Fix Kubernetes manifest bugs, dedupe drifted files, harden security

- Rebuild manifests/doormile/miletruth.yaml (was corrupted since the
  initial commit - contained pasted AI/terminal output, truncated env
  var names/values, duplicate keys). Rebuilt from the confirmed-live
  config, secrets sourced via a Secret instead of plaintext values.
- Lock down the Kubernetes Dashboard: remove --enable-skip-login /
  --enable-insecure-login / --insecure-port=9090, remove the extra
  cluster-admin binding on the dashboard's own ServiceAccount, remove
  the now-dead insecure NodePort Service. Token-based login via the
  existing admin-user ServiceAccount is unaffected.
- Fix the duplicate `backendRefs` key under the same HTTPRoute rule in
  alaska.yaml (invalid/redundant YAML).
- Delete 6 redundant duplicate manifests (fiesta-sts/svc,
  atlantis-sts/svc, jupiter-sts/svc) that were partial, stale subsets
  of nearle-fiesta/atlantis/jupiter.yaml - one pair disagreed on the
  fiesta image tag entirely (v1.3.50 vs v1.3.67, neither of which
  matched what's actually live).
- Reconcile nearle-fiesta.yaml and nearle-jupiter.yaml image tags to
  the confirmed-live versions (v1.3.78 / v2.7.55).
- Add allowPrivilegeEscalation:false + drop-all-capabilities to
  fiesta/atlantis/jupiter/titan/ariane and the 5 specialized core
  workers, which previously ran with no securityContext at all.
- Add terminationGracePeriodSeconds:45 to the worker StatefulSets so
  Kubernetes gives the new graceful-shutdown drain (see worker.py
  changes) enough time before SIGKILL.

manifests/nearle/atlantis-sts.yaml

@@ -1,61 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: atlantis
-  namespace: nearle
-  labels:
-    app: atlantis
-spec:
-  serviceName: "atlantis"
-  replicas: 2
-  selector:
-    matchLabels:
-      app: atlantis
-  template:
-    metadata:
-      labels:
-        app: atlantis
-    spec:
-      tolerations:
-      - key: dedicated
-        operator: Equal
-        value: apps
-        effect: NoSchedule
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: node-role.workolik/app
-                operator: In
-                values:
-                - "true"
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchLabels:
-                  app: atlantis
-              topologyKey: kubernetes.io/hostname
-      topologySpreadConstraints:
-      - maxSkew: 1
-        topologyKey: kubernetes.io/hostname
-        whenUnsatisfiable: ScheduleAnyway
-        labelSelector:
-          matchLabels:
-            app: atlantis
-      containers:
-      - name: backend
-        image: nearlecommerce/atlantis:v0.0.41
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 3000
-        env:
-        - name: PORT
-          value: "3000"
-        envFrom:
-        - configMapRef:
-            name: nearle-config
-        - secretRef:
-            name: app-secrets

manifests/nearle/atlantis-svc.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: atlantis
-  namespace: nearle
-  labels:
-    app: atlantis
-spec:
-  type: NodePort
-  ports:
-  - port: 80
-    targetPort: 3000
-    nodePort: 30825
-    protocol: TCP
-  selector:
-    app: atlantis

manifests/nearle/fiesta-sts.yaml

@@ -1,99 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: fiesta
-  namespace: nearle
-  labels:
-    app: fiesta
-spec:
-  serviceName: "fiesta"
-  replicas: 3
-  selector:
-    matchLabels:
-      app: fiesta
-  template:
-    metadata:
-      labels:
-        app: fiesta
-    spec:
-      tolerations:
-      - key: dedicated
-        operator: Equal
-        value: apps
-        effect: NoSchedule
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: node-role.workolik/app
-                operator: In
-                values:
-                - "true"
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchLabels:
-                  app: fiesta
-              topologyKey: kubernetes.io/hostname
-      topologySpreadConstraints:
-      - maxSkew: 1
-        topologyKey: kubernetes.io/hostname
-        whenUnsatisfiable: ScheduleAnyway
-        labelSelector:
-          matchLabels:
-            app: fiesta
-      containers:
-      - name: backend
-        image: nearlecommerce/fiesta:v1.3.67
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 1122
-        envFrom:
-        - configMapRef:
-            name: nearle-config
-        - secretRef:
-            name: app-secrets
-        env:
-        - name: PORT
-          value: "1122"
-        - name: NATS_USER
-          valueFrom:
-            secretKeyRef:
-              name: nats-credentials
-              key: username
-        - name: NATS_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: nats-credentials
-              key: password
-      - name: gateway
-        image: workolik360/alaska:v1.2.0
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 8000
-          name: http
-        volumeMounts:
-        - name: gateway-script
-          mountPath: /app/app.py
-          subPath: app.py
-        envFrom:
-        - configMapRef:
-            name: nearle-config
-        env:
-        - name: NATS_USER
-          valueFrom:
-            secretKeyRef:
-              name: nats-credentials
-              key: username
-        - name: NATS_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: nats-credentials
-              key: password
-      volumes:
-      - name: gateway-script
-        configMap:
-          name: fiesta-gateway-script

manifests/nearle/fiesta-svc.yaml

@@ -1,21 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: fiesta
-  namespace: nearle
-  labels:
-    app: fiesta
-spec:
-  type: NodePort
-  ports:
-  - port: 80
-    targetPort: 1122
-    nodePort: 30823
-    protocol: TCP
-    name: main
-  - port: 8000
-    targetPort: 8000
-    name: gateway
-    protocol: TCP
-  selector:
-    app: fiesta

manifests/nearle/jupiter-sts.yaml

@@ -1,77 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: jupiter
-  namespace: nearle
-  labels:
-    app: jupiter
-spec:
-  serviceName: "jupiter"
-  replicas: 3
-  selector:
-    matchLabels:
-      app: jupiter
-  template:
-    metadata:
-      labels:
-        app: jupiter
-    spec:
-      tolerations:
-      - key: dedicated
-        operator: Equal
-        value: apps
-        effect: NoSchedule
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: node-role.workolik/app
-                operator: In
-                values:
-                - "true"
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchLabels:
-                  app: jupiter
-              topologyKey: kubernetes.io/hostname
-      topologySpreadConstraints:
-      - maxSkew: 1
-        topologyKey: kubernetes.io/hostname
-        whenUnsatisfiable: ScheduleAnyway
-        labelSelector:
-          matchLabels:
-            app: jupiter
-      containers:
-      - name: jupiter
-        image: nearlecommerce/jupiter:v2.7.53
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 1009
-        env:
-        - name: PORT
-          value: "1009"
-        - name: TZ
-          value: "Asia/Kolkata"
-        volumeMounts:
-        - name: tz-config
-          mountPath: /etc/localtime
-          readOnly: true
-        - name: tz-data
-          mountPath: /usr/share/zoneinfo
-          readOnly: true
-        envFrom:
-        - configMapRef:
-            name: nearle-config
-        - secretRef:
-            name: app-secrets
-      volumes:
-      - name: tz-config
-        hostPath:
-          path: /usr/share/zoneinfo/Asia/Kolkata
-      - name: tz-data
-        hostPath:
-          path: /usr/share/zoneinfo

manifests/nearle/jupiter-svc.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: jupiter
-  namespace: nearle
-  labels:
-    app: jupiter
-spec:
-  type: NodePort
-  ports:
-  - port: 80
-    targetPort: 1009
-    nodePort: 30822
-    protocol: TCP
-  selector:
-    app: jupiter

manifests/nearle/nearle-ariane.yaml

@@ -49,6 +49,11 @@ spec:
       - name: backend
         image: nearlecommerce/ariane:v1.0.22
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 1000
         env:

manifests/nearle/nearle-atlantis.yaml

@@ -49,6 +49,11 @@ spec:
       - name: backend
         image: nearlecommerce/atlantis:v0.0.41
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 3000
         env:

manifests/nearle/nearle-fiesta.yaml

@@ -47,8 +47,13 @@ spec:
             app: fiesta
       containers:
       - name: backend
-        image: nearlecommerce/fiesta:v1.3.50
+        image: nearlecommerce/fiesta:v1.3.78
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 1122
         envFrom:
@@ -72,6 +77,11 @@ spec:
       - name: gateway
         image: workolik360/alaska:v1.2.0
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 8000
           name: http

manifests/nearle/nearle-jupiter.yaml

@@ -47,8 +47,13 @@ spec:
             app: jupiter
       containers:
       - name: jupiter
-        image: nearlecommerce/jupiter:v2.7.31
+        image: nearlecommerce/jupiter:v2.7.55
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 1009
         env:

manifests/nearle/nearle-titan.yaml

@@ -49,6 +49,11 @@ spec:
       - name: backend
         image: groomgear/groomgear:v1.0.41
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         ports:
         - containerPort: 1006
 ---