wehub-resource-sync
d25d482dc2
Publish CLI Package / publish-npm (push) Waiting to run
Publish Python SDK / publish-pypi (push) Waiting to run
Publish TypeScript SDK / publish-npm (push) Waiting to run
CI / Migrate Dev DB (push) Has been skipped
CI / Detect Version (push) Has been cancelled
CI / Migrate DB (push) Has been cancelled
CI / Build Dev ECR (./docker/app.Dockerfile, ECR_APP) (push) Has been cancelled
CI / Build Dev ECR (./docker/db.Dockerfile, ECR_MIGRATIONS) (push) Has been cancelled
CI / Build Dev ECR (./docker/pii.Dockerfile, ECR_PII) (push) Has been cancelled
CI / Build Dev ECR (./docker/realtime.Dockerfile, ECR_REALTIME) (push) Has been cancelled
CI / Deploy Trigger.dev (Dev) (push) Has been cancelled
CI / Build AMD64 (./docker/app.Dockerfile, ECR_APP, ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Build AMD64 (./docker/db.Dockerfile, ECR_MIGRATIONS, ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Build AMD64 (./docker/pii.Dockerfile, ECR_PII, ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Build AMD64 (./docker/realtime.Dockerfile, ECR_REALTIME, ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/app.Dockerfile, ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/db.Dockerfile, ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/pii.Dockerfile, ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/realtime.Dockerfile, ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Check Docs Changes (push) Has been cancelled
CI / Process Docs (push) Has been cancelled
CI / Create GitHub Release (push) Has been cancelled
CI / Test and Build (push) Has been cancelled
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
suite: telemetry — Restricted Pod Security Standard hardening (best-practices fix regression net)
|
|
release:
|
|
name: t
|
|
namespace: sim
|
|
templates:
|
|
- telemetry.yaml
|
|
|
|
tests:
|
|
- it: pod-level security context preserves the collector's original UID/GID/fsGroup and adds seccompProfile
|
|
set:
|
|
telemetry.enabled: true
|
|
documentSelector:
|
|
path: kind
|
|
value: Deployment
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsUser
|
|
value: 10001
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsGroup
|
|
value: 10001
|
|
- equal:
|
|
path: spec.template.spec.securityContext.fsGroup
|
|
value: 10001
|
|
- equal:
|
|
path: spec.template.spec.securityContext.runAsNonRoot
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext.seccompProfile.type
|
|
value: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: false
|
|
|
|
- it: container-level security context matches the Restricted profile (same as every other workload)
|
|
set:
|
|
telemetry.enabled: true
|
|
documentSelector:
|
|
path: kind
|
|
value: Deployment
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
|
|
value: false
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.capabilities.drop[0]
|
|
value: ALL
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.runAsNonRoot
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.seccompProfile.type
|
|
value: RuntimeDefault
|