mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-11-11 21:20:24 +00:00
Cédric VerstraetenandClaude Opus 5.5
3949cb4bac
Only ghcr.io/uug-ai images are trusted, so Admin now defaults to the signed GHCR release with the hardened runtime production already uses (8080, 65532 non-root, read-only root, memory /tmp, /healthz probes). A legacy image can be restored with the documented opt-out values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
88 lines
3.3 KiB
Bash
88 lines
3.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CHART_DIR="${1:-charts/hub}"
|
|
|
|
resource() {
|
|
local source="$1"
|
|
awk -v source="# Source: hub/templates/admin/$source.yaml" '
|
|
/^---/ { selected=0 }
|
|
/^# Source:/ { selected=($0 == source); next }
|
|
selected { print }
|
|
'
|
|
}
|
|
|
|
assert_contains() {
|
|
local rendered="$1" pattern="$2"
|
|
if ! grep -Eq -- "$pattern" <<< "$rendered"; then
|
|
printf 'Missing expected Admin setting: %s\n' "$pattern" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_absent() {
|
|
local rendered="$1" pattern="$2"
|
|
if grep -Eq -- "$pattern" <<< "$rendered"; then
|
|
printf 'Unexpected Admin setting: %s\n' "$pattern" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# Since chart 0.184.0 the hardened ghcr.io/uug-ai/admin runtime is the default;
|
|
# LEGACY_FLAGS opts back into a legacy image on port 80.
|
|
LEGACY_FLAGS=(
|
|
--set admin.repository=uugai/admin
|
|
--set admin.tag=v1.3.0
|
|
--set admin.containerPort=80
|
|
--set admin.securityContext=null
|
|
--set admin.readinessProbe=null
|
|
--set admin.livenessProbe=null
|
|
--set admin.volumes=null
|
|
--set admin.volumeMounts=null
|
|
)
|
|
|
|
for mode in all ui; do
|
|
hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
|
|
hardened_deployment="$(resource deployment <<< "$hardened_render")"
|
|
hardened_service="$(resource service <<< "$hardened_render")"
|
|
hardened_ingress="$(resource ingress <<< "$hardened_render")"
|
|
hardened_oauth="$(resource oauth2-proxy <<< "$hardened_render")"
|
|
assert_contains "$hardened_deployment" 'image: "ghcr.io/uug-ai/admin:'
|
|
assert_contains "$hardened_deployment" 'containerPort: 8080$'
|
|
assert_absent "$hardened_deployment" 'containerPort: 80$'
|
|
for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
|
|
'readOnlyRootFilesystem: true' 'allowPrivilegeEscalation: false' \
|
|
'type: RuntimeDefault' 'drop:' '- ALL' 'medium: Memory' \
|
|
'sizeLimit: 16Mi' 'mountPath: /tmp' 'name: admin-tmp'; do
|
|
assert_contains "$hardened_deployment" "^[[:space:]]*(- )?$setting$"
|
|
done
|
|
for probe in readinessProbe livenessProbe; do
|
|
probe_render="$(awk -v probe="$probe:" '
|
|
/^ [a-zA-Z]/ { selected=($1 == probe) }
|
|
selected { print }
|
|
' <<< "$hardened_deployment")"
|
|
assert_contains "$probe_render" 'path: /healthz$'
|
|
assert_contains "$probe_render" 'port: http$'
|
|
done
|
|
assert_contains "$hardened_service" 'port: 80$'
|
|
assert_contains "$hardened_service" 'targetPort: http$'
|
|
|
|
legacy_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${LEGACY_FLAGS[@]}")"
|
|
legacy_deployment="$(resource deployment <<< "$legacy_render")"
|
|
assert_contains "$legacy_deployment" 'containerPort: 80$'
|
|
assert_absent "$legacy_deployment" 'securityContext:|readinessProbe:|livenessProbe:|admin-tmp'
|
|
|
|
[[ "$(resource service <<< "$legacy_render")" == "$hardened_service" ]]
|
|
[[ "$(resource ingress <<< "$legacy_render")" == "$hardened_ingress" ]]
|
|
[[ "$(resource oauth2-proxy <<< "$legacy_render")" == "$hardened_oauth" ]]
|
|
assert_contains "$hardened_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
|
|
assert_contains "$hardened_ingress" 'number: 80$'
|
|
|
|
echo "OK ($mode): hardened ghcr.io defaults; legacy opt-out; stable Service, ingress and OAuth2"
|
|
done
|
|
|
|
pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline)"
|
|
assert_absent "$pipeline_render" '^# Source: hub/templates/admin/'
|
|
|
|
echo "All Admin runtime checks passed."
|