apiVersion: v1
kind: Pod
metadata:
  name: whitehat-e2-audit
  namespace: user-engine
  labels:
    app.kubernetes.io/name: user-engine
    app.kubernetes.io/component: whitehat-probe
    whitehat.security/engagement: WH-ENG-20260821-AUDIT-E2
spec:
  automountServiceAccountToken: false
  activeDeadlineSeconds: 900
  restartPolicy: Never
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: probe
      image: forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10
      imagePullPolicy: IfNotPresent
      command: ["sleep", "900"]
      resources:
        requests: {cpu: 5m, memory: 16Mi}
        limits: {cpu: 50m, memory: 64Mi}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
      volumeMounts:
        - name: credentials
          mountPath: /var/run/secrets/whitehat
          readOnly: true
  volumes:
    - name: credentials
      secret:
        secretName: whitehat-e2-audit-credentials
        defaultMode: 0440
        items:
          - key: token-a
            path: token-a
          - key: token-b
            path: token-b