panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update jwt test to work with newer slim images (#139)

Browse Source 
* install newer version of slim debug

  - switch to step tool for jwt verification against jwk public keys

Signed-off-by: Drew Wells <[email protected]>

* use step-cli image

Signed-off-by: Drew Wells <[email protected]>

* Fix image tag and add upgrade logic

Signed-off-by: Kevin Fox <[email protected]>

* use registry for consistency

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Drew Wells <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Drew Wells
2023-12-20 19:14:54 -08:00
committed by GitHub
co-authored by kfox1111
parent c39dd44526
commit e6300087b7
4 changed files with 48 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/images.json
+4
View File
@@ -34,6 +34,10 @@
"query": "telemetry.prometheus.nginxExporter.image", "query": "telemetry.prometheus.nginxExporter.image",
"filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+$", "filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+$",
"sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"] "sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"]
}, {
"query": "tests.step.image",
"filter": "^[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+$",
"sort-flags": ["-t", ".", "-k1,1n", "-k2,2n", "-k3,3n"]
}, },
{ {
"query": "tests.bash.image", "query": "tests.bash.image",
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+6 -1
View File
@@ -110,7 +110,12 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` | | `tests.toolkit.image.repository` | The repository within the registry | `chainguard/slim-toolkit-debug` |
| `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.toolkit.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tests.toolkit.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:99cafee4f14fe07a3298fcb7b90d4f0c396cba150b65d937856788b42ad83f79` | | `tests.toolkit.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b7b4cb6a241990f1caba892e061b6b4fa014d778e9608a94b97580a40ab361bb` |
| `tests.step.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `tests.step.image.repository` | The repository within the registry | `smallstep/step-cli` |
| `tests.step.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tests.step.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tests.step.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.25.1` |
| `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tests.busybox.image.registry` | The OCI registry to pull the image from | `""` |
| `tests.busybox.image.repository` | The repository within the registry | `busybox` | | `tests.busybox.image.repository` | The repository within the registry | `busybox` |
| `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tests.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml
+23 -7
View File
@@ -25,6 +25,19 @@ spec:
volumeMounts: volumeMounts:
- name: data-volume - name: data-volume
mountPath: /data mountPath: /data
- name: install-step
image: {{ template "spire-lib.image" (dict "image" .Values.tests.step.image "global" .Values.global) }}
workingDir: /data
command:
- sh
- -c
- |
cp /usr/local/bin/step /data/step
securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }}
volumeMounts:
- name: data-volume
mountPath: /data
- name: gettoken - name: gettoken
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version "image" .Values.tests.agent.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version "image" .Values.tests.agent.image) }}
command: command:
@@ -50,19 +63,22 @@ spec:
image: {{ template "spire-lib.image" (dict "image" .Values.tests.toolkit.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.tests.toolkit.image "global" .Values.global) }}
command: command:
- bash - bash
workingDir: /data
env: env:
- name: TMPDIR - name: TMPDIR
value: /data value: /data
args: args:
- -c - -cx
- | - |
URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }} URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}
curl -k -s -f "${URL}"/keys
JWT=$(cat /data/token.svid | jq -r '.[].svids[0].svid' | xargs) cat /data/token.svid
cat <<'EOF' >> /data/jwt-decode.sh JWT=$(cat /data/token.svid | jq -r '.[] | select(.svids) | .svids[0].svid' | xargs)
{{- (.Files.Get "files/test/jwt-decode.sh") | nindent 10 }} KID=$(echo $JWT | base64 -d 2>/dev/null | jq -r '.kid')
EOF # Retrieve public key from JWK set, match kid from JWT to locate the correct one
bash /data/jwt-decode.sh "${URL}"/keys "${JWT}" curl -k -s --fail-with-body "${URL}"/keys | jq '.keys[] | select(.kid == "'${KID}'")' > public.pem
# Verify JWT with public pem
echo $JWT | /data/step crypto jwt verify --key=public.pem --alg=RS256 --subtle
securityContext: securityContext:
{{- include "spire-lib.securitycontext" . | nindent 8 }} {{- include "spire-lib.securitycontext" . | nindent 8 }}
volumeMounts: volumeMounts:
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+15 -1
View File
@@ -303,7 +303,21 @@ tests:
repository: chainguard/slim-toolkit-debug repository: chainguard/slim-toolkit-debug
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
version: "" version: ""
tag: latest@sha256:99cafee4f14fe07a3298fcb7b90d4f0c396cba150b65d937856788b42ad83f79 tag: latest@sha256:b7b4cb6a241990f1caba892e061b6b4fa014d778e9608a94b97580a40ab361bb
step:
## @param tests.step.image.registry The OCI registry to pull the image from
## @param tests.step.image.repository The repository within the registry
## @param tests.step.image.pullPolicy The image pull policy
## @param tests.step.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
## @param tests.step.image.tag Overrides the image tag whose default is the chart appVersion
##
image:
registry: "docker.io"
repository: smallstep/step-cli
pullPolicy: IfNotPresent
version: ""
tag: 0.25.1
busybox: busybox:
## @param tests.busybox.image.registry The OCI registry to pull the image from ## @param tests.busybox.image.registry The OCI registry to pull the image from