Application topology

GitGuardian application consists of several Kubernetes resources. Each nginx pod runs an nginx container serving the dashboard frontend and acting as a proxy for the backend, and a number of different containers serving all backend tasks.

Kind	Deployment Name	Usage
Front	nginx	Dashboard Frontend and proxy for backend
Backend	internal-api	Backend for the Dashboard
Backend	internal-api-long	Backend for the Dashboard (long requests, no timeout)
Backend	public-api	Public API and ggshield scans
Backend	hook	VCS webhooks events receiver
Backend	app-exporter	Prometheus exporter for applicative metrics
Backend	ml-secret-engine	Machine Learning secret engine
Backend	apache-tika	File scanner for non-VCS sources scanning
Scheduler	beat	Celery Beat task scheduler
Worker	worker-worker	General-purpose worker managing real-time scans, retries, honeytoken tasks, reports (queues: check_run, realtime, realtime_retry, honeytoken, reports, core_default, sources_default, incidents_default, individual_validity_check).
Worker	worker-check-runs	Optional dedicated worker for check run processing (queue: check_run). Disabled by default; enable to offload check_run from worker-worker.
Worker	worker-check-run-scanners	Optional dedicated worker for scan-based (PR-scoped) check runs (queue: check_run_scan). Disabled by default; the queue falls back to worker-scanners.
Worker	worker-email	Handles email notifications and messaging (queues: email, notifier).
Worker	worker-scanners	Performs historical scans for repositories (queues: basic_repo_scan, premium_repo_scan, manual_repo_scan, code_fixing).
Worker	worker-premium-scanners-retry	Optional high-memory worker retrying failed large-repository scans (queue: premium_repo_scan_retry). Disabled by default; see Premium scan retry worker.
Worker	worker-incidents-disk	Optional dedicated worker recomputing secret locations (queue: incidents_disk). Disabled by default; the queue falls back to worker-scanners.
Worker	worker-long	Processes long-running tasks such as validity checks and NHI ingestion (queues: background_validity_check, update_sources_state, nhi_ingestion, hmsl, core_long, sources_long, incidents_long, ml_backpopulate, endpoints, core_aspm, team_sync).
Worker	worker-automatic-severities	Dedicated worker for automatic severity computation (queue: automatic_severities). 1 replica by default, autoscales up to 3.
Worker	worker-realtime-ods	Handles real-time processing for non-VCS sources like Slack and Jira (queues: realtime_ods, realtime_retry_ods).
Worker	worker-long-ods	Processes long-running tasks for non-VCS sources (queue: long_ods).
Worker	worker-long-ods-io	Focuses on IO-intensive long-running tasks for non-VCS sources (queue: long_ods_io).
Worker	worker-scanners-ods	Executes non-VCS historical scans for Jira, Confluence, etc. (queue: ods_scan).
Worker	worker-scanners-ods-highdisk	Handles high storage tasks for non-VCS sources (queue: ods_scan_highdisk).
Worker	worker-scanners-slack	Executes Slack historical scans (queue: slack_scan).
Worker	worker-scanners-db-less-jira-cloud	Optional dedicated worker for Jira Cloud historical scans (queue: db_less_scan_jira_cloud). Disabled by default. While it has 0 replicas, worker-scanners-ods consumes the queue, or worker-scanners when worker-scanners-ods also has 0 replicas.
Worker	worker-scanners-db-less-confluence-cloud	Optional dedicated worker for Confluence Cloud historical scans (queue: db_less_scan_confluence_cloud). Disabled by default. While it has 0 replicas, worker-scanners-ods consumes the queue, or worker-scanners when worker-scanners-ods also has 0 replicas.
Worker	worker-container-registries	Handles secret scanning in Container registries (queue: container_registries).
Worker	worker-public-monitoring	Handles Public Monitoring scans (queues: public_monitoring, public_monitoring_continuous_scan, public_monitoring_historical_scan, public_monitoring_realtime_scan). Active only when licensed.
Worker	worker-business-contribution	Handles business contribution tasks (queue: business_contribution).
Worker	worker-ml-api-priority	Prioritizes machine learning API-related tasks (queue: ml_api_priority).
Worker	worker-scanners-db-less	Optional worker for scans that do not need database access: JFrog Package Registries, SharePoint and OneDrive (queue: db_less_scan). Disabled by default; the queue falls back to worker-scanners.
Job	inapp-analytics	Computes metrics and aggregates data for Advanced Analytics dashboards.
Job	pre-deploy	Pre-deployment job performing database migrations
Job	post-deploy	Post-deployment job performing long data migrations
Replicated	replicated	License management and usage data collection
Replicated	kotsadm	KOTS Admin Console (KOTS-based installation only)

info

We have set a 30-days TTL (Time To Live) for pre-deploy and post-deploy jobs to allow for log retrieval if needed. It is recommended not to delete these pods, as they can be useful for troubleshooting.