Skip to content

Commit b93a4e4

Browse files
slntoppclaude
slntopp
and
claude
authored
Tests and improvements v13-beta (#1409)
* fix: node scanning errors no longer block other scan types When node scanning setup fails (e.g. hostPath rejected on GKE Autopilot), the reconciler now sets the NodeScanningDegraded condition and continues reconciling containers, k8s resources, and resource watcher. The error is still returned at the end so the controller requeues to retry. Previously, any node scanning error would abort the entire reconciliation, preventing all other scan types from being set up. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add e2e test suite for GKE clusters Adds a Terraform + shell-based e2e test suite that provisions a GKE cluster (Autopilot or Standard), builds and deploys the operator from the current branch, and verifies scanning works. Includes two test cases: - Fresh deploy: build, deploy, configure, verify - Upgrade: install baseline release, verify, upgrade to current branch, verify Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: ensure smooth Helm upgrade path for CRDs and deprecated resources Previously, CRDs were shipped in the Helm `crds/` directory which Helm only processes on initial install, never on upgrade. Since v12.x shipped CRDs as template resources, upgrading to a chart that moved them to `crds/` caused Helm to delete the template-managed CRDs while the new ones were never installed — breaking the operator. This commit: - Restores CRDs as Helm template resources (via .Files.Get from files/crds/) so they are managed across install and upgrade - Removes the crds/ directory to avoid duplication - Adds a pre-upgrade hook as belt-and-suspenders for CRD updates - Makes operator startup resilient when MondooOperatorConfig CRD is absent (skips controller registration, uses defaults in reconciler) - Adds RBAC for admissionregistration.k8s.io so deprecated webhook resources can be cleaned up on upgrade * fix: downgrade conflict errors to info level in status updates Optimistic concurrency conflicts on MondooAuditConfig status updates are expected when multiple reconciliation loops run concurrently. The controller-runtime automatically requeues on conflict, so these are not errors. Downgrade to info-level logging to reduce noise. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add nolint:gosec annotations for new gosec rules G117 (marshaling structs with secret-pattern fields) and G118 (stored cancel func) are false positives in these contexts — test fixtures, internal credential structs, and a debouncer that stores cancel for later use. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 6048aab commit b93a4e4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2614
-44
lines changed

‎.github/actions/spelling/expect.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ irsa
1313
kustomization
1414
mcr
1515
mondoooperatorconfig
16+
nginx
1617
oidc
1718
openssl
1819
psat
@@ -24,4 +25,5 @@ SResources
2425
spiffe
2526
SVIDs
2627
tekton
28+
tpl
2729
wif

‎.gitignore‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,17 @@ tests/integration/_output
5252
/cnspec
5353

5454
package.json
55-
.env
55+
.env
56+
57+
# Terraform
58+
.terraform
59+
*.tfstate
60+
.terraform.lock.hcl
61+
terraform.tfvars
62+
.terraform.tfstate.lock.info
63+
terraform.tfstate.backup
64+
65+
# tests artifacts
66+
tests/e2e/terraform/kubeconfig
67+
tests/e2e/terraform/gke_gcloud_auth_plugin_cache
68+
tests/e2e/terraform/mondoo.json

‎charts/mondoo-operator/files/crds/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 1302 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/mondoo-operator/files/crds/k8s.mondoo.com_mondoooperatorconfigs.yaml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.20.0
7+
name: mondoooperatorconfigs.k8s.mondoo.com
8+
spec:
9+
group: k8s.mondoo.com
10+
names:
11+
kind: MondooOperatorConfig
12+
listKind: MondooOperatorConfigList
13+
plural: mondoooperatorconfigs
14+
singular: mondoooperatorconfig
15+
scope: Cluster
16+
versions:
17+
- name: v1alpha2
18+
schema:
19+
openAPIV3Schema:
20+
description: MondooOperatorConfig is the Schema for the mondoooperatorconfigs
21+
API
22+
properties:
23+
apiVersion:
24+
description: |-
25+
APIVersion defines the versioned schema of this representation of an object.
26+
Servers should convert recognized schemas to the latest internal value, and
27+
may reject unrecognized values.
28+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
29+
type: string
30+
kind:
31+
description: |-
32+
Kind is a string value representing the REST resource this object represents.
33+
Servers may infer this from the endpoint the client submits requests to.
34+
Cannot be updated.
35+
In CamelCase.
36+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
37+
type: string
38+
metadata:
39+
type: object
40+
spec:
41+
description: MondooOperatorConfigSpec defines the desired state of MondooOperatorConfig
42+
properties:
43+
containerProxy:
44+
description: ContainerProxy specifies a proxy to use for container
45+
images.
46+
type: string
47+
httpProxy:
48+
description: HttpProxy specifies a proxy to use for HTTP requests
49+
to the Mondoo Platform.
50+
type: string
51+
httpsProxy:
52+
description: HttpsProxy specifies a proxy to use for HTTPS requests
53+
to the Mondoo Platform.
54+
type: string
55+
imagePullSecrets:
56+
description: |-
57+
ImagePullSecrets specifies the name of the Secret to use for pulling images for all Mondoo components.
58+
The secret must be of type kubernetes.io/dockerconfigjson.
59+
items:
60+
description: |-
61+
LocalObjectReference contains enough information to let you locate the
62+
referenced object inside the same namespace.
63+
properties:
64+
name:
65+
default: ""
66+
description: |-
67+
Name of the referent.
68+
This field is effectively required, but due to backwards compatibility is
69+
allowed to be empty. Instances of this type with an empty value here are
70+
almost certainly wrong.
71+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
72+
type: string
73+
type: object
74+
x-kubernetes-map-type: atomic
75+
type: array
76+
imageRegistry:
77+
description: |-
78+
ImageRegistry specifies a custom container image registry to use for all Mondoo images.
79+
This allows using a private registry mirror (e.g., artifactory.example.com/ghcr.io.docker).
80+
If set, all image references will be prefixed with this registry.
81+
Deprecated: Use RegistryMirrors for more flexible registry mapping.
82+
type: string
83+
metrics:
84+
description: Metrics controls the enabling/disabling of metrics report
85+
of mondoo-operator
86+
properties:
87+
enable:
88+
type: boolean
89+
resourceLabels:
90+
additionalProperties:
91+
type: string
92+
description: |-
93+
ResourceLabels allows providing a list of extra labels to apply to the metrics-related
94+
resources (eg. ServiceMonitor)
95+
type: object
96+
type: object
97+
noProxy:
98+
description: NoProxy specifies a comma-separated list of hosts that
99+
should not use the proxy.
100+
type: string
101+
registryMirrors:
102+
additionalProperties:
103+
type: string
104+
description: |-
105+
RegistryMirrors specifies a mapping of public registries to private mirrors.
106+
The key is the public registry (e.g., "ghcr.io", "docker.io", "quay.io")
107+
and the value is the private mirror (e.g., "artifactory.example.com/ghcr.io.docker").
108+
Example:
109+
registryMirrors:
110+
ghcr.io: artifactory.example.com/ghcr.io.docker
111+
docker.io: artifactory.example.com/hub.docker.com
112+
type: object
113+
skipContainerResolution:
114+
description: Allows skipping Image resolution from upstream repository
115+
type: boolean
116+
skipProxyForCnspec:
117+
description: |-
118+
SkipProxyForCnspec disables proxy environment variables for cnspec-based components
119+
(scan-api, container scanning). Use this when the Mondoo API is accessible directly
120+
without proxy (e.g., internal mirror) but other components need proxy for external access.
121+
Default: false (proxy settings are applied to all components)
122+
type: boolean
123+
type: object
124+
status:
125+
description: MondooOperatorConfigStatus defines the observed state of
126+
MondooOperatorConfig
127+
properties:
128+
conditions:
129+
description: Conditions includes more detailed status for the mondoo
130+
config
131+
items:
132+
description: Condition contains details for the current condition
133+
of a MondooOperatorConfig
134+
properties:
135+
lastTransitionTime:
136+
description: LastTransitionTime is the last time the condition
137+
transitioned from one status to another.
138+
format: date-time
139+
type: string
140+
lastUpdateTime:
141+
description: LastUpdateTime is the last time the condition was
142+
updated.
143+
format: date-time
144+
type: string
145+
message:
146+
description: Message is a human-readable message indicating
147+
details about last transition.
148+
type: string
149+
reason:
150+
description: Reason is a unique, one-word, CamelCase reason
151+
for the condition's last transition.
152+
type: string
153+
status:
154+
description: Status is the status of the condition.
155+
type: string
156+
type:
157+
description: Type is the type of the condition.
158+
type: string
159+
required:
160+
- status
161+
- type
162+
type: object
163+
type: array
164+
type: object
165+
type: object
166+
served: true
167+
storage: true
168+
subresources:
169+
status: {}

‎charts/mondoo-operator/templates/manager-rbac.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,15 @@ rules:
124124
- get
125125
- list
126126
- watch
127+
- apiGroups:
128+
- admissionregistration.k8s.io
129+
resources:
130+
- validatingwebhookconfigurations
131+
verbs:
132+
- delete
133+
- get
134+
- list
135+
- watch
127136
- apiGroups:
128137
- monitoring.coreos.com
129138
resources:

‎charts/mondoo-operator/templates/mondooauditconfig-crd.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Copyright (c) Mondoo, Inc.
2+
# SPDX-License-Identifier: BUSL-1.1
3+
#
4+
# On fresh install, Helm installs CRDs from the crds/ directory (before templates).
5+
# On upgrade, crds/ is skipped, so we render CRDs here to keep them current.
6+
{{- if .Release.IsUpgrade }}
7+
{{ .Files.Get "files/crds/k8s.mondoo.com_mondooauditconfigs.yaml" }}
8+
{{- end }}

‎charts/mondoo-operator/templates/mondoooperatorconfig-crd.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Copyright (c) Mondoo, Inc.
2+
# SPDX-License-Identifier: BUSL-1.1
3+
#
4+
# On fresh install, Helm installs CRDs from the crds/ directory (before templates).
5+
# On upgrade, crds/ is skipped, so we render CRDs here to keep them current.
6+
{{- if .Release.IsUpgrade }}
7+
{{ .Files.Get "files/crds/k8s.mondoo.com_mondoooperatorconfigs.yaml" }}
8+
{{- end }}

‎charts/mondoo-operator/templates/pre-upgrade-crds.yaml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Copyright (c) Mondoo, Inc.
2+
# SPDX-License-Identifier: BUSL-1.1
3+
#
4+
# Pre-upgrade hook to ensure CRDs are up-to-date before upgrading the operator.
5+
# Helm only installs CRDs from the crds/ directory on initial install, not on upgrade.
6+
# This hook applies CRDs as templates during pre-upgrade to ensure they are current.
7+
apiVersion: batch/v1
8+
kind: Job
9+
metadata:
10+
name: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
11+
namespace: {{ .Release.Namespace }}
12+
labels:
13+
{{- include "mondoo-operator.labels" . | nindent 4 }}
14+
annotations:
15+
"helm.sh/hook": pre-install,pre-upgrade
16+
"helm.sh/hook-weight": "-5"
17+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
18+
spec:
19+
ttlSecondsAfterFinished: 60
20+
template:
21+
metadata:
22+
labels:
23+
{{- include "mondoo-operator.selectorLabels" . | nindent 8 }}
24+
spec:
25+
serviceAccountName: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
26+
restartPolicy: OnFailure
27+
securityContext:
28+
runAsNonRoot: true
29+
seccompProfile:
30+
type: RuntimeDefault
31+
containers:
32+
- name: crd-upgrade
33+
image: "bitnami/kubectl:latest"
34+
command:
35+
- sh
36+
- -c
37+
- |
38+
kubectl apply --server-side --force-conflicts -f /crds/
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop:
43+
- ALL
44+
readOnlyRootFilesystem: true
45+
resources:
46+
limits:
47+
cpu: 100m
48+
memory: 64Mi
49+
requests:
50+
cpu: 50m
51+
memory: 32Mi
52+
volumeMounts:
53+
- name: crds
54+
mountPath: /crds
55+
readOnly: true
56+
volumes:
57+
- name: crds
58+
configMap:
59+
name: {{ include "mondoo-operator.fullname" . }}-crds
60+
---
61+
apiVersion: v1
62+
kind: ServiceAccount
63+
metadata:
64+
name: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
65+
namespace: {{ .Release.Namespace }}
66+
labels:
67+
{{- include "mondoo-operator.labels" . | nindent 4 }}
68+
annotations:
69+
"helm.sh/hook": pre-install,pre-upgrade
70+
"helm.sh/hook-weight": "-10"
71+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
72+
---
73+
apiVersion: rbac.authorization.k8s.io/v1
74+
kind: ClusterRole
75+
metadata:
76+
name: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
77+
labels:
78+
{{- include "mondoo-operator.labels" . | nindent 4 }}
79+
annotations:
80+
"helm.sh/hook": pre-install,pre-upgrade
81+
"helm.sh/hook-weight": "-10"
82+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
83+
rules:
84+
- apiGroups:
85+
- apiextensions.k8s.io
86+
resources:
87+
- customresourcedefinitions
88+
verbs:
89+
- create
90+
- get
91+
- list
92+
- patch
93+
- update
94+
---
95+
apiVersion: rbac.authorization.k8s.io/v1
96+
kind: ClusterRoleBinding
97+
metadata:
98+
name: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
99+
labels:
100+
{{- include "mondoo-operator.labels" . | nindent 4 }}
101+
annotations:
102+
"helm.sh/hook": pre-install,pre-upgrade
103+
"helm.sh/hook-weight": "-10"
104+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
105+
roleRef:
106+
apiGroup: rbac.authorization.k8s.io
107+
kind: ClusterRole
108+
name: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
109+
subjects:
110+
- kind: ServiceAccount
111+
name: {{ include "mondoo-operator.fullname" . }}-crd-upgrade
112+
namespace: {{ .Release.Namespace }}
113+
---
114+
apiVersion: v1
115+
kind: ConfigMap
116+
metadata:
117+
name: {{ include "mondoo-operator.fullname" . }}-crds
118+
namespace: {{ .Release.Namespace }}
119+
labels:
120+
{{- include "mondoo-operator.labels" . | nindent 4 }}
121+
annotations:
122+
"helm.sh/hook": pre-install,pre-upgrade
123+
"helm.sh/hook-weight": "-10"
124+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
125+
data:
126+
mondooauditconfigs.yaml: |
127+
{{- .Files.Get "files/crds/k8s.mondoo.com_mondooauditconfigs.yaml" | nindent 4 }}
128+
mondoooperatorconfigs.yaml: |
129+
{{- .Files.Get "files/crds/k8s.mondoo.com_mondoooperatorconfigs.yaml" | nindent 4 }}

0 commit comments

Comments
 (0)