mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-10-29 19:18:26 +00:00
Cédric VerstraetenandCopilot
6f1dcf8f00
Publish opt-in hardened runtime support with named Admin Service routing, configurable health probes, legacy defaults and runtime regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
83 lines
3.6 KiB
Bash
83 lines
3.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CHART_DIR="${1:-charts/hub}"
|
|
|
|
resource() {
|
|
local source="$1"
|
|
awk -v source="# Source: hub/templates/admin/$source.yaml" '
|
|
/^---/ { selected=0 }
|
|
/^# Source:/ { selected=($0 == source); next }
|
|
selected { print }
|
|
'
|
|
}
|
|
|
|
assert_contains() {
|
|
local rendered="$1" pattern="$2"
|
|
if ! grep -Eq -- "$pattern" <<< "$rendered"; then
|
|
printf 'Missing expected Admin setting: %s\n' "$pattern" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_absent() {
|
|
local rendered="$1" pattern="$2"
|
|
if grep -Eq -- "$pattern" <<< "$rendered"; then
|
|
printf 'Unexpected Admin setting: %s\n' "$pattern" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
HARDENED_FLAGS=(
|
|
--set admin.containerPort=8080
|
|
--set-json 'admin.securityContext={"runAsNonRoot":true,"runAsUser":65532,"runAsGroup":65532,"readOnlyRootFilesystem":true,"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}}'
|
|
--set-json 'admin.volumes=[{"name":"admin-tmp","emptyDir":{"medium":"Memory","sizeLimit":"16Mi"}}]'
|
|
--set-json 'admin.volumeMounts=[{"name":"admin-tmp","mountPath":"/tmp"}]'
|
|
--set-json 'admin.readinessProbe={"httpGet":{"path":"/healthz","port":"http"},"periodSeconds":10}'
|
|
--set-json 'admin.livenessProbe={"httpGet":{"path":"/healthz","port":"http"},"initialDelaySeconds":10,"periodSeconds":10}'
|
|
)
|
|
|
|
for mode in all ui; do
|
|
default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
|
|
default_deployment="$(resource deployment <<< "$default_render")"
|
|
default_service="$(resource service <<< "$default_render")"
|
|
default_ingress="$(resource ingress <<< "$default_render")"
|
|
default_oauth="$(resource oauth2-proxy <<< "$default_render")"
|
|
assert_contains "$default_deployment" 'containerPort: 80$'
|
|
assert_absent "$default_deployment" 'securityContext:|readinessProbe:|livenessProbe:'
|
|
assert_contains "$default_service" 'port: 80$'
|
|
assert_contains "$default_service" 'targetPort: http$'
|
|
|
|
hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${HARDENED_FLAGS[@]}")"
|
|
hardened_deployment="$(resource deployment <<< "$hardened_render")"
|
|
assert_contains "$hardened_deployment" 'containerPort: 8080$'
|
|
assert_absent "$hardened_deployment" 'containerPort: 80$'
|
|
for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
|
|
'readOnlyRootFilesystem: true' 'allowPrivilegeEscalation: false' \
|
|
'type: RuntimeDefault' 'drop:' '- ALL' 'medium: Memory' \
|
|
'sizeLimit: 16Mi' 'mountPath: /tmp' 'name: admin-tmp'; do
|
|
assert_contains "$hardened_deployment" "^[[:space:]]*(- )?$setting$"
|
|
done
|
|
for probe in readinessProbe livenessProbe; do
|
|
probe_render="$(awk -v probe="$probe:" '
|
|
/^ [a-zA-Z]/ { selected=($1 == probe) }
|
|
selected { print }
|
|
' <<< "$hardened_deployment")"
|
|
assert_contains "$probe_render" 'path: /healthz$'
|
|
assert_contains "$probe_render" 'port: http$'
|
|
done
|
|
|
|
[[ "$(resource service <<< "$hardened_render")" == "$default_service" ]]
|
|
[[ "$(resource ingress <<< "$hardened_render")" == "$default_ingress" ]]
|
|
[[ "$(resource oauth2-proxy <<< "$hardened_render")" == "$default_oauth" ]]
|
|
assert_contains "$default_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
|
|
assert_contains "$default_ingress" 'number: 80$'
|
|
|
|
echo "OK ($mode): legacy defaults; hardened runtime/probes; stable Service, ingress and OAuth2"
|
|
done
|
|
|
|
pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline "${HARDENED_FLAGS[@]}")"
|
|
assert_absent "$pipeline_render" '^# Source: hub/templates/admin/'
|
|
|
|
echo "All Admin runtime checks passed."
|