mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-11-08 20:50:22 +00:00
Cédric VerstraetenandCopilot
56ea65c6e7
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
87 lines
3.4 KiB
Bash
87 lines
3.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CHART_DIR="${1:-charts/hub}"
|
|
|
|
resource() {
|
|
local kind="$1" name="$2"
|
|
awk -v kind="$kind" -v name="$name" '
|
|
function emit() { if (matchedKind && matchedName) printf "%s", block }
|
|
/^---$/ { emit(); block=""; matchedKind=0; matchedName=0 }
|
|
{ block=block $0 "\n" }
|
|
$0 == "kind: " kind { matchedKind=1 }
|
|
$0 == " name: " name { matchedName=1 }
|
|
END { emit() }
|
|
'
|
|
}
|
|
|
|
assert_line() {
|
|
if ! grep -Eq -- "$2" <<< "$1"; then
|
|
printf 'Missing expected Hub API setting: %s\n' "$2" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
fixtures=(
|
|
--set workflowConfiguration.enabled=true
|
|
--set mongodb.tls.enabled=true
|
|
--set mongodb.tls.existingSecret=mongodb-ca
|
|
--set kerberoshub.api.serverTLS.enabled=true
|
|
--set kerberoshub.api.serverTLS.secretName=api-tls
|
|
)
|
|
|
|
for mode in all ui pipeline; do
|
|
defaults="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${fixtures[@]}")"
|
|
legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${fixtures[@]}" \
|
|
--set kerberoshub.api.securityContext=null \
|
|
--set kerberoshub.api.podSecurityContext=null)"
|
|
configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${fixtures[@]}" \
|
|
--set kerberoshub.api.securityContext.runAsUser=1000 \
|
|
--set kerberoshub.api.securityContext.runAsGroup=1000 \
|
|
--set kerberoshub.api.podSecurityContext.fsGroup=1000)"
|
|
helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${fixtures[@]}"
|
|
|
|
if [[ "$mode" == pipeline ]]; then
|
|
[[ -z "$(resource Deployment hub-api <<< "$defaults")" ]]
|
|
[[ "$defaults" == "$legacy" && "$defaults" == "$configured" ]]
|
|
echo "OK (pipeline): no Hub API resources or unrelated changes"
|
|
continue
|
|
fi
|
|
|
|
api="$(resource Deployment hub-api <<< "$defaults")"
|
|
for pattern in \
|
|
'^[ ]{6}securityContext:$' '^[ ]{8}fsGroup: 65532$' \
|
|
'^[ ]{10}securityContext:$' '^[ ]{12}runAsUser: 65532$' \
|
|
'^[ ]{12}runAsGroup: 65532$' '^[ ]{12}runAsNonRoot: true$' \
|
|
'^[ ]{12}readOnlyRootFilesystem: true$' \
|
|
'^[ ]{12}allowPrivilegeEscalation: false$' '^[ ]{12}capabilities:$' \
|
|
'^[ ]{14}drop:$' '^[ ]{14}- ALL$' \
|
|
'^[ ]{12}seccompProfile:$' '^[ ]{14}type: RuntimeDefault$' \
|
|
'^[ ]+(- )?name: hub-api-tmp$' '^[ ]+(- )?emptyDir: \{\}$' \
|
|
'^[ ]+(- )?mountPath: /tmp$' '^[ ]+secretName: mongodb-ca$' \
|
|
'^[ ]+secretName: api-tls$' '^[ ]+mountPath: /etc/mongodb/tls$' \
|
|
'^[ ]+mountPath: /etc/hub-api/tls$' \
|
|
'^[ ]+mountPath: /etc/kerberos/configuration$' \
|
|
'^[ ]+mountPath: /etc/kerberos/classifications$'; do
|
|
assert_line "$api" "$pattern"
|
|
done
|
|
[[ "$(grep -c 'securityContext:' <<< "$api")" == 2 ]]
|
|
old_api="$(resource Deployment hub-api <<< "$legacy")"
|
|
if grep -q 'securityContext:' <<< "$old_api"; then
|
|
echo "Legacy Hub API opt-out still renders a security context" >&2
|
|
exit 1
|
|
fi
|
|
custom_api="$(resource Deployment hub-api <<< "$configured")"
|
|
for field in runAsUser runAsGroup fsGroup; do
|
|
assert_line "$custom_api" "^[ ]+$field: 1000$"
|
|
done
|
|
|
|
# Only security settings change; preserve env, mounts, images and routing.
|
|
for pattern in '^[ ]+image:' '^[ ]+(port|targetPort|containerPort):' \
|
|
'^[ ]+(- )?(name|mountPath|secretName|value):'; do
|
|
[[ "$(grep -E "$pattern" <<< "$defaults")" == "$(grep -E "$pattern" <<< "$legacy")" ]]
|
|
[[ "$(grep -E "$pattern" <<< "$defaults")" == "$(grep -E "$pattern" <<< "$configured")" ]]
|
|
done
|
|
echo "OK ($mode): API security defaults, overrides, opt-out, scratch and TLS/config mounts"
|
|
done
|