feat(security): stage VPA recommender image

config/security/runtime-image-mirror-staging-policy.json

@@ -41,6 +41,19 @@
         "name": "argocd-redis",
         "container": "redis"
       }
+    },
+    {
+      "asset_id": "runtime-image:vpa-recommender-1.6.0-canary",
+      "source_index_digest": "sha256:4af365370c187e4eb60302e937b18a188774698b049a1bfdd77d43e51b30abec",
+      "platform_digest": "sha256:f7da718d281d5e880e966d0182ffb2160b82517c7bc3a38f8002b49e7a4bd0a1",
+      "source_config_digest": "sha256:05526683ba80f70887ef5622c4ee7d78e1e0482d2a9e2f0e29ad92c32cb73819",
+      "push_ref": "registry.wooo.work/awoooi/runtime-mirror/vpa-recommender:1.6.0-linux-amd64",
+      "workload": {
+        "kind": "deployment",
+        "namespace": "kube-system",
+        "name": "vpa-recommender",
+        "container": "recommender"
+      }
     }
   ]
 }

scripts/security/tests/test_runtime_image_mirror_controller.py

@@ -98,13 +98,14 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
 
         self.assertEqual(policy.work_item_id, "AIA-P0-006-02B")
         self.assertEqual(policy.risk_level, "high")
-        self.assertEqual(len(policy.images), 2)
+        self.assertEqual(len(policy.images), 3)
         by_asset = {image.asset_id: image for image in policy.images}
         self.assertEqual(
             set(by_asset),
             {
                 "runtime-image:argocd-v3.3.6-canary",
                 "runtime-image:redis-8.2.3-canary",
+                "runtime-image:vpa-recommender-1.6.0-canary",
             },
         )
         argocd = by_asset["runtime-image:argocd-v3.3.6-canary"]
@@ -130,6 +131,26 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
         self.assertEqual(redis.workload.name, "argocd-redis")
         self.assertEqual(redis.workload.container, "redis")
         self.assertEqual(redis.workload.container_kind, "container")
+
+        vpa = by_asset["runtime-image:vpa-recommender-1.6.0-canary"]
+        self.assertEqual(
+            vpa.source_index_digest,
+            "sha256:4af365370c187e4eb60302e937b18a188774698b049a1bfdd77d43e51b30abec",
+        )
+        self.assertEqual(
+            vpa.platform_digest,
+            "sha256:f7da718d281d5e880e966d0182ffb2160b82517c7bc3a38f8002b49e7a4bd0a1",
+        )
+        self.assertEqual(
+            vpa.source_config_digest,
+            "sha256:05526683ba80f70887ef5622c4ee7d78e1e0482d2a9e2f0e29ad92c32cb73819",
+        )
+        self.assertEqual(vpa.runtime_repository, "vpa-recommender")
+        self.assertEqual(vpa.workload.kind, "deployment")
+        self.assertEqual(vpa.workload.namespace, "kube-system")
+        self.assertEqual(vpa.workload.name, "vpa-recommender")
+        self.assertEqual(vpa.workload.container, "recommender")
+        self.assertEqual(vpa.workload.container_kind, "container")
         self.assertNotIn("github.com", raw)
         self.assertNotIn("ghcr.io", raw)
         self.assertIn('"external_pull_allowed": false', raw)