Skip to content

Commit 2bad603

Browse files
disentangle-networkLarsen-Close
disentangle-network
and
Larsen-Close
authored
Add multi-arch test-tools container image (#11)
* Add multi-arch test-tools container image Adds a minimal container image (wolfi-base + curl + jq) for use by helm test pods. Runs as non-root (UID 65532). CI workflow builds linux/amd64 and linux/arm64, pushes to ghcr.io/disentangle-network/test-tools, and includes Trivy scan, cosign signature, and SBOM attachment. * switch test pods to wolfi-based test-tools image Replace alpine/curl with ghcr.io/disentangle-network/test-tools (Chainguard wolfi-base + curl + jq). Removes runtime apk add calls that fail under non-root securityContext. Updates runAsUser to 65532 (Chainguard nonroot). Regenerates golden files. --------- Co-authored-by: Larsen Close <lclose@quovis.io>
1 parent cd3e53a commit 2bad603

File tree

11 files changed

+149
-48
lines changed

11 files changed

+149
-48
lines changed

‎.github/workflows/test-tools.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Test Tools Image
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'test-tools/**'
8+
tags:
9+
- 'test-tools-v*'
10+
11+
jobs:
12+
build-push:
13+
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
16+
packages: write
17+
id-token: write
18+
security-events: write
19+
steps:
20+
- uses: actions/checkout@v4
21+
22+
- name: Set up QEMU
23+
uses: docker/setup-qemu-action@v3
24+
25+
- uses: docker/setup-buildx-action@v3
26+
27+
- uses: docker/login-action@v3
28+
with:
29+
registry: ghcr.io
30+
username: ${{ github.actor }}
31+
password: ${{ secrets.GITHUB_TOKEN }}
32+
33+
- name: Determine tags
34+
id: meta
35+
uses: docker/metadata-action@v5
36+
with:
37+
images: ghcr.io/disentangle-network/test-tools
38+
tags: |
39+
type=match,pattern=test-tools-v(.*),group=1
40+
type=raw,value=latest
41+
42+
- name: Build and push multi-arch image
43+
id: build
44+
uses: docker/build-push-action@v6
45+
with:
46+
context: ./test-tools
47+
push: true
48+
platforms: linux/amd64,linux/arm64
49+
tags: ${{ steps.meta.outputs.tags }}
50+
cache-from: type=gha
51+
cache-to: type=gha,mode=max
52+
53+
- name: Run Trivy vulnerability scanner
54+
uses: aquasecurity/trivy-action@0.28.0
55+
with:
56+
image-ref: ghcr.io/disentangle-network/test-tools:latest
57+
format: sarif
58+
output: trivy-results.sarif
59+
severity: CRITICAL,HIGH
60+
61+
- name: Upload Trivy scan results
62+
uses: github/codeql-action/upload-sarif@v3
63+
if: always()
64+
with:
65+
sarif_file: trivy-results.sarif
66+
67+
- name: Install cosign
68+
uses: sigstore/cosign-installer@v3
69+
70+
- name: Sign image by digest
71+
env:
72+
COSIGN_EXPERIMENTAL: "true"
73+
run: |
74+
cosign sign --yes ghcr.io/disentangle-network/test-tools@${{ steps.build.outputs.digest }}
75+
76+
- name: Generate SBOM
77+
uses: anchore/sbom-action@v0
78+
with:
79+
image: ghcr.io/disentangle-network/test-tools:latest
80+
format: spdx-json
81+
output-file: sbom.spdx.json
82+
83+
- name: Attach SBOM to image
84+
run: |
85+
cosign attach sbom --sbom sbom.spdx.json ghcr.io/disentangle-network/test-tools@${{ steps.build.outputs.digest }}

‎helm/disentangle/templates/tests/test-connection.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@ spec:
1212
restartPolicy: Never
1313
containers:
1414
- name: test-connection
15-
image: alpine/curl:8.12.1
15+
image: "{{ .Values.testImage.repository }}:{{ .Values.testImage.tag }}"
16+
imagePullPolicy: {{ .Values.testImage.pullPolicy }}
1617
securityContext:
1718
runAsNonRoot: true
18-
runAsUser: 65534
19+
runAsUser: 65532
1920
allowPrivilegeEscalation: false
2021

2122
capabilities:

‎helm/disentangle/templates/tests/test-genesis-sync.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@ spec:
1212
restartPolicy: Never
1313
containers:
1414
- name: test-genesis
15-
image: alpine/curl:8.12.1
15+
image: "{{ .Values.testImage.repository }}:{{ .Values.testImage.tag }}"
16+
imagePullPolicy: {{ .Values.testImage.pullPolicy }}
1617
securityContext:
1718
runAsNonRoot: true
18-
runAsUser: 65534
19+
runAsUser: 65532
1920
allowPrivilegeEscalation: false
2021

2122
capabilities:
@@ -32,7 +33,6 @@ spec:
3233
- -c
3334
- |
3435
set -e
35-
apk add --no-cache jq > /dev/null 2>&1
3636
3737
echo "=== Disentangle Genesis Sync Test ==="
3838

‎helm/disentangle/templates/tests/test-rpc-api.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@ spec:
1212
restartPolicy: Never
1313
containers:
1414
- name: test-rpc
15-
image: alpine/curl:8.12.1
15+
image: "{{ .Values.testImage.repository }}:{{ .Values.testImage.tag }}"
16+
imagePullPolicy: {{ .Values.testImage.pullPolicy }}
1617
securityContext:
1718
runAsNonRoot: true
18-
runAsUser: 65534
19+
runAsUser: 65532
1920
allowPrivilegeEscalation: false
2021

2122
capabilities:
@@ -32,7 +33,6 @@ spec:
3233
- -c
3334
- |
3435
set -e
35-
apk add --no-cache jq > /dev/null 2>&1
3636
3737
echo "=== Disentangle RPC API Test ==="
3838

‎helm/disentangle/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@ image:
77
tag: "" # defaults to appVersion from Chart.yaml
88
pullPolicy: IfNotPresent
99

10+
# Test image (includes curl + jq; no runtime apk needed)
11+
testImage:
12+
repository: ghcr.io/disentangle-network/test-tools
13+
tag: "latest"
14+
pullPolicy: IfNotPresent
15+
1016
# Network configuration
1117
nodes:
1218
count: 5 # Number of nodes in the network

‎test-tools/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
FROM cgr.dev/chainguard/wolfi-base:latest
2+
RUN apk update && apk add --no-cache curl jq && rm -rf /var/cache/apk/*
3+
USER 65532
4+
ENTRYPOINT ["/bin/sh"]

‎tests/golden/custom-resources.yaml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -230,10 +230,11 @@ spec:
230230
restartPolicy: Never
231231
containers:
232232
- name: test-connection
233-
image: alpine/curl:8.12.1
233+
image: "ghcr.io/disentangle-network/test-tools:latest"
234+
imagePullPolicy: IfNotPresent
234235
securityContext:
235236
runAsNonRoot: true
236-
runAsUser: 65534
237+
runAsUser: 65532
237238
allowPrivilegeEscalation: false
238239

239240
capabilities:
@@ -309,10 +310,11 @@ spec:
309310
restartPolicy: Never
310311
containers:
311312
- name: test-genesis
312-
image: alpine/curl:8.12.1
313+
image: "ghcr.io/disentangle-network/test-tools:latest"
314+
imagePullPolicy: IfNotPresent
313315
securityContext:
314316
runAsNonRoot: true
315-
runAsUser: 65534
317+
runAsUser: 65532
316318
allowPrivilegeEscalation: false
317319

318320
capabilities:
@@ -329,7 +331,6 @@ spec:
329331
- -c
330332
- |
331333
set -e
332-
apk add --no-cache jq > /dev/null 2>&1
333334
334335
echo "=== Disentangle Genesis Sync Test ==="
335336
@@ -397,10 +398,11 @@ spec:
397398
restartPolicy: Never
398399
containers:
399400
- name: test-rpc
400-
image: alpine/curl:8.12.1
401+
image: "ghcr.io/disentangle-network/test-tools:latest"
402+
imagePullPolicy: IfNotPresent
401403
securityContext:
402404
runAsNonRoot: true
403-
runAsUser: 65534
405+
runAsUser: 65532
404406
allowPrivilegeEscalation: false
405407

406408
capabilities:
@@ -417,7 +419,6 @@ spec:
417419
- -c
418420
- |
419421
set -e
420-
apk add --no-cache jq > /dev/null 2>&1
421422
422423
echo "=== Disentangle RPC API Test ==="
423424

‎tests/golden/default.yaml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -230,10 +230,11 @@ spec:
230230
restartPolicy: Never
231231
containers:
232232
- name: test-connection
233-
image: alpine/curl:8.12.1
233+
image: "ghcr.io/disentangle-network/test-tools:latest"
234+
imagePullPolicy: IfNotPresent
234235
securityContext:
235236
runAsNonRoot: true
236-
runAsUser: 65534
237+
runAsUser: 65532
237238
allowPrivilegeEscalation: false
238239

239240
capabilities:
@@ -309,10 +310,11 @@ spec:
309310
restartPolicy: Never
310311
containers:
311312
- name: test-genesis
312-
image: alpine/curl:8.12.1
313+
image: "ghcr.io/disentangle-network/test-tools:latest"
314+
imagePullPolicy: IfNotPresent
313315
securityContext:
314316
runAsNonRoot: true
315-
runAsUser: 65534
317+
runAsUser: 65532
316318
allowPrivilegeEscalation: false
317319

318320
capabilities:
@@ -329,7 +331,6 @@ spec:
329331
- -c
330332
- |
331333
set -e
332-
apk add --no-cache jq > /dev/null 2>&1
333334
334335
echo "=== Disentangle Genesis Sync Test ==="
335336
@@ -397,10 +398,11 @@ spec:
397398
restartPolicy: Never
398399
containers:
399400
- name: test-rpc
400-
image: alpine/curl:8.12.1
401+
image: "ghcr.io/disentangle-network/test-tools:latest"
402+
imagePullPolicy: IfNotPresent
401403
securityContext:
402404
runAsNonRoot: true
403-
runAsUser: 65534
405+
runAsUser: 65532
404406
allowPrivilegeEscalation: false
405407

406408
capabilities:
@@ -417,7 +419,6 @@ spec:
417419
- -c
418420
- |
419421
set -e
420-
apk add --no-cache jq > /dev/null 2>&1
421422
422423
echo "=== Disentangle RPC API Test ==="
423424

‎tests/golden/full-features.yaml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -338,10 +338,11 @@ spec:
338338
restartPolicy: Never
339339
containers:
340340
- name: test-connection
341-
image: alpine/curl:8.12.1
341+
image: "ghcr.io/disentangle-network/test-tools:latest"
342+
imagePullPolicy: IfNotPresent
342343
securityContext:
343344
runAsNonRoot: true
344-
runAsUser: 65534
345+
runAsUser: 65532
345346
allowPrivilegeEscalation: false
346347

347348
capabilities:
@@ -417,10 +418,11 @@ spec:
417418
restartPolicy: Never
418419
containers:
419420
- name: test-genesis
420-
image: alpine/curl:8.12.1
421+
image: "ghcr.io/disentangle-network/test-tools:latest"
422+
imagePullPolicy: IfNotPresent
421423
securityContext:
422424
runAsNonRoot: true
423-
runAsUser: 65534
425+
runAsUser: 65532
424426
allowPrivilegeEscalation: false
425427

426428
capabilities:
@@ -437,7 +439,6 @@ spec:
437439
- -c
438440
- |
439441
set -e
440-
apk add --no-cache jq > /dev/null 2>&1
441442
442443
echo "=== Disentangle Genesis Sync Test ==="
443444
@@ -505,10 +506,11 @@ spec:
505506
restartPolicy: Never
506507
containers:
507508
- name: test-rpc
508-
image: alpine/curl:8.12.1
509+
image: "ghcr.io/disentangle-network/test-tools:latest"
510+
imagePullPolicy: IfNotPresent
509511
securityContext:
510512
runAsNonRoot: true
511-
runAsUser: 65534
513+
runAsUser: 65532
512514
allowPrivilegeEscalation: false
513515

514516
capabilities:
@@ -525,7 +527,6 @@ spec:
525527
- -c
526528
- |
527529
set -e
528-
apk add --no-cache jq > /dev/null 2>&1
529530
530531
echo "=== Disentangle RPC API Test ==="
531532

‎tests/golden/minimal.yaml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -224,10 +224,11 @@ spec:
224224
restartPolicy: Never
225225
containers:
226226
- name: test-connection
227-
image: alpine/curl:8.12.1
227+
image: "ghcr.io/disentangle-network/test-tools:latest"
228+
imagePullPolicy: IfNotPresent
228229
securityContext:
229230
runAsNonRoot: true
230-
runAsUser: 65534
231+
runAsUser: 65532
231232
allowPrivilegeEscalation: false
232233

233234
capabilities:
@@ -303,10 +304,11 @@ spec:
303304
restartPolicy: Never
304305
containers:
305306
- name: test-genesis
306-
image: alpine/curl:8.12.1
307+
image: "ghcr.io/disentangle-network/test-tools:latest"
308+
imagePullPolicy: IfNotPresent
307309
securityContext:
308310
runAsNonRoot: true
309-
runAsUser: 65534
311+
runAsUser: 65532
310312
allowPrivilegeEscalation: false
311313

312314
capabilities:
@@ -323,7 +325,6 @@ spec:
323325
- -c
324326
- |
325327
set -e
326-
apk add --no-cache jq > /dev/null 2>&1
327328
328329
echo "=== Disentangle Genesis Sync Test ==="
329330
@@ -391,10 +392,11 @@ spec:
391392
restartPolicy: Never
392393
containers:
393394
- name: test-rpc
394-
image: alpine/curl:8.12.1
395+
image: "ghcr.io/disentangle-network/test-tools:latest"
396+
imagePullPolicy: IfNotPresent
395397
securityContext:
396398
runAsNonRoot: true
397-
runAsUser: 65534
399+
runAsUser: 65532
398400
allowPrivilegeEscalation: false
399401

400402
capabilities:
@@ -411,7 +413,6 @@ spec:
411413
- -c
412414
- |
413415
set -e
414-
apk add --no-cache jq > /dev/null 2>&1
415416
416417
echo "=== Disentangle RPC API Test ==="
417418

0 commit comments

Comments
 (0)