# CONTRACT ONLY. Do not apply until WP-0025 projection and admit-plane succeed.
apiVersion: v1
kind: Pod
metadata:
  name: whitehat-e2-audit-03
  namespace: whitehat
  labels:
    app.kubernetes.io/name: whitehat-security
    app.kubernetes.io/component: whitehat-probe
    whitehat.security/plane: "true"
    whitehat.security/target: audit-core
    whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-03
spec:
  serviceAccountName: whitehat-runner
  automountServiceAccountToken: false
  activeDeadlineSeconds: 900
  restartPolicy: Never
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: probe
      image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
      imagePullPolicy: IfNotPresent
      command: ["sleep", "900"]
      resources:
        requests: {cpu: 5m, memory: 16Mi}
        limits: {cpu: 50m, memory: 64Mi}
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
      volumeMounts:
        - name: credentials
          mountPath: /var/run/secrets/whitehat
          readOnly: true
  volumes:
    - name: credentials
      secret:
        secretName: whitehat-e2-audit-credentials-03
        defaultMode: 0440
        items:
          - key: token-a
            path: token-a
          - key: token-b
            path: token-b