wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(security): expand internal runtime mirrors

Browse Source
This commit is contained in:
ogt
2026-07-14 16:15:40 +08:00
parent 33f1c0b8f4
commit 568058a59b
4 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
scripts/security/tests/test_runtime_image_mirror_controller.py
View File

@@ -36,7 +36,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(policy.work_item_id, "AIA-P0-006-02A")
self.assertEqual(policy.risk_level, "high")
self.assertEqual(len(policy.images), 3)
self.assertEqual(len(policy.images), 5)
self.assertNotIn("github.com", raw)
self.assertNotIn("ghcr.io", raw)
self.assertIn('"external_pull_allowed": false', raw)
@@ -109,11 +109,27 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
event = (ROOT / "k8s/observability/event-exporter.yaml").read_text(
encoding="utf-8"
)
kube_state_metrics = (
ROOT / "k8s/kube-state-metrics/kube-state-metrics.yaml"
).read_text(encoding="utf-8")
node_problem_detector = (ROOT / "k8s/npd/node-problem-detector.yaml").read_text(
encoding="utf-8"
)
self.assertIn(by_asset["runtime-image:kured"].runtime_ref, kured)
self.assertIn(by_asset["runtime-image:event-exporter"].runtime_ref, event)
self.assertIn(
by_asset["runtime-image:kube-state-metrics"].runtime_ref,
kube_state_metrics,
)
self.assertIn(
by_asset["runtime-image:node-problem-detector"].runtime_ref,
node_problem_detector,
)
self.assertNotIn("ghcr.io", kured)
self.assertNotIn("ghcr.io", event)
self.assertNotIn("registry.k8s.io", kube_state_metrics)
self.assertNotIn("registry.k8s.io", node_problem_detector)
def test_controller_and_cd_never_pull_external_images(self) -> None:
controller_source = CONTROLLER_PATH.read_text(encoding="utf-8")