extra_hosts"
+    type: "string"
+    default: ""
+    required: false
+    description: "Comma-separated additional hostnames the Ingress also serves (e.g. a customer's own domain). Each becomes its own rule and TLS host beside ingress_host; at most 5."
+  - name: "env_from_secrets"
+    type: "string"
+    default: ""
+    required: false
+    description: "Comma-separated names of Secrets in the application's namespace whose keys become environment variables (envFrom)."
+  - name: "ingress_tls_issuer"
+    type: "string"
+    default: "letsencrypt-prod"
+    required: false
+    description: "cert-manager ClusterIssuer that mints the Ingress certificate. Leave empty to serve plain HTTP."

.ankra/manifests/deployment.yaml

@@ -0,0 +1,90 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tael-cli
+  labels:
+    app.kubernetes.io/name: tael-cli
+automountServiceAccountToken: false
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tael-cli
+  labels:
+    app.kubernetes.io/name: tael-cli
+  annotations:
+    ankra.io/generated: "true"
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tael-cli
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tael-cli
+    spec:
+      serviceAccountName: tael-cli
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      imagePullSecrets:
+        - name: ankra-registry-pull
+      containers:
+        - name: tael-cli
+          image: registry.ankra.cloud/org-ff91b1e8-3f9c-4699-aeea-b45bf4d00dd4/cli:${{ ankra.image_tag }}
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: TAEL_CONFIG
+              valueFrom:
+                secretKeyRef:
+                  name: tael-cli-env
+                  key: TAEL_CONFIG
+                  optional: true
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          startupProbe:
+            tcpSocket:
+              port: http
+            failureThreshold: 30
+            periodSeconds: 2
+          livenessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 5
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 100m
+              memory: 128Mi
+      volumes:
+        - name: tmp
+          emptyDir: {}

.ankra/manifests/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: tael-cli
+  labels:
+    app.kubernetes.io/name: tael-cli
+  annotations:
+    ankra.io/generated: "true"
+    cert-manager.io/cluster-issuer: ${{ ankra.ingress_tls_issuer }}
+spec:
+  ingressClassName: ${{ ankra.ingress_class }}
+  tls:
+    - hosts:
+        - ${{ ankra.ingress_host }}
+      secretName: tael-cli-tls
+  rules:
+    - host: ${{ ankra.ingress_host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: tael-cli
+                port:
+                  number: 80

.ankra/manifests/networkpolicy.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tael-cli
+  labels:
+    app.kubernetes.io/name: tael-cli
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: tael-cli
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector: {}
+    - ports:
+        - port: 8080
+          protocol: TCP

.ankra/manifests/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tael-cli
+  labels:
+    app.kubernetes.io/name: tael-cli
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: tael-cli
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+      protocol: TCP

.ankra/pipeline.yaml

@@ -0,0 +1,78 @@
+# Ankra pipeline.
+# Ankra runs this pipeline in your own cluster on every push, pull request and
+# schedule it declares. Stages run as hardened Jobs sharing one workspace;
+# ${{ … }} expressions are resolved per run. Edit it here - Git is the source
+# of truth, and the definition on the default branch governs authority.
+apiVersion: ankra.io/v1
+kind: Pipeline
+metadata:
+  name: "tael-cli"
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+    branches:
+      - "main"
+    fork_policy: "read_only"
+concurrency:
+  group: "${{ ankra.repository }}-${{ ankra.ref }}"
+  cancel_in_progress: true
+workspace:
+  size: "10Gi"
+  access: "rwo"
+defaults:
+  timeout: "30m"
+  network: "egress-https"
+permissions:
+  contents: "read"
+stages:
+  - name: "checkout"
+    kind: "checkout"
+  - name: "test"
+    kind: "run"
+    image: "golang:1.26-alpine"
+    run: "go test ./..."
+    needs:
+      - "checkout"
+  - name: "build"
+    kind: "build"
+    needs:
+      - "test"
+    network: "egress-https"
+    build:
+      provenance: true
+      sbom: true
+  - name: "scan"
+    kind: "scan"
+    with:
+      image_gate: "app"
+      semgrep_config: "p/default p/docker p/github-actions p/javascript"
+    needs:
+      - "build"
+    network: "egress-https"
+    scan:
+      scanners:
+        - "semgrep"
+        - "checkov"
+        - "trivy"
+      fail_on:
+        checkov: "none"
+        semgrep: "error"
+        trivy: "app"
+  - name: "gate"
+    kind: "gate"
+    needs:
+      - "scan"
+    gate:
+      require_stages:
+        - "scan"
+  - name: "publish"
+    kind: "publish"
+    with:
+      image: "registry.ankra.cloud/org-ff91b1e8-3f9c-4699-aeea-b45bf4d00dd4/cli"
+    needs:
+      - "gate"
+    when:
+      events:
+        - "push"