---
# One Service, three named ports (the page gate, the internal API and metrics).
#
# clusterIP IS PINNED ON PURPOSE (10.43.210.10, verified unused against the live Service list on
# 2026-11-09, inside k3s' default 10.43.0.0/16 Service CIDR). The triage bot runs as a Gitea Actions
# job inside the runner's DinD daemon, and whether in-cluster DNS resolves from a DinD job container
# is UNVERIFIED. The pinned address is the bot's fallback when the Service name does not resolve:
# `http://10.43.210.10:8081` (VULN_API_FALLBACK_URL in .gitea/workflows/cve-triage.yaml).
apiVersion: v1
kind: Service
metadata:
  name: vuln-scanner
  namespace: vuln-scanner
  labels:
    app.kubernetes.io/name: vuln-scanner
spec:
  type: ClusterIP
  clusterIP: 10.43.210.10
  selector:
    app.kubernetes.io/name: vuln-scanner
  ports:
    - name: http
      port: 4180
      targetPort: http
      protocol: TCP
    - name: internal
      port: 8081
      targetPort: internal
      protocol: TCP
    - name: metrics
      port: 9090
      targetPort: metrics
      protocol: TCP