From 568058a59b4052ec0528b53cad0f893a278c24e7 Mon Sep 17 00:00:00 2001 From: ogt Date: Tue, 14 Jul 2026 16:15:40 +0800 Subject: [PATCH] feat(security): expand internal runtime mirrors --- .../security/runtime-image-mirror-policy.json | 28 +++++++++++++++++++ .../kube-state-metrics.yaml | 2 +- k8s/npd/node-problem-detector.yaml | 2 +- .../test_runtime_image_mirror_controller.py | 18 +++++++++++- 4 files changed, 47 insertions(+), 3 deletions(-) diff --git a/config/security/runtime-image-mirror-policy.json b/config/security/runtime-image-mirror-policy.json index ea3dd4d5d..2db40ab15 100644 --- a/config/security/runtime-image-mirror-policy.json +++ b/config/security/runtime-image-mirror-policy.json @@ -56,6 +56,34 @@ "name": "event-exporter", "container": "event-exporter" } + }, + { + "asset_id": "runtime-image:kube-state-metrics", + "source_index_digest": "sha256:af8220f534938de121a694cb7314313a6195c9d494fc30bfa6885b08a276bb82", + "platform_digest": "sha256:50502264dbee17136b48d19404ce40d6e57ef9d38aafd95ceb1d977cc92e9519", + "target_registry_digest": "sha256:de7f1c00cc352d86db81aa80b6c75066a1de0c39837548b8c250865dc466820f", + "push_ref": "registry.wooo.work/awoooi/runtime-mirror/kube-state-metrics:v2.10.1-linux-amd64", + "runtime_ref": "192.168.0.110:5000/awoooi/runtime-mirror/kube-state-metrics@sha256:de7f1c00cc352d86db81aa80b6c75066a1de0c39837548b8c250865dc466820f", + "workload": { + "kind": "deployment", + "namespace": "kube-state-metrics", + "name": "kube-state-metrics", + "container": "kube-state-metrics" + } + }, + { + "asset_id": "runtime-image:node-problem-detector", + "source_index_digest": "sha256:a510d7d95d071fa901bf71b10e6c7df3e8361c8383b5cf792e97a3e36dee80b8", + "platform_digest": "sha256:0f75bc8c9e1c6d436f3b18927aa866aea68bb4213cb399c5b2507f1adde212b8", + "target_registry_digest": "sha256:24d60a21b81f9d8ab6174c0f7c7e13efaa04e57601ddd94c34b3dc5861096b7a", + "push_ref": "registry.wooo.work/awoooi/runtime-mirror/node-problem-detector:v0.8.17-linux-amd64", + "runtime_ref": "192.168.0.110:5000/awoooi/runtime-mirror/node-problem-detector@sha256:24d60a21b81f9d8ab6174c0f7c7e13efaa04e57601ddd94c34b3dc5861096b7a", + "workload": { + "kind": "daemonset", + "namespace": "node-problem-detector", + "name": "node-problem-detector", + "container": "node-problem-detector" + } } ] } diff --git a/k8s/kube-state-metrics/kube-state-metrics.yaml b/k8s/kube-state-metrics/kube-state-metrics.yaml index 68e7bf56a..96f9bbec7 100644 --- a/k8s/kube-state-metrics/kube-state-metrics.yaml +++ b/k8s/kube-state-metrics/kube-state-metrics.yaml @@ -127,7 +127,7 @@ spec: fsGroup: 65534 containers: - name: kube-state-metrics - image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1 + image: 192.168.0.110:5000/awoooi/runtime-mirror/kube-state-metrics@sha256:de7f1c00cc352d86db81aa80b6c75066a1de0c39837548b8c250865dc466820f imagePullPolicy: IfNotPresent ports: - name: http-metrics diff --git a/k8s/npd/node-problem-detector.yaml b/k8s/npd/node-problem-detector.yaml index 33e4d9d14..1a864081f 100644 --- a/k8s/npd/node-problem-detector.yaml +++ b/k8s/npd/node-problem-detector.yaml @@ -68,7 +68,7 @@ spec: serviceAccountName: node-problem-detector containers: - name: node-problem-detector - image: registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.17 + image: 192.168.0.110:5000/awoooi/runtime-mirror/node-problem-detector@sha256:24d60a21b81f9d8ab6174c0f7c7e13efaa04e57601ddd94c34b3dc5861096b7a command: - /node-problem-detector - --logtostderr diff --git a/scripts/security/tests/test_runtime_image_mirror_controller.py b/scripts/security/tests/test_runtime_image_mirror_controller.py index 4bcbdeaca..9faa3dab4 100644 --- a/scripts/security/tests/test_runtime_image_mirror_controller.py +++ b/scripts/security/tests/test_runtime_image_mirror_controller.py @@ -36,7 +36,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase): self.assertEqual(policy.work_item_id, "AIA-P0-006-02A") self.assertEqual(policy.risk_level, "high") - self.assertEqual(len(policy.images), 3) + self.assertEqual(len(policy.images), 5) self.assertNotIn("github.com", raw) self.assertNotIn("ghcr.io", raw) self.assertIn('"external_pull_allowed": false', raw) @@ -109,11 +109,27 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase): event = (ROOT / "k8s/observability/event-exporter.yaml").read_text( encoding="utf-8" ) + kube_state_metrics = ( + ROOT / "k8s/kube-state-metrics/kube-state-metrics.yaml" + ).read_text(encoding="utf-8") + node_problem_detector = (ROOT / "k8s/npd/node-problem-detector.yaml").read_text( + encoding="utf-8" + ) self.assertIn(by_asset["runtime-image:kured"].runtime_ref, kured) self.assertIn(by_asset["runtime-image:event-exporter"].runtime_ref, event) + self.assertIn( + by_asset["runtime-image:kube-state-metrics"].runtime_ref, + kube_state_metrics, + ) + self.assertIn( + by_asset["runtime-image:node-problem-detector"].runtime_ref, + node_problem_detector, + ) self.assertNotIn("ghcr.io", kured) self.assertNotIn("ghcr.io", event) + self.assertNotIn("registry.k8s.io", kube_state_metrics) + self.assertNotIn("registry.k8s.io", node_problem_detector) def test_controller_and_cd_never_pull_external_images(self) -> None: controller_source = CONTROLLER_PATH.read_text(encoding="utf-8")