mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-11-10 21:10:24 +00:00
Cédric VerstraetenandCopilot
166b4a31e6
Coordinate frontend v1.19.28, port 8080, non-root/read-only security defaults and writable scratch for primary and demo. Preserve Service port 80, Admin legacy defaults, and explicit legacy rollback settings. Validate real image startup, health and generated configuration in Kind. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
103 lines
4.1 KiB
Bash
103 lines
4.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CHART_DIR="${1:-charts/hub}"
|
|
values=()
|
|
if [[ $# -ge 2 ]]; then values=(--values "$2"); fi
|
|
|
|
resource() {
|
|
local kind="$1" name="$2"
|
|
awk -v kind="$kind" -v name="$name" '
|
|
function emit() { if (matchedKind && matchedName) printf "%s", block }
|
|
/^---$/ { emit(); block=""; matchedKind=0; matchedName=0 }
|
|
{ block=block $0 "\n" }
|
|
$0 == "kind: " kind { matchedKind=1 }
|
|
$0 == " name: " name { matchedName=1 }
|
|
END { emit() }
|
|
'
|
|
}
|
|
|
|
assert_contains() {
|
|
if ! grep -Eq -- "$2" <<< "$1"; then
|
|
printf 'Missing expected frontend setting: %s\n' "$2" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
for mode in all ui; do
|
|
rendered="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
|
|
--set kerberoshub.frontend.demoEnabled=true)"
|
|
for name in hub-frontend hub-frontend-demo; do
|
|
deployment="$(resource Deployment "$name" <<< "$rendered")"
|
|
assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
|
|
assert_contains "$deployment" 'containerPort: 8080$'
|
|
[[ "$(grep -c 'containerPort:' <<< "$deployment")" == 1 ]]
|
|
for setting in 'name: http' 'runAsNonRoot: true' 'runAsUser: 65532' \
|
|
'runAsGroup: 65532' 'readOnlyRootFilesystem: true' \
|
|
'allowPrivilegeEscalation: false' 'type: RuntimeDefault' 'drop:' '- ALL' \
|
|
'medium: Memory' 'sizeLimit: 16Mi' 'mountPath: /tmp' 'name: frontend-tmp'; do
|
|
assert_contains "$deployment" "^[[:space:]]*(- )?$setting$"
|
|
done
|
|
service="$(resource Service "$name-svc" <<< "$rendered")"
|
|
assert_contains "$service" 'port: 80$'
|
|
assert_contains "$service" 'targetPort: http$'
|
|
echo "OK ($mode): $name hardened image, security, scratch and named routing"
|
|
done
|
|
admin="$(resource Deployment admin <<< "$rendered")"
|
|
assert_contains "$admin" 'containerPort: 80$'
|
|
|
|
legacy="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
|
|
--set kerberoshub.frontend.demoEnabled=true \
|
|
--set kerberoshub.frontend.tag=v1.13.9 \
|
|
--set kerberoshub.frontend.containerPort=80 \
|
|
--set kerberoshub.frontend.securityContext=null \
|
|
--set-json 'kerberoshub.frontend.volumes=[]' \
|
|
--set-json 'kerberoshub.frontend.volumeMounts=[]')"
|
|
for name in hub-frontend hub-frontend-demo; do
|
|
deployment="$(resource Deployment "$name" <<< "$legacy")"
|
|
assert_contains "$deployment" 'containerPort: 80$'
|
|
assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.13.9"$'
|
|
if grep -Eq 'securityContext:|mountPath: /tmp' <<< "$deployment"; then
|
|
echo "Legacy frontend retains incompatible hardened runtime settings" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
done
|
|
|
|
if [[ "${CLUSTER_SMOKE:-false}" == true ]]; then
|
|
namespace=frontend-runtime-test
|
|
kubectl create namespace "$namespace"
|
|
helm template runtime "$CHART_DIR" "${values[@]}" --namespace "$namespace" \
|
|
--set mode=ui --set ingress="" --set kerberoshub.frontend.demoEnabled=true \
|
|
--show-only templates/kerberos-hub/hub-frontend.yaml \
|
|
--show-only templates/kerberos-hub/hub-frontend-demo.yaml | kubectl apply -f -
|
|
pid=""
|
|
cleanup() {
|
|
if [[ -n "$pid" ]]; then kill "$pid"; fi
|
|
if [[ "$1" != 0 ]]; then
|
|
kubectl -n "$namespace" get pods
|
|
kubectl -n "$namespace" describe pods
|
|
kubectl -n "$namespace" logs -l app=hub-frontend --all-containers=true
|
|
kubectl -n "$namespace" logs -l app=hub-frontend-demo --all-containers=true
|
|
fi
|
|
}
|
|
trap 'cleanup "$?"' EXIT
|
|
for name in hub-frontend hub-frontend-demo; do
|
|
kubectl -n "$namespace" rollout status "deployment/$name" --timeout=180s
|
|
kubectl -n "$namespace" port-forward "service/$name-svc" 18080:80 &
|
|
pid=$!
|
|
for attempt in {1..30}; do
|
|
if curl --fail --silent http://127.0.0.1:18080/healthz > /dev/null; then break; fi
|
|
sleep 1
|
|
done
|
|
[[ "$(curl --fail --silent http://127.0.0.1:18080/healthz)" == ok ]]
|
|
curl --fail --silent http://127.0.0.1:18080/assets/env.js | grep 'window' > /dev/null
|
|
kill "$pid"
|
|
wait "$pid" || [[ "$?" == 143 ]]
|
|
pid=""
|
|
echo "OK: $name serves health and generated runtime configuration through Service port 80"
|
|
done
|
|
fi
|
|
|
|
echo "Frontend runtime checks passed."
|