wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(security): stage VPA recommender image
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m15s
Details
CD Pipeline / build-and-deploy (push) Successful in 13m32s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m10s
Details

Browse Source
This commit is contained in:
ogt
2026-07-15 04:24:02 +08:00
parent 72a414ed2f
commit 956b55d66c
2 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
config/security/runtime-image-mirror-staging-policy.json
View File

@@ -41,6 +41,19 @@
"name": "argocd-redis", "name": "argocd-redis",
"container": "redis" "container": "redis"
} }
},
{
"asset_id": "runtime-image:vpa-recommender-1.6.0-canary",
"source_index_digest": "sha256:4af365370c187e4eb60302e937b18a188774698b049a1bfdd77d43e51b30abec",
"platform_digest": "sha256:f7da718d281d5e880e966d0182ffb2160b82517c7bc3a38f8002b49e7a4bd0a1",
"source_config_digest": "sha256:05526683ba80f70887ef5622c4ee7d78e1e0482d2a9e2f0e29ad92c32cb73819",
"push_ref": "registry.wooo.work/awoooi/runtime-mirror/vpa-recommender:1.6.0-linux-amd64",
"workload": {
"kind": "deployment",
"namespace": "kube-system",
"name": "vpa-recommender",
"container": "recommender"
}
} }
] ]
} }

23
scripts/security/tests/test_runtime_image_mirror_controller.py
View File

@@ -98,13 +98,14 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(policy.work_item_id, "AIA-P0-006-02B") self.assertEqual(policy.work_item_id, "AIA-P0-006-02B")
self.assertEqual(policy.risk_level, "high") self.assertEqual(policy.risk_level, "high")
self.assertEqual(len(policy.images), 2) self.assertEqual(len(policy.images), 3)
by_asset = {image.asset_id: image for image in policy.images} by_asset = {image.asset_id: image for image in policy.images}
self.assertEqual( self.assertEqual(
set(by_asset), set(by_asset),
{ {
"runtime-image:argocd-v3.3.6-canary", "runtime-image:argocd-v3.3.6-canary",
"runtime-image:redis-8.2.3-canary", "runtime-image:redis-8.2.3-canary",
"runtime-image:vpa-recommender-1.6.0-canary",
}, },
) )
argocd = by_asset["runtime-image:argocd-v3.3.6-canary"] argocd = by_asset["runtime-image:argocd-v3.3.6-canary"]
@@ -130,6 +131,26 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
self.assertEqual(redis.workload.name, "argocd-redis") self.assertEqual(redis.workload.name, "argocd-redis")
self.assertEqual(redis.workload.container, "redis") self.assertEqual(redis.workload.container, "redis")
self.assertEqual(redis.workload.container_kind, "container") self.assertEqual(redis.workload.container_kind, "container")
vpa = by_asset["runtime-image:vpa-recommender-1.6.0-canary"]
self.assertEqual(
vpa.source_index_digest,
"sha256:4af365370c187e4eb60302e937b18a188774698b049a1bfdd77d43e51b30abec",
)
self.assertEqual(
vpa.platform_digest,
"sha256:f7da718d281d5e880e966d0182ffb2160b82517c7bc3a38f8002b49e7a4bd0a1",
)
self.assertEqual(
vpa.source_config_digest,
"sha256:05526683ba80f70887ef5622c4ee7d78e1e0482d2a9e2f0e29ad92c32cb73819",
)
self.assertEqual(vpa.runtime_repository, "vpa-recommender")
self.assertEqual(vpa.workload.kind, "deployment")
self.assertEqual(vpa.workload.namespace, "kube-system")
self.assertEqual(vpa.workload.name, "vpa-recommender")
self.assertEqual(vpa.workload.container, "recommender")
self.assertEqual(vpa.workload.container_kind, "container")
self.assertNotIn("github.com", raw) self.assertNotIn("github.com", raw)
self.assertNotIn("ghcr.io", raw) self.assertNotIn("ghcr.io", raw)
self.assertIn('"external_pull_allowed": false', raw) self.assertIn('"external_pull_allowed": false', raw)