FastAPI Kubernetes Deployment
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The Docker Compose configuration for Keycloak includes hardcoded default credentials (
KEYCLOAK_ADMIN=adminandKEYCLOAK_ADMIN_PASSWORD=admin). While these are common defaults for local development environments and initial setup, they represent a security risk if used in production without modification. - [EXTERNAL_DOWNLOADS]: The Dockerfiles and configuration files reference several external dependencies, including Docker images (Python, MongoDB, Redis, Keycloak) and packages via
apt-getandpip. All referenced sources are well-known technology providers (Debian, Python Package Index, Docker Hub, Quay.io) and are used for their intended primary purpose. - [COMMAND_EXECUTION]: The skill uses standard shell and Python commands within container management instructions, such as
pip install,apt-get install, and a Python-based HTTP health check (python -c "import httpx; ..."). These are routine operations for building and monitoring microservices. - [SAFE]: The skill explicitly implements several security best practices: multi-stage Docker builds to minimize the attack surface, enforcement of non-root user execution (
USER appuserandrunAsNonRoot: true), and the use of KubernetessecretKeyRefto avoid exposing sensitive database connection strings in manifest files.
Audit Metadata