wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(security): project runtime service asset types

Browse Source
This commit is contained in:
ogt
2026-07-14 14:24:46 +08:00
parent f963452b3e
commit d4bc3cb453
2 changed files with 481 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

202
apps/api/tests/test_asset_scanner_job.py
View File

@@ -554,6 +554,106 @@ def test_k8s_metadata_assets_never_read_volume_secret_or_command_data() -> None:
assert secret["metadata"]["secret_value_read"] is False
def test_workload_network_and_service_registry_projections_are_bounded() -> None:
web_assets, web_relationships = (
asset_scanner_job._build_workload_component_assets(
{
"metadata": {
"namespace": "awoooi-prod",
"name": "awoooi-web",
"labels": {
"app": "awoooi-web",
"system": "awoooi",
},
}
},
"Deployment",
)
)
log_assets, _ = asset_scanner_job._build_workload_component_assets(
{
"metadata": {
"namespace": "observability",
"name": "otel-collector",
"labels": {
"app.kubernetes.io/component": "log-collector",
},
}
},
"DaemonSet",
)
network = asset_scanner_job._build_service_network_asset(
{
"metadata": {
"namespace": "awoooi-prod",
"name": "awoooi-api",
"labels": {"system": "awoooi"},
},
"spec": {
"type": "ClusterIP",
"clusterIP": "10.43.0.10",
"ports": [
{
"name": "http",
"protocol": "TCP",
"port": 80,
"targetPort": 8000,
}
],
},
}
)
registry_assets, registry_relationships = (
asset_scanner_job._collect_service_registry_assets(
{
"metadata": {
"namespace": "awoooi-prod",
"name": "service-registry",
},
"data": {
"service-registry.yaml": """
services:
- name: grafana
display_name: Grafana
host: 192.168.0.110
stateful_level: STANDARD_HITL
containers: [grafana]
- name: redis
display_name: Redis cache
host: 192.168.0.188
stateful_level: CRITICAL_HITL
containers: [redis]
- name: sentry-redis
display_name: Sentry task queue
host: 192.168.0.110
stateful_level: CRITICAL_HITL
containers: [sentry-redis]
""",
},
}
)
)
assert [asset["asset_type"] for asset in web_assets] == ["frontend"]
assert web_relationships[0]["to_key"] == (
"k8s/deployment/awoooi-prod/awoooi-web"
)
assert [asset["asset_type"] for asset in log_assets] == ["log_stream"]
assert network["asset_type"] == "network"
assert network["metadata"]["packet_payload_read"] is False
assert {asset["asset_type"] for asset in registry_assets} == {
"dashboard",
"cache",
"message_queue",
}
assert all(
asset["metadata"]["raw_config_persisted"] is False
and asset["metadata"]["secret_value_read"] is False
for asset in registry_assets
)
assert len(registry_relationships) == len(registry_assets)
def test_runtime_collection_integrates_new_asset_types_and_reconciliation_prefixes(
monkeypatch,
) -> None:
@@ -584,6 +684,94 @@ def test_runtime_collection_integrates_new_asset_types_and_reconciliation_prefix
}
]
}
if resource == "deployments":
return {
"items": [
{
"metadata": {
"namespace": "awoooi-prod",
"name": "awoooi-web",
"labels": {
"app": "awoooi-web",
"system": "awoooi",
},
},
"spec": {},
"status": {},
},
{
"metadata": {
"namespace": "awoooi-prod",
"name": "awoooi-api",
"labels": {
"app": "awoooi-api",
"system": "awoooi",
},
},
"spec": {},
"status": {},
},
]
}
if resource == "daemonsets":
return {
"items": [
{
"metadata": {
"namespace": "observability",
"name": "otel-collector",
"labels": {
"app.kubernetes.io/component": "log-collector"
},
},
"spec": {},
"status": {},
}
]
}
if resource == "services":
return {
"items": [
{
"metadata": {
"namespace": "awoooi-prod",
"name": "awoooi-api",
"labels": {"system": "awoooi"},
},
"spec": {
"type": "ClusterIP",
"clusterIP": "10.43.0.10",
"ports": [{"port": 80, "targetPort": 8000}],
},
}
]
}
if resource == "configmaps":
return {
"items": [
{
"metadata": {
"namespace": "awoooi-prod",
"name": "service-registry",
},
"data": {
"service-registry.yaml": """
services:
- name: grafana
display_name: Grafana
host: 192.168.0.110
stateful_level: STANDARD_HITL
containers: [grafana]
- name: sentry-redis
display_name: Sentry task queue
host: 192.168.0.110
stateful_level: CRITICAL_HITL
containers: [sentry-redis]
""",
},
}
]
}
if resource == "ingresses":
return {
"items": [
@@ -663,6 +851,13 @@ def test_runtime_collection_integrates_new_asset_types_and_reconciliation_prefix
"api_endpoint",
"certificate",
"scheduled_job",
"network",
"frontend",
"backend",
"log_stream",
"dashboard",
"cache",
"message_queue",
} <= {asset["asset_type"] for asset in assets}
assert {
"k8s/secret-ref/",
@@ -671,6 +866,13 @@ def test_runtime_collection_integrates_new_asset_types_and_reconciliation_prefix
"k8s/ingress-route/",
"k8s/certificate-ref/",
"k8s/cronjob/",
"k8s/network/service/",
"k8s/component/frontend/deployment/",
"k8s/component/backend/deployment/",
"k8s/component/log_stream/daemonset/",
"service-registry/dashboard/",
"service-registry/cache/",
"service-registry/message_queue/",
} <= set(prefixes)
assert any(
relationship["to_key"] == "k8s/secret-ref/prod/database-ref"