tegwick
259f8a20a6
policy.enabled cannot flip against the user-engine or tenant-engine bindings. Helm release flex-auth-ops-warden rev 1 serves the production registry in warn. Workstation warden sends no caller token; enforce and the yaml flip stay ops-warden's.
42 lines
2.4 KiB
Bash
Executable file
42 lines
2.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Stage 1 overlay render: contract + helm template of every independently
|
|
# rollable values file. Does not contact the cluster.
|
|
set -euo pipefail
|
|
cd "$(dirname "${BASH_SOURCE[0]}")/.."
|
|
|
|
python3 tests/validate_app_toml.py
|
|
|
|
for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
|
|
values/user-engine.yaml values/tenant-engine.yaml values/ops-warden.yaml; do
|
|
echo "helm template ${values}"
|
|
helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
|
|
done
|
|
|
|
user_render="$(helm template flex-auth-user-engine charts/flex-auth -f values/user-engine.yaml --namespace flex-auth)"
|
|
echo "$user_render" | grep -q -- '--caller-auth-mode' || { echo "user-engine render omits caller-auth-mode" >&2; exit 1; }
|
|
echo "$user_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
|
|
|| { echo "user-engine caller-auth-mode must be warn or enforce" >&2; exit 1; }
|
|
echo "$user_render" | grep -q tokenreviews || { echo "user-engine render omits TokenReview RBAC" >&2; exit 1; }
|
|
echo "$user_render" | grep -q flex-auth-reviewer || { echo "user-engine render omits reviewer projection" >&2; exit 1; }
|
|
|
|
tenant_render="$(helm template flex-auth-tenant-engine charts/flex-auth -f values/tenant-engine.yaml --namespace flex-auth)"
|
|
echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
|
|
|| { echo "tenant-engine caller-auth-mode must be warn or enforce" >&2; exit 1; }
|
|
echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engine:tenant-engine' \
|
|
|| { echo "tenant-engine render omits its exact binding" >&2; exit 1; }
|
|
|
|
ops_render="$(helm template flex-auth-ops-warden charts/flex-auth -f values/ops-warden.yaml --namespace flex-auth)"
|
|
echo "$ops_render" | grep -A1 -- '--caller-auth-mode' | grep -q warn \
|
|
|| { echo "ops-warden first pin must be warn" >&2; exit 1; }
|
|
echo "$ops_render" | grep -q 'ops-warden=system:serviceaccount:ops-warden:ops-warden' \
|
|
|| { echo "ops-warden render omits its exact binding" >&2; exit 1; }
|
|
echo "$ops_render" | grep -q production_registry_snapshot.json \
|
|
|| { echo "ops-warden render omits the production registry" >&2; exit 1; }
|
|
|
|
canary_render="$(helm template flex-auth-canary charts/flex-auth -f values/stage2-canary.yaml --namespace flex-auth)"
|
|
if echo "$canary_render" | grep -q tokenreviews; then
|
|
echo "isolated canary must not create TokenReview RBAC" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "stage1 overlay render ok"
|