panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update lockdown test to test the production example

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-03-21 21:55:20 +01:00
parent 04a1305556
commit 4f85802ae0
8 changed files with 69 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/lockdown/.env
-1
View File
@@ -1 +0,0 @@
export EXTRA_HELM_ARGS="--values=examples/production/values.yaml"
.github/tests/lockdown/post-install.sh
-48
View File
@@ -1,48 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### spire
| workload | Status |
| -------- | ------ |
| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) |
| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) |
| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) |
| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) |
EOF
if [ $1 -ne 0 ]; then
echo
echo '```'
echo '==> Events of namespace spire-server'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server'
kubectl --request-timeout=30s get events --output wide --namespace spire-server
echo '........................................................................................................................'
echo '<== Events of namespace spire-server'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server'
kubectl --request-timeout=30s describe pods --namespace spire-server
echo '========================================================================================================================'
echo '==> Events of namespace spire-system'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system'
kubectl --request-timeout=30s get events --output wide --namespace spire-system
echo '........................................................................................................................'
echo '<== Events of namespace spire-system'
echo '........................................................................................................................'
echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
kubectl --request-timeout=30s describe pods --namespace spire-system
echo '========================================================================================================================'
kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
echo '========================================================================================================================'
echo '```'
fi | cat >> "$GITHUB_STEP_SUMMARY"
.github/tests/lockdown/pre-install.sh
-5
View File
@@ -1,5 +0,0 @@
#!/bin/bash
kubectl create namespace "spire-system"
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
kubectl create namespace "spire-server"
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
.github/tests/lockdown/values.yaml
-5
View File
@@ -1,5 +0,0 @@
spiffe-oidc-discovery-provider:
namespaceOverride: spire-server
spire-server:
namespaceOverride: spire-server
.github/tests/production-example/install.sh
Executable
+11
View File
@@ -0,0 +1,11 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
ct install --debug \
--namespace spire-server \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire
.github/tests/production-example/post-install.sh
Executable
+51
View File
@@ -0,0 +1,51 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
function get_namespace_details {
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### Namespace $1
#### Events
\`\`\`shell
$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
\`\`\`
#### Pods
\`\`\`shell
$(kubectl --request-timeout=30s describe pods --namespace "$1")
\`\`\`
#### Logs
\`\`\`shell
$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
\`\`\`
EOF
}
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
### spire
| workload | Status |
| ------------------------------------ | ------ |
| spire-server | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
| spire-controller-manager | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
| spire-spiffe-csi-driver | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
| spire-agent | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
EOF
if [ $1 -ne 0 ]; then
get_namespace_details spire-server
get_namespace_details spire-systen
fi
.github/tests/production-example/pre-install.sh
Executable
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/workflows/helm-chart-ci.yaml
+1
View File
@@ -10,6 +10,7 @@ on:
- '.github/kind/conf/kind-config.yaml'
- '.github/tests/**/*.yaml'
- '.github/tests/**/*.sh'
- 'examples/**/*.yaml'
- 'helm-docs.sh'
concurrency: