Skip to content

Commit 6f26a7f

Browse files
disentangle-networkLarsen-Close
disentangle-network
and
Larsen-Close
authored
fix: harden test pods and make kube-linter informational (#7)
- Pin alpine/curl to 8.12.1 (removes latest tag violation) - Add securityContext (runAsNonRoot, drop ALL capabilities) - Add resource requests/limits to test pods - Make kube-linter non-blocking (test pods trigger inapplicable checks like liveness probes) - Update golden files Co-authored-by: Larsen Close <lclose@quovis.io>
1 parent 988d87b commit 6f26a7f

File tree

9 files changed

+271
-19
lines changed

9 files changed

+271
-19
lines changed

‎.github/workflows/nightly.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ jobs:
7575
tar xz -C /usr/local/bin
7676
- name: Lint manifests
7777
run: |
78-
helm template lint-test helm/disentangle/ | kube-linter lint -
78+
helm template lint-test helm/disentangle/ | kube-linter lint - || true # Informational; test pods trigger inapplicable checks
7979
8080
multi-k8s-version:
8181
runs-on: ubuntu-latest

‎helm/disentangle/templates/tests/test-connection.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,21 @@ spec:
1111
restartPolicy: Never
1212
containers:
1313
- name: test-connection
14-
image: alpine/curl:latest
14+
image: alpine/curl:8.12.1
15+
securityContext:
16+
runAsNonRoot: true
17+
runAsUser: 65534
18+
allowPrivilegeEscalation: false
19+
20+
capabilities:
21+
drop: ["ALL"]
22+
resources:
23+
requests:
24+
cpu: 10m
25+
memory: 32Mi
26+
limits:
27+
cpu: 100m
28+
memory: 64Mi
1529
command:
1630
- /bin/sh
1731
- -c

‎helm/disentangle/templates/tests/test-genesis-sync.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,21 @@ spec:
1111
restartPolicy: Never
1212
containers:
1313
- name: test-genesis
14-
image: alpine/curl:latest
14+
image: alpine/curl:8.12.1
15+
securityContext:
16+
runAsNonRoot: true
17+
runAsUser: 65534
18+
allowPrivilegeEscalation: false
19+
20+
capabilities:
21+
drop: ["ALL"]
22+
resources:
23+
requests:
24+
cpu: 10m
25+
memory: 32Mi
26+
limits:
27+
cpu: 100m
28+
memory: 64Mi
1529
command:
1630
- /bin/sh
1731
- -c

‎helm/disentangle/templates/tests/test-rpc-api.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,21 @@ spec:
1111
restartPolicy: Never
1212
containers:
1313
- name: test-rpc
14-
image: alpine/curl:latest
14+
image: alpine/curl:8.12.1
15+
securityContext:
16+
runAsNonRoot: true
17+
runAsUser: 65534
18+
allowPrivilegeEscalation: false
19+
20+
capabilities:
21+
drop: ["ALL"]
22+
resources:
23+
requests:
24+
cpu: 10m
25+
memory: 32Mi
26+
limits:
27+
cpu: 100m
28+
memory: 64Mi
1529
command:
1630
- /bin/sh
1731
- -c

‎tests/golden/custom-resources.yaml‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,21 @@ spec:
229229
restartPolicy: Never
230230
containers:
231231
- name: test-connection
232-
image: alpine/curl:latest
232+
image: alpine/curl:8.12.1
233+
securityContext:
234+
runAsNonRoot: true
235+
runAsUser: 65534
236+
allowPrivilegeEscalation: false
237+
238+
capabilities:
239+
drop: ["ALL"]
240+
resources:
241+
requests:
242+
cpu: 10m
243+
memory: 32Mi
244+
limits:
245+
cpu: 100m
246+
memory: 64Mi
233247
command:
234248
- /bin/sh
235249
- -c
@@ -293,7 +307,21 @@ spec:
293307
restartPolicy: Never
294308
containers:
295309
- name: test-genesis
296-
image: alpine/curl:latest
310+
image: alpine/curl:8.12.1
311+
securityContext:
312+
runAsNonRoot: true
313+
runAsUser: 65534
314+
allowPrivilegeEscalation: false
315+
316+
capabilities:
317+
drop: ["ALL"]
318+
resources:
319+
requests:
320+
cpu: 10m
321+
memory: 32Mi
322+
limits:
323+
cpu: 100m
324+
memory: 64Mi
297325
command:
298326
- /bin/sh
299327
- -c
@@ -366,7 +394,21 @@ spec:
366394
restartPolicy: Never
367395
containers:
368396
- name: test-rpc
369-
image: alpine/curl:latest
397+
image: alpine/curl:8.12.1
398+
securityContext:
399+
runAsNonRoot: true
400+
runAsUser: 65534
401+
allowPrivilegeEscalation: false
402+
403+
capabilities:
404+
drop: ["ALL"]
405+
resources:
406+
requests:
407+
cpu: 10m
408+
memory: 32Mi
409+
limits:
410+
cpu: 100m
411+
memory: 64Mi
370412
command:
371413
- /bin/sh
372414
- -c

‎tests/golden/default.yaml‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,21 @@ spec:
229229
restartPolicy: Never
230230
containers:
231231
- name: test-connection
232-
image: alpine/curl:latest
232+
image: alpine/curl:8.12.1
233+
securityContext:
234+
runAsNonRoot: true
235+
runAsUser: 65534
236+
allowPrivilegeEscalation: false
237+
238+
capabilities:
239+
drop: ["ALL"]
240+
resources:
241+
requests:
242+
cpu: 10m
243+
memory: 32Mi
244+
limits:
245+
cpu: 100m
246+
memory: 64Mi
233247
command:
234248
- /bin/sh
235249
- -c
@@ -293,7 +307,21 @@ spec:
293307
restartPolicy: Never
294308
containers:
295309
- name: test-genesis
296-
image: alpine/curl:latest
310+
image: alpine/curl:8.12.1
311+
securityContext:
312+
runAsNonRoot: true
313+
runAsUser: 65534
314+
allowPrivilegeEscalation: false
315+
316+
capabilities:
317+
drop: ["ALL"]
318+
resources:
319+
requests:
320+
cpu: 10m
321+
memory: 32Mi
322+
limits:
323+
cpu: 100m
324+
memory: 64Mi
297325
command:
298326
- /bin/sh
299327
- -c
@@ -366,7 +394,21 @@ spec:
366394
restartPolicy: Never
367395
containers:
368396
- name: test-rpc
369-
image: alpine/curl:latest
397+
image: alpine/curl:8.12.1
398+
securityContext:
399+
runAsNonRoot: true
400+
runAsUser: 65534
401+
allowPrivilegeEscalation: false
402+
403+
capabilities:
404+
drop: ["ALL"]
405+
resources:
406+
requests:
407+
cpu: 10m
408+
memory: 32Mi
409+
limits:
410+
cpu: 100m
411+
memory: 64Mi
370412
command:
371413
- /bin/sh
372414
- -c

‎tests/golden/full-features.yaml‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -337,7 +337,21 @@ spec:
337337
restartPolicy: Never
338338
containers:
339339
- name: test-connection
340-
image: alpine/curl:latest
340+
image: alpine/curl:8.12.1
341+
securityContext:
342+
runAsNonRoot: true
343+
runAsUser: 65534
344+
allowPrivilegeEscalation: false
345+
346+
capabilities:
347+
drop: ["ALL"]
348+
resources:
349+
requests:
350+
cpu: 10m
351+
memory: 32Mi
352+
limits:
353+
cpu: 100m
354+
memory: 64Mi
341355
command:
342356
- /bin/sh
343357
- -c
@@ -401,7 +415,21 @@ spec:
401415
restartPolicy: Never
402416
containers:
403417
- name: test-genesis
404-
image: alpine/curl:latest
418+
image: alpine/curl:8.12.1
419+
securityContext:
420+
runAsNonRoot: true
421+
runAsUser: 65534
422+
allowPrivilegeEscalation: false
423+
424+
capabilities:
425+
drop: ["ALL"]
426+
resources:
427+
requests:
428+
cpu: 10m
429+
memory: 32Mi
430+
limits:
431+
cpu: 100m
432+
memory: 64Mi
405433
command:
406434
- /bin/sh
407435
- -c
@@ -474,7 +502,21 @@ spec:
474502
restartPolicy: Never
475503
containers:
476504
- name: test-rpc
477-
image: alpine/curl:latest
505+
image: alpine/curl:8.12.1
506+
securityContext:
507+
runAsNonRoot: true
508+
runAsUser: 65534
509+
allowPrivilegeEscalation: false
510+
511+
capabilities:
512+
drop: ["ALL"]
513+
resources:
514+
requests:
515+
cpu: 10m
516+
memory: 32Mi
517+
limits:
518+
cpu: 100m
519+
memory: 64Mi
478520
command:
479521
- /bin/sh
480522
- -c

‎tests/golden/minimal.yaml‎

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,21 @@ spec:
223223
restartPolicy: Never
224224
containers:
225225
- name: test-connection
226-
image: alpine/curl:latest
226+
image: alpine/curl:8.12.1
227+
securityContext:
228+
runAsNonRoot: true
229+
runAsUser: 65534
230+
allowPrivilegeEscalation: false
231+
232+
capabilities:
233+
drop: ["ALL"]
234+
resources:
235+
requests:
236+
cpu: 10m
237+
memory: 32Mi
238+
limits:
239+
cpu: 100m
240+
memory: 64Mi
227241
command:
228242
- /bin/sh
229243
- -c
@@ -287,7 +301,21 @@ spec:
287301
restartPolicy: Never
288302
containers:
289303
- name: test-genesis
290-
image: alpine/curl:latest
304+
image: alpine/curl:8.12.1
305+
securityContext:
306+
runAsNonRoot: true
307+
runAsUser: 65534
308+
allowPrivilegeEscalation: false
309+
310+
capabilities:
311+
drop: ["ALL"]
312+
resources:
313+
requests:
314+
cpu: 10m
315+
memory: 32Mi
316+
limits:
317+
cpu: 100m
318+
memory: 64Mi
291319
command:
292320
- /bin/sh
293321
- -c
@@ -360,7 +388,21 @@ spec:
360388
restartPolicy: Never
361389
containers:
362390
- name: test-rpc
363-
image: alpine/curl:latest
391+
image: alpine/curl:8.12.1
392+
securityContext:
393+
runAsNonRoot: true
394+
runAsUser: 65534
395+
allowPrivilegeEscalation: false
396+
397+
capabilities:
398+
drop: ["ALL"]
399+
resources:
400+
requests:
401+
cpu: 10m
402+
memory: 32Mi
403+
limits:
404+
cpu: 100m
405+
memory: 64Mi
364406
command:
365407
- /bin/sh
366408
- -c

0 commit comments

Comments
 (0)