wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(security): stage local path provisioner image
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 1m10s
Details
CD Pipeline / build-and-deploy (push) Successful in 14m7s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ogt
2026-07-15 08:09:40 +08:00
parent 088d8a509d
commit 315c795cec
2 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
config/security/runtime-image-mirror-staging-policy.json
View File

@@ -67,6 +67,19 @@
"name": "metrics-server",
"container": "metrics-server"
}
},
{
"asset_id": "runtime-image:local-path-provisioner-0.0.34-canary",
"source_index_digest": "sha256:6ff68ebe98bc623b45ad22c28be84f8a08214982710f3247d5862e9bccce73ef",
"platform_digest": "sha256:90745b5457d61b84362ea2aeeb06caef4d576c99861eaff4c7bfe9b36e1cf8d7",
"source_config_digest": "sha256:acccaf97bcb578daff51c6246e47babbca6e998e4225aa230544684cf147d6c1",
"push_ref": "registry.wooo.work/awoooi/runtime-mirror/local-path-provisioner:v0.0.34-linux-amd64",
"workload": {
"kind": "deployment",
"namespace": "kube-system",
"name": "local-path-provisioner",
"container": "local-path-provisioner"
}
}
]
}

25
scripts/security/tests/test_runtime_image_mirror_controller.py
View File

@@ -215,12 +215,13 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(policy.work_item_id, "AIA-P0-006-02B")
self.assertEqual(policy.risk_level, "high")
self.assertEqual(len(policy.images), 4)
self.assertEqual(len(policy.images), 5)
by_asset = {image.asset_id: image for image in policy.images}
self.assertEqual(
set(by_asset),
{
"runtime-image:argocd-v3.3.6-canary",
"runtime-image:local-path-provisioner-0.0.34-canary",
"runtime-image:metrics-server-0.8.1-canary",
"runtime-image:redis-8.2.3-canary",
"runtime-image:vpa-recommender-1.6.0-canary",
@@ -289,6 +290,28 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(metrics.workload.name, "metrics-server")
self.assertEqual(metrics.workload.container, "metrics-server")
self.assertEqual(metrics.workload.container_kind, "container")
local_path = by_asset[
"runtime-image:local-path-provisioner-0.0.34-canary"
]
self.assertEqual(
local_path.source_index_digest,
"sha256:6ff68ebe98bc623b45ad22c28be84f8a08214982710f3247d5862e9bccce73ef",
)
self.assertEqual(
local_path.platform_digest,
"sha256:90745b5457d61b84362ea2aeeb06caef4d576c99861eaff4c7bfe9b36e1cf8d7",
)
self.assertEqual(
local_path.source_config_digest,
"sha256:acccaf97bcb578daff51c6246e47babbca6e998e4225aa230544684cf147d6c1",
)
self.assertEqual(local_path.runtime_repository, "local-path-provisioner")
self.assertEqual(local_path.workload.kind, "deployment")
self.assertEqual(local_path.workload.namespace, "kube-system")
self.assertEqual(local_path.workload.name, "local-path-provisioner")
self.assertEqual(local_path.workload.container, "local-path-provisioner")
self.assertEqual(local_path.workload.container_kind, "container")
self.assertNotIn("github.com", raw)
self.assertNotIn("ghcr.io", raw)
self.assertIn('"external_pull_allowed": false', raw)