wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(security): expand internal runtime mirrors

Browse Source
This commit is contained in:
ogt
2026-07-14 16:15:40 +08:00
parent 33f1c0b8f4
commit 568058a59b
4 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
config/security/runtime-image-mirror-policy.json
View File

@@ -56,6 +56,34 @@
"name": "event-exporter",
"container": "event-exporter"
}
},
{
"asset_id": "runtime-image:kube-state-metrics",
"source_index_digest": "sha256:af8220f534938de121a694cb7314313a6195c9d494fc30bfa6885b08a276bb82",
"platform_digest": "sha256:50502264dbee17136b48d19404ce40d6e57ef9d38aafd95ceb1d977cc92e9519",
"target_registry_digest": "sha256:de7f1c00cc352d86db81aa80b6c75066a1de0c39837548b8c250865dc466820f",
"push_ref": "registry.wooo.work/awoooi/runtime-mirror/kube-state-metrics:v2.10.1-linux-amd64",
"runtime_ref": "192.168.0.110:5000/awoooi/runtime-mirror/kube-state-metrics@sha256:de7f1c00cc352d86db81aa80b6c75066a1de0c39837548b8c250865dc466820f",
"workload": {
"kind": "deployment",
"namespace": "kube-state-metrics",
"name": "kube-state-metrics",
"container": "kube-state-metrics"
}
},
{
"asset_id": "runtime-image:node-problem-detector",
"source_index_digest": "sha256:a510d7d95d071fa901bf71b10e6c7df3e8361c8383b5cf792e97a3e36dee80b8",
"platform_digest": "sha256:0f75bc8c9e1c6d436f3b18927aa866aea68bb4213cb399c5b2507f1adde212b8",
"target_registry_digest": "sha256:24d60a21b81f9d8ab6174c0f7c7e13efaa04e57601ddd94c34b3dc5861096b7a",
"push_ref": "registry.wooo.work/awoooi/runtime-mirror/node-problem-detector:v0.8.17-linux-amd64",
"runtime_ref": "192.168.0.110:5000/awoooi/runtime-mirror/node-problem-detector@sha256:24d60a21b81f9d8ab6174c0f7c7e13efaa04e57601ddd94c34b3dc5861096b7a",
"workload": {
"kind": "daemonset",
"namespace": "node-problem-detector",
"name": "node-problem-detector",
"container": "node-problem-detector"
}
}
]
}

2
k8s/kube-state-metrics/kube-state-metrics.yaml
View File

@@ -127,7 +127,7 @@ spec:
fsGroup: 65534
containers:
- name: kube-state-metrics
image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1
image: 192.168.0.110:5000/awoooi/runtime-mirror/kube-state-metrics@sha256:de7f1c00cc352d86db81aa80b6c75066a1de0c39837548b8c250865dc466820f
imagePullPolicy: IfNotPresent
ports:
- name: http-metrics

2
k8s/npd/node-problem-detector.yaml
View File

@@ -68,7 +68,7 @@ spec:
serviceAccountName: node-problem-detector
containers:
- name: node-problem-detector
image: registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.17
image: 192.168.0.110:5000/awoooi/runtime-mirror/node-problem-detector@sha256:24d60a21b81f9d8ab6174c0f7c7e13efaa04e57601ddd94c34b3dc5861096b7a
command:
- /node-problem-detector
- --logtostderr

18
scripts/security/tests/test_runtime_image_mirror_controller.py
View File

@@ -36,7 +36,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(policy.work_item_id, "AIA-P0-006-02A")
self.assertEqual(policy.risk_level, "high")
self.assertEqual(len(policy.images), 3)
self.assertEqual(len(policy.images), 5)
self.assertNotIn("github.com", raw)
self.assertNotIn("ghcr.io", raw)
self.assertIn('"external_pull_allowed": false', raw)
@@ -109,11 +109,27 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
event = (ROOT / "k8s/observability/event-exporter.yaml").read_text(
encoding="utf-8"
)
kube_state_metrics = (
ROOT / "k8s/kube-state-metrics/kube-state-metrics.yaml"
).read_text(encoding="utf-8")
node_problem_detector = (ROOT / "k8s/npd/node-problem-detector.yaml").read_text(
encoding="utf-8"
)
self.assertIn(by_asset["runtime-image:kured"].runtime_ref, kured)
self.assertIn(by_asset["runtime-image:event-exporter"].runtime_ref, event)
self.assertIn(
by_asset["runtime-image:kube-state-metrics"].runtime_ref,
kube_state_metrics,
)
self.assertIn(
by_asset["runtime-image:node-problem-detector"].runtime_ref,
node_problem_detector,
)
self.assertNotIn("ghcr.io", kured)
self.assertNotIn("ghcr.io", event)
self.assertNotIn("registry.k8s.io", kube_state_metrics)
self.assertNotIn("registry.k8s.io", node_problem_detector)
def test_controller_and_cd_never_pull_external_images(self) -> None:
controller_source = CONTROLLER_PATH.read_text(encoding="utf-8")