ms2k/remora
SHA256
Watch
0
Code Releases Activity

Enforce immutable supply chain defaults

Browse source
This commit is contained in:
ms2k 2026-08-21 14:25:58 +09:00
commit 19ac156f4b
1 changed files with 187 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

19
tests/kind/deployment/run.sh
View file

@ -181,11 +181,11 @@ write_helm_values() {
fi
cat > "$RUNTIME/deployment-values.yaml" <<EOF
api:
image: {repository: remora-api, tag: local, digest: "", pullPolicy: Never}
image: {repository: remora-api, tag: local, digest: "", allowTag: true, pullPolicy: Never}
worker:
image: {repository: remora-worker, tag: local, digest: "", pullPolicy: Never}
image: {repository: remora-worker, tag: local, digest: "", allowTag: true, pullPolicy: Never}
web:
image: {repository: remora-web, tag: local, digest: "", pullPolicy: Never}
image: {repository: remora-web, tag: local, digest: "", allowTag: true, pullPolicy: Never}
publicOrigin: $public_origin
oidcClientId: remora-web
podDnsPolicy: None
@ -209,6 +209,7 @@ target:
defaultPrefix: "$target_prefix"
vault:
image: "$VAULT_LOCAL_IMAGE"
allowTag: true
address: http://vault:8200
path: "$vault_path"
kubernetesAuthMount: auth/remora-kubernetes
@ -388,10 +389,20 @@ reject_chart_values() {
validate_deployment_assets() {
local chart="$ROOT/deploy/charts/remora"
helm lint "$chart"
local tag_args=(
--set api.image.allowTag=true
--set worker.image.allowTag=true
--set web.image.allowTag=true
)
reject_chart_values "mutable application image defaults"
reject_chart_values "a mutable Vault image" \
"${tag_args[@]}" \
--set-string vault.image=hashicorp/vault:latest
helm lint "$chart" "${tag_args[@]}"
umask 077
helm template remora "$chart" \
--namespace "$FIXTURE_NAMESPACE" \
"${tag_args[@]}" \
--set observability.prometheusRule.enabled=true \
> "$RUNTIME/deployment-policy-rendered.yaml"
grep -q '^kind: NetworkPolicy$' "$RUNTIME/deployment-policy-rendered.yaml"